@sanity/sdk 2.19.0 → 2.20.0

package/dist/authStore-CWTAuieY.js

@@ -0,0 +1,1072 @@
+import { t as __exportAll } from "./rolldown-runtime-vyAXikos.js";
+import { r as createLogger, t as getEnv } from "./getEnv-76AjZd_f.js";
+import { createClient } from "@sanity/client";
+import { EMPTY, Observable, catchError, defer, distinctUntilChanged, exhaustMap, filter, finalize, fromEvent, map, shareReplay, skip, switchMap, takeWhile, timer } from "rxjs";
+import "@sanity/types";
+import { devtools } from "zustand/middleware";
+import { createStore } from "zustand/vanilla";
+/**
+* @beta
+*/
+function isDatasetResource(resource) {
+	return "projectId" in resource && "dataset" in resource;
+}
+/**
+* @beta
+*/
+function isMediaLibraryResource(resource) {
+	return "mediaLibraryId" in resource;
+}
+/**
+* @beta
+*/
+function isCanvasResource(resource) {
+	return "canvasId" in resource;
+}
+/**
+* @deprecated Use `isDatasetResource` instead.
+* @beta
+*/
+function isDatasetSource(source) {
+	return isDatasetResource(source);
+}
+/**
+* @deprecated Use `isMediaLibraryResource` instead.
+* @beta
+*/
+function isMediaLibrarySource(source) {
+	return isMediaLibraryResource(source);
+}
+/**
+* @deprecated Use `isCanvasResource` instead.
+* @beta
+*/
+function isCanvasSource(source) {
+	return isCanvasResource(source);
+}
+const isReleasePerspective = (perspective) => typeof perspective == "object" && !!perspective && "releaseName" in perspective;
+/**
+* Creates a reactive store state container with multiple access patterns
+* @param initialState - Initial state value for the store
+* @param devToolsOptions - Configuration for Zustand devtools integration
+* @returns StoreState instance with get/set/observable interface
+*
+* @example
+* ```typescript
+* // Create a simple counter store
+* const counterStore = createStoreState({ count: 0 });
+*
+* // Update state
+* counterStore.set('increment', { count: 1 });
+*
+* // Observe changes
+* counterStore.observable.subscribe(console.log);
+* ```
+*
+* @remarks
+* Uses Zustand for state management under the hood with RxJS for observable interface.
+* Designed to work with both imperative and reactive programming patterns.
+*/
+function createStoreState(initialState, devToolsOptions) {
+	let store = createStore()(devtools(() => initialState, devToolsOptions));
+	return {
+		get: store.getState,
+		set: (actionKey, updatedState) => {
+			let currentState = store.getState(), nextState = typeof updatedState == "function" ? updatedState(currentState) : updatedState;
+			currentState !== nextState && store.setState(nextState, !1, actionKey);
+		},
+		observable: new Observable((observer) => {
+			let emit = () => observer.next(store.getState());
+			emit();
+			let unsubscribe = store.subscribe(emit);
+			return () => unsubscribe();
+		})
+	};
+}
+/**
+* Typescript helper function for creating store definitions
+*
+* @param storeDefinition - Configuration object defining the store
+* @returns The finalized store definition
+*/
+function defineStore(storeDefinition) {
+	return storeDefinition;
+}
+/**
+* Creates a new instance of a store from a store definition
+*
+* @param instance - The Sanity instance this store will be associated with
+* @param storeDefinition - The store definition containing initial state and initialization logic
+* @returns A store instance with state management and lifecycle methods
+*
+* @remarks
+* The store instance maintains its own state that is scoped to the given Sanity instance.
+* If the store definition includes an initialize function, it will be called during
+* instance creation, and its cleanup function will be called during disposal.
+*
+* @example
+* ```ts
+* const counterStore = defineStore({
+*   name: 'Counter',
+*   getInitialState: () => ({ count: 0 }),
+*   initialize: ({state}) => {
+*     console.log('Counter store initialized')
+*     return () => console.log('Counter store disposed')
+*   }
+* })
+*
+* const instance = createStoreInstance(sanityInstance, counterStore)
+* // Later when done with the store:
+* instance.dispose()
+* ```
+*/
+function createStoreInstance(instance, key, { name, getInitialState, initialize }) {
+	let state = createStoreState(getInitialState(instance, key), {
+		enabled: !!getEnv("DEV"),
+		name: `${name}-${key.name}`
+	}), dispose = initialize?.({
+		state,
+		instance,
+		key
+	}), disposed = { current: !1 };
+	return {
+		state,
+		dispose: () => {
+			disposed.current || (disposed.current = !0, dispose?.());
+		},
+		isDisposed: () => disposed.current
+	};
+}
+/**
+* Creates an action binder function that uses the provided key function
+* to determine how store instances are shared between Sanity instances
+*
+* @param keyFn - Function that generates a key from a Sanity config
+* @returns A function that binds store actions to Sanity instances
+*
+* @remarks
+* Action binders determine how store instances are shared across multiple
+* Sanity instances. The key function determines which instances share state.
