@pinooxhq/auth 0.1.0

package/dist/svelte/index.js

@@ -0,0 +1,915 @@
+import { writable, derived } from 'svelte/store';
+
+// src/svelte/useAuth.ts
+
+// src/core/logger.ts
+var defaultSink = (event, enabled) => {
+  if (!enabled && event.level === "debug") {
+    return;
+  }
+  const prefix = `[pinoox-auth:${event.code}]`;
+  const payload = event.context ? [prefix, event.message, event.context] : [prefix, event.message];
+  switch (event.level) {
+    case "error":
+      console.error(...payload);
+      break;
+    case "warn":
+      console.warn(...payload);
+      break;
+    case "info":
+      console.info(...payload);
+      break;
+    default:
+      console.debug(...payload);
+  }
+};
+function createLogger(debug = false, sink) {
+  let customSink = null;
+  const emit = (event) => {
+    if (customSink) {
+      customSink(event);
+      return;
+    }
+    defaultSink(event, debug);
+  };
+  return {
+    emit,
+    debug: (code, message, context) => emit({ level: "debug", code, message, context }),
+    info: (code, message, context) => emit({ level: "info", code, message, context }),
+    warn: (code, message, context) => emit({ level: "warn", code, message, context }),
+    error: (code, message, context) => emit({ level: "error", code, message, context }),
+    setSink: (next) => {
+      customSink = next;
+    }
+  };
+}
+
+// src/core/returnPath.ts
+var DEFAULT_FALLBACK = "/";
+var DEFAULT_BLOCKED = ["/account"];
+function isSafeReturnPath(value, blockedPrefixes = DEFAULT_BLOCKED) {
+  if (typeof value !== "string") {
+    return false;
+  }
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//")) {
+    return false;
+  }
+  if (trimmed.includes("://") || trimmed.includes("\\")) {
+    return false;
+  }
+  for (const prefix of blockedPrefixes) {
+    if (!prefix) {
+      continue;
+    }
+    if (trimmed === prefix || trimmed.startsWith(`${prefix}/`)) {
+      return false;
+    }
+  }
+  return true;
+}
+function resolveReturnPath(queryOrPath = void 0, fallback = DEFAULT_FALLBACK, blockedPrefixes = DEFAULT_BLOCKED) {
+  let candidate = queryOrPath;
+  if (queryOrPath && typeof queryOrPath === "object" && !Array.isArray(queryOrPath)) {
+    candidate = queryOrPath.redirect;
+  }
+  if (candidate === void 0 && typeof window !== "undefined") {
+    candidate = new URLSearchParams(window.location.search).get("redirect");
+  }
+  if (isSafeReturnPath(candidate, blockedPrefixes)) {
+    return candidate.trim();
+  }
+  return fallback;
+}
+function resolveSiteOrigin(bootUrl, explicit) {
+  const candidates = [explicit, bootUrl?.SITE];
+  for (const value of candidates) {
+    if (typeof value !== "string" || !value) {
+      continue;
+    }
+    try {
+      return new URL(value).origin;
+    } catch {
+      const cleaned = value.replace(/\/$/, "");
+      if (/^https?:\/\//i.test(cleaned)) {
+        return cleaned;
+      }
+    }
+  }
+  return null;
+}
+function toAbsoluteReturnUrl(path, siteOrigin) {
+  if (typeof path !== "string" || !path.startsWith("/")) {
+    return path;
+  }
+  if (!siteOrigin || typeof window === "undefined") {
+    return path;
+  }
+  if (window.location.origin === siteOrigin) {
+    return path;
+  }
+  return `${siteOrigin.replace(/\/$/, "")}${path}`;
+}
+function redirectToReturn(queryOrPath, options = {}) {
+  if (typeof window === "undefined") {
+    return;
+  }
+  const path = resolveReturnPath(queryOrPath, options.fallback, options.blockedPrefixes);
+  window.location.href = toAbsoluteReturnUrl(path, options.siteOrigin);
+}
+
+// src/core/resolveConfig.ts
+function readBoot() {
+  if (typeof globalThis === "undefined") {
+    return {};
+  }
+  const g = globalThis;
+  if (g.__PINOOX__ && typeof g.__PINOOX__ === "object") {
+    return g.__PINOOX__;
+  }
+  if (g.PINOOX?.URL) {
+    return { url: g.PINOOX.URL };
+  }
+  return {};
+}
+function normalizeMode(value) {
+  const mode = String(value ?? "jwt").toLowerCase();
