vaporauth-js 0.1.0

package/README.md

@@ -0,0 +1,52 @@
+# vaporauth-js
+
+Supabase-style JavaScript client for VaporAuth backends.
+
+## Install
+
+```bash
+npm i vaporauth-js
+```
+
+## Usage
+
+```ts
+import { createVaporAuthClient } from 'vaporauth-js';
+
+const auth = createVaporAuthClient({
+  apiUrl: 'https://api.example.com'
+});
+
+const signIn = await auth.auth.signInWithPassword({
+  email: 'user@example.com',
+  password: 'secret'
+});
+
+if (signIn.error) {
+  console.error(signIn.error.message);
+} else {
+  const { data } = await auth.auth.getUser();
+  console.log(data?.user);
+}
+```
+
+## API
+
+- `createVaporAuthClient(options)`
+- `auth.signInWithPassword({ email, password })`
+- `auth.signOut({ scope?: 'global' | 'local' })`
+- `auth.getSession()`
+- `auth.getUser()`
+- `auth.refreshSession(refreshToken?)`
+- `auth.setSession(session | null)`
+- `auth.fetch(input, init?)` (adds bearer token, refreshes once on `401`)
+- `auth.onAuthStateChange((event, session) => void)`
+
+## Notes
+
+- Expects backend endpoints:
+  - `POST /auth/token`
+  - `GET /auth/me`
+  - `POST /auth/logout`
+- Includes browser + memory + cookie storage adapters.
+- Supports cross-tab sync (`BroadcastChannel` + storage events) and auto-refresh.

package/dist/index.cjs

@@ -0,0 +1,476 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  browserStorage: () => browserStorage,
+  cookieStorage: () => cookieStorage,
+  createVaporAuthClient: () => createVaporAuthClient,
+  memoryStorage: () => memoryStorage
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/adapters.ts
+function browserStorage() {
+  if (typeof window === "undefined" || !window.localStorage) {
+    return memoryStorage();
+  }
+  return {
+    getItem: (key) => window.localStorage.getItem(key),
+    setItem: (key, value) => {
+      window.localStorage.setItem(key, value);
+    },
+    removeItem: (key) => {
+      window.localStorage.removeItem(key);
+    }
+  };
+}
+function memoryStorage(seed) {
+  const state = new Map(Object.entries(seed ?? {}));
+  return {
+    getItem: (key) => state.get(key) ?? null,
+    setItem: (key, value) => {
+      state.set(key, value);
+    },
+    removeItem: (key) => {
+      state.delete(key);
+    }
+  };
+}
+function cookieStorage(read, write) {
+  return {
+    getItem: () => read(),
+    setItem: (_, value) => {
+      write(value);
+    },
+    removeItem: () => {
+      write(null);
+    }
+  };
+}
+
+// src/index.ts
+var DEFAULT_STORAGE_KEY = "vaporauth.session";
+var DEFAULT_REFRESH_MARGIN_MS = 6e4;
+var TAB_SYNC_CHANNEL = "vaporauth.sync";
+function createVaporAuthClient(options) {
+  const state = new VaporAuthState(options);
+  return {
+    auth: {
+      signInWithPassword: (credentials) => state.signInWithPassword(credentials),
+      signOut: (signOutOptions) => state.signOut(signOutOptions),
+      getSession: () => state.getSession(),
+      getUser: () => state.getUser(),
+      refreshSession: (refreshToken) => state.refreshSession(refreshToken),
+      setSession: (session) => state.setSession(session),
+      fetch: (input, init) => state.authFetch(input, init),
+      onAuthStateChange: (callback) => state.onAuthStateChange(callback)
+    }
+  };
+}
+var VaporAuthState = class {
+  apiUrl;
+  fetcher;
+  storage;
+  storageKey;
+  persistSession;
+  autoRefreshToken;
+  refreshMarginMs;
+  headers;
+  multiTab;
+  session = null;
+  sessionLoaded = false;
+  listeners = /* @__PURE__ */ new Set();
+  refreshTimer = null;
+  inFlightRefresh = null;
+  channel = null;
+  instanceID = Math.random().toString(36).slice(2);
+  constructor(options) {
+    this.apiUrl = options.apiUrl.replace(/\/$/, "");
+    this.fetcher = options.fetch ?? globalThis.fetch;
+    this.storage = options.storage ?? browserStorage();
+    this.storageKey = options.storageKey ?? DEFAULT_STORAGE_KEY;
+    this.persistSession = options.persistSession ?? true;
+    this.autoRefreshToken = options.autoRefreshToken ?? true;
+    this.refreshMarginMs = options.refreshMarginMs ?? DEFAULT_REFRESH_MARGIN_MS;
+    this.headers = options.headers ?? {};
+    this.multiTab = options.multiTab ?? true;
+    this.setupBrowserLifecycle();
+  }
+  onAuthStateChange(callback) {
+    this.listeners.add(callback);
+    void this.ensureSessionLoaded().then(() => {
+      callback("INITIAL_SESSION", this.session);
+    });
+    return {
+      data: {