+*
+* @example
+* ```ts
+* // Create a custom binder that uses a tenant ID for isolation
+* const bindActionByTenant = createActionBinder(config => config.tenantId || 'default')
+*
+* // Use the custom binder with a store definition
+* const getTenantUsers = bindActionByTenant(
+*   userStore,
+*   ({state}) => state.get().users
+* )
+* ```
+*/
+function createActionBinder(keyFn) {
+	let instanceRegistry = /* @__PURE__ */ new Map(), storeRegistry = /* @__PURE__ */ new Map();
+	/**
+	* Binds a store action to a store definition
+	*
+	* @param storeDefinition - The store definition
+	* @param action - The action to bind
+	* @returns A function that executes the action with a Sanity instance
+	*/
+	return function bindAction(storeDefinition, action) {
+		return function boundAction(instance, ...params) {
+			let key = keyFn(instance, ...params), compositeKey = storeDefinition.name + (key.name ? `:${key.name}` : ""), instances = instanceRegistry.get(compositeKey);
+			instances || (instances = /* @__PURE__ */ new Set(), instanceRegistry.set(compositeKey, instances)), instances.has(instance.instanceId) || (instances.add(instance.instanceId), instance.onDispose(() => {
+				instances.delete(instance.instanceId), instances.size === 0 && (storeRegistry.get(compositeKey)?.dispose(), storeRegistry.delete(compositeKey), instanceRegistry.delete(compositeKey));
+			}));
+			let storeInstance = storeRegistry.get(compositeKey);
+			return storeInstance || (storeInstance = createStoreInstance(instance, key, storeDefinition), storeRegistry.set(compositeKey, storeInstance)), action({
+				instance,
+				state: storeInstance.state,
+				key
+			}, ...params);
+		};
+	};
+}
+const createResourceKey = (instance, resource) => {
+	let name, resourceForKey;
+	if (resource) {
+		if (resourceForKey = resource, isDatasetResource(resource)) name = `${resource.projectId}.${resource.dataset}`;
+		else if (isMediaLibraryResource(resource)) name = `media-library:${resource.mediaLibraryId}`;
+		else if (isCanvasResource(resource)) name = `canvas:${resource.canvasId}`;
+		else throw Error(`Received invalid resource: ${JSON.stringify(resource)}`);
+		return {
+			name,
+			resource: resourceForKey
+		};
+	}
+	let { projectId, dataset } = instance.config;
+	if (!projectId || !dataset) throw Error("This API requires a project ID and dataset configured.");
+	return {
+		name: `${projectId}.${dataset}`,
+		resource: {
+			projectId,
+			dataset
+		}
+	};
+}, bindActionByResource = createActionBinder((instance, { resource }) => createResourceKey(instance, resource)), bindActionByResourceAndPerspective = createActionBinder((instance, options) => {
+	let { resource, perspective } = options, utilizedPerspective = perspective ?? instance.config.perspective ?? "drafts", perspectiveKey;
+	perspectiveKey = isReleasePerspective(utilizedPerspective) ? utilizedPerspective.releaseName : typeof utilizedPerspective == "string" ? utilizedPerspective : JSON.stringify(utilizedPerspective);
+	let sourceKey = createResourceKey(instance, resource);
+	return {
+		name: `${sourceKey.name}:${perspectiveKey}`,
+		resource: sourceKey.resource,
+		perspective: utilizedPerspective
+	};
+}), bindActionGlobally = createActionBinder((..._rest) => ({ name: "global" }));
+/**
+* Creates a state source action that generates StateSource instances
+*
+* @remarks
+* The returned action can be bound to a store using createActionBinder.
+* When invoked, returns a StateSource that stays synchronized with the store.
+*
+* Key performance features:
+* - Memoizes selector contexts to prevent redundant object creation
+* - Only runs selectors when the underlying state changes
+*
+* For complex data transformations, consider using memoized selectors
+* (like those from Reselect) to prevent expensive recalculations.
+*
+* @example
+* ```ts
+* // Create a simple counter source
+* const getCount = createStateSourceAction(({state}: SelectorContext<CounterState>) => state.count)
+* ```
+*
+* @example
+* ```ts
+* // Create a parameterized source with setup/cleanup
+* const getItem = createStateSourceAction({
+*   selector: ({state}, index: number) => state.items[index],
+*   onSubscribe: (context, index) => {
+*     trackItemSubscription(index)
+*     return () => untrackItem(index)
+*   }
+* })
+* ```
+*
+* @example
+* ```ts
+* // Binding a state source to a specific store
+* const documentStore = defineStore<DocumentState>({
+*   name: 'Documents',
+*   getInitialState: () => ({ documents: {} }),
+*   // ...
+* })
+*
+* const getDocument = bindActionByDataset(
+*   documentStore,
+*   createStateSourceAction(({state}, documentId: string) => state.documents[documentId])
+* )
+*
+* // Usage
+* const documentSource = getDocument(sanityInstance, 'doc123')
+* const doc = documentSource.getCurrent()
+* const subscription = documentSource.observable.subscribe(updatedDoc => {
+*   console.log('Document changed:', updatedDoc)
+* })
+* ```
+*/
+function createStateSourceAction(options) {
+	let selector = typeof options == "function" ? options : options.selector, subscribeHandler = options && "onSubscribe" in options ? options.onSubscribe : void 0, isEqual = options && "isEqual" in options ? options.isEqual ?? Object.is : Object.is, selectorContextCache = /* @__PURE__ */ new WeakMap();
+	/**
+	* The state source action implementation
+	* @param context - Store context providing access to state and instance
+	* @param params - Parameters provided when invoking the bound action
+	*/
+	function stateSourceAction(context, ...params) {
+		let { state, instance } = context, getCurrent = (currentState) => {
+			if (typeof currentState != "object" || !currentState) throw Error(`Expected store state to be an object but got "${typeof currentState}" instead`);
+			let instanceCache = selectorContextCache.get(currentState);
+			instanceCache || (instanceCache = /* @__PURE__ */ new WeakMap(), selectorContextCache.set(currentState, instanceCache));
+			let selectorContext = instanceCache.get(instance);
+			return selectorContext || (selectorContext = {
+				state: currentState,
+				instance
+			}, instanceCache.set(instance, selectorContext)), selector(selectorContext, ...params);
+		}, values = state.observable.pipe(map(getCurrent), distinctUntilChanged(isEqual));
+		subscribeHandler && (values = withSubscribeHook(values, () => subscribeHandler(context, ...params)));
+		let sharedValues = values.pipe(shareReplay({
+			bufferSize: 1,
+			refCount: !0
+		})), subscribe = (onStoreChanged) => {
+			let subscription = sharedValues.pipe(skip(1)).subscribe({
+				next: () => onStoreChanged?.(),
+				error: () => onStoreChanged?.()
+			});
+			return () => {
+				subscription.unsubscribe();
+			};
+		};
+		return {
+			getCurrent: () => getCurrent(state.get()),
+			subscribe,
+			observable: sharedValues
+		};
+	}
+	return stateSourceAction;
+}
+/**
+* Creates a new Observable which wraps an existing Observable which will invoke
+* the function when a new subscriber appears.
