@atlasauth/capacitor 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,43 @@
+# @atlasauth/capacitor changelog
+
+## 0.2.0
+
+### Changed
+- **`signOut(options?: SignOutOptions)` now resolves `Promise<SignOutResult>`** (`{ revoked: boolean; activeSessionId?: string }`)
+  instead of `Promise<void>`, and revokes the session on the Frontend API (it used to only clear local state). Existing
+  `await atlas.signOut()` call sites keep working. The revoke is authenticated as the session being dropped, retried once,
+  then re-tried in the background (a 401 from an expired JWT rotates it once with the refresh token). `{ strict: true }`
+  rejects with `SignOutError` (`code: 'SIGN_OUT_REVOKE_FAILED'`, `sessionId`, `status`) after the local sign-out.
+  `activeSessionId` (a server-promoted session) is reported but not adopted: the bearer revoke never returns a credential
+  for it.
+- **A signed-out session is never re-adopted.** Its id is remembered (a tombstone, via `SignOutGuard` from
+  `@atlasauth/js`) in the platform store before the revoke; the next app start refuses a stored session that is tombstoned
+  (and clears it), and a refresh still in flight at sign-out can no longer write the session back or resurrect it in
+  memory. A refused session's revoke is re-tried in the background and its tombstone dropped once the server confirms.
+- `getToken()` / `authHeaders()` return no bearer for a session signed out while a refresh was in flight; `onChange()`
+  listeners are not called for a signed-out session.
+
+### Added
+- `CreateAtlasCapacitorConfig.tombstoneStore?: TombstoneStore` (default: `@capacitor/preferences` when present, else the
+  WebView's `localStorage`) and `CreateAtlasCapacitorConfig.signOutRetryDelaysMs?: number[]`.
+- `createPreferencesTombstoneStore(preferences)` and `tombstoneStoreFromTokenStore(store)` adapters.
+- `NativeSessionConfig.refuse?: (session: NativeSession) => boolean` on `createNativeSessionManager()`.
+- Re-exports `SignOutError`, `SignOutOptions`, `SignOutResult` and `TombstoneStore` from `@atlasauth/js`.
+
+## 0.1.1
+- **`frontendApi` is validated at `createAtlasCapacitor()`.** A missing, empty or malformed value now throws an
+  `AtlasConfigError` (from `@atlasauth/js`; `code: 'FRONTEND_API_REQUIRED'` or `'FRONTEND_API_INVALID'`)
+  instead of silently sending requests to relative URLs on the app's own origin. Accepted: an absolute
+  `https:` URL (`http:` only for localhost / local development hosts). Native apps have no origin of their own, so `"same-origin"` is refused. A trailing slash is now normalised away.
+
+## 0.1.0
+
+First published release.
+
+### Added
+- `createAtlasCapacitor()` sets up native sign-in for Capacitor / Ionic apps on iOS, Android and web.
+- System-browser sign-in with deep-link callback and PKCE: `signInWithBrowser()`, `completeRedirectSignIn()`, `buildAuthorizeUrl()`, `parseAuthCallback()`, `redeemAuthorizationCode()`, `exchangeAuthCode()`.
+- Cookie-free native session that auto-refreshes and persists: `createNativeSessionManager()`, `clearNativeSession()`, plus re-exported `NativeSessionManager`, `exchangeForSession`, `refreshNativeSession`.
+- Token stores: `createPreferencesTokenStore()` (backed by `@capacitor/preferences`) and `createInMemoryTokenStore()`.
+- PKCE helpers `createPkcePair()` and `createState()`.
+- `loadCapacitorPlugins()` / `isNativePlatform()`; all `@capacitor/*` plugins are optional peers with graceful fallback.

package/dist/index.d.ts

@@ -16,7 +16,7 @@
  * (the sign-in flow, the token store, the PKCE helpers) is exposed for apps that
  * want to drive the pieces themselves.
