@plitzi/sdk-auth 0.32.25 → 0.33.0

package/dist/AuthProvider.mjs

@@ -1,90 +1,280 @@
+import { readSessionHint as e } from "./helpers/sessionHint.mjs";
+import t from "./helpers/SessionStore.mjs";
+import { nowInSeconds as n, toSeconds as r, tokenExpiresAt as i } from "./helpers/tokenClaims.mjs";
+import { onAuthFailure as a, sameRegistrableDomain as o } from "@plitzi/sdk-shared/auth";
 //#region src/AuthProvider.ts
-var e = class {
-	cache;
-	enableRefresh = !1;
-	tokenStorage = "localStorage";
+var s = 60, c = 300, l = 2147483647, u = class {
 	state = "init";
+	session = { validatedAt: 0 };
+	store;
+	gate;
+	hintCookie;
+	revalidateSeconds;
 	listeners = /* @__PURE__ */ new Set();
-	constructor({ enableRefresh: e = !1, tokenStorage: t = "localStorage" } = {}) {
-		this.enableRefresh = e, this.tokenStorage = t;
-		try {
-			let e = null;
-			t === "localStorage" ? e = localStorage.getItem("user_state") : t === "sessionStorage" && (e = sessionStorage.getItem("user_state")), e && this.setCache("token", JSON.parse(e));
-		} catch {}
-		return new Proxy(this, { get: (e, n, r) => {
-			if (n in e) return Reflect.get(e, n, r);
-			if (!(e.cache && n in e.cache && n === "token" && t === "") && e.cache && n in e.cache) return e.cache[n];
-		} });
+	renewal;
+	renewalTimer;
+	detachListeners;
+	offline = !1;
+	spaceKey;
+	constructor({ spaceKey: e = "", tokenStorage: n = "localStorage", sessionHintCookie: r, sessionGate: i = "optimistic", sessionRevalidateSeconds: a = c, storageKey: o = "plitzi_auth_session" } = {}) {
+		this.spaceKey = e, this.store = new t(n, o), this.gate = i, this.hintCookie = r, this.revalidateSeconds = a;
 	}
-	internalRefresh(e) {
-		e || (this.setState("guest"), this.setCache(void 0, void 0)), this.setCache("token", e);
+	get endpoints() {
+		return [];
 	}
-	internalGetUser(e) {
-		this.setCache("user", e), e ? this.setState("authenticated") : (this.setState("guest"), this.isExpired() && this.clearCache());
+	requestExchange() {
+		return Promise.resolve(void 0);
 	}
-	internalLogin(e, t) {
-		this.setCache("user", e), this.setCache("token", t), e ? this.setState("authenticated") : this.setState("guest");
+	consumeRedirect() {
+		return Promise.resolve(void 0);
 	}
-	internalLogout() {
-		this.clearCache(), this.setState("guest"), this.emit({ type: "logout" });
+	get user() {
+		return this.session.user;
 	}
-	isExpired() {
-		return !this.cache || !this.cache.token || !this.cache.token.expiresAt || Date.now() >= this.cache.token.expiresAt;
+	get token() {
+		return this.session.token;
 	}
-	setCache(e, t) {
-		if (!e) {
-			this.cache = t, typeof localStorage < "u" && this.tokenStorage === "localStorage" && this.cache.token ? localStorage.setItem("user_state", JSON.stringify(this.cache.token)) : typeof sessionStorage < "u" && this.tokenStorage === "sessionStorage" && this.cache.token && sessionStorage.setItem("user_state", JSON.stringify(this.cache.token));
+	getState() {
+		return this.state;
+	}
+	can(e) {
+		let t = this.session.user?.permissions;
+		return Array.isArray(t) && t.includes(e);
+	}
+	peekState() {
+		return this.peek().state;
+	}
+	peek() {
+		let t = this.store.read(), a = e(this.hintCookie);
+		if (this.hintCookie && !a) return { state: "guest" };
+		let o = t?.token, c = r(o?.expiresAt) ?? i(o?.accessToken);
+		return o?.accessToken && (c === void 0 || c - s > n()) && t?.user ? {
+			state: "authenticated",
+			user: t.user,
+			token: t.token
+		} : o?.accessToken || o?.refreshToken || a ? {
+			state: "init",
+			user: t?.user,
+			token: t?.token
+		} : { state: "guest" };
+	}
+	async init(e = {}) {
+		this.attach(), await this.decide(e), this.settle();
+	}
+	settle() {
+		(this.state === "init" || this.state === "initLoading") && this.setState(this.session.user || this.hasLiveToken() ? "authenticated" : "guest", "settled");
+	}
+	async decide(t) {
+		if (t.skipAuth) {
+			this.setState("guest", "skip-auth");
 			return;
 		}