+*/
+function withSubscribeHook(obs, fn) {
+	return defer(() => {
+		let cleanup = fn();
+		return cleanup ? obs.pipe(finalize(() => cleanup())) : obs;
+	});
+}
+/**
+* Returns the staging API host if the `__SANITY_STAGING__` build-time flag is
+* set to `true` (mirroring how Sanity Studio detects staging builds).
+*
+* @internal
+*/
+function getStagingApiHost() {
+	if (typeof __SANITY_STAGING__ < "u" && __SANITY_STAGING__ === !0) return "https://api.sanity.work";
+}
+const loggers = /* @__PURE__ */ new WeakMap();
+/**
+* Returns the auth logger for a Sanity instance, creating it on first use.
+*
+* The logger is cached per instance so repeated action calls (logout,
+* setAuthToken, handleAuthCallback) reuse the same logger instead of
+* rebuilding it. The instance details are nested under `instanceContext`,
+* which is what the logger's formatter reads to render the
+* `[project:x] [dataset:y] [instance:z]` prefix.
+*
+* @internal
+*/
+function getAuthLogger(instance) {
+	let logger = loggers.get(instance);
+	return logger || (logger = createLogger("auth", { instanceContext: {
+		instanceId: instance.instanceId,
+		projectId: instance.config.projectId,
+		dataset: instance.config.dataset
+	} }), loggers.set(instance, logger)), logger;
+}
+const DEFAULT_BASE = "http://localhost", DEFAULT_API_VERSION = "2021-06-07", REQUEST_TAG_PREFIX = "sanity.sdk.auth";
+/**
+* Determines the auth mode from instance config and environment.
+*
+* Priority:
+* 1. `studio` config provided → `'studio'`
+* 2. `studioMode.enabled` in config (deprecated) → `'studio'`
+* 3. Dashboard context detected (`_context` URL param with content) → `'dashboard'`
+* 4. Otherwise → `'standalone'`
+*
+* @internal
+*/
+function resolveAuthMode(config, locationHref) {
+	return isStudioConfig(config) ? "studio" : detectDashboardContext(locationHref) ? "dashboard" : "standalone";
+}
+/**
+* Returns `true` when the config indicates the SDK is running inside a Studio.
+* Checks the new `studio` field first, then falls back to the deprecated
+* `studioMode.enabled` for backwards compatibility.
+*
+* @internal
+*/
+function isStudioConfig(config) {
+	return !!config.studio || !!config.studioMode?.enabled;
+}
+/**
+* Checks whether the given location href contains a `_context` URL parameter
+* with a non-empty JSON object, indicating the SDK is running inside the
+* Sanity Dashboard.
+*
+* @internal
+*/
+function detectDashboardContext(locationHref) {
+	try {
+		let contextParam = new URL(locationHref, DEFAULT_BASE).searchParams.get("_context");
+		if (!contextParam) return !1;
+		let parsed = JSON.parse(contextParam);
+		return typeof parsed == "object" && !!parsed && !Array.isArray(parsed) && Object.keys(parsed).length > 0;
+	} catch (err) {
+		return console.error("Failed to parse dashboard context from initial location:", err), !1;
+	}
+}
+/**
+* Represents the various states the authentication type can be in.
+*
+* @public
+*/
+let AuthStateType = /* @__PURE__ */ function(AuthStateType) {
+	return AuthStateType.LOGGED_IN = "logged-in", AuthStateType.LOGGING_IN = "logging-in", AuthStateType.ERROR = "error", AuthStateType.LOGGED_OUT = "logged-out", AuthStateType;
+}({});
+const REFRESH_INTERVAL = 432e5;
+function createTokenRefreshStream(token, clientFactory, apiHost) {
+	return new Observable((subscriber) => {
+		let subscription = clientFactory({
+			apiVersion: DEFAULT_API_VERSION,
+			requestTagPrefix: REQUEST_TAG_PREFIX,
+			useProjectHostname: !1,
+			useCdn: !1,
+			token,
+			ignoreBrowserTokenWarning: !0,
+			...apiHost && { apiHost }
+		}).observable.request({
+			uri: "auth/refresh-token",
+			method: "POST",
+			tag: "refresh-token",
+			body: { token }
+		}).subscribe(subscriber);
+		return () => subscription.unsubscribe();
+	});
+}
+function shouldRefreshToken(lastRefresh) {
+	return !lastRefresh || Date.now() - lastRefresh >= REFRESH_INTERVAL;
+}
+/**
+* Periodically refreshes stamped auth tokens (those containing `-st`).
+*
+* Two triggers cause a refresh while the user stays logged in:
+* - a 12-hour interval timer (only fires while the tab is visible)
+* - the tab becoming visible again after `lastTokenRefresh` has gone stale
+*
+* Non-stamped tokens (e.g. personal access tokens) are never refreshed.