+  if (mode === "cookie" || mode === "session" || mode === "jwt") {
+    return mode;
+  }
+  return "jwt";
+}
+function normalizeBaseUrl(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    return null;
+  }
+  let base = value.trim().replace(/\/$/, "");
+  if (!/^https?:\/\//i.test(base) && !base.startsWith("/")) {
+    base = `/${base}`;
+  }
+  return base;
+}
+function joinUrl(base, path) {
+  if (!path) {
+    return base;
+  }
+  if (/^https?:\/\//i.test(path)) {
+    return path;
+  }
+  if (path.startsWith("/")) {
+    return path;
+  }
+  const normalizedBase = base.replace(/\/$/, "");
+  return `${normalizedBase}/${path.replace(/^\//, "")}`;
+}
+function resolveEndpoint(path, fallback, baseUrl) {
+  const value = typeof path === "string" && path.trim() !== "" ? path.trim() : fallback;
+  if (/^https?:\/\//i.test(value) || value.startsWith("/")) {
+    return value;
+  }
+  if (baseUrl) {
+    return joinUrl(baseUrl, value);
+  }
+  return value;
+}
+function inferStrategy(bootAuth, explicit) {
+  if (explicit) {
+    return normalizeStrategy(explicit) ?? explicit;
+  }
+  const fromBoot = normalizeStrategy(bootAuth?.strategy);
+  if (fromBoot) {
+    return fromBoot;
+  }
+  if (bootAuth?.source) {
+    return "remote";
+  }
+  return "local";
+}
+function normalizeStrategy(value) {
+  if (value === "local" || value === "provider") {
+    return "local";
+  }
+  if (value === "remote" || value === "consumer" || value === "external") {
+    return "remote";
+  }
+  return null;
+}
+function defaultEndpoints(apiBase, strategy, baseUrl) {
+  if (strategy === "remote") {
+    if (baseUrl) {
+      return {
+        login: "auth/login",
+        logout: "auth/logout",
+        me: "auth/get"
+      };
+    }
+    return {
+      login: "/account/api/v1/auth/login",
+      logout: "/account/api/v1/auth/logout",
+      me: "/account/api/v1/auth/get"
+    };
+  }
+  return {
+    login: joinUrl(apiBase, "auth/login"),
+    logout: joinUrl(apiBase, "auth/logout"),
+    me: joinUrl(apiBase, "auth/get")
+  };
+}
+function resolveConfig(options = {}, logger) {
+  const boot = options.boot ?? readBoot();
+  const bootAuth = boot.auth ?? {};
+  const apiBase = (options.apiBase ?? boot.url?.API ?? "").replace(/\/$/, "");
+  const strategy = inferStrategy(bootAuth, options.strategy);
+  const baseUrl = normalizeBaseUrl(options.baseUrl ?? bootAuth.baseUrl ?? null);
+  const defaults = defaultEndpoints(apiBase || "/", strategy, baseUrl);
+  const bootEndpoints = bootAuth.endpoints ?? {};
+  const endpoints = {
+    login: resolveEndpoint(options.endpoints?.login ?? bootEndpoints.login, defaults.login, baseUrl),
+    logout: resolveEndpoint(options.endpoints?.logout ?? bootEndpoints.logout, defaults.logout, baseUrl),
+    me: resolveEndpoint(options.endpoints?.me ?? bootEndpoints.me, defaults.me, baseUrl)
+  };
+  const key = bootAuth.key || options.key || "";
+  const mode = normalizeMode(bootAuth.mode || options.mode);
+  const debug = options.debug ?? (typeof import.meta !== "undefined" && !!import.meta.env?.DEV);
+  if (!boot.auth && !options.key && !options.mode) {
+    logger?.warn("config.missing", "No __PINOOX__.auth and no explicit mode/key overrides", {
+      hasBoot: Object.keys(boot).length > 0
+    });
+  }
+  if (!key) {
+    logger?.warn("config.missing", "auth.key is empty \u2014 token storage will fail until key is provided", {
+      bootAuth
+    });
+  }
+  const loginUrl = options.loginUrl ?? bootAuth.loginUrl ?? (strategy === "remote" ? "/account/login" : null);
+  const appPath = typeof boot.url?.BASE === "string" && boot.url.BASE || typeof boot.url?.APP === "string" && boot.url.APP || (apiBase.match(/^(\/[^/]+)/)?.[1] ?? null);
+  const siteOrigin = resolveSiteOrigin(boot.url, options.siteOrigin);
+  const resolved = {
+    mode,
+    key,
+    provider: bootAuth.provider ?? null,
+    source: bootAuth.source ?? null,
+    strategy,
+    loginUrl,
+    baseUrl,
+    endpoints,