-		this.cache ||= {}, this.cache[e] = t, this.cache.token && (typeof localStorage < "u" && this.tokenStorage === "localStorage" ? localStorage.setItem("user_state", JSON.stringify(this.cache.token)) : typeof sessionStorage < "u" && this.tokenStorage === "sessionStorage" && sessionStorage.setItem("user_state", JSON.stringify(this.cache.token)));
+		let n = await this.consumeRedirect();
+		if (n) {
+			n.ok ? (this.adopt(n), await this.handOffToServer(), this.emit({
+				type: "login",
+				token: this.session.token
+			})) : this.endSession(n.reason);
+			return;
+		}
+		if (t.user) {
+			this.adopt({
+				ok: !0,
+				user: t.user,
+				token: t.accessToken ? {
+					accessToken: t.accessToken,
+					expiresAt: t.expiresAt ?? null,
+					refreshToken: null
+				} : this.session.token
+			}, !0, "bootstrap");
+			return;
+		}
+		let r = this.store.read(), i = e(this.hintCookie);
+		if (this.session = {
+			user: r?.user,
+			token: r?.token,
+			validatedAt: r?.validatedAt ?? 0
+		}, this.hintCookie && !i) {
+			this.endSession(void 0, "hint-missing");
+			return;
+		}
+		if (this.hasLiveToken() && this.session.user) {
+			this.setState("authenticated", "restored"), this.scheduleRenewal();
+			let e = this.isFresh() && this.gate !== "strict" ? void 0 : this.revalidate(!0);
+			this.gate === "strict" && await e;
+			return;
+		}
+		if (!this.hasEvidence()) {
+			this.endSession(void 0, "no-evidence");
+			return;
+		}
+		if (this.setState("initLoading", "no-evidence"), this.hasLiveToken() && this.capabilities.identity) {
+			await this.loadIdentity();
+			return;
+		}
+		if (this.capabilities.renew) {
+			await this.renew();
+			return;
+		}
+		if (this.capabilities.identity) {
+			await this.loadIdentity();
+			return;
+		}
+		this.endSession();
+	}
+	dispose() {
+		clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.detachListeners?.(), this.detachListeners = void 0;
+	}
+	async login(e) {
+		this.setState("authenticating", "authenticating");
+		let t = await this.requestLogin(e);
+		if (!t.ok) {
+			this.endSession(t.reason);
+			return;
+		}
+		if (this.adopt(t), await this.handOffToServer(), this.state !== "guest") return !this.session.user && this.capabilities.identity && await this.loadIdentity(), this.emit({
+			type: "login",
+			token: this.session.token
+		}), this.session.token;
+	}
+	async handOffToServer() {
+		let e = await this.requestExchange();
+		if (e) {
+			if (e.ok) {
+				this.adopt(e);
+				return;
+			}
+			if (e.reason === "network") {
+				this.offline = !0;
+				return;
+			}
+			this.endSession(e.reason);
+		}
+	}
+	async refresh() {
+		return await this.renew(), this.session.token;
 	}
-	clearCache(e) {
-		if (e && this.cache) {
-			delete this.cache[e], e === "token" && (typeof localStorage < "u" && this.tokenStorage === "localStorage" ? localStorage.removeItem("user_state") : typeof sessionStorage < "u" && this.tokenStorage === "sessionStorage" && sessionStorage.removeItem("user_state"));
+	async revalidate(e = !1) {
+		return this.hasEvidence() ? !e && this.isFresh() && this.hasLiveToken() ? this.state === "authenticated" : this.hasLiveToken() && this.capabilities.identity ? this.loadIdentity() : this.capabilities.renew ? this.renew() : this.capabilities.identity ? this.loadIdentity() : (this.hasLiveToken() || this.endSession("expired"), this.state === "authenticated") : (this.state !== "guest" && this.endSession(), !1);
+	}
+	invalidate(e = "expired") {
+		if (e === "network") {
+			this.offline = !0;
+			return;
+		}
+		if (e === "expired" && this.capabilities.renew) {
+			this.renew();
 			return;
 		}
-		typeof localStorage < "u" && this.tokenStorage === "localStorage" ? localStorage.removeItem("user_state") : typeof sessionStorage < "u" && this.tokenStorage === "sessionStorage" && sessionStorage.removeItem("user_state"), this.cache = void 0;
+		this.endSession(e);
+	}
+	async logout() {
+		await this.requestLogout(), this.endSession(), this.emit({ type: "logout" });
 	}
 	on(e) {
-		return Array.isArray(e) ? (e.forEach((e) => this.listeners.add(e)), () => e.forEach((e) => this.listeners.delete(e))) : (this.listeners.add(e), () => this.listeners.delete(e));
+		let t = Array.isArray(e) ? e : [e];
