mythik 0.0.1 → 0.1.0

package/dist/auth/cross-tab.js

@@ -0,0 +1,117 @@
+const CHANNEL_NAME = 'mythik-auth';
+const STORAGE_KEY = 'mythik-auth-event';
+/** Valid auth event types for message validation. */
+const VALID_EVENT_TYPES = new Set([
+    'SIGNED_IN', 'SIGNED_OUT', 'TOKEN_REFRESHED', 'SESSION_EXPIRED', 'AUTH_ERROR',
+]);
+function dispatchToListeners(listeners, data) {
+    if (!data || typeof data !== 'object' || !VALID_EVENT_TYPES.has(data.type)) {
+        return;
+    }
+    const event = data;
+    for (const listener of listeners) {
+        try {
+            listener(event);
+        }
+        catch {
+            // Individual listener failure must not prevent other listeners from running
+        }
+    }
+}
+/**
+ * Creates cross-tab auth synchronization.
+ *
+ * Primary: BroadcastChannel (modern browsers, 97%+ support).
+ * Fallback: localStorage `storage` events (legacy browsers).
+ *
+ * - Logout in Tab A → all other tabs clear session and redirect to login
+ * - Sign in in Tab A → other tabs can restore session from persistence
+ * - Token refresh in Tab A → other tabs pick up new token
+ *
+ * The channelFactory parameter enables testing without real BroadcastChannel.
+ * Pass `() => null` for environments where BroadcastChannel is unavailable.
+ */
+export function createCrossTabSync(channelFactory) {
+    const listeners = new Set();
+    let destroyed = false;
+    // ─── Try BroadcastChannel first ───
+    let channel = null;
+    try {
+        channel = channelFactory
+            ? channelFactory()
+            : (typeof BroadcastChannel !== 'undefined' ? new BroadcastChannel(CHANNEL_NAME) : null);
+    }
+    catch {
+        // BroadcastChannel not available
+    }
+    // ─── Storage event fallback handler ───
+    let storageHandler = null;
+    const useStorageFallback = !channel && typeof globalThis.localStorage !== 'undefined';
+    if (channel) {
+        channel.onmessage = (ev) => {
+            dispatchToListeners(listeners, ev.data);
+        };
+    }
+    else if (useStorageFallback) {
+        storageHandler = (ev) => {
+            if (ev.key !== STORAGE_KEY || !ev.newValue)
+                return;
+            try {
+                const data = JSON.parse(ev.newValue);
+                dispatchToListeners(listeners, data);
+            }
+            catch {
+                // Invalid JSON — ignore
+            }
+        };
+        globalThis.addEventListener('storage', storageHandler);
+    }
+    function broadcast(event) {
+        if (destroyed)
+            return;
+        if (channel) {
+            try {
+                channel.postMessage(event);
+            }
+            catch {
+                // Channel closed or unavailable
+            }
+        }
+        else if (useStorageFallback) {
+            try {
+                // Write to localStorage triggers `storage` event in OTHER tabs (not this one)
+                globalThis.localStorage.setItem(STORAGE_KEY, JSON.stringify(event));
+                // Remove immediately — we only need the event, not persisted data
+                globalThis.localStorage.removeItem(STORAGE_KEY);
+            }
+            catch {
+                // Storage unavailable
+            }
+        }
+    }
+    function onEvent(callback) {
+        if (!channel && !useStorageFallback)
+            return () => { };
+        if (destroyed)
+            return () => { };
+        listeners.add(callback);
+        return () => { listeners.delete(callback); };
+    }
+    function destroy() {
+        destroyed = true;
+        listeners.clear();
+        if (channel) {
+            try {
+                channel.close();
+            }
+            catch { /* Already closed */ }
+            channel = null;
+        }
+        if (storageHandler) {
+            globalThis.removeEventListener('storage', storageHandler);
+            storageHandler = null;
+        }
+    }
+    return { broadcast, onEvent, destroy };
+}
+//# sourceMappingURL=cross-tab.js.map