  */
-import type { NativeSession, NativeSessionManager } from '@atlasauth/js';
+import { NativeSessionManager, type NativeSession, type SignOutOptions, type SignOutResult, type TombstoneStore } from '@atlasauth/js';
 import { type CapacitorPlugins } from './plugins';
 import { type SignInOutcome } from './sign-in';
 import { type TokenStore } from './token-store';
@@ -40,6 +40,19 @@ export interface CreateAtlasCapacitorConfig {
     storage?: TokenStore;
     /** Where the transient PKCE material is stashed on the WEB redirect path. */
     pkceStore?: TokenStore;
+    /**
+     * Where the ids of sessions this app signed out of are kept, so a restart
+     * never re-adopts one (even when the revoke never reached the server).
+     * Defaults to `@capacitor/preferences` when present, else the WebView's
+     * `localStorage`. Adapt a secure-storage {@link TokenStore} with
+     * `tombstoneStoreFromTokenStore()` (give it its own slot).
+     */
+    tombstoneStore?: TombstoneStore;
+    /**
+     * Delays (ms) between background re-tries of a revoke `signOut()` could not
+     * complete. @default `[15_000, 60_000, 300_000]`
+     */
+    signOutRetryDelaysMs?: number[];
     /** Inject the Capacitor plugins (tests). Defaults to a lazy, guarded load. */
     plugins?: CapacitorPlugins;
     /** Injectable for tests; defaults to the platform `fetch`. */
@@ -75,8 +88,18 @@ export interface AtlasCapacitor {
      * (or null when there is nothing to complete).
      */
     handleRedirectCallback(url?: string): Promise<NativeSession | null>;
-    /** Forget the session and clear the store (sign-out). */
-    signOut(): Promise<void>;
+    /**
+     * Sign out: remember the session id (so nothing re-adopts it — not a refresh
+     * in flight, not the next app start), revoke it on the Frontend API (retried
+     * once, then in the background, authenticated as the dropped session), and
+     * forget it locally. Resolves `{ revoked }` — `false` when the server could
+     * not be reached (the app is signed out regardless). With `{ strict: true }`
+     * it rejects with a `SignOutError` instead, after the local sign-out.
+     *
+     * A bearer client never gets a server-promoted session's credential back from
+     * the revoke, so `activeSessionId` is reported (when present) but not adopted.
+     */
+    signOut(options?: SignOutOptions): Promise<SignOutResult>;
     /** The current session JWT, auto-refreshed near expiry; null when signed out. */
     getToken(): Promise<string | null>;
     /** The headers an authenticated `/v1/client/me/*` call needs (bearer + pk). */
@@ -109,6 +132,7 @@ export interface AtlasCapacitor {
  * ```
  */
 export declare function createAtlasCapacitor(config: CreateAtlasCapacitorConfig): Promise<AtlasCapacitor>;
+export { SignOutError, type SignOutOptions, type SignOutResult, type TombstoneStore, } from '@atlasauth/js';
 export * from './plugins';
 export * from './pkce';
 export * from './token-store';

package/dist/index.js

@@ -32,8 +32,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.refreshNativeSession = exports.exchangeForSession = exports.NativeSessionManager = exports.clearNativeSession = exports.createNativeSessionManager = void 0;
+exports.refreshNativeSession = exports.exchangeForSession = exports.NativeSessionManager = exports.clearNativeSession = exports.createNativeSessionManager = exports.SignOutError = void 0;
 exports.createAtlasCapacitor = createAtlasCapacitor;
+const js_1 = require("@atlasauth/js");
 const plugins_1 = require("./plugins");
 const sign_in_1 = require("./sign-in");
 const token_store_1 = require("./token-store");
@@ -59,6 +60,14 @@ const native_session_1 = require("./native-session");
  * ```
  */
 async function createAtlasCapacitor(config) {
+    // Validated (and normalised — no trailing slash) before anything else: a
+    // missing value, "same-origin" or a bare path throws an `AtlasConfigError`.
+    // The OAuth URLs below are built from it, and a native app has no origin of
+    // its own to resolve a relative one against.
+    const frontendApi = (0, js_1.resolveFrontendApi)(config.frontendApi, {
+        component: 'createAtlasCapacitor()',
+        allowSameOrigin: false,
+    });
     const plugins = config.plugins ?? (await (0, plugins_1.loadCapacitorPlugins)());
     const storage = config.storage ??