+*
+* @internal
+*/
+const refreshStampedToken = ({ state, instance }) => {
+	let logger = getAuthLogger(instance), { clientFactory, apiHost, storageArea, storageKey } = state.get().options;
+	return state.observable.pipe(map((storeState) => storeState.authState), filter((authState) => authState.type === "logged-in"), distinctUntilChanged((prev, curr) => prev.token === curr.token), filter((authState) => authState.token.includes("-st")), exhaustMap(() => new Observable((subscriber) => {
+		let visibilityHandler = () => {
+			let currentState = state.get();
+			document.visibilityState === "visible" && currentState.authState.type === "logged-in" && shouldRefreshToken(currentState.authState.lastTokenRefresh) && createTokenRefreshStream(currentState.authState.token, clientFactory, apiHost).subscribe({
+				next: (response) => {
+					state.set("setRefreshStampedToken", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+						...prev.authState,
+						token: response.token,
+						lastTokenRefresh: Date.now()
+					} : prev.authState })), subscriber.next(response);
+				},
+				error: (error) => subscriber.error(error)
+			});
+		}, timerSubscription = timer(REFRESH_INTERVAL, REFRESH_INTERVAL).pipe(filter(() => document.visibilityState === "visible"), switchMap(() => {
+			let currentState = state.get().authState;
+			if (currentState.type !== "logged-in") throw Error("User logged out before refresh could complete");
+			return createTokenRefreshStream(currentState.token, clientFactory, apiHost);
+		})).subscribe({
+			next: (response) => {
+				state.set("setRefreshStampedToken", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+					...prev.authState,
+					token: response.token,
+					lastTokenRefresh: Date.now()
+				} : prev.authState })), subscriber.next(response);
+			},
+			error: (error) => subscriber.error(error)
+		});
+		return document.addEventListener("visibilitychange", visibilityHandler), () => {
+			document.removeEventListener("visibilitychange", visibilityHandler), timerSubscription.unsubscribe();
+		};
+	}).pipe(takeWhile(() => state.get().authState.type === "logged-in"), map((response) => ({ token: response.token }))))).subscribe({
+		next: (response) => {
+			logger.debug("Token refresh completed, updating state"), state.set("setRefreshStampedToken", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+				...prev.authState,
+				token: response.token,
+				lastTokenRefresh: Date.now()
+			} : prev.authState })), storageArea?.setItem(storageKey, JSON.stringify({ token: response.token }));
+		},
+		error: (error) => {
+			logger.error("Token refresh failed", { error }), state.set("setRefreshStampedTokenError", { authState: {
+				type: "error",
+				error
+			} });
+		}
+	});
+}, subscribeToStateAndFetchCurrentUser = ({ state, instance }, fetchOptions) => {
+	let logger = getAuthLogger(instance), { clientFactory, apiHost } = state.get().options, useProjectHostname = fetchOptions?.useProjectHostname ?? isStudioConfig(instance.config), projectId = instance.config.projectId;
+	return state.observable.pipe(map(({ authState, options: storeOptions }) => ({
+		authState,
+		authMethod: storeOptions.authMethod
+	})), filter((value) => value.authState.type === "logged-in" && !value.authState.currentUser), map((value) => ({
+		token: value.authState.token,
+		authMethod: value.authMethod
+	})), distinctUntilChanged((prev, curr) => prev.token === curr.token && prev.authMethod === curr.authMethod)).pipe(map(({ token, authMethod }) => clientFactory({
+		apiVersion: DEFAULT_API_VERSION,
+		requestTagPrefix: REQUEST_TAG_PREFIX,
+		token: authMethod === "cookie" ? void 0 : token,
+		ignoreBrowserTokenWarning: !0,
+		useProjectHostname,
+		useCdn: !1,
+		...authMethod === "cookie" ? { withCredentials: !0 } : {},
+		...useProjectHostname && projectId ? { projectId } : {},
+		...apiHost && { apiHost }
+	})), switchMap((client) => client.observable.request({
+		uri: "/users/me",
+		method: "GET",
+		tag: "users.get-current"
+	}).pipe(
+		/**
+		* Catch inside switchMap so the outer subscription survives.
+		* Without this, a 401 terminates the subscription permanently
+		* and subsequent token refreshes via comlink never re-fetch /users/me.
+		* @see SDK-1409
+		*/
+		catchError((error) => (logger.error("Failed to fetch current user", { error }), state.set("setError", { authState: {
+			type: "error",
+			error
+		} }), EMPTY))
+	))).subscribe({ next: (currentUser) => {
+		logger.info("Current user fetched successfully", { hasEmail: !!currentUser.email }), logger.debug("Current user details", { userId: currentUser.id }), state.set("setCurrentUser", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+			...prev.authState,
+			currentUser
+		} : prev.authState }));
+	} });
+};
+/**
+* Creates a properly initialized {@link LoggedInAuthState}.
+*
+* For stamped tokens (containing `"-st"`), `lastTokenRefresh` is set to
+* `Date.now()` so that the visibility-change handler in
+* {@link refreshStampedToken} does not trigger an unnecessary refresh the
+* first time the tab becomes visible.
+*
+* @param token - The auth token.
+* @param currentUser - The current user, or `null` if not yet fetched.
+* @param existingLastTokenRefresh - An existing timestamp to preserve
+*   (e.g. when updating a token while keeping the previous refresh time).