package/dist/auth/cross-tab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tab.js","sourceRoot":"","sources":["../../src/auth/cross-tab.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY;CAC9E,CAAC,CAAC;AAWH,SAAS,mBAAmB,CAAC,SAA0C,EAAE,IAAa;IACpF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAE,IAAgC,CAAC,IAAc,CAAC,EAAE,CAAC;QAClH,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAiB,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAAuC;IAEvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,qCAAqC;IACrC,IAAI,OAAO,GAA4B,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,cAAc;YACtB,CAAC,CAAC,cAAc,EAAE;YAClB,CAAC,CAAC,CAAC,OAAO,gBAAgB,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,yCAAyC;IACzC,IAAI,cAAc,GAAwC,IAAI,CAAC;IAC/D,MAAM,kBAAkB,GAAG,CAAC,OAAO,IAAI,OAAO,UAAU,CAAC,YAAY,KAAK,WAAW,CAAC;IAEtF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACvC,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,kBAAkB,EAAE,CAAC;QAC9B,cAAc,GAAG,CAAC,EAAgB,EAAE,EAAE;YACpC,IAAI,EAAE,CAAC,GAAG,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,QAAQ;gBAAE,OAAO;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACrC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC,CAAC;QACF,UAAU,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IAED,SAAS,SAAS,CAAC,KAAgB;QACjC,IAAI,SAAS;YAAE,OAAO;QAEtB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;aAAM,IAAI,kBAAkB,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,8EAA8E;gBAC9E,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpE,kEAAkE;gBAClE,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,QAAoC;QACnD,IAAI,CAAC,OAAO,IAAI,CAAC,kBAAkB;YAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS,OAAO;QACd,SAAS,GAAG,IAAI,CAAC;QACjB,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACvD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,UAAU,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAC1D,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}

package/dist/auth/engine.d.ts

@@ -0,0 +1,16 @@
+import type { AuthEngineConfig, AuthEngine } from './types.js';
+/**
+ * Creates the AuthEngine — the core authentication manager.
+ *
+ * SECURITY: Tokens are stored exclusively in closure variables.
+ * They NEVER touch the state store. Only safe derived data
+ * (user info, isAuthenticated, loading, error) is written to state.
+ *
+ * Persistence: Only the refresh token + safe user data are persisted.
+ * Access tokens are NEVER persisted — they live in closure only.
+ * Plain JSON storage is intentional: browser-fingerprint encryption does NOT
+ * protect against XSS (the only realistic attack on localStorage) because
+ * the fingerprint is computable by any script on the page.
+ */
+export declare function createAuthEngine(config: AuthEngineConfig): AuthEngine;
+//# sourceMappingURL=engine.d.ts.map

package/dist/auth/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/auth/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAwB,MAAM,YAAY,CAAC;AAMrF;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAkPrE"}