         (plugins.Preferences
@@ -68,14 +77,68 @@ async function createAtlasCapacitor(config) {
         (plugins.Preferences
             ? (0, token_store_1.createPreferencesTokenStore)(plugins.Preferences, sign_in_1.PKCE_STASH_KEY)
             : (0, token_store_1.createInMemoryTokenStore)());
+    const doFetch = config.fetchImpl ?? ((input, init) => fetch(input, init));
+    /**
+     * A Frontend API request authenticated as `session` — and only it. Holds its
+     * own copy (never persisted), so a revoke re-tried after sign-out dropped the
+     * session can still authenticate: a 401 (the short-lived JWT expired) rotates
+     * it once with the refresh token and tries again.
+     */
+    const sessionBoundRequest = (session) => {
+        const holder = new js_1.NativeSessionManager({
+            baseUrl: frontendApi,
+            publishableKey: config.publishableKey,
+            initial: session,
+            fetchImpl: config.fetchImpl,
+            now: config.now,
+        });
+        return async (path, init) => {
+            const send = async () => doFetch(`${frontendApi}${path}`, {
+                ...init,
+                headers: { ...(await holder.authHeaders()), ...init?.headers },
+            });
+            const response = await send();
+            if (response.status !== 401 || !(await holder.refresh()))
+                return response;
+            return send();
+        };
+    };
+    // The sessions this app signed out of, kept in the platform store so a
+    // restart never re-adopts one. Loaded before the stored session is trusted.
+    const tombstoneStore = config.tombstoneStore ??
+        (plugins.Preferences ? (0, token_store_1.createPreferencesTombstoneStore)(plugins.Preferences) : undefined);
+    const guard = new js_1.SignOutGuard({
+        // Every revoke passes its own session-bound request; this one carries none.
+        request: (path, init) => doFetch(`${frontendApi}${path}`, {
+            ...init,
+            headers: { 'x-publishable-key': config.publishableKey, ...init?.headers },
+        }),
+        frontendApi,
+        ...(tombstoneStore ? { store: tombstoneStore } : {}),
+        ...(config.signOutRetryDelaysMs ? { retryDelaysMs: config.signOutRetryDelaysMs } : {}),
+    });
+    await guard.ready;
     const manager = await (0, native_session_1.createNativeSessionManager)({
-        frontendApi: config.frontendApi,
+        frontendApi,
         publishableKey: config.publishableKey,
         clientId: config.clientId,
         storage,
         fetchImpl: config.fetchImpl,
         now: config.now,
+        // Never adopt (nor write back) a session this app signed out of; a stored
+        // one is revoked again in the background, as itself.
+        refuse: (session) => guard.isSignedOut(session.sessionId) && guard.refuse(session.sessionId, sessionBoundRequest(session)),
     });
+    // A refresh still in flight at sign-out must not put the session back in memory.
+    manager.onChange((session) => {
+        if (guard.isSignedOut(session.sessionId))
+            manager.clear();
+    });
+    const getToken = async () => {
+        const token = await manager.getToken();
+        // Signed out while a refresh was in flight: the rotated token is not ours.
+        return token && manager.current ? token : null;
+    };
     const requireString = (value, name) => {
         if (!value)
             throw new Error(`Atlas: \`${name}\` is required to sign in.`);
@@ -87,7 +150,7 @@ async function createAtlasCapacitor(config) {
             const clientId = requireString(options.clientId ?? config.clientId, 'clientId');
             const redirectUri = requireString(options.redirectUri ?? config.redirectUri, 'redirectUri');
             const outcome = await (0, sign_in_1.signInWithBrowser)({
-                frontendApi: config.frontendApi,
+                frontendApi,
                 clientId,
                 redirectUri,
                 scope: options.scope ?? config.scope,
@@ -112,7 +175,7 @@ async function createAtlasCapacitor(config) {
             const clientId = requireString(config.clientId, 'clientId');
             const redirectUri = requireString(config.redirectUri, 'redirectUri');
             const session = await (0, sign_in_1.completeRedirectSignIn)({
-                frontendApi: config.frontendApi,
+                frontendApi,
                 clientId,
                 redirectUri,
                 url: landingUrl,
@@ -123,25 +186,47 @@ async function createAtlasCapacitor(config) {
                 manager.setSession(session);
             return session;
         },
-        async signOut() {
+        async signOut(options = {}) {
+            const session = manager.current;
+            // Tombstones the session synchronously, before anything below can yield;
+            // the revoke itself rides on the session being dropped.