+        subscription: {
+          unsubscribe: () => {
+            this.listeners.delete(callback);
+          }
+        }
+      }
+    };
+  }
+  async signInWithPassword(credentials) {
+    const response = await this.fetchJson("/auth/token", {
+      method: "POST",
+      body: JSON.stringify({
+        grant_type: "password",
+        email: credentials.email,
+        password: credentials.password
+      })
+    });
+    if (response.error || !response.data) {
+      return { data: null, error: response.error ?? makeError("Failed to sign in") };
+    }
+    const session = toSession(response.data);
+    await this.replaceSession(session, "SIGNED_IN", true);
+    return {
+      data: {
+        session,
+        user: session.user
+      },
+      error: null
+    };
+  }
+  async signOut(options = {}) {
+    await this.ensureSessionLoaded();
+    if (options.scope !== "local" && this.session?.refresh_token) {
+      await this.fetchJson("/auth/logout", {
+        method: "POST",
+        body: JSON.stringify({ refresh_token: this.session.refresh_token })
+      });
+    }
+    await this.replaceSession(null, "SIGNED_OUT", true);
+    return { data: null, error: null };
+  }
+  async getSession() {
+    await this.ensureSessionLoaded();
+    if (this.session && isExpired(this.session)) {
+      const refreshed = await this.refreshSession();
+      if (refreshed.error) {
+        return { data: { session: null }, error: null };
+      }
+    }
+    return { data: { session: this.session }, error: null };
+  }
+  async getUser() {
+    await this.ensureSessionLoaded();
+    if (!this.session?.access_token) {
+      return { data: null, error: makeError("No active session") };
+    }
+    const response = await this.fetchWithAuth("/auth/me", {
+      method: "GET"
+    });
+    if (response.error || !response.data) {
+      return { data: null, error: response.error ?? makeError("Failed to fetch user") };
+    }
+    this.session = {
+      ...this.session,
+      user: response.data
+    };
+    await this.persistCurrentSession();
+    return { data: { user: response.data }, error: null };
+  }
+  async refreshSession(refreshToken) {
+    await this.ensureSessionLoaded();
+    if (this.inFlightRefresh) {
+      return this.inFlightRefresh;
+    }
+    const currentRefreshToken = refreshToken ?? this.session?.refresh_token;
+    if (!currentRefreshToken) {
+      return { data: null, error: makeError("No refresh token available") };
+    }
+    const refreshPromise = (async () => {
+      const response = await this.fetchJson("/auth/token", {
+        method: "POST",
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          refresh_token: currentRefreshToken
+        })
+      });
+      if (response.error || !response.data) {
+        await this.replaceSession(null, "SESSION_EXPIRED", true);
+        return { data: null, error: response.error ?? makeError("Failed to refresh session") };
+      }
+      const session = toSession(response.data);
+      await this.replaceSession(session, "TOKEN_REFRESHED", true);
+      return { data: { session }, error: null };
+    })();
+    this.inFlightRefresh = refreshPromise;
+    try {
+      return await refreshPromise;
+    } finally {
+      this.inFlightRefresh = null;
+    }
+  }
+  async setSession(session) {
+    await this.replaceSession(session, session ? "SIGNED_IN" : "SIGNED_OUT", true);
+    return { data: { session }, error: null };
+  }
+  async authFetch(input, init = {}) {
+    await this.ensureSessionLoaded();
+    const execute = (token) => {
+      const headers = new Headers(init.headers ?? void 0);
+      if (token) {
+        headers.set("Authorization", `Bearer ${token}`);
+      }
+      return this.fetcher(input, {
+        ...init,
+        headers
+      });
+    };
+    const first = await execute(this.session?.access_token);
+    if (first.status !== 401) {
+      return first;
+    }
+    const refreshed = await this.refreshSession();
+    if (refreshed.error || !this.session?.access_token) {
+      return first;
+    }
+    return execute(this.session.access_token);
+  }
+  async fetchWithAuth(path, init) {
+    await this.ensureSessionLoaded();
+    const firstTry = await this.fetchJson(path, {
+      ...init,
+      headers: {
+        ...init.headers ?? {},
+        ...this.session?.access_token ? {
+          Authorization: `Bearer ${this.session.access_token}`