+    apiBase,
+    siteOrigin,
+    appPath,
+    debug: !!debug
+  };
+  logger?.debug("config.resolved", "Auth config resolved", {
+    mode: resolved.mode,
+    key: resolved.key,
+    provider: resolved.provider,
+    source: resolved.source,
+    strategy: resolved.strategy,
+    baseUrl: resolved.baseUrl,
+    endpoints: resolved.endpoints,
+    siteOrigin: resolved.siteOrigin,
+    appPath: resolved.appPath
+  });
+  return resolved;
+}
+
+// src/core/storage.ts
+function readCookie(name) {
+  if (typeof document === "undefined") {
+    return null;
+  }
+  const match = document.cookie.match(new RegExp(`(?:^|; )${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : null;
+}
+function writeCookie(name, value) {
+  if (typeof document === "undefined") {
+    return;
+  }
+  const maxAge = 60 * 60 * 24 * 90;
+  document.cookie = `${name}=${encodeURIComponent(value)}; path=/; max-age=${maxAge}; SameSite=Lax`;
+}
+function deleteCookie(name) {
+  if (typeof document === "undefined") {
+    return;
+  }
+  document.cookie = `${name}=; path=/; max-age=0; SameSite=Lax`;
+}
+function isDev() {
+  try {
+    return typeof import.meta !== "undefined" && !!import.meta.env?.DEV;
+  } catch {
+    return false;
+  }
+}
+function createStorage(key, logger) {
+  const syncDevCookie = isDev();
+  return {
+    get: () => {
+      if (!key) {
+        return null;
+      }
+      try {
+        if (typeof localStorage !== "undefined") {
+          const fromStorage = localStorage.getItem(key)?.trim() || null;
+          if (fromStorage) {
+            if (syncDevCookie) {
+              writeCookie(key, fromStorage);
+            }
+            return fromStorage;
+          }
+        }
+      } catch (error) {
+        logger?.warn("token.storage", "Failed to read localStorage", { error: String(error) });
+      }
+      if (!syncDevCookie) {
+        return null;
+      }
+      const fromCookie = readCookie(key);
+      if (fromCookie) {
+        try {
+          localStorage.setItem(key, fromCookie);
+        } catch {
+        }
+        return fromCookie;
+      }
+      return null;
+    },
+    set: (token) => {
+      if (!key) {
+        logger?.warn("mismatch.key", "Cannot store token without auth.key");
+        return;
+      }
+      if (typeof localStorage === "undefined") {
+        return;
+      }
+      try {
+        if (token) {
+          const value = token.trim();
+          localStorage.setItem(key, value);
+          logger?.debug("token.stored", "Token stored", { key });
+          if (syncDevCookie) {
+            writeCookie(key, value);
+          }
+        } else {
+          localStorage.removeItem(key);
+          logger?.debug("token.cleared", "Token cleared", { key });
+          if (syncDevCookie) {
+            deleteCookie(key);
+          }
+        }
+      } catch (error) {
+        logger?.warn("token.storage", "Failed to write storage", { error: String(error) });
+      }
+    },
+    clear: () => {
+      if (!key || typeof localStorage === "undefined") {
+        return;
+      }
+      try {
+        localStorage.removeItem(key);
+      } catch {
+      }
+      if (syncDevCookie) {
+        deleteCookie(key);
+      }
+      logger?.debug("token.cleared", "Token cleared", { key });
+    }
+  };
+}
+
+// src/strategies/local.ts
+function unwrapPayload(data) {
+  if (!data || typeof data !== "object") {
+    return {};
+  }
+  const record = data;
+  if (record.data && typeof record.data === "object") {
+    return record.data;
+  }
+  return record;
+}
+function extractTokenAndUser(payload) {
+  const data = unwrapPayload(payload);
+  const tokenCandidate = typeof data.token === "string" && data.token || typeof payload?.token === "string" && payload.token || null;
+  const userCandidate = (data.user && typeof data.user === "object" ? data.user : null) || (data.username || data.email || data.user_id ? data : null);
+  return {
+    token: tokenCandidate,
