flowlink-auth 2.6.9

package/dist/index.js

@@ -0,0 +1,574 @@
+// src/provider.js
+import React, { createContext, useContext, useEffect, useState, useCallback, useRef } from "react";
+
+// src/securityUtils.js
+function isSecureContext() {
+  if (typeof window === "undefined") return true;
+  const isLocalhost = window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1" || window.location.hostname === "[::1]";
+  const isHttps = window.location.protocol === "https:";
+  return isHttps || isLocalhost;
+}
+function checkSecureContext() {
+  if (!isSecureContext()) {
+    console.warn(
+      "flowlink-auth: HTTPS is required for production. Your connection is not secure. Authentication may fail."
+    );
+  }
+}
+function getSafeErrorMessage(error) {
+  if (typeof error === "string") {
+    if (error.includes("password") || error.includes("token") || error.includes("secret")) {
+      return "An error occurred. Please try again.";
+    }
+    return error;
+  }
+  if (error?.message) {
+    return getSafeErrorMessage(error.message);
+  }
+  return "An error occurred. Please try again.";
+}
+
+// src/provider.js
+var AuthContext = createContext(null);
+var flowlinkAuthProvider = ({ children, publishableKey, baseUrl, redirect }) => {
+  const [ready, setReady] = useState(false);
+  const [error, setError] = useState(null);
+  const [user, setUser] = useState(null);
+  const [loadingUser, setLoadingUser] = useState(true);
+  const [sessionTimeout, setSessionTimeout] = useState(null);
+  const redirectedRef = useRef(false);
+  const sessionTimerRef = useRef(null);
+  useEffect(() => {
+    checkSecureContext();
+  }, []);
+  useEffect(() => {
+    if (!publishableKey || !publishableKey.trim()) {
+      setError("Missing publishable key");
+      setReady(false);
+      return;
+    }
+    if (!baseUrl || !baseUrl.trim()) {
+      setError("Missing baseUrl");
+      setReady(false);
+      return;
+    }
+    if (!publishableKey.startsWith("pk_")) {
+      console.warn('flowlink-auth: publishableKey should start with "pk_"');
+    }
+    setError(null);
+    setReady(true);
+  }, [publishableKey, baseUrl]);
+  const normalizedBase = useCallback(() => {
+    return baseUrl?.replace(/\/+$/, "") || "";
+  }, [baseUrl]);
+  const redirectTo = (url, { replace = true } = {}) => {
+    if (!url) return;
+    if (typeof window === "undefined") return;
+    if (url.startsWith("//") || url.startsWith("http")) {
+      console.error("flowlink-auth: Redirect URL must be relative");
+      return;
+    }
+    try {
+      if (replace) window.location.replace(url);
+      else window.location.assign(url);
+    } catch (_) {
+      window.location.href = url;
+    }
+  };
+  const resetSessionTimeout = useCallback(() => {
+    if (sessionTimerRef.current) {
+      clearTimeout(sessionTimerRef.current);
+    }
+    sessionTimerRef.current = setTimeout(() => {
+      setSessionTimeout(true);
+      logout();
+    }, 24 * 60 * 60 * 1e3);
+  }, []);
+  const fetchMe = useCallback(async () => {
+    setLoadingUser(true);
+    try {
+      const base = normalizedBase();
+      if (!base) {
+        setUser(null);
+        setLoadingUser(false);
+        return null;
+      }
+      const fullUrl = new URL(`${base}/api/sdk/me`).href;
+      const res = await fetch(fullUrl, {
+        method: "GET",
+        credentials: "include",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        referrerPolicy: "strict-origin-when-cross-origin"
+      });
+      if (!res.ok) {
+        setUser(null);
+        setLoadingUser(false);
+        return null;
+      }
+      const data = await res.json();
+      const u = data?.user ?? null;
+      setUser(u);
+      setLoadingUser(false);
+      resetSessionTimeout();
+      return u;
+    } catch (err) {
+      console.error("Failed to fetch user:", getSafeErrorMessage(err));
+      setUser(null);
+      setLoadingUser(false);
+      return null;
+    }
+  }, [normalizedBase, resetSessionTimeout]);
+  useEffect(() => {
+    if (!ready) return;