+        } : {}
+      }
+    });
+    if (firstTry.error?.status !== 401) {
+      return firstTry;
+    }
+    const refreshed = await this.refreshSession();
+    if (refreshed.error || !this.session?.access_token) {
+      return firstTry;
+    }
+    return this.fetchJson(path, {
+      ...init,
+      headers: {
+        ...init.headers ?? {},
+        Authorization: `Bearer ${this.session.access_token}`
+      }
+    });
+  }
+  async fetchJson(path, init) {
+    try {
+      const response = await this.fetcher(`${this.apiUrl}${path}`, {
+        ...init,
+        headers: {
+          "content-type": "application/json",
+          ...this.headers,
+          ...init.headers ?? {}
+        }
+      });
+      const isJson = response.headers.get("content-type")?.includes("application/json") ?? false;
+      const body = isJson ? await response.json() : null;
+      if (!response.ok) {
+        return {
+          data: null,
+          error: makeError(
+            parseErrorMessage(body) ?? `Request failed with status ${response.status}`,
+            response.status,
+            typeof body?.code === "string" ? body.code : void 0,
+            body
+          )
+        };
+      }
+      return { data: body, error: null };
+    } catch (error) {
+      return { data: null, error: makeError("Network error", void 0, void 0, error) };
+    }
+  }
+  async ensureSessionLoaded() {
+    if (this.sessionLoaded) {
+      return;
+    }
+    this.sessionLoaded = true;
+    if (!this.persistSession) {
+      return;
+    }
+    const raw = await this.storage.getItem(this.storageKey);
+    if (!raw) {
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      this.session = parsed;
+      this.scheduleRefresh();
+    } catch {
+      await this.storage.removeItem(this.storageKey);
+      this.session = null;
+    }
+  }
+  async replaceSession(session, event, broadcast) {
+    this.session = session;
+    await this.persistCurrentSession();
+    this.scheduleRefresh();
+    if (broadcast) {
+      this.broadcastSession();
+    }
+    this.emit(event);
+  }
+  async persistCurrentSession() {
+    if (!this.persistSession) {
+      return;
+    }
+    if (this.session) {
+      await this.storage.setItem(this.storageKey, JSON.stringify(this.session));
+    } else {
+      await this.storage.removeItem(this.storageKey);
+    }
+  }
+  scheduleRefresh() {
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer);
+      this.refreshTimer = null;
+    }
+    if (!this.autoRefreshToken || !this.session) {
+      return;
+    }
+    const refreshAtMs = this.session.expires_at * 1e3 - this.refreshMarginMs;
+    const delay = Math.max(0, refreshAtMs - Date.now());
+    this.refreshTimer = setTimeout(() => {
+      void this.refreshSession();
+    }, delay);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      listener(event, this.session);
+    }
+  }
+  setupBrowserLifecycle() {
+    if (typeof window === "undefined") {
+      return;
+    }
+    const triggerRefresh = () => {
+      if (!this.autoRefreshToken || !this.session) {
+        return;
+      }
+      const refreshAt = this.session.expires_at * 1e3 - this.refreshMarginMs;
+      if (Date.now() >= refreshAt) {
+        void this.refreshSession();
+      } else {
+        this.scheduleRefresh();
+      }
+    };
+    window.addEventListener("focus", triggerRefresh);
+    document.addEventListener("visibilitychange", () => {
+      if (!document.hidden) {
+        triggerRefresh();
+      }
+    });
+    if (!this.multiTab) {
+      return;
+    }
+    window.addEventListener("storage", (event) => {
+      if (event.key !== this.storageKey) {
+        return;
+      }
+      void this.syncFromStorage(event.newValue);
+    });
+    if (typeof BroadcastChannel !== "undefined") {
+      this.channel = new BroadcastChannel(TAB_SYNC_CHANNEL);
+      this.channel.addEventListener("message", (event) => {
+        const payload = event.data;
+        if (!payload || payload.instanceID === this.instanceID || payload.storageKey !== this.storageKey) {
+          return;
+        }
+        void this.syncFromStorage(payload.rawSession ?? null);
+      });
+    }
+  }
+  async syncFromStorage(raw) {
+    let nextSession = null;
+    if (raw) {
+      try {
+        nextSession = JSON.parse(raw);
+      } catch {
+        nextSession = null;
+      }
+    }