+    user: userCandidate
+  };
+}
+async function localLogin(config, http, storage, credentials, logger) {
+  const response = await http.request({
+    url: config.endpoints.login,
+    method: "POST",
+    body: credentials,
+    credentials: "include",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Requested-With": "XMLHttpRequest"
+    }
+  });
+  if (!response.ok) {
+    logger?.error("session.unauthorized", "Login request failed", {
+      status: response.status,
+      url: config.endpoints.login
+    });
+    throw Object.assign(new Error("Login failed"), { status: response.status, data: response.data });
+  }
+  const { token, user } = extractTokenAndUser(response.data);
+  if (config.mode === "jwt" && !token) {
+    logger?.warn("mismatch.mode", "JWT mode expected token in login response but none found", {
+      mode: config.mode,
+      url: config.endpoints.login
+    });
+  }
+  if (token) {
+    storage.set(token);
+  }
+  logger?.info("session.ok", "Login succeeded", { hasToken: !!token, hasUser: !!user });
+  return { token, user, raw: response.data };
+}
+
+// src/strategies/remote.ts
+function buildRemoteLoginUrl(config, returnPath, logger) {
+  const loginUrl = config.loginUrl ?? "/account/login";
+  const blocked = config.appPath ? [config.appPath, "/account"] : ["/account"];
+  const safeRedirect = resolveReturnPath(
+    returnPath ?? (typeof window !== "undefined" ? `${window.location.pathname}${window.location.search}` : "/"),
+    "/",
+    blocked
+  );
+  const url = `${loginUrl}?redirect=${encodeURIComponent(safeRedirect)}`;
+  logger?.info("redirect.login", "Redirecting to remote login", { url, returnPath: safeRedirect });
+  return url;
+}
+function redirectToRemoteLogin(config, returnPath, logger) {
+  if (typeof window === "undefined") {
+    return;
+  }
+  window.location.href = buildRemoteLoginUrl(config, returnPath, logger);
+}
+
+// src/http/types.ts
+function createFetchProvider() {
+  return {
+    async request(input) {
+      const headers = {
+        Accept: "application/json",
+        ...input.headers
+      };
+      let body;
+      if (input.body !== void 0 && input.body !== null) {
+        if (typeof input.body === "string" || input.body instanceof FormData || input.body instanceof Blob) {
+          body = input.body;
+        } else {
+          headers["Content-Type"] = headers["Content-Type"] ?? "application/json";
+          body = JSON.stringify(input.body);
+        }
+      }
+      const response = await fetch(input.url, {
+        method: input.method ?? "GET",
+        headers,
+        body,
+        credentials: input.credentials ?? "include"
+      });
+      const contentType = response.headers.get("content-type") ?? "";
+      let data;
+      if (contentType.includes("application/json")) {
+        data = await response.json();
+      } else {
+        data = await response.text();
+      }
+      return {
+        status: response.status,
+        data,
+        headers: response.headers,
+        ok: response.ok
+      };
+    }
+  };
+}
+
+// src/core/createAuth.ts
+var defaultInstance = null;
+function getAuth() {
+  if (!defaultInstance) {
+    throw new Error("@pinooxhq/auth: call createAuth() before getAuth()");
+  }
+  return defaultInstance;
+}
+function createAuth(options = {}) {
+  const logger = options.logger ?? createLogger(options.debug);
+  const config = resolveConfig(options, logger);
+  const storage = createStorage(config.key, logger);
+  let http = options.http ?? createFetchProvider();
+  let token = storage.get();
+  let user = null;
+  let authenticated = false;
+  const listeners = /* @__PURE__ */ new Map();
+  const emit = (event, payload) => {
+    const set = listeners.get(event);
+    if (!set) {
+      return;
+    }
+    for (const handler of set) {
+      try {
+        handler(payload);
+      } catch (error) {
+        logger.error("error", "Event handler failed", { event, error: String(error) });