+		return t.forEach((e) => this.listeners.add(e)), () => t.forEach((e) => this.listeners.delete(e));
 	}
 	emit(e) {
 		for (let t of this.listeners) t(e);
 	}
-	setState(e) {
+	setState(e, t) {
 		this.state !== e && (this.state = e, this.emit({
 			type: "state",
-			state: e
+			state: e,
+			reason: t
 		}));
 	}
-	getState() {
-		return this.state;
+	async renew() {
+		return this.renewal ??= this.performRenewal().finally(() => {
+			this.renewal = void 0;
+		}), this.renewal;
 	}
-	async request(e, t) {
-		let n;
-		try {
-			n = await fetch(e, t);
-		} catch {
-			return Promise.resolve({
-				data: void 0,
-				status: 500
-			});
-		}
-		if (!n.ok) return Promise.resolve({
-			data: void 0,
-			status: n.status
+	async performRenewal() {
+		let e = await this.requestRenewal(this.session.token?.refreshToken ?? void 0);
+		return e.ok ? (this.adopt(e), !this.session.user && this.capabilities.identity ? this.loadIdentity() : this.state === "authenticated") : (this.handleFailure(e.reason), !1);
+	}
+	async loadIdentity() {
+		let e = await this.requestIdentity();
+		return e.ok ? (this.adopt(e), this.state === "authenticated") : e.reason === "expired" && this.capabilities.renew && !this.renewal ? this.renew() : (this.handleFailure(e.reason), !1);
+	}
+	handleFailure(e) {
+		if (e === "network") {
+			this.offline = !0;
+			return;
+		}
+		this.endSession(e);
+	}
+	adopt(e, t = !0, r = "granted") {
+		this.session = {
+			user: e.user ?? this.session.user,
+			token: e.token ?? this.session.token,
+			validatedAt: n()
+		}, this.offline = !1, t && this.store.write(this.session), this.scheduleRenewal(), this.setState(this.session.user || this.hasLiveToken() ? "authenticated" : "guest", r);
+	}
+	endSession(e, t = "signed-out") {
+		clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.session = { validatedAt: n() }, this.store.write(this.session), this.setState("guest", t), e && this.emit({
+			type: "expired",
+			reason: e
 		});
-		let r;
-		try {
-			r = await n.json();
-		} catch {
-			r = void 0;
-		}
-		return {
-			data: r,
-			status: n.status
+	}
+	expiresAt() {
+		return r(this.session.token?.expiresAt) ?? i(this.session.token?.accessToken);
+	}
+	hasLiveToken() {
+		if (!this.session.token?.accessToken) return !1;
+		let e = this.expiresAt();
+		return e === void 0 || e - s > n();
+	}
+	isFresh() {
+		return n() - this.session.validatedAt < this.revalidateSeconds;
+	}
+	hasEvidence() {
+		return this.session.token?.accessToken || this.session.token?.refreshToken ? !0 : !!e(this.hintCookie);
+	}
+	scheduleRenewal() {
+		clearTimeout(this.renewalTimer), this.renewalTimer = void 0;
+		let e = this.expiresAt();
+		if (e === void 0 || typeof window > "u" || this.state === "guest") return;
+		let t = Math.min((e - s - n()) * 1e3, l);
+		if (t <= 0) {
+			this.onRenewalDue();
+			return;
+		}
+		this.renewalTimer = setTimeout(() => this.onRenewalDue(), t);
+	}
+	onRenewalDue() {
+		if (this.capabilities.renew) {
+			this.renew();
+			return;
+		}
+		this.endSession("expired");
+	}
+	attach() {
+		if (typeof window > "u" || this.detachListeners) return;
+		let e = () => {
+			document.visibilityState === "visible" && this.revalidate();
+		}, t = () => {
+			this.offline && this.revalidate(!0);
+		}, n = this.store.subscribe((e) => this.adoptFromStorage(e)), r = a(({ reason: e, url: t }) => {
+			let n = this.endpoints.filter(Boolean);
+			(n.length === 0 || n.some((e) => o(e, t))) && this.invalidate(e);
+		});
+		document.addEventListener("visibilitychange", e), window.addEventListener("online", t), this.detachListeners = () => {
+			document.removeEventListener("visibilitychange", e), window.removeEventListener("online", t), n(), r();
 		};
 	}
+	adoptFromStorage(e) {
+		if (!e?.token && !e?.user) {
+			clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.session = { validatedAt: n() }, this.setState("guest", "another-tab"), this.emit({ type: "logout" });
+			return;
+		}
+		this.adopt({
+			ok: !0,
+			user: e.user,
+			token: e.token
+		}, !1);
+	}
 };
 //#endregion
-export { e as default };
+export { u as default };