+    const currentRaw = this.session ? JSON.stringify(this.session) : null;
+    const nextRaw = nextSession ? JSON.stringify(nextSession) : null;
+    if (currentRaw === nextRaw) {
+      return;
+    }
+    const event = nextSession == null ? "SIGNED_OUT" : this.session == null ? "SIGNED_IN" : "TOKEN_REFRESHED";
+    await this.replaceSession(nextSession, event, false);
+  }
+  broadcastSession() {
+    if (!this.multiTab || !this.channel) {
+      return;
+    }
+    const rawSession = this.session ? JSON.stringify(this.session) : null;
+    this.channel.postMessage({
+      instanceID: this.instanceID,
+      storageKey: this.storageKey,
+      rawSession
+    });
+  }
+};
+function toSession(payload) {
+  return {
+    access_token: payload.access_token,
+    refresh_token: payload.refresh_token,
+    token_type: payload.token_type,
+    expires_in: payload.expires_in,
+    expires_at: Math.floor(Date.now() / 1e3) + payload.expires_in,
+    user: payload.user
+  };
+}
+function parseErrorMessage(body) {
+  if (!body || typeof body !== "object") {
+    return null;
+  }
+  const candidate = body;
+  const keys = ["error_description", "msg", "message", "error"];
+  for (const key of keys) {
+    const value = candidate[key];
+    if (typeof value === "string" && value.trim().length > 0) {
+      return value;
+    }
+  }
+  return null;
+}
+function makeError(message, status, code, cause) {
+  return {
+    name: "VaporAuthError",
+    message,
+    status,
+    code,
+    cause
+  };
+}
+function isExpired(session) {
+  return session.expires_at * 1e3 <= Date.now();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  browserStorage,
+  cookieStorage,
+  createVaporAuthClient,
+  memoryStorage
+});

package/dist/index.d.cts

@@ -0,0 +1,88 @@
+type VaporAuthUser = {
+    id: string;
+    email?: string | null;
+    role?: string | null;
+    aud?: string | null;
+    created_at?: string | null;
+    updated_at?: string | null;
+};
+type VaporAuthSession = {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    expires_at: number;
+    user?: VaporAuthUser;
+};
+type VaporAuthError = {
+    name: 'VaporAuthError';
+    message: string;
+    status?: number;
+    code?: string;
+    cause?: unknown;
+};
+type VaporAuthResponse<T> = Promise<{
+    data: T | null;
+    error: VaporAuthError | null;
+}>;
+type VaporAuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'SESSION_EXPIRED';
+type VaporAuthStorage = {
+    getItem: (key: string) => string | null | Promise<string | null>;
+    setItem: (key: string, value: string) => void | Promise<void>;
+    removeItem: (key: string) => void | Promise<void>;
+};
+type VaporAuthClientOptions = {
+    apiUrl: string;
+    fetch?: typeof fetch;
+    storage?: VaporAuthStorage;
+    storageKey?: string;
+    persistSession?: boolean;
+    autoRefreshToken?: boolean;
+    refreshMarginMs?: number;
+    headers?: Record<string, string>;
+    multiTab?: boolean;
+};
+type SignInWithPasswordCredentials = {
+    email: string;
+    password: string;
+};
+type OnAuthStateChangeCallback = (event: VaporAuthChangeEvent, session: VaporAuthSession | null) => void;
+type VaporAuthClient = {
+    auth: {
+        signInWithPassword: (credentials: SignInWithPasswordCredentials) => VaporAuthResponse<{
+            session: VaporAuthSession;
+            user: VaporAuthUser | undefined;
+        }>;
+        signOut: (options?: {
+            scope?: 'global' | 'local';
+        }) => VaporAuthResponse<null>;
+        getSession: () => VaporAuthResponse<{
+            session: VaporAuthSession | null;
+        }>;
+        getUser: () => VaporAuthResponse<{
+            user: VaporAuthUser;
+        }>;
+        refreshSession: (refreshToken?: string) => VaporAuthResponse<{
+            session: VaporAuthSession;
+        }>;
+        setSession: (session: VaporAuthSession | null) => VaporAuthResponse<{
+            session: VaporAuthSession | null;
+        }>;
+        fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
+        onAuthStateChange: (callback: OnAuthStateChangeCallback) => {
+            data: {
+                subscription: {
+                    unsubscribe: () => void;
+                };
+            };
+        };
+    };
+};
+
+declare function browserStorage(): VaporAuthStorage;
+declare function memoryStorage(seed?: Record<string, string>): VaporAuthStorage;