+            const pending = session
+                ? guard.revoke(session.sessionId, { ...options, request: sessionBoundRequest(session) })
+                : null;
             manager.clear();
-            await (0, native_session_1.clearNativeSession)(storage);
+            // The tombstone already keeps a restart from re-adopting a session this
+            // clear fails to remove, so a store error does not fail the sign-out.
+            await Promise.resolve()
+                .then(() => (0, native_session_1.clearNativeSession)(storage))
+                .catch(() => undefined);
+            // Nothing to revoke when signed out (a bearer client has no cookie to find one by).
+            const attempt = pending ? await pending : { sessionId: null, outcome: { revoked: true, status: 200 } };
+            // A promoted session (`activeSessionId`) comes with cookies only — the
+            // bearer revoke never hands this client a credential for it — so it is
+            // reported, not adopted.
+            return guard.settle(attempt, options);
         },
-        getToken() {
-            return manager.getToken();
-        },
-        authHeaders() {
-            return manager.authHeaders();
+        getToken,
+        async authHeaders() {
+            const token = await getToken();
+            return token
+                ? { Authorization: `Bearer ${token}`, 'x-publishable-key': config.publishableKey }
+                : { 'x-publishable-key': config.publishableKey };
         },
         getSession() {
             return manager.current;
         },
         onChange(listener) {
-            return manager.onChange(listener);
+            return manager.onChange((session) => {
+                if (!guard.isSignedOut(session.sessionId))
+                    listener(session);
+            });
         },
     };
 }
 // ── Re-exports: the pieces, for apps that drive the flow themselves ──────────
+var js_2 = require("@atlasauth/js");
+Object.defineProperty(exports, "SignOutError", { enumerable: true, get: function () { return js_2.SignOutError; } });
 __exportStar(require("./plugins"), exports);
 __exportStar(require("./pkce"), exports);
 __exportStar(require("./token-store"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;AAiHH,oDA8FC;AA5MD,uCAImB;AACnB,uCAKmB;AACnB,+CAKuB;AACvB,qDAAkF;AAyElF;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,IAAA,8BAAoB,GAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,CAAC,OAAO,CAAC,WAAW;YAClB,CAAC,CAAC,IAAA,yCAA2B,EAAC,OAAO,CAAC,WAAW,EAAE,iCAAmB,CAAC;YACvE,CAAC,CAAC,IAAA,sCAAwB,GAAE,CAAC,CAAC;IAElC,MAAM,SAAS,GACb,MAAM,CAAC,SAAS;QAChB,CAAC,OAAO,CAAC,WAAW;YAClB,CAAC,CAAC,IAAA,yCAA2B,EAAC,OAAO,CAAC,WAAW,EAAE,wBAAc,CAAC;YAClE,CAAC,CAAC,IAAA,sCAAwB,GAAE,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA0B,EAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,IAAY,EAAU,EAAE;QACxE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,4BAA4B,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QAEP,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE;YACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChF,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC;gBACtC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ;gBACR,WAAW;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;gBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,GAAG;YAC9B,8EAA8E;YAC9E,IAAI,IAAA,0BAAgB,EAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,UAAU,GACd,GAAG,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAsB,EAAC;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,UAAU;gBACf,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAA,mCAAkB,EAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,QAAQ;YACN,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAED,UAAU;YACR,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,4CAA0B;AAC1B,yCAAuB;AACvB,gDAA8B;AAC9B,4CAA0B;AAC1B,mDAQ0B;AAPxB,4HAAA,0BAA0B,OAAA;AAC1B,oHAAA,kBAAkB,OAAA;AAClB,sHAAA,oBAAoB,OAAA;AACpB,oHAAA,kBAAkB,OAAA;AAClB,sHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;AAkJH,oDAqLC;AArUD,sCASuB;AACvB,uCAImB;AACnB,uCAKmB;AACnB,+CAMuB;AACvB,qDAAkF;AAgGlF;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkC;IAElC,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAA,uBAAkB,EAAC,MAAM,CAAC,WAAW,EAAE;QACzD,SAAS,EAAE,wBAAwB;QACnC,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,IAAA,8BAAoB,GAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,CAAC,OAAO,CAAC,WAAW;YAClB,CAAC,CAAC,IAAA,yCAA2B,EAAC,OAAO,CAAC,WAAW,EAAE,iCAAmB,CAAC;YACvE,CAAC,CAAC,IAAA,sCAAwB,GAAE,CAAC,CAAC;IAElC,MAAM,SAAS,GACb,MAAM,CAAC,SAAS;QAChB,CAAC,OAAO,CAAC,WAAW;YAClB,CAAC,CAAC,IAAA,yCAA2B,EAAC,OAAO,CAAC,WAAW,EAAE,wBAAc,CAAC;YAClE,CAAC,CAAC,IAAA,sCAAwB,GAAE,CAAC,CAAC;IAElC,MAAM,OAAO,GAAiB,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAExF;;;;;OAKG;IACH,MAAM,mBAAmB,GAAG,CAAC,OAAsB,EAAe,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,yBAAoB,CAAC;YACtC,OAAO,EAAE,WAAW;YACpB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CACtB,OAAO,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE;gBAC/B,GAAG,IAAI;gBACP,OAAO,EAAE,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,GAAI,IAAI,EAAE,OAAkC,EAAE;aAC3F,CAAC,CAAC;YACL,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;YAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC1E,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,cAAc,GAClB,MAAM,CAAC,cAAc;QACrB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,6CAA+B,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,iBAAY,CAAC;QAC7B,4EAA4E;QAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACtB,OAAO,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE;YAC/B,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAI,IAAI,EAAE,OAAkC,EAAE;SACtG,CAAC;QACJ,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,KAAK,CAAC;IAElB,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA0B,EAAC;QAC/C,WAAW;QACX,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAClB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;KACxG,CAAC,CAAC;IACH,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,IAA4B,EAAE;QAClD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,2EAA2E;QAC3E,OAAO,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,IAAY,EAAU,EAAE;QACxE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,4BAA4B,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QAEP,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE;YACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChF,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC;gBACtC,WAAW;gBACX,QAAQ;gBACR,WAAW;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;gBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,GAAG;YAC9B,8EAA8E;YAC9E,IAAI,IAAA,0BAAgB,EAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,UAAU,GACd,GAAG,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAsB,EAAC;gBAC3C,WAAW;gBACX,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,UAAU;gBACf,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO,GAAG,EAAE;YACxB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,yEAAyE;YACzE,wDAAwD;YACxD,MAAM,OAAO,GAAG,OAAO;gBACrB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,OAAO,CAAC,OAAO,EAAE;iBACpB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,OAAO,CAAC,CAAC;iBACvC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,oFAAoF;YACpF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;YACvG,uEAAuE;YACvE,uEAAuE;YACvE,yBAAyB;YACzB,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,QAAQ;QAER,KAAK,CAAC,WAAW;YACf,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK;gBACV,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE;gBAClF,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QACrD,CAAC;QAED,UAAU;YACR,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;oBAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,oCAKuB;AAJrB,kGAAA,YAAY,OAAA;AAKd,4CAA0B;AAC1B,yCAAuB;AACvB,gDAA8B;AAC9B,4CAA0B;AAC1B,mDAQ0B;AAPxB,4HAAA,0BAA0B,OAAA;AAC1B,oHAAA,kBAAkB,OAAA;AAClB,sHAAA,oBAAoB,OAAA;AACpB,oHAAA,kBAAkB,OAAA;AAClB,sHAAA,oBAAoB,OAAA"}

package/dist/native-session.d.ts

@@ -12,7 +12,7 @@
  * session id the refresh call needs and the current JWT. Give the native session
  * its OWN store/key, separate from any other value the app keeps.
  */
-import { NativeSessionManager } from '@atlasauth/js';
+import { NativeSessionManager, type NativeSession } from '@atlasauth/js';
 import { type TokenStore } from './token-store';
 export interface NativeSessionConfig {
     /** The instance's FAPI origin, e.g. `https://fapi.acme.atlasauth.net`. */
@@ -31,6 +31,14 @@ export interface NativeSessionConfig {
     fetchImpl?: typeof fetch;
     /** Injectable clock, epoch ms. Defaults to `Date.now`. */
     now?: () => number;
+    /**
+     * Asked before a session is adopted from the store on boot, and before a
+     * (rotated) session is persisted. Return true for a session the app signed
+     * out of: it is not seeded (and is cleared from the store), nor written back
+     * by a refresh that was still in flight at sign-out. `createAtlasCapacitor`
+     * wires this to its `SignOutGuard`.