+    fetchMe();
+    const onStorage = (e) => {
+      if (!e.key) return;
+      if (e.key === "flowlink_login" || e.key === "flowlink_logout") {
+        fetchMe();
+      }
+    };
+    if (typeof window !== "undefined") {
+      window.addEventListener("storage", onStorage);
+    }
+    return () => {
+      if (typeof window !== "undefined") {
+        window.removeEventListener("storage", onStorage);
+      }
+    };
+  }, [ready, fetchMe]);
+  useEffect(() => {
+    if (!ready) return;
+    if (loadingUser) return;
+    if (!user) {
+      redirectedRef.current = false;
+      return;
+    }
+    if (user && redirect && !redirectedRef.current) {
+      redirectedRef.current = true;
+      redirectTo(redirect, { replace: true });
+    }
+  }, [ready, loadingUser, user, redirect]);
+  const completeLogin = useCallback(async (opts = {}) => {
+    const { redirectTo: redirectUrl, replace = true } = opts;
+    const u = await fetchMe();
+    try {
+      localStorage.setItem("flowlink_login", String(Date.now()));
+    } catch (_) {
+    }
+    const dest = redirectUrl ?? redirect;
+    if (u && dest) {
+      redirectTo(dest, { replace });
+    }
+    return u;
+  }, [fetchMe, redirect]);
+  const logout = useCallback(async (opts = {}) => {
+    const { callServer = true, redirectTo: redirectUrl, replace = true } = opts;
+    const base = normalizedBase();
+    if (callServer && base) {
+      try {
+        await fetch(`${base}/api/sdk/logout`, {
+          method: "POST",
+          credentials: "include",
+          headers: { "Content-Type": "application/json" }
+        });
+      } catch (_) {
+      }
+    }
+    setUser(null);
+    try {
+      localStorage.setItem("flowlink_logout", String(Date.now()));
+    } catch (_) {
+    }
+    const dest = redirectUrl ?? redirect;
+    if (dest) redirectTo(dest, { replace });
+  }, [normalizedBase, redirect]);
+  const value = {
+    publishableKey,
+    baseUrl,
+    redirectTo: (url, opts) => redirectTo(url, opts),
+    user,
+    setUser,
+    loadingUser,
+    fetchMe,
+    logout,
+    completeLogin
+  };
+  return /* @__PURE__ */ React.createElement(AuthContext.Provider, { value }, error ? /* @__PURE__ */ React.createElement("div", { style: { padding: "20px", background: "#220000", color: "white" } }, /* @__PURE__ */ React.createElement("h2", null, "flowlink Auth Error"), /* @__PURE__ */ React.createElement("p", null, error)) : !ready ? null : children);
+};
+var useAuth = () => {
+  const ctx = useContext(AuthContext);
+  if (!ctx) throw new Error("useAuth must be used within flowlinkAuthProvider");
+  return ctx;
+};
+var provider_default = flowlinkAuthProvider;
+
+// src/SignIn.jsx
+import React2, { useState as useState2 } from "react";
+function SignIn({ onSuccess } = {}) {
+  const {
+    publishableKey,
+    baseUrl,
+    redirect,
+    redirectTo,
+    user,
+    loadingUser,
+    completeLogin,
+    fetchMe,
+    setUser
+  } = useAuth();
+  const [email, setEmail] = useState2("");
+  const [password, setPassword] = useState2("");
+  const [loading, setLoading] = useState2(false);
+  const [error, setError] = useState2(null);
+  const [message, setMessage] = useState2(null);
+  if (loadingUser) return null;
+  if (user && redirect) {
+    if (typeof redirectTo === "function") redirectTo(redirect);
+    else if (typeof window !== "undefined") window.location.assign(redirect);
+    return null;
+  }
+  async function submit(e) {
+    e.preventDefault();
+    setError(null);
+    setMessage(null);
+    if (!email || !password) {
+      setError("Email and password are required");
+      return;
+    }
+    setLoading(true);
+    try {
+      const endpoint = `${(baseUrl || "").replace(/\/+$/, "")}/api/sdk/login`;
+      const res = await fetch(endpoint, {
+        method: "POST",
+        credentials: "include",
+        headers: {
+          "Content-Type": "application/json",
+          "x-publishable-key": publishableKey || ""
+        },
+        body: JSON.stringify({ email, password })
+      });