+      }
+    }
+  };
+  const syncToken = (value) => {
+    token = value;
+    storage.set(value);
+  };
+  const getAuthHeader = () => {
+    if (config.mode !== "jwt" || !token) {
+      return null;
+    }
+    return token.toLowerCase().startsWith("bearer ") ? token : `Bearer ${token}`;
+  };
+  const getRequestAuth = () => ({
+    header: getAuthHeader(),
+    credentials: "include",
+    mode: config.mode,
+    key: config.key
+  });
+  const authorize = (headers = {}) => {
+    const auth = getRequestAuth();
+    const next = { ...headers };
+    if (auth.header) {
+      next.Authorization = auth.header;
+    }
+    logger.debug("request.auth", "Authorized request headers", {
+      mode: auth.mode,
+      hasHeader: !!auth.header
+    });
+    return { ...auth, headers: next };
+  };
+  const withAuthHeaders = (headers = {}) => {
+    return authorize(headers).headers;
+  };
+  const loginFromResponse = (payload) => {
+    const extracted = extractTokenAndUser(payload);
+    if (config.mode === "jwt" && !extracted.token) {
+      logger.warn("mismatch.mode", "JWT mode expected token in response but none found", {
+        mode: config.mode
+      });
+      emit("mismatch", { code: "mismatch.mode", payload });
+    }
+    if (extracted.token) {
+      syncToken(extracted.token);
+    }
+    if (extracted.user) {
+      user = extracted.user;
+    }
+    authenticated = !!(extracted.token || config.mode !== "jwt");
+    emit("login", { token: extracted.token, user: extracted.user });
+    return { ...extracted, raw: payload };
+  };
+  const me = async () => {
+    const current = storage.get();
+    token = current;
+    if (config.mode === "jwt" && !current) {
+      authenticated = false;
+      user = null;
+      logger.debug("session.unauthorized", "No token for me()", { mode: config.mode });
+      return null;
+    }
+    try {
+      const response = await http.request({
+        url: config.endpoints.me,
+        method: "GET",
+        credentials: "include",
+        headers: withAuthHeaders({
+          Accept: "application/json",
+          "X-Requested-With": "XMLHttpRequest"
+        })
+      });
+      if (response.status === 401) {
+        syncToken(null);
+        user = null;
+        authenticated = false;
+        logger.warn("session.unauthorized", "Session validation returned 401", {
+          url: config.endpoints.me
+        });
+        emit("unauthorized", { status: 401 });
+        return null;
+      }
+      if (!response.ok) {
+        logger.error("error", "me() request failed", { status: response.status });
+        emit("error", { status: response.status, data: response.data });
+        return null;
+      }
+      const extracted = extractTokenAndUser(response.data);
+      user = extracted.user ?? response.data;
+      authenticated = true;
+      logger.info("session.ok", "Session validated", { hasUser: !!user });
+      return user;
+    } catch (error) {
+      logger.error("error", "me() threw", { error: String(error) });
+      emit("error", error);
+      return null;
+    }
+  };
+  const login = async (credentials) => {
+    if (config.strategy === "remote") {
+      redirectToRemoteLogin(config, void 0, logger);
+      return;
+    }
+    if (!credentials?.password) {
+      throw new Error("@pinooxhq/auth: login() requires credentials for local strategy");
+    }
+    const result = await localLogin(config, http, storage, credentials, logger);
+    token = result.token ?? storage.get();
+    user = result.user;
+    authenticated = !!(result.token || config.mode !== "jwt");
+    emit("login", result);
+    return result;
+  };
+  const logout = async () => {
+    try {
+      await http.request({
+        url: config.endpoints.logout,
+        method: "GET",
+        credentials: "include",
+        headers: withAuthHeaders({
+          Accept: "application/json",
+          "X-Requested-With": "XMLHttpRequest"
