@sanity/sdk 3.0.0-rc.1 → 3.0.0

package/dist/authStore-CtE9bLHW.js

@@ -0,0 +1,754 @@
+import { t as __exportAll } from "./rolldown-runtime-vyAXikos.js";
+import { a as defineStore, i as bindActionGlobally, t as createStateSourceAction } from "./createStateSourceAction-BOKtqFNm.js";
+import { n as createLogger } from "./logger-DAtJb5RQ.js";
+import { createClient } from "@sanity/client";
+import { EMPTY, Observable, catchError, defer, distinctUntilChanged, exhaustMap, filter, fromEvent, map, switchMap, takeWhile, timer } from "rxjs";
+import "@sanity/types";
+/**
+* Returns the staging API host if the `__SANITY_STAGING__` build-time flag is
+* set to `true` (mirroring how Sanity Studio detects staging builds).
+*
+* @internal
+*/
+function getStagingApiHost() {
+	if (typeof __SANITY_STAGING__ < "u" && __SANITY_STAGING__ === !0) return "https://api.sanity.work";
+}
+const loggers = /* @__PURE__ */ new WeakMap();
+/**
+* Returns the auth logger for a Sanity instance, creating it on first use.
+*
+* The logger is cached per instance so repeated action calls (logout,
+* setAuthToken, handleAuthCallback) reuse the same logger instead of
+* rebuilding it. The instance details are nested under `instanceContext`,
+* which is what the logger's formatter reads to render the
+* `[project:x] [dataset:y] [instance:z]` prefix.
+*
+* @internal
+*/
+function getAuthLogger(instance) {
+	let logger = loggers.get(instance);
+	return logger || (logger = createLogger("auth", { instanceContext: {
+		instanceId: instance.instanceId,
+		projectId: instance.config.projectId,
+		dataset: instance.config.dataset
+	} }), loggers.set(instance, logger)), logger;
+}
+const DEFAULT_BASE = "http://localhost", DEFAULT_API_VERSION = "2021-06-07", REQUEST_TAG_PREFIX = "sanity.sdk.auth";
+/**
+* Determines the auth mode from instance config and environment.
+*
+* Priority:
+* 1. `studio` config provided → `'studio'`
+* 2. Dashboard context detected (`_context` URL param with content) → `'dashboard'`
+* 3. Otherwise → `'standalone'`
+*
+* @internal
+*/
+function resolveAuthMode(config, locationHref) {
+	return isStudioConfig(config) ? "studio" : detectDashboardContext(locationHref) ? "dashboard" : "standalone";
+}
+/**
+* Returns `true` when the config indicates the SDK is running inside a Studio.
+*
+* @internal
+*/
+function isStudioConfig(config) {
+	return !!config.studio;
+}
+/**
+* Checks whether the given location href contains a `_context` URL parameter
+* with a non-empty JSON object, indicating the SDK is running inside the
+* Sanity Dashboard.
+*
+* @internal
+*/
+function detectDashboardContext(locationHref) {
+	try {
+		let contextParam = new URL(locationHref, DEFAULT_BASE).searchParams.get("_context");
+		if (!contextParam) return !1;
+		let parsed = JSON.parse(contextParam);
+		return typeof parsed == "object" && !!parsed && !Array.isArray(parsed) && Object.keys(parsed).length > 0;
+	} catch (err) {
+		return console.error("Failed to parse dashboard context from initial location:", err), !1;
+	}
+}
+/**
+* Represents the various states the authentication type can be in.
+*
+* @public
+*/
+let AuthStateType = /* @__PURE__ */ function(AuthStateType) {
+	return AuthStateType.LOGGED_IN = "logged-in", AuthStateType.LOGGING_IN = "logging-in", AuthStateType.ERROR = "error", AuthStateType.LOGGED_OUT = "logged-out", AuthStateType;
+}({});
+const REFRESH_INTERVAL = 432e5;
+function createTokenRefreshStream(token, clientFactory, apiHost) {
+	return new Observable((subscriber) => {
+		let subscription = clientFactory({
+			apiVersion: DEFAULT_API_VERSION,
+			requestTagPrefix: REQUEST_TAG_PREFIX,
+			useProjectHostname: !1,
+			useCdn: !1,
+			token,
+			ignoreBrowserTokenWarning: !0,
+			...apiHost && { apiHost }
+		}).observable.request({
+			uri: "auth/refresh-token",
+			method: "POST",
+			tag: "refresh-token",
+			body: { token }
+		}).subscribe(subscriber);
+		return () => subscription.unsubscribe();
+	});
+}
+function shouldRefreshToken(lastRefresh) {
+	return !lastRefresh || Date.now() - lastRefresh >= REFRESH_INTERVAL;
+}
+/**
+* Periodically refreshes stamped auth tokens (those containing `-st`).