+      const ct = res.headers.get("content-type") || "";
+      let data = {};
+      if (ct.includes("application/json")) data = await res.json();
+      else {
+        const text = await res.text();
+        throw new Error(`Unexpected response (status ${res.status}): ${text.slice(0, 200)}`);
+      }
+      if (!res.ok) throw new Error(data.error || data.message || `Login failed (status ${res.status})`);
+      const serverUser = data.user ?? null;
+      if (serverUser && typeof setUser === "function") {
+        try {
+          setUser(serverUser);
+        } catch (_) {
+        }
+      }
+      if (typeof completeLogin === "function") {
+        try {
+          await completeLogin();
+        } catch (e2) {
+          if (typeof fetchMe === "function") await fetchMe();
+        }
+      } else if (typeof fetchMe === "function") {
+        await fetchMe();
+      }
+      if (onSuccess) {
+        try {
+          onSuccess(data);
+        } catch (_) {
+        }
+      }
+      setMessage("Signed in. Redirecting...");
+      if (redirect) {
+        setTimeout(() => {
+          if (typeof redirectTo === "function") redirectTo(redirect);
+          else if (typeof window !== "undefined") window.location.assign(redirect);
+        }, 250);
+      }
+    } catch (err) {
+      setError(err.message || "Network error");
+    } finally {
+      setLoading(false);
+    }
+  }
+  async function startOAuthFlow(provider) {
+    setError(null);
+    setLoading(true);
+    try {
+      const rid = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+      const callbackUrl = encodeURIComponent(`${window.location.origin}/signin`);
+      const sdkBase = typeof process !== "undefined" && process.env && process.env.NEXT_PUBLIC_SDK_BASE_URL || baseUrl || "http://localhost:3001";
+      const startUrl = `${sdkBase.replace(/\/+$/, "")}/sdk/auth/start?rid=${rid}&source=${encodeURIComponent(provider)}&callbackUrl=${callbackUrl}`;
+      if (!publishableKey) {
+        throw new Error("Missing publishable key (client side). Set NEXT_PUBLIC_SDK_PUBLISHABLE_KEY or provide publishableKey in provider.");
+      }
+      const res = await fetch(startUrl, {
+        method: "GET",
+        headers: { "x-publishable-key": publishableKey },
+        mode: "cors"
+      });
+      const data = await res.json().catch(() => null);
+      if (!res.ok) throw new Error(data?.error || `OAuth start failed (${res.status})`);
+      if (!data?.oauthUrl) throw new Error("SDK start did not return oauthUrl");
+      window.location.href = data.oauthUrl;
+    } catch (err) {
+      console.error("OAuth start error:", err);
+      setError(err?.message || "OAuth start failed");
+      setLoading(false);
+    }
+  }
+  const handleGoogle = (e) => {
+    if (e && typeof e.preventDefault === "function") e.preventDefault();
+    startOAuthFlow("google");
+  };
+  const handleGithub = (e) => {
+    if (e && typeof e.preventDefault === "function") e.preventDefault();
+    startOAuthFlow("github");
+  };
+  return /* @__PURE__ */ React2.createElement("div", { style: overlay }, /* @__PURE__ */ React2.createElement("div", { style: modal }, /* @__PURE__ */ React2.createElement("h2", { style: title }, "Sign in"), /* @__PURE__ */ React2.createElement("p", { style: subtitle }, "Welcome back \u2014 enter your credentials."), /* @__PURE__ */ React2.createElement("form", { onSubmit: submit, style: { width: "100%" } }, /* @__PURE__ */ React2.createElement("label", { style: label }, "Email"), /* @__PURE__ */ React2.createElement(
+    "input",
+    {
+      style: input,
+      value: email,
+      onChange: (e) => setEmail(e.target.value),
+      type: "email",
+      required: true
+    }
+  ), /* @__PURE__ */ React2.createElement("label", { style: label }, "Password"), /* @__PURE__ */ React2.createElement(
+    "input",
+    {
+      style: input,
+      type: "password",
+      value: password,
+      onChange: (e) => setPassword(e.target.value),
+      required: true
+    }