package/dist/helpers/SessionStore.d.ts

@@ -0,0 +1,34 @@
+import { Schema, TokenResult } from '@plitzi/sdk-shared';
+export type StorageKind = Exclude<Schema['settings']['tokenStorage'], undefined>;
+export type StoredSession<U> = {
+    version: number;
+    token?: TokenResult;
+    user?: U;
+    /**
+     * Unix seconds of the last time the backend answered about this session — including the answer that nobody is
+     * signed in. Storing the negative answer is what stops a signed-out visitor from paying for a request on every
+     * single page load just to be told the same thing again.
+     */
+    validatedAt: number;
+};
+/**
+ * Where a session survives a reload. It holds the user next to the token on purpose: a token alone says a session is
+ * live but not whose it is, so a page that stored only the token had to ask the backend who it was talking to before
+ * it could render anything — which is the reason boot used to cost a round trip.
+ */
+declare class SessionStore<U> {
+    private readonly kind;
+    private readonly key;
+    constructor(kind: StorageKind, key: string);
+    private get area();
+    read(): StoredSession<U> | undefined;
+    write(session: Omit<StoredSession<U>, 'version'>): void;
+    clear(): void;
+    /**
+     * Fires when another tab writes the session. Signing out in one tab has to end it in all of them, and a renewal in
+     * one has to be adopted by the rest — two tabs that each renew on their own would rotate the refresh token out from
+     * under each other, and whichever lost the race would sign its user out for no reason.
+     */
+    subscribe(listener: (session?: StoredSession<U>) => void): () => void;
+}
+export default SessionStore;