+*
+* Two triggers cause a refresh while the user stays logged in:
+* - a 12-hour interval timer (only fires while the tab is visible)
+* - the tab becoming visible again after `lastTokenRefresh` has gone stale
+*
+* Non-stamped tokens (e.g. personal access tokens) are never refreshed.
+*
+* @internal
+*/
+const refreshStampedToken = ({ state, instance }) => {
+	let logger = getAuthLogger(instance), { clientFactory, apiHost, storageArea, storageKey } = state.get().options;
+	return state.observable.pipe(map((storeState) => storeState.authState), filter((authState) => authState.type === "logged-in"), distinctUntilChanged((prev, curr) => prev.token === curr.token), filter((authState) => authState.token.includes("-st")), exhaustMap(() => new Observable((subscriber) => {
+		let visibilityHandler = () => {
+			let currentState = state.get();
+			document.visibilityState === "visible" && currentState.authState.type === "logged-in" && shouldRefreshToken(currentState.authState.lastTokenRefresh) && createTokenRefreshStream(currentState.authState.token, clientFactory, apiHost).subscribe({
+				next: (response) => {
+					state.set("setRefreshStampedToken", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+						...prev.authState,
+						token: response.token,
+						lastTokenRefresh: Date.now()
+					} : prev.authState })), subscriber.next(response);
+				},
+				error: (error) => subscriber.error(error)
+			});
+		}, timerSubscription = timer(REFRESH_INTERVAL, REFRESH_INTERVAL).pipe(filter(() => document.visibilityState === "visible"), switchMap(() => {
+			let currentState = state.get().authState;
+			if (currentState.type !== "logged-in") throw Error("User logged out before refresh could complete");
+			return createTokenRefreshStream(currentState.token, clientFactory, apiHost);
+		})).subscribe({
+			next: (response) => {
+				state.set("setRefreshStampedToken", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+					...prev.authState,
+					token: response.token,
+					lastTokenRefresh: Date.now()
+				} : prev.authState })), subscriber.next(response);
+			},
+			error: (error) => subscriber.error(error)
+		});
+		return document.addEventListener("visibilitychange", visibilityHandler), () => {
+			document.removeEventListener("visibilitychange", visibilityHandler), timerSubscription.unsubscribe();
+		};
+	}).pipe(takeWhile(() => state.get().authState.type === "logged-in"), map((response) => ({ token: response.token }))))).subscribe({
+		next: (response) => {
+			logger.debug("Token refresh completed, updating state"), state.set("setRefreshStampedToken", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+				...prev.authState,
+				token: response.token,
+				lastTokenRefresh: Date.now()
+			} : prev.authState })), storageArea?.setItem(storageKey, JSON.stringify({ token: response.token }));
+		},
+		error: (error) => {
+			logger.error("Token refresh failed", { error }), state.set("setRefreshStampedTokenError", { authState: {
+				type: "error",
+				error
+			} });
+		}
+	});
+}, subscribeToStateAndFetchCurrentUser = ({ state, instance }, fetchOptions) => {
+	let logger = getAuthLogger(instance), { clientFactory, apiHost } = state.get().options, useProjectHostname = fetchOptions?.useProjectHostname ?? isStudioConfig(instance.config), projectId = instance.config.projectId;
+	return state.observable.pipe(map(({ authState, options: storeOptions }) => ({
+		authState,
+		authMethod: storeOptions.authMethod
+	})), filter((value) => value.authState.type === "logged-in" && !value.authState.currentUser), map((value) => ({
+		token: value.authState.token,
+		authMethod: value.authMethod
+	})), distinctUntilChanged((prev, curr) => prev.token === curr.token && prev.authMethod === curr.authMethod)).pipe(map(({ token, authMethod }) => clientFactory({
+		apiVersion: DEFAULT_API_VERSION,
+		requestTagPrefix: REQUEST_TAG_PREFIX,
+		token: authMethod === "cookie" ? void 0 : token,
+		ignoreBrowserTokenWarning: !0,
+		useProjectHostname,
+		useCdn: !1,
+		...authMethod === "cookie" ? { withCredentials: !0 } : {},
+		...useProjectHostname && projectId ? { projectId } : {},
+		...apiHost && { apiHost }
+	})), switchMap((client) => client.observable.request({
+		uri: "/users/me",
+		method: "GET",
+		tag: "users.get-current"
+	}).pipe(
+		/**
+		* Catch inside switchMap so the outer subscription survives.