+  ), /* @__PURE__ */ React2.createElement("div", { style: { marginTop: 12 } }, /* @__PURE__ */ React2.createElement("button", { style: button, type: "submit", disabled: loading }, loading ? "Signing in\u2026" : "Sign in")), /* @__PURE__ */ React2.createElement("div", { style: { display: "flex", gap: 8, marginTop: 16 } }, /* @__PURE__ */ React2.createElement("button", { type: "button", onClick: handleGoogle, style: oauthButtonGoogle, disabled: loading }, "Continue with Google"), /* @__PURE__ */ React2.createElement("button", { type: "button", onClick: handleGithub, style: oauthButtonGithub, disabled: loading }, "Continue with GitHub")), error && /* @__PURE__ */ React2.createElement("div", { style: errorBox }, error), message && /* @__PURE__ */ React2.createElement("div", { style: successBox }, message))));
+}
+var overlay = { position: "fixed", inset: 0, display: "flex", alignItems: "center", justifyContent: "center", background: "rgba(0,0,0,0.45)", zIndex: 9999, padding: 20 };
+var modal = { width: "100%", maxWidth: 420, background: "#0f1724", color: "#fff", borderRadius: 12, padding: 22, boxShadow: "0 10px 30px rgba(2,6,23,0.6)", border: "1px solid rgba(255,255,255,0.04)" };
+var title = { margin: 0, fontSize: 20, fontWeight: 600 };
+var subtitle = { marginTop: 6, marginBottom: 14, color: "#cbd5e1", fontSize: 13 };
+var label = { display: "block", color: "#cbd5e1", fontSize: 13, marginTop: 8 };
+var input = { width: "100%", padding: "10px 12px", marginTop: 6, borderRadius: 8, border: "1px solid rgba(255,255,255,0.06)", background: "#0b1220", color: "#fff", boxSizing: "border-box" };
+var button = { width: "100%", padding: "10px 12px", borderRadius: 8, background: "linear-gradient(90deg,#06b6d4,#2563eb)", color: "#0b1220", border: "none", fontWeight: 700, cursor: "pointer" };
+var oauthButtonGoogle = { flex: 1, padding: "10px 12px", borderRadius: 8, background: "#db4437", color: "#fff", border: "none", cursor: "pointer" };
+var oauthButtonGithub = { flex: 1, padding: "10px 12px", borderRadius: 8, background: "#24292f", color: "#fff", border: "none", cursor: "pointer" };
+var errorBox = { marginTop: 10, color: "#ffb4b4", fontSize: 13 };
+var successBox = { marginTop: 10, color: "#bef264", fontSize: 13 };
+
+// src/SignUp.jsx
+import React3, { useState as useState3 } from "react";
+function SignUp() {
+  const {
+    publishableKey,
+    baseUrl,
+    redirect,
+    redirectTo,
+    user,
+    loadingUser,
+    fetchMe,
+    setUser
+  } = useAuth();
+  const [name, setName] = useState3("");
+  const [email, setEmail] = useState3("");
+  const [password, setPassword] = useState3("");
+  const [loading, setLoading] = useState3(false);
+  const [error, setError] = useState3(null);
+  const [message, setMessage] = useState3(null);
+  if (loadingUser) return null;
+  if (user && redirect) {
+    if (typeof redirectTo === "function") redirectTo(redirect);
+    else if (typeof window !== "undefined") window.location.assign(redirect);
+    return null;
+  }
+  async function submit(e) {
+    e.preventDefault();
+    setError(null);
+    setMessage(null);
+    setLoading(true);
+    const url = `${(baseUrl || "").replace(/\/+$/, "")}/api/sdk/signup`;
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        credentials: "include",
+        headers: {
+          "Content-Type": "application/json",
+          "x-publishable-key": publishableKey || ""
+        },
+        body: JSON.stringify({ name, email, password })
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) throw new Error(data.error || "Signup failed");
+      if (data.user && typeof setUser === "function") setUser(data.user);
+      if (typeof fetchMe === "function") await fetchMe();
+      setMessage("Account created. Redirecting\u2026");
+      if (redirect) {
+        setTimeout(() => {
+          if (typeof redirectTo === "function") redirectTo(redirect);
+          else if (typeof window !== "undefined") window.location.assign(redirect);
+        }, 300);
+      }
+    } catch (err) {
+      setError(err?.message ?? "Network error");