package/dist/auth/engine.js

@@ -0,0 +1,225 @@
+import { createRefreshEngine } from './refresh-engine.js';
+import { createLoginRateLimiter } from './rate-limiter.js';
+import { createAuthPersistence } from './persistence.js';
+import { createCrossTabSync } from './cross-tab.js';
+/**
+ * Creates the AuthEngine — the core authentication manager.
+ *
+ * SECURITY: Tokens are stored exclusively in closure variables.
+ * They NEVER touch the state store. Only safe derived data
+ * (user info, isAuthenticated, loading, error) is written to state.
+ *
+ * Persistence: Only the refresh token + safe user data are persisted.
+ * Access tokens are NEVER persisted — they live in closure only.
+ * Plain JSON storage is intentional: browser-fingerprint encryption does NOT
+ * protect against XSS (the only realistic attack on localStorage) because
+ * the fingerprint is computable by any script on the page.
+ */
+export function createAuthEngine(config) {
+    const { provider, store, config: authConfig } = config;
+    // ─── Closure-based token storage (NEVER in state) ───
+    let accessToken = null;
+    let refreshToken = null;
+    let destroyed = false;
+    // ─── Rate limiter (brute-force protection) ───
+    const rateLimiter = createLoginRateLimiter();
+    // ─── Persistence (refresh token + safe user data only) ───
+    const persistence = createAuthPersistence(authConfig.persistence);
+    // ─── Cross-tab sync ───
+    const crossTab = createCrossTabSync();
+    // ─── Refresh engine (mutex + proactive scheduling) ───
+    const refreshEngine = createRefreshEngine({
+        doRefresh: async () => {
+            if (!refreshToken)
+                throw new Error('No refresh token available');
+            const result = await provider.refresh(refreshToken);
+            applyAuthResult(result);
+            return result.token;
+        },
+    });
+    // Listen for auth events from other tabs
+    crossTab.onEvent((event) => {
+        if (destroyed)
+            return;
+        if (event.type === 'SIGNED_OUT' || event.type === 'SESSION_EXPIRED') {
+            // Another tab logged out — clear local session
+            refreshEngine.cancelProactive();
+            clearTokens();
+            clearAuthState();
+        }
+        else if (event.type === 'TOKEN_REFRESHED') {
+            // Another tab refreshed — restore from persistence to get new token
+            const data = persistence.restore();
+            if (data) {
+                refreshToken = data.refreshToken;
+            }
+        }
+    });
+    // ─── State helpers ───
+    function writeUserToState(user) {
+        store.set('/auth/user/id', user.id);
+        store.set('/auth/user/email', user.email);
+        store.set('/auth/user/name', user.name ?? null);
+        store.set('/auth/user/avatar', user.avatar ?? null);
+        store.set('/auth/user/role', user.role);
+        store.set('/auth/user/roles', user.roles);
+        store.set('/auth/user/metadata', user.metadata ?? null);
+    }
+    function clearUserFromState() {
+        store.set('/auth/user/id', null);
+        store.set('/auth/user/email', null);
+        store.set('/auth/user/name', null);
+        store.set('/auth/user/avatar', null);
+        store.set('/auth/user/role', null);
+        store.set('/auth/user/roles', null);
+        store.set('/auth/user/metadata', null);
+    }
+    function clearAuthState() {
+        store.set('/auth/isAuthenticated', false);
+        clearUserFromState();
+        store.set('/auth/loading', false);
+        store.set('/auth/error', null);
+    }
+    function clearTokens() {
+        accessToken = null;
+        refreshToken = null;
+    }
+    /** Apply auth result to closure + state + persistence. Shared by login and refresh. */
+    function applyAuthResult(result) {
+        accessToken = result.token;
+        refreshToken = result.refreshToken ?? refreshToken;
+        store.set('/auth/isAuthenticated', true);
+        writeUserToState(result.user);
+        // Persist refresh token + safe user data
+        if (refreshToken) {
+            persistence.save({ refreshToken, user: result.user });
+        }
+        // Schedule proactive refresh if enabled and expiry info available
+        if (authConfig.tokenRefresh) {
+            const lifetimeMs = result.expiresAt
+                ? result.expiresAt - Date.now()
+                : result.expiresIn
+                    ? result.expiresIn * 1000
+                    : null;
+            if (lifetimeMs && lifetimeMs > 0) {
+                refreshEngine.scheduleProactive(lifetimeMs);
+            }
+        }
+    }
+    /** Best-effort cleanup of credential values from the passed object. */
+    function clearCredentials(credentials) {
+        for (const key of Object.keys(credentials)) {
+            credentials[key] = undefined;
+        }
+    }
+    // ─── Login ───
+    async function login(credentials) {
+        if (destroyed)
+            throw new Error('AuthEngine has been destroyed');
+        // Rate limit check (brute-force protection)
+        rateLimiter.assertAllowed();
+        // Clear previous error
+        store.set('/auth/error', null);
+        store.set('/auth/loading', true);
+        try {
+            const result = await provider.login(credentials);
+            // Apply auth result (tokens to closure, user to state, persist, schedule refresh)
+            applyAuthResult(result);
+            store.set('/auth/loading', false);
+            store.set('/auth/error', null);
+            // Broadcast to other tabs
+            crossTab.broadcast({ type: 'SIGNED_IN', user: result.user });
+            // Best-effort credential cleanup
+            clearCredentials(credentials);
+        }
+        catch (err) {
+            // Clear tokens on failure
+            clearTokens();
+            store.set('/auth/isAuthenticated', false);
+            store.set('/auth/loading', false);
+            store.set('/auth/error', err instanceof Error ? err.message : 'Login failed');
+            // Best-effort credential cleanup even on failure
+            clearCredentials(credentials);
+            throw err;
+        }
+    }
+    // ─── Logout ───
+    async function logout() {
+        refreshEngine.cancelProactive();
+        try {
+            await provider.logout();
+        }
+        catch {
+            // Provider logout failure should not prevent client-side cleanup
+        }
+        clearTokens();
+        clearAuthState();
+        persistence.clear();
+        crossTab.broadcast({ type: 'SIGNED_OUT' });
+    }
+    // ─── Refresh ───
+    async function refreshSession() {
+        const newToken = await refreshEngine.requestRefresh();
+        if (!newToken) {
+            // Refresh failed — session is dead
+            clearTokens();
+            clearAuthState();
+            persistence.clear();
+            crossTab.broadcast({ type: 'SESSION_EXPIRED' });
+            throw new Error('Session refresh failed');
+        }
+        // applyAuthResult already handles persistence + state via doRefresh callback
+        crossTab.broadcast({ type: 'TOKEN_REFRESHED', token: '' }); // token value not broadcast for security
+    }
+    // ─── Mount ───
+    async function mount() {
+        // Initialize auth state in store
+        clearAuthState();
+        // Restore session from persistence
+        const persisted = persistence.restore();
+        if (persisted && persisted.refreshToken) {
+            refreshToken = persisted.refreshToken;
+            // Don't set isAuthenticated or write user data until refresh confirms.
+            // applyAuthResult (called by successful refresh) handles both.
+            // This prevents the app from briefly entering authenticated state
+            // and making requests with an invalid token when the server has restarted.
+            try {
+                await refreshSession();
+            }
+            catch {
+                // Refresh failed — persisted session is dead
+                clearTokens();
+                clearAuthState();
+                persistence.clear();
+            }
+        }
+    }
+    // ─── Destroy ───
+    function destroy() {
+        destroyed = true;
+        refreshEngine.destroy();
+        crossTab.destroy();
+        clearTokens();
+    }
+    // ─── Accessors ───
+    function getAccessToken() {
+        return accessToken;
+    }
+    function isAuthenticatedFn() {
+        return accessToken !== null;
+    }
+    function getConfig() {
+        return authConfig;
+    }
+    return {
+        login,
+        logout,
+        refreshSession,
+        mount,
+        destroy,
+        getAccessToken,
+        isAuthenticated: isAuthenticatedFn,
+        getConfig,
+    };
+}
+//# sourceMappingURL=engine.js.map