+		* Without this, a 401 terminates the subscription permanently
+		* and subsequent token refreshes via comlink never re-fetch /users/me.
+		* @see SDK-1409
+		*/
+		catchError((error) => (logger.error("Failed to fetch current user", { error }), state.set("setError", { authState: {
+			type: "error",
+			error
+		} }), EMPTY))
+	))).subscribe({ next: (currentUser) => {
+		logger.info("Current user fetched successfully", { hasEmail: !!currentUser.email }), logger.debug("Current user details", { userId: currentUser.id }), state.set("setCurrentUser", (prev) => ({ authState: prev.authState.type === "logged-in" ? {
+			...prev.authState,
+			currentUser
+		} : prev.authState }));
+	} });
+};
+/**
+* Creates a properly initialized {@link LoggedInAuthState}.
+*
+* For stamped tokens (containing `"-st"`), `lastTokenRefresh` is set to
+* `Date.now()` so that the visibility-change handler in
+* {@link refreshStampedToken} does not trigger an unnecessary refresh the
+* first time the tab becomes visible.
+*
+* @param token - The auth token.
+* @param currentUser - The current user, or `null` if not yet fetched.
+* @param existingLastTokenRefresh - An existing timestamp to preserve
+*   (e.g. when updating a token while keeping the previous refresh time).
+* @internal
+*/
+function createLoggedInAuthState(token, currentUser, existingLastTokenRefresh) {
+	let isStampedToken = token.includes("-st"), lastTokenRefresh = existingLastTokenRefresh ?? (isStampedToken ? Date.now() : void 0);
+	return {
+		type: "logged-in",
+		token,
+		currentUser,
+		...lastTokenRefresh !== void 0 && { lastTokenRefresh }
+	};
+}
+function getAuthCode(callbackUrl, locationHref) {
+	let loc = new URL(locationHref, DEFAULT_BASE), callbackLocation = callbackUrl ? new URL(callbackUrl, DEFAULT_BASE) : void 0, callbackLocationMatches = !callbackLocation || loc.pathname.toLowerCase().startsWith(callbackLocation.pathname.toLowerCase()), authCode = new URLSearchParams(loc.hash.slice(1)).get("sid") || new URLSearchParams(loc.search).get("sid");
+	if (!authCode) {
+		let contextParam = new URLSearchParams(loc.search).get("_context");
+		if (contextParam) try {
+			let parsedContext = JSON.parse(contextParam);
+			parsedContext && typeof parsedContext == "object" && typeof parsedContext.sid == "string" && parsedContext.sid && (authCode = parsedContext.sid);
+		} catch {}
+	}
+	return authCode && callbackLocationMatches ? authCode : null;
+}
+function getTokenFromLocation(locationHref) {
+	let loc = new URL(locationHref);
+	return new URLSearchParams(loc.hash.slice(1)).get("token") || null;
+}
+/**
+* Attempts to retrieve a token from the configured storage.
+* If invalid or not present, returns null.
+*/
+function getTokenFromStorage(storageArea, storageKey) {
+	if (!storageArea) return null;
+	let item = storageArea.getItem(storageKey);
+	if (item === null) return null;
+	try {
+		let parsed = JSON.parse(item);
+		if (typeof parsed != "object" || !parsed || !("token" in parsed) || typeof parsed.token != "string") throw Error("Invalid stored auth data structure");
+		return parsed.token;
+	} catch {
+		return storageArea.removeItem(storageKey), null;
+	}
+}
+/**
+* Creates an observable stream of storage events. If not in a browser environment,
+* returns an EMPTY observable.
