@onjunctiondev/auth 0.2.0 → 0.2.1

package/dist/index.cjs

@@ -61,29 +61,80 @@ function localStorageStorage(key) {
     }
   };
 }
+function cookieStorage(key) {
+  const canUse = typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined";
+  return {
+    get() {
+      if (!canUse) return null;
+      try {
+        const jar = globalThis.document.cookie;
+        if (!jar) return null;
+        const prefix = `${key}=`;
+        for (const part of jar.split("; ")) {
+          if (part.startsWith(prefix)) {
+            const value = part.slice(prefix.length);
+            if (!value) return null;
+            return JSON.parse(decodeURIComponent(value));
+          }
+        }
+        return null;
+      } catch {
+        return null;
+      }
+    },
+    set(session) {
+      if (!canUse) return;
+      try {
+        const doc = globalThis.document;
+        const loc = globalThis.location;
+        const isHttps = loc?.protocol === "https:";
+        const secure = isHttps ? "; Secure" : "";
+        if (session) {
+          const now = Math.floor(Date.now() / 1e3);
+          const maxAge = Math.max(0, session.expires_at - now);
+          const value = encodeURIComponent(JSON.stringify(session));
+          doc.cookie = `${key}=${value}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secure}`;
+        } else {
+          doc.cookie = `${key}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+        }
+      } catch {
+      }
+    }
+  };
+}
 
 // src/client.ts
-var DEFAULT_STORAGE_KEY = "junction.auth.session";
-function pickStorage(opts) {
-  const key = opts.storageKey ?? DEFAULT_STORAGE_KEY;
+var DEFAULT_STORAGE_KEY = "__junction_session";
+function pickStorage(opts, key) {
   if (opts.storage === "memory") return memoryStorage();
-  if (typeof globalThis !== "undefined" && "localStorage" in globalThis) {
-    return localStorageStorage(key);
-  }
+  if (opts.storage === "localStorage") return localStorageStorage(key);
+  const hasDocument = typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined";
+  if (hasDocument) return cookieStorage(key);
   return memoryStorage();
 }
 var AuthClient = class {
   #deps;
   #listeners = /* @__PURE__ */ new Set();
+  #channel;
+  #selfId;
   // Refresh in-flight — concurrent 401s share one refresh so we don't
   // race-rotate the single-use token on the server.
   #inflightRefresh = null;
   constructor(opts) {
+    const key = opts.storageKey ?? DEFAULT_STORAGE_KEY;
     this.#deps = {
       url: opts.url.replace(/\/+$/, ""),
       fetchFn: opts.fetch ?? ((...args) => fetch(...args)),
-      storage: pickStorage(opts)
+      storage: pickStorage(opts, key)
     };
+    this.#selfId = randomId();
+    this.#channel = openChannel(`junction.auth.${key}`);
+    this.#channel?.addEventListener("message", (e) => {
+      const payload = e.data;
+      if (!payload || payload.from === this.#selfId) return;
+      this.#deps.storage.set(payload.session);
+      this.#emitLocal(payload.event, payload.session);
+    });
   }
   // --- public API --------------------------------------------------------
   async signUp(credentials) {
@@ -202,7 +253,22 @@ var AuthClient = class {
   async #rawFetch(path, init) {
     return this.#deps.fetchFn(`${this.#deps.url}${path}`, init);
   }
+  // Emits locally AND broadcasts to peer tabs.
   #emit(event, session) {
+    this.#emitLocal(event, session);
+    try {
+      this.#channel?.postMessage({
+        from: this.#selfId,
+        event,
+        session
+      });
+    } catch {
+    }
+  }
+  // Emits to in-process subscribers only — used both by local actions
+  // (via #emit, which also broadcasts) and by inbound broadcast messages
+  // (direct, so we don't re-broadcast and loop).
+  #emitLocal(event, session) {
     for (const l of this.#listeners) {
       try {
         l(event, session);
@@ -211,6 +277,20 @@ var AuthClient = class {
     }
   }
 };
+function openChannel(name) {
+  const Ctor = globalThis.BroadcastChannel;
+  if (!Ctor) return null;
+  try {
+    return new Ctor(name);
+  } catch {
+    return null;
+  }
+}
+function randomId() {
+  const crypto = globalThis.crypto;
+  if (crypto?.randomUUID) return crypto.randomUUID();
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
 function errorFrom(code, message, status) {
   return { code, message, status };
 }

package/dist/index.d.cts

@@ -34,7 +34,7 @@ type AuthEvent = "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED" | "USER_UPDATED"
 type AuthStateChangeHandler = (event: AuthEvent, session: AuthSession | null) => void;
 type ClientOptions = {
     url: string;
-    storage?: "localStorage" | "memory";
+    storage?: "cookie" | "localStorage" | "memory";
     storageKey?: string;
     fetch?: typeof fetch;
 };