+* @internal
+*/
+function createLoggedInAuthState(token, currentUser, existingLastTokenRefresh) {
+	let isStampedToken = token.includes("-st"), lastTokenRefresh = existingLastTokenRefresh ?? (isStampedToken ? Date.now() : void 0);
+	return {
+		type: "logged-in",
+		token,
+		currentUser,
+		...lastTokenRefresh !== void 0 && { lastTokenRefresh }
+	};
+}
+function getAuthCode(callbackUrl, locationHref) {
+	let loc = new URL(locationHref, DEFAULT_BASE), callbackLocation = callbackUrl ? new URL(callbackUrl, DEFAULT_BASE) : void 0, callbackLocationMatches = !callbackLocation || loc.pathname.toLowerCase().startsWith(callbackLocation.pathname.toLowerCase()), authCode = new URLSearchParams(loc.hash.slice(1)).get("sid") || new URLSearchParams(loc.search).get("sid");
+	if (!authCode) {
+		let contextParam = new URLSearchParams(loc.search).get("_context");
+		if (contextParam) try {
+			let parsedContext = JSON.parse(contextParam);
+			parsedContext && typeof parsedContext == "object" && typeof parsedContext.sid == "string" && parsedContext.sid && (authCode = parsedContext.sid);
+		} catch {}
+	}
+	return authCode && callbackLocationMatches ? authCode : null;
+}
+function getTokenFromLocation(locationHref) {
+	let loc = new URL(locationHref);
+	return new URLSearchParams(loc.hash.slice(1)).get("token") || null;
+}
+/**
+* Attempts to retrieve a token from the configured storage.
+* If invalid or not present, returns null.
+*/
+function getTokenFromStorage(storageArea, storageKey) {
+	if (!storageArea) return null;
+	let item = storageArea.getItem(storageKey);
+	if (item === null) return null;
+	try {
+		let parsed = JSON.parse(item);
+		if (typeof parsed != "object" || !parsed || !("token" in parsed) || typeof parsed.token != "string") throw Error("Invalid stored auth data structure");
+		return parsed.token;
+	} catch {
+		return storageArea.removeItem(storageKey), null;
+	}
+}
+/**
+* Creates an observable stream of storage events. If not in a browser environment,
+* returns an EMPTY observable.
+*/
+function getStorageEvents() {
+	return typeof window < "u" && typeof window.addEventListener == "function" ? fromEvent(window, "storage") : EMPTY;
+}
+/**
+* Returns a default storage instance (localStorage) if available.
+* If not available or an error occurs, returns undefined.
+*/
+function getDefaultStorage() {
+	try {
+		return typeof localStorage < "u" && typeof localStorage.getItem == "function" ? localStorage : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Returns the default location to use.
+* Tries accessing `location.href`, falls back to a default base if not available or on error.
+*/
+function getDefaultLocation() {
+	try {
+		return typeof location > "u" ? DEFAULT_BASE : typeof location.href == "string" ? location.href : DEFAULT_BASE;
+	} catch {
+		return DEFAULT_BASE;
+	}
+}
+/**
+* Cleans up the URL by removing the `token` from the hash and the `sid` and `url` search params.
+* @internal
+*/
+function getCleanedUrl(locationUrl) {
+	let loc = new URL(locationUrl), rawHash = loc.hash.startsWith("#") ? loc.hash.slice(1) : loc.hash;
+	if (rawHash && rawHash.includes("=")) {
+		let hashParams = new URLSearchParams(rawHash);
+		hashParams.delete("token"), hashParams.delete("withSid");
+		let nextHash = hashParams.toString();
+		loc.hash = nextHash ? `#${nextHash}` : "";
+	}
+	return loc.searchParams.delete("sid"), loc.searchParams.delete("url"), loc.toString();
+}
+/** @internal Extracts the structured API error body from a ClientError, if present. */
+function getClientErrorApiBody(error) {
+	let body = error.response?.body;
+	return body && typeof body == "object" ? body : void 0;
+}
+/** @internal Returns the error type string from an API error body, if available. */
+function getClientErrorApiType(error) {
+	let body = getClientErrorApiBody(error);
+	return body?.error?.type ?? body?.type;
+}
+/** @internal Returns the error description string from an API error body, if available. */
+function getClientErrorApiDescription(error) {
+	let body = getClientErrorApiBody(error);
+	return body?.error?.description ?? body?.description;
+}
+/** @internal True if the error represents a projectUserNotFoundError. */
+function isProjectUserNotFoundClientError(error) {
+	return getClientErrorApiType(error) === "projectUserNotFoundError";
+}
+/**
+* Parses the dashboard context from a location href's `_context` URL parameter.
+* Strips the `sid` property from the parsed context (it's handled separately).
+*
+* @internal
+*/
+function parseDashboardContext(locationHref) {
+	try {
+		let contextParam = new URL(locationHref, DEFAULT_BASE).searchParams.get("_context");
+		if (contextParam) {
+			let parsedContext = JSON.parse(contextParam);
+			if (parsedContext && typeof parsedContext == "object" && !Array.isArray(parsedContext) && Object.keys(parsedContext).length > 0) return delete parsedContext.sid, parsedContext;
+		}
+	} catch (err) {
+		console.error("Failed to parse dashboard context from initial location:", err);
+	}
+	return {};
+}
+/**
+* Resolves the initial auth state for Dashboard mode.
+*
+* In dashboard mode the token is provided by the parent frame via Comlink,
+* so the SDK starts in a `LOGGED_OUT` state and waits for the token to arrive.
+* The `_context` URL parameter provides dashboard metadata (orgId, mode, env).
+*
+* A provided token (`auth.token`) or an auth code/callback still takes
+* precedence, even when running inside the dashboard.