+*/
+function getStorageEvents() {
+	return typeof window < "u" && typeof window.addEventListener == "function" ? fromEvent(window, "storage") : EMPTY;
+}
+/**
+* Returns a default storage instance (localStorage) if available.
+* If not available or an error occurs, returns undefined.
+*/
+function getDefaultStorage() {
+	try {
+		return typeof localStorage < "u" && typeof localStorage.getItem == "function" ? localStorage : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Returns the default location to use.
+* Tries accessing `location.href`, falls back to a default base if not available or on error.
+*/
+function getDefaultLocation() {
+	try {
+		return typeof location > "u" ? DEFAULT_BASE : typeof location.href == "string" ? location.href : DEFAULT_BASE;
+	} catch {
+		return DEFAULT_BASE;
+	}
+}
+/**
+* Cleans up the URL by removing the `token` from the hash and the `sid` and `url` search params.
+* @internal
+*/
+function getCleanedUrl(locationUrl) {
+	let loc = new URL(locationUrl), rawHash = loc.hash.startsWith("#") ? loc.hash.slice(1) : loc.hash;
+	if (rawHash && rawHash.includes("=")) {
+		let hashParams = new URLSearchParams(rawHash);
+		hashParams.delete("token"), hashParams.delete("withSid");
+		let nextHash = hashParams.toString();
+		loc.hash = nextHash ? `#${nextHash}` : "";
+	}
+	return loc.searchParams.delete("sid"), loc.searchParams.delete("url"), loc.toString();
+}
+/** @internal Extracts the structured API error body from a ClientError, if present. */
+function getClientErrorApiBody(error) {
+	let body = error.response?.body;
+	return body && typeof body == "object" ? body : void 0;
+}
+/** @internal Returns the error type string from an API error body, if available. */
+function getClientErrorApiType(error) {
+	let body = getClientErrorApiBody(error);
+	return body?.error?.type ?? body?.type;
+}
+/** @internal Returns the error description string from an API error body, if available. */
+function getClientErrorApiDescription(error) {
+	let body = getClientErrorApiBody(error);
+	return body?.error?.description ?? body?.description;
+}
+/** @internal True if the error represents a projectUserNotFoundError. */
+function isProjectUserNotFoundClientError(error) {
+	return getClientErrorApiType(error) === "projectUserNotFoundError";
+}
+/**
+* Parses the dashboard context from a location href's `_context` URL parameter.
+* Strips the `sid` property from the parsed context (it's handled separately).
+*
+* @internal
+*/
+function parseDashboardContext(locationHref) {
+	try {
+		let contextParam = new URL(locationHref, DEFAULT_BASE).searchParams.get("_context");
+		if (contextParam) {
+			let parsedContext = JSON.parse(contextParam);
+			if (parsedContext && typeof parsedContext == "object" && !Array.isArray(parsedContext) && Object.keys(parsedContext).length > 0) return delete parsedContext.sid, parsedContext;
+		}
+	} catch (err) {
+		console.error("Failed to parse dashboard context from initial location:", err);
+	}
+	return {};
+}
+/**
+* Resolves the initial auth state for Dashboard mode.
+*
+* In dashboard mode the token is provided by the parent frame via Comlink,
+* so the SDK starts in a `LOGGED_OUT` state and waits for the token to arrive.
+* The `_context` URL parameter provides dashboard metadata (orgId, mode, env).
+*
+* A provided token (`auth.token`) or an auth code/callback still takes
+* precedence, even when running inside the dashboard.