+declare function cookieStorage(read: () => string | null, write: (value: string | null) => void): VaporAuthStorage;
+
+declare function createVaporAuthClient(options: VaporAuthClientOptions): VaporAuthClient;
+
+export { type OnAuthStateChangeCallback, type SignInWithPasswordCredentials, type VaporAuthChangeEvent, type VaporAuthClient, type VaporAuthClientOptions, type VaporAuthError, type VaporAuthResponse, type VaporAuthSession, type VaporAuthStorage, type VaporAuthUser, browserStorage, cookieStorage, createVaporAuthClient, memoryStorage };

package/dist/index.d.ts

@@ -0,0 +1,88 @@
+type VaporAuthUser = {
+    id: string;
+    email?: string | null;
+    role?: string | null;
+    aud?: string | null;
+    created_at?: string | null;
+    updated_at?: string | null;
+};
+type VaporAuthSession = {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    expires_at: number;
+    user?: VaporAuthUser;
+};
+type VaporAuthError = {
+    name: 'VaporAuthError';
+    message: string;
+    status?: number;
+    code?: string;
+    cause?: unknown;
+};
+type VaporAuthResponse<T> = Promise<{
+    data: T | null;
+    error: VaporAuthError | null;
+}>;
+type VaporAuthChangeEvent = 'INITIAL_SESSION' | 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'SESSION_EXPIRED';
+type VaporAuthStorage = {
+    getItem: (key: string) => string | null | Promise<string | null>;
+    setItem: (key: string, value: string) => void | Promise<void>;
+    removeItem: (key: string) => void | Promise<void>;
+};
+type VaporAuthClientOptions = {
+    apiUrl: string;
+    fetch?: typeof fetch;
+    storage?: VaporAuthStorage;
+    storageKey?: string;
+    persistSession?: boolean;
+    autoRefreshToken?: boolean;
+    refreshMarginMs?: number;
+    headers?: Record<string, string>;
+    multiTab?: boolean;
+};
+type SignInWithPasswordCredentials = {
+    email: string;
+    password: string;
+};
+type OnAuthStateChangeCallback = (event: VaporAuthChangeEvent, session: VaporAuthSession | null) => void;
+type VaporAuthClient = {
+    auth: {
+        signInWithPassword: (credentials: SignInWithPasswordCredentials) => VaporAuthResponse<{
+            session: VaporAuthSession;
+            user: VaporAuthUser | undefined;
+        }>;
+        signOut: (options?: {
+            scope?: 'global' | 'local';
+        }) => VaporAuthResponse<null>;
+        getSession: () => VaporAuthResponse<{
+            session: VaporAuthSession | null;
+        }>;
+        getUser: () => VaporAuthResponse<{
+            user: VaporAuthUser;
+        }>;
+        refreshSession: (refreshToken?: string) => VaporAuthResponse<{
+            session: VaporAuthSession;
+        }>;
+        setSession: (session: VaporAuthSession | null) => VaporAuthResponse<{
+            session: VaporAuthSession | null;
+        }>;
+        fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
+        onAuthStateChange: (callback: OnAuthStateChangeCallback) => {
+            data: {
+                subscription: {
+                    unsubscribe: () => void;
+                };
+            };
+        };
+    };
+};
+
+declare function browserStorage(): VaporAuthStorage;
+declare function memoryStorage(seed?: Record<string, string>): VaporAuthStorage;
+declare function cookieStorage(read: () => string | null, write: (value: string | null) => void): VaporAuthStorage;
+
+declare function createVaporAuthClient(options: VaporAuthClientOptions): VaporAuthClient;
+
+export { type OnAuthStateChangeCallback, type SignInWithPasswordCredentials, type VaporAuthChangeEvent, type VaporAuthClient, type VaporAuthClientOptions, type VaporAuthError, type VaporAuthResponse, type VaporAuthSession, type VaporAuthStorage, type VaporAuthUser, browserStorage, cookieStorage, createVaporAuthClient, memoryStorage };

package/dist/index.js

@@ -0,0 +1,446 @@
+// src/adapters.ts
+function browserStorage() {
+  if (typeof window === "undefined" || !window.localStorage) {
+    return memoryStorage();
+  }
+  return {
+    getItem: (key) => window.localStorage.getItem(key),
+    setItem: (key, value) => {
+      window.localStorage.setItem(key, value);
+    },
+    removeItem: (key) => {
+      window.localStorage.removeItem(key);
+    }
+  };
+}
+function memoryStorage(seed) {
+  const state = new Map(Object.entries(seed ?? {}));
+  return {
+    getItem: (key) => state.get(key) ?? null,
+    setItem: (key, value) => {
+      state.set(key, value);
+    },