+*
+* @internal
+*/
+function getDashboardInitialState(options) {
+	let { authConfig, initialLocationHref } = options, providedToken = authConfig.token, callbackUrl = authConfig.callbackUrl, storageKey = "__sanity_auth_token", dashboardContext = parseDashboardContext(initialLocationHref);
+	return providedToken ? {
+		authState: createLoggedInAuthState(providedToken, null),
+		storageKey,
+		storageArea: void 0,
+		authMethod: void 0,
+		dashboardContext
+	} : getAuthCode(callbackUrl, initialLocationHref) || getTokenFromLocation(initialLocationHref) ? {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !1
+		},
+		storageKey,
+		storageArea: void 0,
+		authMethod: void 0,
+		dashboardContext
+	} : {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		storageKey,
+		storageArea: void 0,
+		authMethod: void 0,
+		dashboardContext
+	};
+}
+/**
+* Initialize Dashboard auth subscriptions:
+* - Subscribe to state changes and fetch current user
+* - Start stamped token refresh
+*
+* Note: storage events are NOT subscribed in dashboard mode since
+* the dashboard does not use localStorage for token persistence.
+*
+* @internal
+*/
+function initializeDashboardAuth(context, tokenRefresherRunning) {
+	let subscriptions = [], startedRefresher = !1;
+	return subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !1 })), tokenRefresherRunning || (startedRefresher = !0, subscriptions.push(refreshStampedToken(context))), {
+		dispose: () => {
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: startedRefresher
+	};
+}
+const subscribeToStorageEventsAndSetToken = ({ state }) => {
+	let { storageArea, storageKey } = state.get().options;
+	return defer(getStorageEvents).pipe(filter((e) => e.storageArea === storageArea && e.key === storageKey), map(() => getTokenFromStorage(storageArea, storageKey)), distinctUntilChanged()).subscribe((token) => {
+		state.set("updateTokenFromStorageEvent", { authState: token ? createLoggedInAuthState(token, null) : {
+			type: "logged-out",
+			isDestroyingSession: !1
+		} });
+	});
+};
+/**
+* Resolves the initial auth state for Standalone mode.
+*
+* Token discovery order:
+* 1. Provided token (`auth.token` in config)
+* 2. Auth code or token from location (OAuth callback)
+* 3. localStorage: `__sanity_auth_token`
+* 4. Falls back to `LOGGED_OUT`
+*
+* @internal
+*/
+function getStandaloneInitialState(options) {
+	let { authConfig, initialLocationHref } = options, providedToken = authConfig.token, callbackUrl = authConfig.callbackUrl, storageKey = "__sanity_auth_token", storageArea = authConfig.storageArea ?? getDefaultStorage();
+	if (providedToken) return {
+		authState: createLoggedInAuthState(providedToken, null),
+		storageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+	if (getAuthCode(callbackUrl, initialLocationHref) || getTokenFromLocation(initialLocationHref)) return {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !1
+		},
+		storageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+	let token = getTokenFromStorage(storageArea, storageKey);
+	return token ? {
+		authState: createLoggedInAuthState(token, null),
+		storageKey,
+		storageArea,
+		authMethod: "localstorage",
+		dashboardContext: {}
+	} : {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		storageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+}
+/**
+* Initialize Standalone auth subscriptions:
+* - Subscribe to state changes and fetch current user
+* - Subscribe to storage events for token key
+* - Start stamped token refresh
+*
+* @internal
+*/
+function initializeStandaloneAuth(context, tokenRefresherRunning) {
+	let subscriptions = [], startedRefresher = !1;
+	return subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !1 })), context.state.get().options?.storageArea && subscriptions.push(subscribeToStorageEventsAndSetToken(context)), tokenRefresherRunning || (startedRefresher = !0, subscriptions.push(refreshStampedToken(context))), {
+		dispose: () => {
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: startedRefresher
+	};
+}
+/**
+* Attempts to check for cookie auth by making a withCredentials request to the users endpoint.
+* @param projectId - The project ID to check for cookie auth.
+* @param clientFactory - A factory function that creates a Sanity client.
+* @returns True if the user is authenticated, false otherwise.
+* @internal
+*/
+async function checkForCookieAuth(projectId, clientFactory) {
+	if (!projectId) return !1;
+	try {
+		let user = await clientFactory({
+			projectId,
+			useCdn: !1,
+			requestTagPrefix: REQUEST_TAG_PREFIX,
+			timeout: 1e4
+		}).request({
+			uri: "/users/me",
+			withCredentials: !0,
+			tag: "users.get-current"
+		});
+		return typeof user == "object" && !!user && typeof user.id == "string";
+	} catch {
+		return !1;
+	}
+}
+/**
+* Attempts to retrieve a studio token from local storage.
+* @param storageArea - The storage area to retrieve the token from.
+* @param storageKey - The storage key to retrieve the token from.
+* @returns The studio token or null if it does not exist.
+* @internal
+*/
+function getStudioTokenFromLocalStorage(storageArea, storageKey) {
+	return !storageArea || !storageKey ? null : getTokenFromStorage(storageArea, storageKey) || null;
+}
+/**
+* Resolves the initial auth state for Studio mode.
+*
+* When a `tokenSource` is provided (via `config.studio.auth.token`), the
+* initial state is `LOGGING_IN` — the actual token arrives asynchronously
+* via the subscription set up in `initializeStudioAuth`.