+*
+* @internal
+*/
+function getDashboardInitialState(options) {
+	let { authConfig, initialLocationHref } = options, providedToken = authConfig.token, callbackUrl = authConfig.callbackUrl, storageKey = "__sanity_auth_token", dashboardContext = parseDashboardContext(initialLocationHref);
+	return providedToken ? {
+		authState: createLoggedInAuthState(providedToken, null),
+		storageKey,
+		storageArea: void 0,
+		authMethod: void 0,
+		dashboardContext
+	} : getAuthCode(callbackUrl, initialLocationHref) || getTokenFromLocation(initialLocationHref) ? {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !1
+		},
+		storageKey,
+		storageArea: void 0,
+		authMethod: void 0,
+		dashboardContext
+	} : {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		storageKey,
+		storageArea: void 0,
+		authMethod: void 0,
+		dashboardContext
+	};
+}
+/**
+* Initialize Dashboard auth subscriptions:
+* - Subscribe to state changes and fetch current user
+* - Start stamped token refresh
+*
+* Note: storage events are NOT subscribed in dashboard mode since
+* the dashboard does not use localStorage for token persistence.
+*
+* @internal
+*/
+function initializeDashboardAuth(context, tokenRefresherRunning) {
+	let subscriptions = [], startedRefresher = !1;
+	return subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !1 })), tokenRefresherRunning || (startedRefresher = !0, subscriptions.push(refreshStampedToken(context))), {
+		dispose: () => {
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: startedRefresher
+	};
+}
+const subscribeToStorageEventsAndSetToken = ({ state }) => {
+	let { storageArea, storageKey } = state.get().options;
+	return defer(getStorageEvents).pipe(filter((e) => e.storageArea === storageArea && e.key === storageKey), map(() => getTokenFromStorage(storageArea, storageKey)), distinctUntilChanged()).subscribe((token) => {
+		state.set("updateTokenFromStorageEvent", { authState: token ? createLoggedInAuthState(token, null) : {
+			type: "logged-out",
+			isDestroyingSession: !1
+		} });
+	});
+};
+/**
+* Resolves the initial auth state for Standalone mode.
+*
+* Token discovery order:
+* 1. Provided token (`auth.token` in config)
+* 2. Auth code or token from location (OAuth callback)
+* 3. localStorage: `__sanity_auth_token`
+* 4. Falls back to `LOGGED_OUT`
+*
+* @internal
+*/
+function getStandaloneInitialState(options) {
+	let { authConfig, initialLocationHref } = options, providedToken = authConfig.token, callbackUrl = authConfig.callbackUrl, storageKey = "__sanity_auth_token", storageArea = authConfig.storageArea ?? getDefaultStorage();
+	if (providedToken) return {
+		authState: createLoggedInAuthState(providedToken, null),
+		storageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+	if (getAuthCode(callbackUrl, initialLocationHref) || getTokenFromLocation(initialLocationHref)) return {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !1
+		},
+		storageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+	let token = getTokenFromStorage(storageArea, storageKey);
+	return token ? {
+		authState: createLoggedInAuthState(token, null),
+		storageKey,
+		storageArea,
+		authMethod: "localstorage",
+		dashboardContext: {}
+	} : {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		storageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+}
+/**
+* Initialize Standalone auth subscriptions:
+* - Subscribe to state changes and fetch current user
+* - Subscribe to storage events for token key
+* - Start stamped token refresh
+*
+* @internal
+*/
+function initializeStandaloneAuth(context, tokenRefresherRunning) {
+	let subscriptions = [], startedRefresher = !1;
+	return subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !1 })), context.state.get().options?.storageArea && subscriptions.push(subscribeToStorageEventsAndSetToken(context)), tokenRefresherRunning || (startedRefresher = !0, subscriptions.push(refreshStampedToken(context))), {
+		dispose: () => {
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: startedRefresher
+	};
+}
+/**
+* Attempts to check for cookie auth by making a withCredentials request to the users endpoint.
+* @param projectId - The project ID to check for cookie auth.
+* @param clientFactory - A factory function that creates a Sanity client.
+* @returns True if the user is authenticated, false otherwise.
+* @internal
+*/
+async function checkForCookieAuth(projectId, clientFactory) {
+	if (!projectId) return !1;
+	try {
+		let user = await clientFactory({
+			projectId,
+			useCdn: !1,
+			requestTagPrefix: REQUEST_TAG_PREFIX,
+			timeout: 1e4
+		}).request({
+			uri: "/users/me",
+			withCredentials: !0,
+			tag: "users.get-current"
+		});
+		return typeof user == "object" && !!user && typeof user.id == "string";
+	} catch {
+		return !1;
+	}
+}
+/**
+* Attempts to retrieve a studio token from local storage.