package/dist/helpers/SessionStore.mjs

@@ -0,0 +1,45 @@
+//#region src/helpers/SessionStore.ts
+var e = (e) => typeof e == "object" && !!e && e.version === 1, t = class {
+	kind;
+	key;
+	constructor(e, t) {
+		this.kind = e, this.key = t;
+	}
+	get area() {
+		try {
+			if (this.kind === "localStorage" && typeof localStorage < "u") return localStorage;
+			if (this.kind === "sessionStorage" && typeof sessionStorage < "u") return sessionStorage;
+		} catch {}
+	}
+	read() {
+		let t = this.area?.getItem(this.key);
+		if (t) try {
+			let n = JSON.parse(t);
+			return e(n) ? n : void 0;
+		} catch {
+			return;
+		}
+	}
+	write(e) {
+		try {
+			this.area?.setItem(this.key, JSON.stringify({
+				version: 1,
+				...e
+			}));
+		} catch {}
+	}
+	clear() {
+		try {
+			this.area?.removeItem(this.key);
+		} catch {}
+	}
+	subscribe(e) {
+		if (this.kind !== "localStorage" || typeof window > "u") return () => void 0;
+		let t = (t) => {
+			(t.key === null || t.key === this.key) && e(this.read());
+		};
+		return window.addEventListener("storage", t), () => window.removeEventListener("storage", t);
+	}
+};
+//#endregion
+export { t as default };

package/dist/helpers/sessionHint.d.ts

@@ -0,0 +1,15 @@
+export type SessionHint = {
+    /** Unix seconds the session's access credential dies at. */
+    expiresAt: number;
+    /** Unix seconds renewal stops being possible at, when the backend states it. */
+    refreshExpiresAt?: number;
+};
+/**
+ * Reads the session hint your backend publishes beside its httpOnly session cookie (see `sessionHintCookie` in the
+ * space settings). It answers, with no request, the one question local storage cannot: whether this browser holds a
+ * session that some other page — a sibling app on the same domain, a social sign-in redirect — established.
+ *
+ * Its absence is an answer too, and the more valuable one: a configured hint that is not there means nobody is signed
+ * in, which is how a signed-out visitor gets a page rendered without a round trip to be told so.
+ */
+export declare const readSessionHint: (cookieName?: string) => SessionHint | undefined;

package/dist/helpers/sessionHint.mjs

@@ -0,0 +1,17 @@
+//#region src/helpers/sessionHint.ts
+var e = (e) => {
+	let [t, n] = e.split("."), r = Number(t);
+	if (!Number.isFinite(r) || r <= 0) return;
+	let i = Number(n);
+	return {
+		expiresAt: r,
+		refreshExpiresAt: Number.isFinite(i) && i > 0 ? i : void 0
+	};
+}, t = (t) => {
+	if (!(!t || typeof document > "u")) for (let n of document.cookie.split(";")) {
+		let r = n.indexOf("=");
+		if (r !== -1 && n.slice(0, r).trim() === t) return e(decodeURIComponent(n.slice(r + 1).trim()));
+	}
+};
+//#endregion
+export { t as readSessionHint };

package/dist/helpers/tokenClaims.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The `exp` claim of a JWT, in unix seconds, or undefined for a token that is opaque or unreadable.
+ *
+ * Decoded, never verified: a browser holds no signing secret, and a signature it cannot check tells it nothing. This
+ * is only ever used to skip asking a question the token already answers — "has this lapsed?" — and never to grant
+ * anything. A forged `exp` buys an attacker one refused request from the server, which is the only opinion that counts.
+ */
+export declare const tokenExpiresAt: (token?: string | null) => number | undefined;
+/** Unix seconds, the unit every expiry in this package is stated in — `Date.now()` is the odd one out. */
+export declare const nowInSeconds: () => number;
+export declare const toSeconds: (expiry?: number | null) => number | undefined;

package/dist/helpers/tokenClaims.mjs

@@ -0,0 +1,19 @@
+//#region src/helpers/tokenClaims.ts
+var e = (e) => {
+	try {
+		let t = e.replaceAll("-", "+").replaceAll("_", "/"), n = t.padEnd(t.length + (4 - t.length % 4) % 4, "="), r = JSON.parse(atob(n));
+		return typeof r == "object" && r ? r : void 0;
+	} catch {
+		return;
+	}
+}, t = (t) => {
+	if (!t) return;
+	let n = t.split(".");
+	if (n.length !== 3) return;
+	let r = e(n[1])?.exp;
+	return typeof r == "number" && Number.isFinite(r) ? r : void 0;
+}, n = () => Math.floor(Date.now() / 1e3), r = 1e11, i = (e) => {
+	if (!(typeof e != "number" || !Number.isFinite(e) || e <= 0)) return Math.floor(e > r ? e / 1e3 : e);
+};
+//#endregion
+export { n as nowInSeconds, i as toSeconds, t as tokenExpiresAt };