package/dist/index.d.ts

@@ -34,7 +34,7 @@ type AuthEvent = "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED" | "USER_UPDATED"
 type AuthStateChangeHandler = (event: AuthEvent, session: AuthSession | null) => void;
 type ClientOptions = {
     url: string;
-    storage?: "localStorage" | "memory";
+    storage?: "cookie" | "localStorage" | "memory";
     storageKey?: string;
     fetch?: typeof fetch;
 };

package/dist/index.js

@@ -34,29 +34,80 @@ function localStorageStorage(key) {
     }
   };
 }
+function cookieStorage(key) {
+  const canUse = typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined";
+  return {
+    get() {
+      if (!canUse) return null;
+      try {
+        const jar = globalThis.document.cookie;
+        if (!jar) return null;
+        const prefix = `${key}=`;
+        for (const part of jar.split("; ")) {
+          if (part.startsWith(prefix)) {
+            const value = part.slice(prefix.length);
+            if (!value) return null;
+            return JSON.parse(decodeURIComponent(value));
+          }
+        }
+        return null;
+      } catch {
+        return null;
+      }
+    },
+    set(session) {
+      if (!canUse) return;
+      try {
+        const doc = globalThis.document;
+        const loc = globalThis.location;
+        const isHttps = loc?.protocol === "https:";
+        const secure = isHttps ? "; Secure" : "";
+        if (session) {
+          const now = Math.floor(Date.now() / 1e3);
+          const maxAge = Math.max(0, session.expires_at - now);
+          const value = encodeURIComponent(JSON.stringify(session));
+          doc.cookie = `${key}=${value}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secure}`;
+        } else {
+          doc.cookie = `${key}=; Path=/; Max-Age=0; SameSite=Lax${secure}`;
+        }
+      } catch {
+      }
+    }
+  };
+}
 
 // src/client.ts
-var DEFAULT_STORAGE_KEY = "junction.auth.session";
-function pickStorage(opts) {
-  const key = opts.storageKey ?? DEFAULT_STORAGE_KEY;
+var DEFAULT_STORAGE_KEY = "__junction_session";
+function pickStorage(opts, key) {
   if (opts.storage === "memory") return memoryStorage();
-  if (typeof globalThis !== "undefined" && "localStorage" in globalThis) {
-    return localStorageStorage(key);
-  }
+  if (opts.storage === "localStorage") return localStorageStorage(key);
+  const hasDocument = typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined";
+  if (hasDocument) return cookieStorage(key);
   return memoryStorage();
 }
 var AuthClient = class {
   #deps;
   #listeners = /* @__PURE__ */ new Set();
+  #channel;
+  #selfId;
   // Refresh in-flight — concurrent 401s share one refresh so we don't
   // race-rotate the single-use token on the server.
   #inflightRefresh = null;
   constructor(opts) {
+    const key = opts.storageKey ?? DEFAULT_STORAGE_KEY;
     this.#deps = {
       url: opts.url.replace(/\/+$/, ""),
       fetchFn: opts.fetch ?? ((...args) => fetch(...args)),
-      storage: pickStorage(opts)
+      storage: pickStorage(opts, key)
     };
+    this.#selfId = randomId();
+    this.#channel = openChannel(`junction.auth.${key}`);
+    this.#channel?.addEventListener("message", (e) => {
+      const payload = e.data;
+      if (!payload || payload.from === this.#selfId) return;
+      this.#deps.storage.set(payload.session);
+      this.#emitLocal(payload.event, payload.session);
+    });
   }
   // --- public API --------------------------------------------------------
   async signUp(credentials) {
@@ -175,7 +226,22 @@ var AuthClient = class {
   async #rawFetch(path, init) {
     return this.#deps.fetchFn(`${this.#deps.url}${path}`, init);
   }
+  // Emits locally AND broadcasts to peer tabs.
   #emit(event, session) {
+    this.#emitLocal(event, session);
+    try {
+      this.#channel?.postMessage({
+        from: this.#selfId,
+        event,
+        session
+      });
+    } catch {
+    }
+  }
+  // Emits to in-process subscribers only — used both by local actions
+  // (via #emit, which also broadcasts) and by inbound broadcast messages
+  // (direct, so we don't re-broadcast and loop).
+  #emitLocal(event, session) {
     for (const l of this.#listeners) {
       try {
         l(event, session);
@@ -184,6 +250,20 @@ var AuthClient = class {
     }
   }
 };
+function openChannel(name) {
+  const Ctor = globalThis.BroadcastChannel;
+  if (!Ctor) return null;
+  try {
+    return new Ctor(name);
+  } catch {
+    return null;
+  }
+}
+function randomId() {
+  const crypto = globalThis.crypto;
+  if (crypto?.randomUUID) return crypto.randomUUID();
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
 function errorFrom(code, message, status) {
   return { code, message, status };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onjunctiondev/auth",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Headless auth SDK for Junction — email/password sessions with per-project JWTs and RLS claims.",
   "license": "MIT",
   "homepage": "https://onjunction.dev",