+    removeItem: (key) => {
+      state.delete(key);
+    }
+  };
+}
+function cookieStorage(read, write) {
+  return {
+    getItem: () => read(),
+    setItem: (_, value) => {
+      write(value);
+    },
+    removeItem: () => {
+      write(null);
+    }
+  };
+}
+
+// src/index.ts
+var DEFAULT_STORAGE_KEY = "vaporauth.session";
+var DEFAULT_REFRESH_MARGIN_MS = 6e4;
+var TAB_SYNC_CHANNEL = "vaporauth.sync";
+function createVaporAuthClient(options) {
+  const state = new VaporAuthState(options);
+  return {
+    auth: {
+      signInWithPassword: (credentials) => state.signInWithPassword(credentials),
+      signOut: (signOutOptions) => state.signOut(signOutOptions),
+      getSession: () => state.getSession(),
+      getUser: () => state.getUser(),
+      refreshSession: (refreshToken) => state.refreshSession(refreshToken),
+      setSession: (session) => state.setSession(session),
+      fetch: (input, init) => state.authFetch(input, init),
+      onAuthStateChange: (callback) => state.onAuthStateChange(callback)
+    }
+  };
+}
+var VaporAuthState = class {
+  apiUrl;
+  fetcher;
+  storage;
+  storageKey;
+  persistSession;
+  autoRefreshToken;
+  refreshMarginMs;
+  headers;
+  multiTab;
+  session = null;
+  sessionLoaded = false;
+  listeners = /* @__PURE__ */ new Set();
+  refreshTimer = null;
+  inFlightRefresh = null;
+  channel = null;
+  instanceID = Math.random().toString(36).slice(2);
+  constructor(options) {
+    this.apiUrl = options.apiUrl.replace(/\/$/, "");
+    this.fetcher = options.fetch ?? globalThis.fetch;
+    this.storage = options.storage ?? browserStorage();
+    this.storageKey = options.storageKey ?? DEFAULT_STORAGE_KEY;
+    this.persistSession = options.persistSession ?? true;
+    this.autoRefreshToken = options.autoRefreshToken ?? true;
+    this.refreshMarginMs = options.refreshMarginMs ?? DEFAULT_REFRESH_MARGIN_MS;
+    this.headers = options.headers ?? {};
+    this.multiTab = options.multiTab ?? true;
+    this.setupBrowserLifecycle();
+  }
+  onAuthStateChange(callback) {
+    this.listeners.add(callback);
+    void this.ensureSessionLoaded().then(() => {
+      callback("INITIAL_SESSION", this.session);
+    });
+    return {
+      data: {
+        subscription: {
+          unsubscribe: () => {
+            this.listeners.delete(callback);
+          }
+        }
+      }
+    };
+  }
+  async signInWithPassword(credentials) {
+    const response = await this.fetchJson("/auth/token", {
+      method: "POST",
+      body: JSON.stringify({
+        grant_type: "password",
+        email: credentials.email,
+        password: credentials.password
+      })
+    });
+    if (response.error || !response.data) {
+      return { data: null, error: response.error ?? makeError("Failed to sign in") };
+    }
+    const session = toSession(response.data);
+    await this.replaceSession(session, "SIGNED_IN", true);
+    return {
+      data: {
+        session,
+        user: session.user
+      },
+      error: null
+    };
+  }
+  async signOut(options = {}) {
+    await this.ensureSessionLoaded();
+    if (options.scope !== "local" && this.session?.refresh_token) {
+      await this.fetchJson("/auth/logout", {
+        method: "POST",
+        body: JSON.stringify({ refresh_token: this.session.refresh_token })
+      });
+    }
+    await this.replaceSession(null, "SIGNED_OUT", true);
+    return { data: null, error: null };
+  }
+  async getSession() {
+    await this.ensureSessionLoaded();
+    if (this.session && isExpired(this.session)) {
+      const refreshed = await this.refreshSession();
+      if (refreshed.error) {
+        return { data: { session: null }, error: null };
+      }
+    }
+    return { data: { session: this.session }, error: null };
+  }
+  async getUser() {
+    await this.ensureSessionLoaded();
+    if (!this.session?.access_token) {
+      return { data: null, error: makeError("No active session") };
+    }
+    const response = await this.fetchWithAuth("/auth/me", {
+      method: "GET"
+    });
+    if (response.error || !response.data) {
+      return { data: null, error: response.error ?? makeError("Failed to fetch user") };
+    }
+    this.session = {
+      ...this.session,
+      user: response.data
+    };
+    await this.persistCurrentSession();
+    return { data: { user: response.data }, error: null };
+  }
+  async refreshSession(refreshToken) {