package/dist/auth/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/auth/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAqB,MAAM,gBAAgB,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAEvD,uDAAuD;IACvD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,gDAAgD;IAChD,MAAM,WAAW,GAAqB,sBAAsB,EAAE,CAAC;IAE/D,4DAA4D;IAC5D,MAAM,WAAW,GAAoB,qBAAqB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAEnF,yBAAyB;IACzB,MAAM,QAAQ,GAAiB,kBAAkB,EAAE,CAAC;IAEpD,wDAAwD;IACxD,MAAM,aAAa,GAAkB,mBAAmB,CAAC;QACvD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACpD,eAAe,CAAC,MAAM,CAAC,CAAC;YACxB,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;KACF,CAAC,CAAC;IAEH,yCAAyC;IACzC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpE,+CAA+C;YAC/C,aAAa,CAAC,eAAe,EAAE,CAAC;YAChC,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;QACnB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC5C,oEAAoE;YACpE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACT,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wBAAwB;IAExB,SAAS,gBAAgB,CAAC,IAAc;QACtC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,SAAS,kBAAkB;QACzB,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,cAAc;QACrB,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC1C,kBAAkB,EAAE,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,WAAW;QAClB,WAAW,GAAG,IAAI,CAAC;QACnB,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uFAAuF;IACvF,SAAS,eAAe,CAAC,MAAkB;QACzC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,YAAY,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QACzC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE9B,yCAAyC;QACzC,IAAI,YAAY,EAAE,CAAC;YACjB,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,kEAAkE;QAClE,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAC/B,CAAC,CAAC,MAAM,CAAC,SAAS;oBAChB,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI;oBACzB,CAAC,CAAC,IAAI,CAAC;YAEX,IAAI,UAAU,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACjC,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,SAAS,gBAAgB,CAAC,WAAoC;QAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,WAAW,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,gBAAgB;IAEhB,KAAK,UAAU,KAAK,CAAC,WAAoC;QACvD,IAAI,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAEhE,4CAA4C;QAC5C,WAAW,CAAC,aAAa,EAAE,CAAC;QAE5B,uBAAuB;QACvB,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAEjD,kFAAkF;YAClF,eAAe,CAAC,MAAM,CAAC,CAAC;YAExB,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAE/B,0BAA0B;YAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAE7D,iCAAiC;YACjC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0BAA0B;YAC1B,WAAW,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC1C,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAClC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YAE9E,iDAAiD;YACjD,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,iBAAiB;IAEjB,KAAK,UAAU,MAAM;QACnB,aAAa,CAAC,eAAe,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QAED,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,CAAC;QACjB,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB;IAElB,KAAK,UAAU,cAAc;QAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,cAAc,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,mCAAmC;YACnC,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,6EAA6E;QAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,yCAAyC;IACvG,CAAC;IAED,gBAAgB;IAEhB,KAAK,UAAU,KAAK;QAClB,iCAAiC;QACjC,cAAc,EAAE,CAAC;QAEjB,mCAAmC;QACnC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACxC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;YAEtC,uEAAuE;YACvE,+DAA+D;YAC/D,kEAAkE;YAClE,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,cAAc,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;gBAC7C,WAAW,EAAE,CAAC;gBACd,cAAc,EAAE,CAAC;gBACjB,WAAW,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,kBAAkB;IAElB,SAAS,OAAO;QACd,SAAS,GAAG,IAAI,CAAC;QACjB,aAAa,CAAC,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,oBAAoB;IAEpB,SAAS,cAAc;QACrB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,SAAS,iBAAiB;QACxB,OAAO,WAAW,KAAK,IAAI,CAAC;IAC9B,CAAC;IAED,SAAS,SAAS;QAChB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,KAAK;QACL,MAAM;QACN,cAAc;QACd,KAAK;QACL,OAAO;QACP,cAAc;QACd,eAAe,EAAE,iBAAiB;QAClC,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/auth/persistence.d.ts