+     */
+    refuse?: (session: NativeSession) => boolean;
 }
 /**
  * Build a {@link NativeSessionManager} wired to a Capacitor token store.

package/dist/native-session.js

@@ -28,10 +28,24 @@ const token_store_1 = require("./token-store");
  * store via the manager's `persist` hook.
  */
 async function createNativeSessionManager(config) {
+    // A native app has no origin of its own, so "same-origin" / a bare path is
+    // refused along with a missing value.
+    const baseUrl = (0, js_1.resolveFrontendApi)(config.frontendApi, {
+        component: 'createNativeSessionManager()',
+        allowSameOrigin: false,
+    });
     const storage = config.storage ?? (0, token_store_1.createInMemoryTokenStore)();
-    const initial = (0, js_1.parseNativeSession)(await storage.getToken()) ?? undefined;
+    let initial = (0, js_1.parseNativeSession)(await storage.getToken()) ?? undefined;
+    if (initial && config.refuse?.(initial)) {
+        // A session this app signed out of (the clear never landed, or a refresh
+        // in flight at sign-out wrote it back): boot signed out.
+        initial = undefined;
+        await Promise.resolve()
+            .then(() => storage.clearToken())
+            .catch(() => undefined);
+    }
     return new js_1.NativeSessionManager({
-        baseUrl: config.frontendApi,
+        baseUrl,
         publishableKey: config.publishableKey,
         clientId: config.clientId,
         initial,
@@ -41,6 +55,8 @@ async function createNativeSessionManager(config) {
         // the rotated refresh token survives an app restart. Fire-and-forget — the
         // store may be async, and a write failure must not break the live session.
         persist: (session) => {
+            if (config.refuse?.(session))
+                return;
             void Promise.resolve(storage.setToken((0, js_1.serializeNativeSession)(session))).catch(() => undefined);
         },
     });

package/dist/native-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../src/native-session.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAqCH,gEAsBC;AAGD,gDAEC;AA9DD,sCAKuB;AACvB,+CAA0E;AAqB1E;;;;;;;GAOG;AACI,KAAK,UAAU,0BAA0B,CAC9C,MAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAA,sCAAwB,GAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAA,uBAAkB,EAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS,CAAC;IAE1E,OAAO,IAAI,yBAAoB,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO,EAAE,CAAC,OAAsB,EAAE,EAAE;YAClC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAA,2BAAsB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAC3E,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC1D,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,oCAKuB;AAJrB,0GAAA,oBAAoB,OAAA;AACpB,wGAAA,kBAAkB,OAAA;AAClB,0GAAA,oBAAoB,OAAA"}
+{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../src/native-session.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AA8CH,gEAqCC;AAGD,gDAEC;AAtFD,sCAMuB;AACvB,+CAA0E;AA6B1E;;;;;;;GAOG;AACI,KAAK,UAAU,0BAA0B,CAC9C,MAA2B;IAE3B,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,OAAO,GAAG,IAAA,uBAAkB,EAAC,MAAM,CAAC,WAAW,EAAE;QACrD,SAAS,EAAE,8BAA8B;QACzC,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAA,sCAAwB,GAAE,CAAC;IAC7D,IAAI,OAAO,GAAG,IAAA,uBAAkB,EAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS,CAAC;IACxE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,yEAAyE;QACzE,yDAAyD;QACzD,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,OAAO,CAAC,OAAO,EAAE;aACpB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;aAChC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,yBAAoB,CAAC;QAC9B,OAAO;QACP,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO,EAAE,CAAC,OAAsB,EAAE,EAAE;YAClC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC;gBAAE,OAAO;YACrC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAA,2BAAsB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAC3E,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC1D,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,oCAKuB;AAJrB,0GAAA,oBAAoB,OAAA;AACpB,wGAAA,kBAAkB,OAAA;AAClB,0GAAA,oBAAoB,OAAA"}

package/dist/token-store.d.ts

@@ -20,6 +20,7 @@
  * `capacitor-secure-storage-plugin` — behind this same {@link TokenStore}
  * interface. See {@link createPreferencesTokenStore} for the drop-in shape.