+    await this.ensureSessionLoaded();
+    if (this.inFlightRefresh) {
+      return this.inFlightRefresh;
+    }
+    const currentRefreshToken = refreshToken ?? this.session?.refresh_token;
+    if (!currentRefreshToken) {
+      return { data: null, error: makeError("No refresh token available") };
+    }
+    const refreshPromise = (async () => {
+      const response = await this.fetchJson("/auth/token", {
+        method: "POST",
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          refresh_token: currentRefreshToken
+        })
+      });
+      if (response.error || !response.data) {
+        await this.replaceSession(null, "SESSION_EXPIRED", true);
+        return { data: null, error: response.error ?? makeError("Failed to refresh session") };
+      }
+      const session = toSession(response.data);
+      await this.replaceSession(session, "TOKEN_REFRESHED", true);
+      return { data: { session }, error: null };
+    })();
+    this.inFlightRefresh = refreshPromise;
+    try {
+      return await refreshPromise;
+    } finally {
+      this.inFlightRefresh = null;
+    }
+  }
+  async setSession(session) {
+    await this.replaceSession(session, session ? "SIGNED_IN" : "SIGNED_OUT", true);
+    return { data: { session }, error: null };
+  }
+  async authFetch(input, init = {}) {
+    await this.ensureSessionLoaded();
+    const execute = (token) => {
+      const headers = new Headers(init.headers ?? void 0);
+      if (token) {
+        headers.set("Authorization", `Bearer ${token}`);
+      }
+      return this.fetcher(input, {
+        ...init,
+        headers
+      });
+    };
+    const first = await execute(this.session?.access_token);
+    if (first.status !== 401) {
+      return first;
+    }
+    const refreshed = await this.refreshSession();
+    if (refreshed.error || !this.session?.access_token) {
+      return first;
+    }
+    return execute(this.session.access_token);
+  }
+  async fetchWithAuth(path, init) {
+    await this.ensureSessionLoaded();
+    const firstTry = await this.fetchJson(path, {
+      ...init,
+      headers: {
+        ...init.headers ?? {},
+        ...this.session?.access_token ? {
+          Authorization: `Bearer ${this.session.access_token}`
+        } : {}
+      }
+    });
+    if (firstTry.error?.status !== 401) {
+      return firstTry;
+    }
+    const refreshed = await this.refreshSession();
+    if (refreshed.error || !this.session?.access_token) {
+      return firstTry;
+    }
+    return this.fetchJson(path, {
+      ...init,
+      headers: {
+        ...init.headers ?? {},
+        Authorization: `Bearer ${this.session.access_token}`
+      }
+    });
+  }
+  async fetchJson(path, init) {
+    try {
+      const response = await this.fetcher(`${this.apiUrl}${path}`, {
+        ...init,
+        headers: {
+          "content-type": "application/json",
+          ...this.headers,
+          ...init.headers ?? {}
+        }
+      });
+      const isJson = response.headers.get("content-type")?.includes("application/json") ?? false;
+      const body = isJson ? await response.json() : null;
+      if (!response.ok) {
+        return {
+          data: null,
+          error: makeError(
+            parseErrorMessage(body) ?? `Request failed with status ${response.status}`,
+            response.status,
+            typeof body?.code === "string" ? body.code : void 0,
+            body
+          )
+        };
+      }
+      return { data: body, error: null };
+    } catch (error) {
+      return { data: null, error: makeError("Network error", void 0, void 0, error) };
+    }
+  }
+  async ensureSessionLoaded() {
+    if (this.sessionLoaded) {
+      return;
+    }
+    this.sessionLoaded = true;
+    if (!this.persistSession) {
+      return;
+    }
+    const raw = await this.storage.getItem(this.storageKey);
+    if (!raw) {
+      return;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      this.session = parsed;
+      this.scheduleRefresh();
+    } catch {
+      await this.storage.removeItem(this.storageKey);
+      this.session = null;
+    }
+  }
+  async replaceSession(session, event, broadcast) {
+    this.session = session;
+    await this.persistCurrentSession();
+    this.scheduleRefresh();
+    if (broadcast) {
+      this.broadcastSession();
+    }
+    this.emit(event);
+  }
+  async persistCurrentSession() {
+    if (!this.persistSession) {