@@ -0,0 +1,21 @@
+import type { AuthUser } from './types.js';
+export interface PersistedAuthData {
+    refreshToken: string;
+    user: Pick<AuthUser, 'id' | 'email' | 'name' | 'avatar' | 'role' | 'roles' | 'metadata'>;
+}
+export interface AuthPersistence {
+    save: (data: PersistedAuthData) => void;
+    restore: () => PersistedAuthData | null;
+    clear: () => void;
+}
+/**
+ * Creates an auth persistence adapter.
+ *
+ * - "memory": data lives in a closure variable. Lost on page refresh.
+ * - "local": uses localStorage (or injectable storage). Survives browser close.
+ * - "session": uses sessionStorage (or injectable storage). Lost on browser close.
+ *
+ * Injectable storage parameter enables testing without real localStorage/sessionStorage.
+ */
+export declare function createAuthPersistence(mode: 'local' | 'session' | 'memory', storage?: Storage): AuthPersistence;
+//# sourceMappingURL=persistence.d.ts.map

package/dist/auth/persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACxC,OAAO,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IACxC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,EACpC,OAAO,CAAC,EAAE,OAAO,GAChB,eAAe,CAOjB"}

package/dist/auth/persistence.js

@@ -0,0 +1,97 @@
+const STORAGE_KEY = 'mythik_auth';
+/**
+ * Creates an auth persistence adapter.
+ *
+ * - "memory": data lives in a closure variable. Lost on page refresh.
+ * - "local": uses localStorage (or injectable storage). Survives browser close.
+ * - "session": uses sessionStorage (or injectable storage). Lost on browser close.
+ *
+ * Injectable storage parameter enables testing without real localStorage/sessionStorage.
+ */
+export function createAuthPersistence(mode, storage) {
+    if (mode === 'memory') {
+        return createMemoryPersistence();
+    }
+    const store = storage ?? (mode === 'local' ? globalThis.localStorage : globalThis.sessionStorage);
+    return createStoragePersistence(store);
+}
+// ─── Memory adapter ───
+function createMemoryPersistence() {
+    let data = null;
+    return {
+        save(d) {
+            data = { ...d, user: { ...d.user } };
+        },
+        restore() {
+            return data ? { ...data, user: { ...data.user } } : null;
+        },
+        clear() {
+            data = null;
+        },
+    };
+}
+// ─── Storage adapter (localStorage / sessionStorage) ───
+function createStoragePersistence(storage) {
+    return {
+        save(data) {
+            try {
+                const serialized = JSON.stringify({
+                    refreshToken: data.refreshToken,
+                    user: {
+                        id: data.user.id,
+                        email: data.user.email,
+                        name: data.user.name,
+                        avatar: data.user.avatar,
+                        role: data.user.role,
+                        roles: data.user.roles,
+                        metadata: data.user.metadata,
+                    },
+                });
+                storage.setItem(STORAGE_KEY, serialized);
+            }
+            catch {
+                // Storage full or unavailable — fail silently
+            }
+        },
+        restore() {
+            try {
+                const raw = storage.getItem(STORAGE_KEY);
+                if (!raw)
+                    return null;
+                const parsed = JSON.parse(raw);
+                // Validate shape — reject incomplete data to prevent silent corruption
+                if (!parsed ||
+                    typeof parsed.refreshToken !== 'string' ||
+                    !parsed.user ||
+                    typeof parsed.user.id !== 'string' ||
+                    typeof parsed.user.email !== 'string' ||
+                    typeof parsed.user.role !== 'string' ||
+                    !Array.isArray(parsed.user.roles)) {
+                    try {
+                        storage.removeItem(STORAGE_KEY);
+                    }
+                    catch { /* ignore */ }
+                    return null;
+                }
+                return parsed;
+            }
+            catch {
+                // Corrupted data — clear and return null
+                try {
+                    storage.removeItem(STORAGE_KEY);
+                }
+                catch { /* ignore */ }
+                return null;
+            }
+        },
+        clear() {
+            try {
+                storage.removeItem(STORAGE_KEY);
+            }
+            catch {
+                // Storage unavailable — fail silently
+            }
+        },
+    };
+}
+//# sourceMappingURL=persistence.js.map