+*
+* Fallback token discovery order (no tokenSource):
+* 1. Provided token (`auth.token` in config)
+* 2. localStorage: `__studio_auth_token_${projectId}`
+* 3. Falls back to `LOGGED_OUT` (cookie auth is checked async in `initializeStudioAuth`)
+*
+* @internal
+*/
+function getStudioInitialState(options) {
+	let { authConfig, projectId, tokenSource } = options, storageArea = authConfig.storageArea ?? getDefaultStorage(), studioStorageKey = `__studio_auth_token_${projectId ?? ""}`;
+	if (tokenSource) return {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !1
+		},
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+	let providedToken = authConfig.token, authMethod, token = getStudioTokenFromLocalStorage(storageArea, studioStorageKey);
+	return token && (authMethod = "localstorage"), providedToken ? {
+		authState: createLoggedInAuthState(providedToken, null),
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod,
+		dashboardContext: {}
+	} : token ? {
+		authState: createLoggedInAuthState(token, null),
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod: "localstorage",
+		dashboardContext: {}
+	} : {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+}
+/**
+* Initialize Studio auth subscriptions.
+*
+* When a `tokenSource` is available (reactive path), subscribes to it for
+* ongoing token sync. The Studio is the token authority — no independent
+* token refresh or cookie auth probing is needed.
+*
+* Fallback path (no tokenSource):
+* - Subscribe to state changes and fetch current user
+* - Subscribe to storage events for studio token key
+* - Check for cookie auth asynchronously if no token was found
+* - Start stamped token refresh
+*
+* @internal
+*/
+function initializeStudioAuth(context, tokenRefresherRunning) {
+	let tokenSource = context.instance.config.studio?.auth?.token;
+	return tokenSource ? initializeWithTokenSource(context, tokenSource) : initializeWithFallback(context, tokenRefresherRunning);
+}
+/**
+* Subscribe to a reactive token source from the Studio workspace.
+*
+* When the token source emits a non-null token, the SDK uses it directly.
+* When it emits `null`, the behavior depends on the `authenticated` flag
+* from the Studio's workspace config:
+*
+* - `authenticated: true` — the Studio has already verified the user is
+*   logged in (e.g. via cookie auth). The SDK treats the null token as
+*   cookie-based auth and stays in the LOGGED_IN state.
+*
+* - `authenticated` absent/false — the user is genuinely not authenticated;
+*   transition to LOGGED_OUT.
+*
+* No async cookie probing is needed here because this code path only runs
+* when a Studio provides SDKStudioContext, and the Studio's Workspace type
+* always includes `authenticated`. The async `checkForCookieAuth` fallback
+* remains in `initializeWithFallback` for the non-Studio path.
+*/
+function initializeWithTokenSource(context, tokenSource) {
+	let subscriptions = [], studioAuthenticated = context.instance.config.studio?.authenticated === !0;
+	subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !0 }));
+	let tokenSub = tokenSource.subscribe({ next: (token) => {
+		let { state } = context;
+		token ? state.set("studioTokenSource", (prev) => ({
+			options: {
+				...prev.options,
+				authMethod: void 0
+			},
+			authState: createLoggedInAuthState(token, null)
+		})) : studioAuthenticated ? state.set("studioTokenSourceCookieAuth", (prev) => ({
+			options: {
+				...prev.options,
+				authMethod: "cookie"
+			},
+			authState: prev.authState.type === "logged-in" ? prev.authState : createLoggedInAuthState("", null)
+		})) : state.set("studioTokenSourceLoggedOut", (prev) => ({
+			options: {
+				...prev.options,
+				authMethod: void 0
+			},
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			}
+		}));
+	} });
+	return {
+		dispose: () => {
+			tokenSub.unsubscribe();
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: !1
+	};
+}
+/**
+* Fallback initialization when no reactive token source is available.
+* Uses localStorage/cookie discovery (existing behavior).
+*/
+function initializeWithFallback(context, tokenRefresherRunning) {
+	let subscriptions = [], startedRefresher = !1;
+	subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !0 })), context.state.get().options?.storageArea && subscriptions.push(subscribeToStorageEventsAndSetToken(context));
+	try {
+		let { instance, state } = context;
+		if (!(state.get().authState?.type === "logged-in" && state.get().authState.token)) {
+			let projectIdValue = instance.config.projectId, clientFactory = state.get().options.clientFactory;
+			checkForCookieAuth(projectIdValue, clientFactory).then((isCookieAuthEnabled) => {
+				isCookieAuthEnabled && state.set("enableCookieAuth", (prev) => ({
+					options: {
+						...prev.options,
+						authMethod: "cookie"
+					},
+					authState: prev.authState.type === "logged-in" ? prev.authState : createLoggedInAuthState("", null)
+				}));
+			});
+		}
+	} catch {}
+	return tokenRefresherRunning || (startedRefresher = !0, subscriptions.push(refreshStampedToken(context))), {
+		dispose: () => {
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: startedRefresher
+	};
+}
+var authStore_exports = /* @__PURE__ */ __exportAll({
+	authStore: () => authStore,
+	getAuthMethodState: () => getAuthMethodState,
+	getAuthState: () => getAuthState,
+	getCurrentUserState: () => getCurrentUserState,
+	getDashboardOrganizationId: () => getDashboardOrganizationId,
+	getIsInDashboardState: () => getIsInDashboardState,
+	getLoginUrlState: () => getLoginUrlState,
+	getTokenState: () => getTokenState,
+	setAuthToken: () => setAuthToken
+});
+let tokenRefresherRunning = !1;
+const authStore = defineStore({
+	name: "Auth",