  */
+import type { TombstoneStore } from '@atlasauth/js';
 import type { PreferencesPlugin } from './plugins';
 /**
  * A single-slot token store: read, write, clear one string value. This is the
@@ -61,3 +62,16 @@ export declare function createPreferencesTokenStore(preferences: PreferencesPlug
  * adapter) in production.
  */
 export declare function createInMemoryTokenStore(): TokenStore;
+/**
+ * A {@link TombstoneStore} over `@capacitor/preferences` — where the ids of the
+ * sessions this app signed out of are kept, so a restart never re-adopts one
+ * (see `SignOutGuard` in `@atlasauth/js`). The default when the plugin is
+ * present. Tombstones are session ids, never credentials, so plaintext is fine.
+ */
+export declare function createPreferencesTombstoneStore(preferences: PreferencesPlugin): TombstoneStore;
+/**
+ * Adapt a single-slot {@link TokenStore} (e.g. a secure-storage-backed one) to
+ * a {@link TombstoneStore}. Give it its OWN slot — never the session's: the
+ * key `SignOutGuard` asks for is ignored, every read and write hits that slot.
+ */
+export declare function tombstoneStoreFromTokenStore(store: TokenStore): TombstoneStore;

package/dist/token-store.js

@@ -25,6 +25,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_SESSION_KEY = void 0;
 exports.createPreferencesTokenStore = createPreferencesTokenStore;
 exports.createInMemoryTokenStore = createInMemoryTokenStore;
+exports.createPreferencesTombstoneStore = createPreferencesTombstoneStore;
+exports.tombstoneStoreFromTokenStore = tombstoneStoreFromTokenStore;
 /** The default key the serialized native session is stored under. */
 exports.DEFAULT_SESSION_KEY = 'atlas.native_session';
 /**
@@ -67,4 +69,27 @@ function createInMemoryTokenStore() {
         },
     };
 }
+/**
+ * A {@link TombstoneStore} over `@capacitor/preferences` — where the ids of the
+ * sessions this app signed out of are kept, so a restart never re-adopts one
+ * (see `SignOutGuard` in `@atlasauth/js`). The default when the plugin is
+ * present. Tombstones are session ids, never credentials, so plaintext is fine.
+ */
+function createPreferencesTombstoneStore(preferences) {
+    return {
+        getItem: async (key) => (await preferences.get({ key })).value ?? null,
+        setItem: (key, value) => preferences.set({ key, value }),
+    };
+}
+/**
+ * Adapt a single-slot {@link TokenStore} (e.g. a secure-storage-backed one) to
+ * a {@link TombstoneStore}. Give it its OWN slot — never the session's: the
+ * key `SignOutGuard` asks for is ignored, every read and write hits that slot.
+ */
+function tombstoneStoreFromTokenStore(store) {
+    return {
+        getItem: () => store.getToken(),
+        setItem: (_key, value) => store.setToken(value),
+    };
+}
 //# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAsCH,kEASC;AAQD,4DAWC;AA9CD,qEAAqE;AACxD,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,2BAA2B,CACzC,WAA8B,EAC9B,MAAc,2BAAmB;IAEjC,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI;QACpE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACpD,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB;IACtC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QACrB,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;YACzB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAuCH,kEASC;AAQD,4DAWC;AAQD,0EAKC;AAOD,oEAKC;AAvED,qEAAqE;AACxD,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,2BAA2B,CACzC,WAA8B,EAC9B,MAAc,2BAAmB;IAEjC,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI;QACpE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACpD,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wBAAwB;IACtC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QACrB,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;YACzB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAAC,WAA8B;IAC5E,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI;QACtE,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,KAAiB;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/capacitor",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -11,7 +11,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/js": "0.2.0"
+    "@atlasauth/js": "0.8.0"
   },
   "peerDependencies": {
     "@capacitor/core": ">=6",
@@ -46,7 +46,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",