package/dist/auth/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../../src/auth/persistence.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG,aAAa,CAAC;AAalC;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoC,EACpC,OAAiB;IAEjB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAClG,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,yBAAyB;AAEzB,SAAS,uBAAuB;IAC9B,IAAI,IAAI,GAA6B,IAAI,CAAC;IAE1C,OAAO;QACL,IAAI,CAAC,CAAoB;YACvB,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,OAAO;YACL,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,CAAC;QACD,KAAK;YACH,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0DAA0D;AAE1D,SAAS,wBAAwB,CAAC,OAAgB;IAChD,OAAO;QACL,IAAI,CAAC,IAAuB;YAC1B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;oBAChC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,IAAI,EAAE;wBACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;wBAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;wBACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;wBACpB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;wBACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;wBACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;wBACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;qBAC7B;iBACF,CAAC,CAAC;gBACH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,uEAAuE;gBACvE,IACE,CAAC,MAAM;oBACP,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;oBACvC,CAAC,MAAM,CAAC,IAAI;oBACZ,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ;oBAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ;oBACrC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;oBACpC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;oBACD,IAAI,CAAC;wBAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;oBAC/D,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO,MAA2B,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;gBACzC,IAAI,CAAC;oBAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK;YACH,IAAI,CAAC;gBACH,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/providers/custom-jwt.d.ts

@@ -0,0 +1,41 @@
+import type { AuthProvider } from '../types.js';
+export interface CustomJWTProviderConfig {
+    /** POST endpoint for login. */
+    loginUrl: string;
+    /** POST endpoint for token refresh. Optional — if absent, refresh is unsupported. */
+    refreshUrl?: string;
+    /** POST/DELETE endpoint for logout. Optional — if absent, logout is client-side only. */
+    logoutUrl?: string;
+    /** Request body template. Use "$email" and "$password" as placeholders replaced at runtime. */
+    loginBody?: Record<string, unknown>;
+    /** Dot-notation path to access token in login/refresh response. Default: "token". */
+    tokenPath?: string;
+    /** Dot-notation path to refresh token in response. Default: "refreshToken". */
+    refreshTokenPath?: string;
+    /** Dot-notation path to user object in response. Default: "user". */
+    userPath?: string;
+    /** Path to primary role. Plain keys resolve inside userPath; dotted paths resolve from the full response. Default: "role". */
+    rolePath?: string;
+    /** Path to roles array. Plain keys resolve inside userPath; dotted paths resolve from the full response. Default: "roles". */
+    rolesPath?: string;
+    /** Dot-notation path to expiresIn (seconds) in response. Optional. */
+    expiresInPath?: string;
+    /** Default role when none found in response. Default: "user". */
+    defaultRole?: string;
+    /** Custom fetch function for testing. Defaults to globalThis.fetch. */
+    fetcher?: typeof globalThis.fetch;
+}
+/**
+ * Custom JWT Provider — configurable endpoints and response mapping.
+ *
+ * Usage:
+ *   const provider = createCustomJWTProvider({
+ *     loginUrl: 'https://api.example.com/auth/login',
+ *     refreshUrl: 'https://api.example.com/auth/refresh',
+ *     tokenPath: 'data.access_token',
+ *     userPath: 'data.user',
+ *     rolePath: 'role', // relative to data.user; use 'data.user.role' for full-response paths
+ *   });
+ */
+export declare function createCustomJWTProvider(config: CustomJWTProviderConfig): AuthProvider;
+//# sourceMappingURL=custom-jwt.d.ts.map

package/dist/auth/providers/custom-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/custom-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AAEtE,MAAM,WAAW,uBAAuB;IACtC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8HAA8H;IAC9H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8HAA8H;IAC9H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACnC;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,YAAY,CAmGrF"}