package/dist/hooks/useAuth/useAuth.d.ts

@@ -1,19 +1,20 @@
 import { AuthManager } from '../../AuthManager';
-import { Schema, Server } from '@plitzi/sdk-shared';
+import { AuthProviderSettings } from '../../types';
+import { AuthState, Server } from '@plitzi/sdk-shared';
 export type UseAuthProps = {
     server?: Server;
     isHydrating?: boolean;
-    tokenStorage?: Schema['settings']['tokenStorage'];
-    provider?: Schema['settings']['userProvider'];
-    loginUrl?: Schema['settings']['loginUrl'];
-    userUrl?: Schema['settings']['userUrl'];
-    refreshUrl?: Schema['settings']['refreshUrl'];
-    logoutUrl?: Schema['settings']['logoutUrl'];
-    detailsPath?: Schema['settings']['detailsPath'];
-    tokenPath?: Schema['settings']['tokenPath'];
-    expirationTimePath?: Schema['settings']['expirationTimePath'];
+    provider?: string;
+    /** Held stable by the caller: a new object here builds a new provider and re-runs the whole boot decision. */
+    settings: AuthProviderSettings;
 };
-declare const useAuth: ({ server, isHydrating, tokenStorage, provider, loginUrl, userUrl, refreshUrl, logoutUrl, detailsPath, tokenPath, expirationTimePath }: UseAuthProps) => {
+/**
+ * `loading` is what a space's pages are held back by, so it is deliberately narrow: it means "this page cannot be
+ * rendered yet", not "auth is doing something". A session restored from storage renders immediately and confirms
+ * itself behind the render, which is the difference between a page that appears at once and one that waits on a
+ * round trip to be told what it already knew.
+ */
+declare const useAuth: ({ server, isHydrating, provider, settings }: UseAuthProps) => {
     manager: AuthManager<{
         id: number;
         username: string;
@@ -21,8 +22,35 @@ declare const useAuth: ({ server, isHydrating, tokenStorage, provider, loginUrl,
         verified: boolean;
         permissions: string[];
         roles: string[];
-    }, "basic">;
+    }>;
+    state: AuthState;
+    /** Who the server rendered this page for, so a consumer can stand on it until the browser has decided. */
+    bootstrapUser: import('@plitzi/sdk-shared').User | undefined;
+    bootstrapToken: string | undefined;
+    /**
+     * Who this browser can be seen to hold a session for, read synchronously before `init()` runs.
+     *
+     * Published for the same reason `bootstrapUser` is: the provider fills in from an effect, so on a
+     * client-rendered page the auth data source was EMPTY for the first commit — `{{user.*}}` rendered blank and
+     * filled in a moment later, on every reload of every signed-in visitor.
+     */
+    peekedUser: {
+        id: number;
+        username: string;
+        email: string;
+        verified: boolean;
+        permissions: string[];
+        roles: string[];
+    } | undefined;
+    peekedToken: string | undefined;
     loading: boolean;
+    /**
+     * Before the browser has decided, the server's answer stands. `state` only becomes `authenticated` from
+     * `init()`, which runs in an effect — and effects do not run during a server render, so this read was false on
+     * the server for a visitor the server had just resolved. Page-level access rules are evaluated against it, so
+     * an `accessLevel: 'authenticated'` page never won on the server, and the browser then picked a different page
+     * than the HTML it was hydrating.
+     */
     authenticated: boolean;
 };
 export default useAuth;