+        })
+      });
+    } catch (error) {
+      logger.warn("error", "Remote logout failed; clearing local session anyway", {
+        error: String(error)
+      });
+    }
+    syncToken(null);
+    user = null;
+    authenticated = false;
+    emit("logout");
+    logger.info("token.cleared", "Logged out");
+  };
+  const instance = {
+    config,
+    logger,
+    get user() {
+      return user;
+    },
+    set user(value) {
+      user = value;
+    },
+    get token() {
+      return token ?? storage.get();
+    },
+    set token(value) {
+      syncToken(value);
+    },
+    get isAuthenticated() {
+      return authenticated && (!!token || config.mode !== "jwt");
+    },
+    set isAuthenticated(value) {
+      authenticated = value;
+    },
+    login,
+    logout,
+    me,
+    getToken: () => token ?? storage.get(),
+    setToken: (value) => {
+      syncToken(value);
+    },
+    clearToken: () => {
+      syncToken(null);
+      authenticated = false;
+    },
+    getAuthHeader,
+    authorize,
+    getRequestAuth,
+    setHttp: (client) => {
+      http = client;
+    },
+    loginFromResponse,
+    redirectToLogin: (returnPath) => {
+      if (config.strategy === "remote") {
+        redirectToRemoteLogin(config, returnPath, logger);
+        return;
+      }
+      const url = config.loginUrl ?? config.endpoints.login;
+      logger.info("redirect.login", "Redirecting to login", { url });
+      if (typeof window !== "undefined") {
+        window.location.href = url;
+      }
+    },
+    getReturnPath: (queryOrPath, fallback = "/") => {
+      const blocked = config.appPath ? [config.appPath] : ["/account"];
+      return resolveReturnPath(queryOrPath, fallback, blocked);
+    },
+    getReturnUrl: (queryOrPath, fallback = "/") => {
+      const blocked = config.appPath ? [config.appPath] : ["/account"];
+      const path = resolveReturnPath(queryOrPath, fallback, blocked);
+      return toAbsoluteReturnUrl(path, config.siteOrigin);
+    },
+    redirectBack: (queryOrPath, fallback = "/") => {
+      const blocked = config.appPath ? [config.appPath] : ["/account"];
+      logger.info("redirect.back", "Redirecting after auth", { queryOrPath, fallback });
+      redirectToReturn(queryOrPath, {
+        fallback,
+        siteOrigin: config.siteOrigin,
+        blockedPrefixes: blocked
+      });
+    },
+    getRedirectQuery: (queryOrPath, fallback = "/") => {
+      const blocked = config.appPath ? [config.appPath] : ["/account"];
+      return { redirect: resolveReturnPath(queryOrPath, fallback, blocked) };
+    },
+    notifyUnauthorized: (payload) => {
+      syncToken(null);
+      user = null;
+      authenticated = false;
+      logger.warn("session.unauthorized", "Unauthorized notified", {
+        payload: payload ? String(payload) : void 0
+      });
+      emit("unauthorized", payload ?? { status: 401 });
+    },
+    on: (event, handler) => {
+      if (!listeners.has(event)) {
+        listeners.set(event, /* @__PURE__ */ new Set());
+      }
+      listeners.get(event).add(handler);
+      return () => {
+        listeners.get(event)?.delete(handler);
+      };
+    },
+    off: (event, handler) => {
+      listeners.get(event)?.delete(handler);
+    }
+  };
+  defaultInstance = instance;
+  emit("config", config);
+  return instance;
+}
+
+// src/svelte/useAuth.ts
+var bound = null;
+function resolveAuthInstance(options) {
+  try {
+    return getAuth();
+  } catch {
+    return createAuth(options ?? {});
+  }
+}
+function readQueryFromWindow() {
+  if (typeof window === "undefined") {
+    return {};
+  }
+  return Object.fromEntries(new URLSearchParams(window.location.search).entries());
+}
+function normalizeQuery(input) {
+  if (typeof input === "string") {
+    const raw = input.startsWith("?") ? input.slice(1) : input;
+    return Object.fromEntries(new URLSearchParams(raw).entries());
+  }
+  if (input instanceof URLSearchParams) {