+* @param storageArea - The storage area to retrieve the token from.
+* @param storageKey - The storage key to retrieve the token from.
+* @returns The studio token or null if it does not exist.
+* @internal
+*/
+function getStudioTokenFromLocalStorage(storageArea, storageKey) {
+	return !storageArea || !storageKey ? null : getTokenFromStorage(storageArea, storageKey) || null;
+}
+/**
+* Resolves the initial auth state for Studio mode.
+*
+* When a `tokenSource` is provided (via `config.studio.auth.token`), the
+* initial state is `LOGGING_IN` — the actual token arrives asynchronously
+* via the subscription set up in `initializeStudioAuth`.
+*
+* Fallback token discovery order (no tokenSource):
+* 1. Provided token (`auth.token` in config)
+* 2. localStorage: `__studio_auth_token_${projectId}`
+* 3. Falls back to `LOGGED_OUT` (cookie auth is checked async in `initializeStudioAuth`)
+*
+* @internal
+*/
+function getStudioInitialState(options) {
+	let { authConfig, projectId, tokenSource } = options, storageArea = authConfig.storageArea ?? getDefaultStorage(), studioStorageKey = `__studio_auth_token_${projectId ?? ""}`;
+	if (tokenSource) return {
+		authState: {
+			type: "logging-in",
+			isExchangingToken: !1
+		},
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+	let providedToken = authConfig.token, authMethod, token = getStudioTokenFromLocalStorage(storageArea, studioStorageKey);
+	return token && (authMethod = "localstorage"), providedToken ? {
+		authState: createLoggedInAuthState(providedToken, null),
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod,
+		dashboardContext: {}
+	} : token ? {
+		authState: createLoggedInAuthState(token, null),
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod: "localstorage",
+		dashboardContext: {}
+	} : {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		storageKey: studioStorageKey,
+		storageArea,
+		authMethod: void 0,
+		dashboardContext: {}
+	};
+}
+/**
+* Initialize Studio auth subscriptions.
+*
+* When a `tokenSource` is available (reactive path), subscribes to it for
+* ongoing token sync. The Studio is the token authority — no independent
+* token refresh or cookie auth probing is needed.
+*
+* Fallback path (no tokenSource):
+* - Subscribe to state changes and fetch current user
+* - Subscribe to storage events for studio token key
+* - Check for cookie auth asynchronously if no token was found
+* - Start stamped token refresh
+*
+* @internal
+*/
+function initializeStudioAuth(context, tokenRefresherRunning) {
+	let tokenSource = context.instance.config.studio?.auth?.token;
+	return tokenSource ? initializeWithTokenSource(context, tokenSource) : initializeWithFallback(context, tokenRefresherRunning);
+}
+/**
+* Subscribe to a reactive token source from the Studio workspace.
+*
+* When the token source emits a non-null token, the SDK uses it directly.
+* When it emits `null`, the behavior depends on the `authenticated` flag
+* from the Studio's workspace config:
+*
+* - `authenticated: true` — the Studio has already verified the user is
+*   logged in (e.g. via cookie auth). The SDK treats the null token as
+*   cookie-based auth and stays in the LOGGED_IN state.
+*
+* - `authenticated` absent/false — the user is genuinely not authenticated;
+*   transition to LOGGED_OUT.
+*
+* No async cookie probing is needed here because this code path only runs
+* when a Studio provides SDKStudioContext, and the Studio's Workspace type
+* always includes `authenticated`. The async `checkForCookieAuth` fallback
+* remains in `initializeWithFallback` for the non-Studio path.