+      console.error("Signup error:", err);
+    } finally {
+      setLoading(false);
+    }
+  }
+  async function startOAuthFlow(provider) {
+    setError(null);
+    setLoading(true);
+    try {
+      const rid = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+      const callbackUrl = encodeURIComponent(`${window.location.origin}/signup`);
+      const sdkBase = typeof process !== "undefined" && process.env && process.env.NEXT_PUBLIC_SDK_BASE_URL || baseUrl || window.location.origin.replace(/\/+$/, "");
+      const startUrl = `${sdkBase}/sdk/auth/start?rid=${rid}&source=${encodeURIComponent(provider)}&callbackUrl=${callbackUrl}`;
+      if (!publishableKey) {
+        throw new Error("Missing publishable key (client side). Set NEXT_PUBLIC_SDK_PUBLISHABLE_KEY or provide publishableKey in provider.");
+      }
+      const res = await fetch(startUrl, {
+        method: "GET",
+        headers: {
+          "x-publishable-key": publishableKey
+        }
+      });
+      const data = await res.json().catch(() => null);
+      if (!res.ok) {
+        throw new Error(data?.error || `OAuth start failed (${res.status})`);
+      }
+      if (!data?.oauthUrl) {
+        throw new Error("SDK start did not return oauthUrl");
+      }
+      window.location.href = data.oauthUrl;
+    } catch (err) {
+      console.error("OAuth start error:", err);
+      setError(err?.message || "OAuth start failed");
+      setLoading(false);
+    }
+  }
+  const handleGoogle = (e) => {
+    if (e && typeof e.preventDefault === "function") e.preventDefault();
+    startOAuthFlow("google");
+  };
+  const handleGithub = (e) => {
+    if (e && typeof e.preventDefault === "function") e.preventDefault();
+    startOAuthFlow("github");
+  };
+  return /* @__PURE__ */ React3.createElement("div", { style: overlay2 }, /* @__PURE__ */ React3.createElement("div", { style: modal2 }, /* @__PURE__ */ React3.createElement("h2", { style: title2 }, "Create account"), /* @__PURE__ */ React3.createElement("form", { onSubmit: submit }, /* @__PURE__ */ React3.createElement("label", { style: label2 }, "Full name"), /* @__PURE__ */ React3.createElement(
+    "input",
+    {
+      name: "name",
+      style: input2,
+      value: name,
+      onChange: (e) => setName(e.target.value),
+      autoComplete: "name"
+    }
+  ), /* @__PURE__ */ React3.createElement("label", { style: label2 }, "Email"), /* @__PURE__ */ React3.createElement(
+    "input",
+    {
+      name: "email",
+      type: "email",
+      style: input2,
+      value: email,
+      onChange: (e) => setEmail(e.target.value),
+      required: true,
+      autoComplete: "email"
+    }
+  ), /* @__PURE__ */ React3.createElement("label", { style: label2 }, "Password"), /* @__PURE__ */ React3.createElement(
+    "input",
+    {
+      name: "password",
+      type: "password",
+      style: input2,
+      value: password,
+      onChange: (e) => setPassword(e.target.value),
+      required: true,
+      autoComplete: "new-password"
+    }
+  ), /* @__PURE__ */ React3.createElement("div", { style: { marginTop: 12 } }, /* @__PURE__ */ React3.createElement("button", { style: button2, type: "submit", disabled: loading }, loading ? "Creating..." : "Create account")), /* @__PURE__ */ React3.createElement("div", { style: { display: "flex", gap: 8, marginTop: 16 } }, /* @__PURE__ */ React3.createElement(
+    "button",
+    {
+      type: "button",
+      onClick: handleGoogle,
+      style: oauthButtonGoogle2
+    },
+    "Continue with Google"
+  ), /* @__PURE__ */ React3.createElement(
+    "button",
+    {
+      type: "button",
+      onClick: handleGithub,
+      style: oauthButtonGithub2
+    },
+    "Continue with GitHub"
+  )), error && /* @__PURE__ */ React3.createElement("div", { style: errorBox2 }, error), message && /* @__PURE__ */ React3.createElement("div", { style: successBox2 }, message))));
+}
+var overlay2 = {
+  position: "fixed",
+  inset: 0,
+  background: "rgba(0,0,0,0.5)",
+  display: "flex",