+      return;
+    }
+    if (this.session) {
+      await this.storage.setItem(this.storageKey, JSON.stringify(this.session));
+    } else {
+      await this.storage.removeItem(this.storageKey);
+    }
+  }
+  scheduleRefresh() {
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer);
+      this.refreshTimer = null;
+    }
+    if (!this.autoRefreshToken || !this.session) {
+      return;
+    }
+    const refreshAtMs = this.session.expires_at * 1e3 - this.refreshMarginMs;
+    const delay = Math.max(0, refreshAtMs - Date.now());
+    this.refreshTimer = setTimeout(() => {
+      void this.refreshSession();
+    }, delay);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      listener(event, this.session);
+    }
+  }
+  setupBrowserLifecycle() {
+    if (typeof window === "undefined") {
+      return;
+    }
+    const triggerRefresh = () => {
+      if (!this.autoRefreshToken || !this.session) {
+        return;
+      }
+      const refreshAt = this.session.expires_at * 1e3 - this.refreshMarginMs;
+      if (Date.now() >= refreshAt) {
+        void this.refreshSession();
+      } else {
+        this.scheduleRefresh();
+      }
+    };
+    window.addEventListener("focus", triggerRefresh);
+    document.addEventListener("visibilitychange", () => {
+      if (!document.hidden) {
+        triggerRefresh();
+      }
+    });
+    if (!this.multiTab) {
+      return;
+    }
+    window.addEventListener("storage", (event) => {
+      if (event.key !== this.storageKey) {
+        return;
+      }
+      void this.syncFromStorage(event.newValue);
+    });
+    if (typeof BroadcastChannel !== "undefined") {
+      this.channel = new BroadcastChannel(TAB_SYNC_CHANNEL);
+      this.channel.addEventListener("message", (event) => {
+        const payload = event.data;
+        if (!payload || payload.instanceID === this.instanceID || payload.storageKey !== this.storageKey) {
+          return;
+        }
+        void this.syncFromStorage(payload.rawSession ?? null);
+      });
+    }
+  }
+  async syncFromStorage(raw) {
+    let nextSession = null;
+    if (raw) {
+      try {
+        nextSession = JSON.parse(raw);
+      } catch {
+        nextSession = null;
+      }
+    }
+    const currentRaw = this.session ? JSON.stringify(this.session) : null;
+    const nextRaw = nextSession ? JSON.stringify(nextSession) : null;
+    if (currentRaw === nextRaw) {
+      return;
+    }
+    const event = nextSession == null ? "SIGNED_OUT" : this.session == null ? "SIGNED_IN" : "TOKEN_REFRESHED";
+    await this.replaceSession(nextSession, event, false);
+  }
+  broadcastSession() {
+    if (!this.multiTab || !this.channel) {
+      return;
+    }
+    const rawSession = this.session ? JSON.stringify(this.session) : null;
+    this.channel.postMessage({
+      instanceID: this.instanceID,
+      storageKey: this.storageKey,
+      rawSession
+    });
+  }
+};
+function toSession(payload) {
+  return {
+    access_token: payload.access_token,
+    refresh_token: payload.refresh_token,
+    token_type: payload.token_type,
+    expires_in: payload.expires_in,
+    expires_at: Math.floor(Date.now() / 1e3) + payload.expires_in,
+    user: payload.user
+  };
+}
+function parseErrorMessage(body) {
+  if (!body || typeof body !== "object") {
+    return null;
+  }
+  const candidate = body;
+  const keys = ["error_description", "msg", "message", "error"];
+  for (const key of keys) {
+    const value = candidate[key];
+    if (typeof value === "string" && value.trim().length > 0) {
+      return value;
+    }
+  }
+  return null;
+}
+function makeError(message, status, code, cause) {
+  return {
+    name: "VaporAuthError",
+    message,
+    status,
+    code,
+    cause
+  };
+}
+function isExpired(session) {
+  return session.expires_at * 1e3 <= Date.now();
+}
+export {
+  browserStorage,
+  cookieStorage,
+  createVaporAuthClient,
+  memoryStorage
+};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "vaporauth-js",
+  "version": "0.1.0",
+  "description": "Supabase-style JavaScript client for VaporAuth backends",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "npm run clean && tsup src/index.ts --format esm,cjs --dts",
+    "check": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "vapor",
+    "auth",
+    "supabase",
+    "jwt",
+    "typescript"
+  ],
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3"
+  }
+}