+*/
+function initializeWithTokenSource(context, tokenSource) {
+	let subscriptions = [], studioAuthenticated = context.instance.config.studio?.authenticated === !0;
+	subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !0 }));
+	let tokenSub = tokenSource.subscribe({ next: (token) => {
+		let { state } = context;
+		token ? state.set("studioTokenSource", (prev) => ({
+			options: {
+				...prev.options,
+				authMethod: void 0
+			},
+			authState: createLoggedInAuthState(token, null)
+		})) : studioAuthenticated ? state.set("studioTokenSourceCookieAuth", (prev) => ({
+			options: {
+				...prev.options,
+				authMethod: "cookie"
+			},
+			authState: prev.authState.type === "logged-in" ? prev.authState : createLoggedInAuthState("", null)
+		})) : state.set("studioTokenSourceLoggedOut", (prev) => ({
+			options: {
+				...prev.options,
+				authMethod: void 0
+			},
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			}
+		}));
+	} });
+	return {
+		dispose: () => {
+			tokenSub.unsubscribe();
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: !1
+	};
+}
+/**
+* Fallback initialization when no reactive token source is available.
+* Uses localStorage/cookie discovery (existing behavior).
+*/
+function initializeWithFallback(context, tokenRefresherRunning) {
+	let subscriptions = [], startedRefresher = !1;
+	subscriptions.push(subscribeToStateAndFetchCurrentUser(context, { useProjectHostname: !0 })), context.state.get().options?.storageArea && subscriptions.push(subscribeToStorageEventsAndSetToken(context));
+	try {
+		let { instance, state } = context;
+		if (!(state.get().authState?.type === "logged-in" && state.get().authState.token)) {
+			let projectIdValue = instance.config.projectId, clientFactory = state.get().options.clientFactory;
+			checkForCookieAuth(projectIdValue, clientFactory).then((isCookieAuthEnabled) => {
+				isCookieAuthEnabled && state.set("enableCookieAuth", (prev) => ({
+					options: {
+						...prev.options,
+						authMethod: "cookie"
+					},
+					authState: prev.authState.type === "logged-in" ? prev.authState : createLoggedInAuthState("", null)
+				}));
+			});
+		}
+	} catch {}
+	return tokenRefresherRunning || (startedRefresher = !0, subscriptions.push(refreshStampedToken(context))), {
+		dispose: () => {
+			for (let subscription of subscriptions) subscription.unsubscribe();
+		},
+		tokenRefresherStarted: startedRefresher
+	};
+}
+var authStore_exports = /* @__PURE__ */ __exportAll({
+	authStore: () => authStore,
+	getAuthMethodState: () => getAuthMethodState,
+	getAuthState: () => getAuthState,
+	getCurrentUserState: () => getCurrentUserState,
+	getDashboardOrganizationId: () => getDashboardOrganizationId,
+	getIsInDashboardState: () => getIsInDashboardState,
+	getLoginUrlState: () => getLoginUrlState,
+	getTokenState: () => getTokenState,
+	setAuthToken: () => setAuthToken
+});
+let tokenRefresherRunning = !1;
+const authStore = defineStore({
+	name: "Auth",
+	getInitialState(instance) {
+		let logger = getAuthLogger(instance);
+		logger.debug("Initializing auth store", {
+			hasProvidedToken: !!instance.config.auth?.token,
+			hasCustomProviders: !!(instance.config.auth?.providers && instance.config.auth.providers.length > 0)
+		});
+		let { apiHost: configApiHost, callbackUrl, providers: customProviders, token: providedToken, clientFactory = createClient, initialLocationHref = getDefaultLocation() } = instance.config.auth ?? {}, apiHost = configApiHost ?? getStagingApiHost(), authConfig = instance.config.auth ?? {}, loginDomain = "https://www.sanity.io";
+		try {
+			apiHost && new URL(apiHost).hostname.endsWith(".sanity.work") && (loginDomain = "https://www.sanity.work");
+		} catch {}
+		let loginUrl = new URL("/login", loginDomain);
+		loginUrl.searchParams.set("origin", getCleanedUrl(initialLocationHref)), loginUrl.searchParams.set("type", "stampedToken"), loginUrl.searchParams.set("withSid", "true");
+		let mode = resolveAuthMode(instance.config, initialLocationHref), strategyOptions = {
+			authConfig,
+			projectId: instance.config.projectId,
+			initialLocationHref,
+			clientFactory,
+			tokenSource: instance.config.studio?.auth?.token