+  justifyContent: "center",
+  alignItems: "center",
+  padding: 20,
+  zIndex: 9999
+};
+var modal2 = {
+  width: "100%",
+  maxWidth: 420,
+  background: "#0f1724",
+  borderRadius: 12,
+  padding: 24,
+  color: "#fff"
+};
+var title2 = { margin: 0, fontSize: 20, fontWeight: 600 };
+var label2 = { marginTop: 10, display: "block", fontSize: 13 };
+var input2 = {
+  width: "100%",
+  padding: "10px 12px",
+  borderRadius: 8,
+  background: "#0b1220",
+  color: "#fff",
+  border: "1px solid #1e293b",
+  marginTop: 6
+};
+var button2 = {
+  marginTop: 15,
+  width: "100%",
+  padding: "10px 12px",
+  borderRadius: 8,
+  background: "#2563eb",
+  border: "none",
+  color: "#fff",
+  fontWeight: 600,
+  cursor: "pointer"
+};
+var oauthButtonGoogle2 = {
+  flex: 1,
+  padding: "10px 12px",
+  borderRadius: 8,
+  background: "#db4437",
+  color: "#fff",
+  border: "none",
+  cursor: "pointer"
+};
+var oauthButtonGithub2 = {
+  flex: 1,
+  padding: "10px 12px",
+  borderRadius: 8,
+  background: "#24292f",
+  color: "#fff",
+  border: "none",
+  cursor: "pointer"
+};
+var errorBox2 = { marginTop: 10, color: "#ffb4b4", fontSize: 13 };
+var successBox2 = { marginTop: 10, color: "#bef264", fontSize: 13 };
+export {
+  provider_default as flowlinkAuthProvider,
+  SignIn,
+  SignUp,
+  useAuth
+};
+

package/dist/init.js

@@ -0,0 +1,73 @@
+// src/init.js
+var CONFIG = null;
+function initflowlinkAuth({ publishableKey, baseUrl, opts } = {}) {
+  if (!publishableKey) throw new Error("flowlink-auth: publishableKey is required in initflowlinkAuth()");
+  if (!baseUrl) throw new Error("flowlink-auth: baseUrl is required in initflowlinkAuth()");
+  if (!publishableKey.startsWith("pk_")) {
+    console.warn('flowlink-auth: publishableKey should start with "pk_"');
+  }
+  if (typeof window !== "undefined" && window.location.protocol === "http:" && !baseUrl.includes("localhost")) {
+    console.error("flowlink-auth: HTTPS is required for production. Current protocol:", window.location.protocol);
+  }
+  const urlObj = new URL(baseUrl).href;
+  if (!urlObj) {
+    throw new Error("flowlink-auth: baseUrl must be a valid URL");
+  }
+  CONFIG = {
+    publishableKey,
+    baseUrl: baseUrl.replace(/\/+$/, ""),
+    requireServerSecret: opts?.requireServerSecret || false,
+    secretKey: opts?.serverSecret || null,
+    csrfToken: generateCSRFToken()
+    // Add CSRF protection
+  };
+  if (CONFIG.requireServerSecret && !CONFIG.secretKey) {
+    console.warn("flowlink-auth: requireServerSecret=true but serverSecret not provided. This is insecure for production.");
+  }
+  if (CONFIG.secretKey) {
+    console.error("flowlink-auth: secretKey should NEVER be provided to client SDK. Use server-side authentication only.");
+  }
+}
+function generateCSRFToken() {
+  if (typeof window === "undefined") return null;
+  const array = new Uint8Array(32);
+  window.crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function setConfigFromProvider({ publishableKey, secretKey = null, baseUrl, opts = {} } = {}) {
+  if (!publishableKey || !baseUrl) {
+    CONFIG = null;
+    return;
+  }
+  if (typeof window !== "undefined" && window.location.protocol === "http:" && !baseUrl.includes("localhost")) {
+    console.warn("flowlink-auth: HTTPS recommended for production");
+  }
+  CONFIG = {
+    publishableKey,
+    baseUrl: baseUrl.replace(/\/+$/, ""),
+    requireServerSecret: opts?.requireServerSecret || false,
+    secretKey: secretKey || null,
+    csrfToken: generateCSRFToken()
+  };
+  if (secretKey) {
+    console.error("flowlink-auth: NEVER pass secretKey to client-side code");
+  }
+}
+function getConfigSafe() {
+  return CONFIG;
+}
+function getConfig() {
+  if (!CONFIG) throw new Error("flowlink-auth: SDK not initialized. Call initflowlinkAuth(...) or wrap components in flowlinkAuthProvider with keys.");
+  return CONFIG;
+}
+function getCSRFToken() {
+  return CONFIG?.csrfToken || null;
+}
+export {
+  getCSRFToken,
+  getConfig,
+  getConfigSafe,
+  initflowlinkAuth,
+  setConfigFromProvider
+};
+