package/dist/hooks/useAuth/useAuth.mjs

@@ -1,58 +1,45 @@
 import { AuthManager as e } from "../../AuthManager.mjs";
 import { useCallback as t, useEffect as n, useMemo as r, useState as i } from "react";
 //#region src/hooks/useAuth/useAuth.ts
-var a = ({ server: a, isHydrating: o = !1, tokenStorage: s = "localStorage", provider: c = "", loginUrl: l = "", userUrl: u = "", refreshUrl: d = "", logoutUrl: f = "", detailsPath: p = "details", tokenPath: m = "access_token", expirationTimePath: h = "expire_at" }) => {
-	let g = typeof window > "u" || o || !!a?.user && a.authenticated, [_, v] = i(!!u && !g), [y, b] = i(!1), x = t((e) => {
-		e.type === "state" && (v(e.state === "initLoading"), b(e.state === "authenticated"));
-	}, []), S = r(() => {
-		let t = {};
-		c === "basic" && (t = {
-			tokenStorage: s,
-			loginUrl: l,
-			userUrl: u,
-			refreshUrl: d,
-			logoutUrl: f,
-			detailsPath: p,
-			tokenPath: m,
-			expirationTimePath: h,
-			isSSR: g
-		});
-		let n = new e(c, x, t);
-		return n.init(a?.authenticated ? a.user?.details : void 0, a?.skipAuth), n;
-	}, [
-		c,
-		x,
-		a?.authenticated,
-		a?.user?.details,
-		a?.skipAuth,
+var a = ({ server: a, isHydrating: o = !1, provider: s = "", settings: c }) => {
+	let l = a?.authenticated ? a.user?.details : void 0, u = typeof a?.user?.accessToken == "string" ? a.user.accessToken : void 0, [d, f] = i("init"), p = t((e) => {
+		e.type === "state" && f(e.state);
+	}, []), m = r(() => new e(s, p, c), [
 		s,
-		l,
-		u,
-		d,
-		f,
 		p,
+		c
+	]), h = r(() => o || l ? void 0 : m.peek(), [
 		m,
-		h,
-		g
-	]);
-	return n(() => {
-		let e = S.getProvider();
-		if (!e || !e.token?.expiresAt) return;
-		let t = Math.floor(Date.now() / 1e3);
-		if (e.token.expiresAt) {
-			let n = setTimeout(() => {
-				S.logout();
-			}, Math.abs(t - e.token.expiresAt) * 1e3);
-			return () => clearTimeout(n);
-		}
-	}, [S, y]), r(() => ({
-		manager: S,
-		loading: _,
-		authenticated: y
+		o,
+		l
+	]), g = d !== "init" && d !== "initLoading" || !!l || o || h?.state === "authenticated" || h?.state === "guest";
+	return n(() => (m.init({
+		user: l,
+		accessToken: u,
+		expiresAt: a?.user?.expiresAt,
+		skipAuth: a?.skipAuth
+	}), () => m.dispose()), [
+		m,
+		l,
+		u,
+		a?.user?.expiresAt,
+		a?.skipAuth
+	]), r(() => ({
+		manager: m,
+		state: d,
+		bootstrapUser: l,
+		bootstrapToken: u,
+		peekedUser: h?.user,
+		peekedToken: h?.token?.accessToken,
+		loading: d === "initLoading" || !g,
+		authenticated: d === "authenticated" || d === "init" && (!!l || h?.state === "authenticated")
 	}), [
-		S,
-		_,
-		y
+		m,
+		d,
+		l,
+		u,
+		g,
+		h
 	]);
 };
 //#endregion

package/dist/index.d.ts

@@ -1,8 +1,12 @@
 import { default as AuthContext } from './AuthContext';
 import { default as AuthContextProvider } from './AuthContextProvider';
+import { default as AuthProvider } from './AuthProvider';
 import { default as useAuth } from './hooks/useAuth';
 export * from './hooks/useAuth';
 export * from './AuthContext';
 export * from './AuthProvider';
 export * from './AuthManager';
-export { useAuth, AuthContext, AuthContextProvider };
+export * from './types';
+export { readSessionHint } from './helpers/sessionHint';
+export { nowInSeconds, tokenExpiresAt } from './helpers/tokenClaims';
+export { useAuth, AuthContext, AuthContextProvider, AuthProvider };