+		}, result;
+		switch (mode) {
+			case "studio":
+				result = getStudioInitialState(strategyOptions);
+				break;
+			case "dashboard":
+				result = getDashboardInitialState(strategyOptions);
+				break;
+			case "standalone": result = getStandaloneInitialState(strategyOptions);
+		}
+		return logger.debug("Auth state initialized", {
+			authStateType: result.authState.type,
+			mode,
+			authMethod: result.authMethod
+		}), {
+			authState: result.authState,
+			dashboardContext: result.dashboardContext,
+			options: {
+				apiHost,
+				loginUrl: loginUrl.toString(),
+				callbackUrl,
+				customProviders,
+				providedToken,
+				clientFactory,
+				initialLocationHref,
+				storageKey: result.storageKey,
+				storageArea: result.storageArea,
+				authMethod: result.authMethod
+			}
+		};
+	},
+	initialize(context) {
+		let logger = getAuthLogger(context.instance), initialLocationHref = context.state.get().options?.initialLocationHref ?? getDefaultLocation(), mode = resolveAuthMode(context.instance.config, initialLocationHref);
+		logger.debug("Setting up auth subscriptions", { mode });
+		let initResult;
+		switch (mode) {
+			case "studio":
+				initResult = initializeStudioAuth(context, tokenRefresherRunning);
+				break;
+			case "dashboard":
+				initResult = initializeDashboardAuth(context, tokenRefresherRunning);
+				break;
+			case "standalone": initResult = initializeStandaloneAuth(context, tokenRefresherRunning);
+		}
+		return initResult.tokenRefresherStarted && (tokenRefresherRunning = !0), () => {
+			logger.debug("Cleaning up auth subscriptions"), initResult.dispose();
+		};
+	}
+}), getCurrentUserState = bindActionGlobally(authStore, createStateSourceAction(({ state: { authState } }) => authState.type === "logged-in" ? authState.currentUser : null)), getTokenState = bindActionGlobally(authStore, createStateSourceAction(({ state: { authState } }) => authState.type === "logged-in" ? authState.token : null)), getAuthMethodState = bindActionGlobally(authStore, createStateSourceAction(({ state: { options } }) => options.authMethod)), getLoginUrlState = bindActionGlobally(authStore, createStateSourceAction(({ state: { options } }) => options.loginUrl)), getAuthState = bindActionGlobally(authStore, createStateSourceAction(({ state: { authState } }) => authState)), getDashboardOrganizationId = bindActionGlobally(authStore, createStateSourceAction(({ state: { dashboardContext } }) => dashboardContext?.orgId)), getIsInDashboardState = bindActionGlobally(authStore, createStateSourceAction(({ state: { dashboardContext } }) => !!dashboardContext && Object.keys(dashboardContext).length > 0)), setAuthToken = bindActionGlobally(authStore, ({ state, instance }, token) => {
+	let logger = getAuthLogger(instance), currentAuthState = state.get().authState;
+	if (token) {
+		if (currentAuthState.type !== "logged-in" || currentAuthState.token !== token) {
+			logger.info("Setting auth token");
+			let currentUser = currentAuthState.type === "logged-in" ? currentAuthState.currentUser : null, preservedLastTokenRefresh = currentAuthState.type === "logged-in" ? currentAuthState.lastTokenRefresh : void 0;
+			state.set("setToken", { authState: createLoggedInAuthState(token, currentUser, preservedLastTokenRefresh) });
+		}
+	} else currentAuthState.type !== "logged-out" && (logger.info("Clearing auth token"), state.set("setToken", { authState: {
+		type: "logged-out",
+		isDestroyingSession: !1
+	} }));
+});
+export { REQUEST_TAG_PREFIX as C, DEFAULT_API_VERSION as S, getStagingApiHost as T, getDefaultLocation as _, getCurrentUserState as a, AuthStateType as b, getLoginUrlState as c, createLoggedInAuthState as d, getAuthCode as f, getClientErrorApiType as g, getClientErrorApiDescription as h, getAuthState as i, getTokenState as l, getClientErrorApiBody as m, authStore_exports as n, getDashboardOrganizationId as o, getCleanedUrl as p, getAuthMethodState as r, getIsInDashboardState as s, authStore as t, setAuthToken as u, getTokenFromLocation as v, getAuthLogger as w, isStudioConfig as x, isProjectUserNotFoundClientError as y };
+
+//# sourceMappingURL=authStore-CtE9bLHW.js.map