+	getInitialState(instance) {
+		let logger = getAuthLogger(instance);
+		logger.debug("Initializing auth store", {
+			hasProvidedToken: !!instance.config.auth?.token,
+			hasCustomProviders: !!(instance.config.auth?.providers && instance.config.auth.providers.length > 0),
+			studioMode: instance.config.studioMode?.enabled ?? !1
+		});
+		let { apiHost: configApiHost, callbackUrl, providers: customProviders, token: providedToken, clientFactory = createClient, initialLocationHref = getDefaultLocation() } = instance.config.auth ?? {}, apiHost = configApiHost ?? getStagingApiHost(), authConfig = instance.config.auth ?? {}, loginDomain = "https://www.sanity.io";
+		try {
+			apiHost && new URL(apiHost).hostname.endsWith(".sanity.work") && (loginDomain = "https://www.sanity.work");
+		} catch {}
+		let loginUrl = new URL("/login", loginDomain);
+		loginUrl.searchParams.set("origin", getCleanedUrl(initialLocationHref)), loginUrl.searchParams.set("type", "stampedToken"), loginUrl.searchParams.set("withSid", "true");
+		let mode = resolveAuthMode(instance.config, initialLocationHref), strategyOptions = {
+			authConfig,
+			projectId: instance.config.projectId,
+			initialLocationHref,
+			clientFactory,
+			tokenSource: instance.config.studio?.auth?.token
+		}, result;
+		switch (mode) {
+			case "studio":
+				result = getStudioInitialState(strategyOptions);
+				break;
+			case "dashboard":
+				result = getDashboardInitialState(strategyOptions);
+				break;
+			case "standalone": result = getStandaloneInitialState(strategyOptions);
+		}
+		return logger.debug("Auth state initialized", {
+			authStateType: result.authState.type,
+			mode,
+			authMethod: result.authMethod
+		}), {
+			authState: result.authState,
+			dashboardContext: result.dashboardContext,
+			options: {
+				apiHost,
+				loginUrl: loginUrl.toString(),
+				callbackUrl,
+				customProviders,
+				providedToken,
+				clientFactory,
+				initialLocationHref,
+				storageKey: result.storageKey,
+				storageArea: result.storageArea,
+				authMethod: result.authMethod
+			}
+		};
+	},
+	initialize(context) {
+		let logger = getAuthLogger(context.instance), initialLocationHref = context.state.get().options?.initialLocationHref ?? getDefaultLocation(), mode = resolveAuthMode(context.instance.config, initialLocationHref);
+		logger.debug("Setting up auth subscriptions", { mode });
+		let initResult;
+		switch (mode) {
+			case "studio":
+				initResult = initializeStudioAuth(context, tokenRefresherRunning);
+				break;
+			case "dashboard":
+				initResult = initializeDashboardAuth(context, tokenRefresherRunning);
+				break;
+			case "standalone": initResult = initializeStandaloneAuth(context, tokenRefresherRunning);
+		}
+		return initResult.tokenRefresherStarted && (tokenRefresherRunning = !0), () => {
+			logger.debug("Cleaning up auth subscriptions"), initResult.dispose();
+		};
+	}
+}), getCurrentUserState = bindActionGlobally(authStore, createStateSourceAction(({ state: { authState } }) => authState.type === "logged-in" ? authState.currentUser : null)), getTokenState = bindActionGlobally(authStore, createStateSourceAction(({ state: { authState } }) => authState.type === "logged-in" ? authState.token : null)), getAuthMethodState = bindActionGlobally(authStore, createStateSourceAction(({ state: { options } }) => options.authMethod)), getLoginUrlState = bindActionGlobally(authStore, createStateSourceAction(({ state: { options } }) => options.loginUrl)), getAuthState = bindActionGlobally(authStore, createStateSourceAction(({ state: { authState } }) => authState)), getDashboardOrganizationId = bindActionGlobally(authStore, createStateSourceAction(({ state: { dashboardContext } }) => dashboardContext?.orgId)), getIsInDashboardState = bindActionGlobally(authStore, createStateSourceAction(({ state: { dashboardContext } }) => !!dashboardContext && Object.keys(dashboardContext).length > 0)), setAuthToken = bindActionGlobally(authStore, ({ state, instance }, token) => {
+	let logger = getAuthLogger(instance), currentAuthState = state.get().authState;
+	if (token) {
+		if (currentAuthState.type !== "logged-in" || currentAuthState.token !== token) {
+			logger.info("Setting auth token");
+			let currentUser = currentAuthState.type === "logged-in" ? currentAuthState.currentUser : null, preservedLastTokenRefresh = currentAuthState.type === "logged-in" ? currentAuthState.lastTokenRefresh : void 0;
+			state.set("setToken", { authState: createLoggedInAuthState(token, currentUser, preservedLastTokenRefresh) });
+		}
+	} else currentAuthState.type !== "logged-out" && (logger.info("Clearing auth token"), state.set("setToken", { authState: {
+		type: "logged-out",
+		isDestroyingSession: !1
+	} }));
+});
+export { defineStore as A, REQUEST_TAG_PREFIX as C, bindActionByResource as D, createStateSourceAction as E, isDatasetSource as F, isMediaLibraryResource as I, isMediaLibrarySource as L, isCanvasResource as M, isCanvasSource as N, bindActionByResourceAndPerspective as O, isDatasetResource as P, DEFAULT_API_VERSION as S, getStagingApiHost as T, getDefaultLocation as _, getCurrentUserState as a, AuthStateType as b, getLoginUrlState as c, createLoggedInAuthState as d, getAuthCode as f, getClientErrorApiType as g, getClientErrorApiDescription as h, getAuthState as i, isReleasePerspective as j, bindActionGlobally as k, getTokenState as l, getClientErrorApiBody as m, authStore_exports as n, getDashboardOrganizationId as o, getCleanedUrl as p, getAuthMethodState as r, getIsInDashboardState as s, authStore as t, setAuthToken as u, getTokenFromLocation as v, getAuthLogger as w, isStudioConfig as x, isProjectUserNotFoundClientError as y };
+
+//# sourceMappingURL=authStore-CWTAuieY.js.map