+    return Object.fromEntries(input.entries());
+  }
+  return input;
+}
+function createAuthStore(options = {}) {
+  if (bound) {
+    return bound;
+  }
+  const auth = resolveAuthInstance(options);
+  const user = writable(auth.user);
+  const token = writable(auth.getToken());
+  const syncFromAuth = () => {
+    user.set(auth.user);
+    token.set(auth.getToken());
+  };
+  auth.on("login", syncFromAuth);
+  auth.on("logout", syncFromAuth);
+  auth.on("unauthorized", syncFromAuth);
+  const isAuthenticated = derived([user, token], ([$user, $token]) => {
+    return auth.isAuthenticated || !!$token && !!$user;
+  });
+  const me = async () => {
+    const profile = await auth.me();
+    syncFromAuth();
+    return profile;
+  };
+  const canAccess = async (refresh = false) => {
+    token.set(auth.getToken());
+    if (!refresh && auth.isAuthenticated) {
+      return true;
+    }
+    if (!auth.getToken() && auth.config.mode === "jwt") {
+      auth.isAuthenticated = false;
+      user.set(null);
+      return false;
+    }
+    const profile = await me();
+    return !!profile || auth.isAuthenticated;
+  };
+  const login = async (credentials) => {
+    const result = await auth.login(credentials);
+    syncFromAuth();
+    return result;
+  };
+  const logout = async () => {
+    await auth.logout();
+    syncFromAuth();
+  };
+  const setSession = (loginKey, userData = null) => {
+    auth.setToken(loginKey);
+    auth.isAuthenticated = true;
+    token.set(loginKey);
+    if (userData) {
+      auth.user = userData;
+      user.set(userData);
+    }
+  };
+  bound = {
+    auth,
+    user,
+    token,
+    isAuthenticated,
+    login,
+    logout,
+    me,
+    canAccess,
+    setSession
+  };
+  return bound;
+}
+function useAuth(options) {
+  return createAuthStore(options ?? {});
+}
+function createAuthRedirect(getQuery = readQueryFromWindow, fallback = "/") {
+  const auth = resolveAuthInstance();
+  const readPath = () => auth.getReturnPath(normalizeQuery(getQuery()), fallback);
+  const readUrl = () => auth.getReturnUrl(normalizeQuery(getQuery()), fallback);
+  const readRedirectQuery = () => auth.getRedirectQuery(normalizeQuery(getQuery()), fallback);
+  const returnPath = {
+    subscribe(run) {
+      run(readPath());
+      return () => void 0;
+    }
+  };
+  const returnUrl = {
+    subscribe(run) {
+      run(readUrl());
+      return () => void 0;
+    }
+  };
+  const redirectQuery = {
+    subscribe(run) {
+      run(readRedirectQuery());
+      return () => void 0;
+    }
+  };
+  return {
+    returnPath,
+    returnUrl,
+    redirectQuery,
+    resolveRedirect: readUrl,
+    redirectBack: () => auth.redirectBack(normalizeQuery(getQuery()), fallback)
+  };
+}
+function createAuthRedirectFromStore(queryStore, fallback = "/") {
+  const auth = resolveAuthInstance();
+  let latest = {};
+  const unsub = queryStore.subscribe((value) => {
+    latest = value;
+  });
+  unsub();
+  const returnPath = derived(queryStore, ($q) => {
+    latest = $q;
+    return auth.getReturnPath(normalizeQuery($q), fallback);
+  });
+  const returnUrl = derived(queryStore, ($q) => {
+    latest = $q;
+    return auth.getReturnUrl(normalizeQuery($q), fallback);
+  });
+  const redirectQuery = derived(queryStore, ($q) => {
+    latest = $q;
+    return auth.getRedirectQuery(normalizeQuery($q), fallback);
+  });
+  return {
+    returnPath,
+    returnUrl,
+    redirectQuery,
+    resolveRedirect: () => auth.getReturnUrl(normalizeQuery(latest), fallback),
+    redirectBack: () => auth.redirectBack(normalizeQuery(latest), fallback)
+  };
+}
+function createSvelteAuth(options = {}) {
+  const store = createAuthStore(options);
+  return {
+    ...store,
+    useAuth: () => store,
+    createAuthRedirect,
+    createAuthRedirectFromStore
+  };
+}
+
+export { createAuthRedirect, createAuthRedirectFromStore, createAuthStore, createSvelteAuth, useAuth };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map