@atlasauth/capacitor 0.1.0

package/README.md

@@ -0,0 +1,118 @@
+# @atlasauth/capacitor
+
+The official Atlas SDK for **Capacitor / Ionic** — the cross-platform
+(iOS · Android · web) native-auth sibling of [`@atlasauth/electron`](../electron)
+and [`@atlasauth/expo`](../expo). It gives a Capacitor app the **native-session
+sign-in flow**: system browser → deep-link callback → PKCE → a cookie-free Atlas
+session that auto-refreshes and persists in secure storage.
+
+A Capacitor app is a web layer (a WebView on device, a real browser on the web
+target) with no cookie against the Atlas FAPI origin, so it cannot carry a
+session the way a web page does. Instead it signs in through the **system
+browser**, catches the **deep-link** callback, completes **PKCE**, trades the
+code for an Atlas session, and carries that session itself as a bearer — wrapping
+the same `@atlasauth/js` `NativeSessionManager` / `exchangeForSession` /
+`refreshNativeSession` core the Electron and Expo SDKs use.
+
+## Install
+
+```sh
+npm install @atlasauth/capacitor
+npx cap sync
+# the Capacitor plugins it drives (all optional peers — install what you use):
+npm install @capacitor/browser @capacitor/app @capacitor/preferences
+```
+
+`@capacitor/core`, `@capacitor/browser`, `@capacitor/app` and
+`@capacitor/preferences` are **optional peers**. The package compiles and runs
+without them (falling back gracefully), but the native sign-in flow needs
+`@capacitor/browser` + `@capacitor/app`, and persistence needs a token store.
+
+### Deep-link setup
+
+Register your custom scheme so the authorize redirect reopens the app, and route
+`appUrlOpen` to Atlas:
+
+- iOS: add the scheme under `CFBundleURLTypes` in `Info.plist`.
+- Android: add an `intent-filter` with your scheme to the main activity.
+
+Your `redirectUri` is that scheme, e.g. `com.acme.app://auth`.
+
+## Quick start
+
+```ts
+import { createAtlasCapacitor } from '@atlasauth/capacitor';
+
+export const atlas = await createAtlasCapacitor({
+  publishableKey: 'pk_live_…',
+  frontendApi: 'https://fapi.your-instance.atlasauth.net',
+  clientId: 'client_…',            // your first-party native OAuth client
+  redirectUri: 'com.acme.app://auth',
+});
+
+// Sign in (opens the system browser; resolves once the deep link returns).
+await atlas.signIn();
+
+// Call your own API with the live, auto-refreshing session.
+const res = await fetch('/api/thing', { headers: await atlas.authHeaders() });
+
+atlas.onChange((session) => console.log('session rotated', session.sessionId));
+await atlas.signOut();
+```
+
+`frontendApi` is required — the publishable key encodes the instance id but not a
+host. Use `https://atlasauth.net` before you verify a custom domain, your custom
+domain after.
+
+### The handle
+
+| Method | What it does |
+| --- | --- |
+| `signIn({ redirectUri?, scope? })` | System browser → deep-link callback → PKCE → session. On the web target, falls back to the standard redirect (see below). |
+| `handleRedirectCallback(url?)` | Finish a **web** redirect sign-in on app load. |
+| `signOut()` | Forget the session and clear the store. |
+| `getToken()` | The current session JWT, auto-refreshed near expiry. |
+| `authHeaders()` | `{ Authorization, 'x-publishable-key' }` for `/v1/client/me/*` and your API. |
+| `getSession()` | The current `NativeSession`, or null. |
+| `onChange(listener)` | Fires on every session change; returns an unsubscribe. |
+
+## Web target (PWA)
+
+On the web, there is no deep link, so `signIn()` falls back to the **standard
+redirect**: it stashes the PKCE verifier and navigates to the authorize URL.
+Finish on the next load:
+
+```ts
+// on app boot, when the URL looks like your callback:
+const session = await atlas.handleRedirectCallback(); // defaults to window.location.href
+```
+
+## Secure storage
+
+By default the session is persisted with `@capacitor/preferences` when that
+plugin is present, else a non-persistent in-memory store.
+
+> ⚠️ **`@capacitor/preferences` is plaintext at rest** (UserDefaults /
+> SharedPreferences). For production, back the store with a secure-storage
+> community plugin (e.g. `@capacitor-community/secure-storage`) behind the same
+> `TokenStore` interface:
+
+```ts
+import { createAtlasCapacitor, type TokenStore } from '@atlasauth/capacitor';
+
+const secureStore: TokenStore = {
+  getToken: () => SecureStorage.get('atlas.session'),
+  setToken: (v) => SecureStorage.set('atlas.session', v),
+  clearToken: () => SecureStorage.remove('atlas.session'),
+};
+
+const atlas = await createAtlasCapacitor({ /* … */ storage: secureStore });
+```
+
+## Driving the pieces yourself
+
+The flow is also exposed à la carte: `createPkcePair`, `buildAuthorizeUrl`,
+`parseAuthCallback`, `redeemAuthorizationCode`, `exchangeAuthCode`,
+`signInWithBrowser`, `completeRedirectSignIn`, plus
+`createNativeSessionManager` / `exchangeForSession` / `refreshNativeSession`
+re-exported from [`@atlasauth/js`](../js).

package/dist/index.d.ts

@@ -0,0 +1,116 @@
+/**
+ * `@atlasauth/capacitor` — the Atlas SDK for Capacitor / Ionic.
+ *
+ * A Capacitor app is a web layer (WebView on iOS/Android, a real browser on the
+ * web target) with no cookie against the Atlas FAPI origin, so it cannot carry a
+ * session the way a web page does. This package gives it the NATIVE-session flow
+ * instead: sign in through the SYSTEM browser, catch the deep-link callback,
+ * complete PKCE, trade the code for a cookie-free Atlas session, and keep that
+ * session live — auto-refreshing the short-lived JWT and persisting each rotated
+ * refresh token into secure storage. It is the Capacitor sibling of
+ * `@atlasauth/electron` and `@atlasauth/expo`, wrapping the very same
+ * `@atlasauth/js` `NativeSessionManager` / `exchangeForSession` /
+ * `refreshNativeSession` core.
+ *
+ * The one call an app makes is {@link createAtlasCapacitor}; everything else here
+ * (the sign-in flow, the token store, the PKCE helpers) is exposed for apps that
+ * want to drive the pieces themselves.
+ */
+import type { NativeSession, NativeSessionManager } from '@atlasauth/js';
+import { type CapacitorPlugins } from './plugins';
+import { type SignInOutcome } from './sign-in';
+import { type TokenStore } from './token-store';
+export interface CreateAtlasCapacitorConfig {
+    /** The instance publishable key (`pk_…`). */
+    publishableKey: string;
+    /** The instance's FAPI origin, e.g. `https://fapi.acme.atlasauth.net`. */
+    frontendApi: string;
+    /** The first-party native OAuth client id. Required to {@link AtlasCapacitor.signIn}. */
+    clientId?: string;
+    /** The app's custom-scheme callback, e.g. `com.acme.app://auth`. A {@link AtlasCapacitor.signIn} default. */
+    redirectUri?: string;
+    /** Space-delimited OAuth scopes. A {@link AtlasCapacitor.signIn} default. */
+    scope?: string;
+    /**
+     * Where the rotated session is persisted. Defaults to a `@capacitor/preferences`
+     * store when the plugin is present, else a NON-persistent in-memory store. Ship
+     * a secure-storage-backed {@link TokenStore} in production — Preferences is
+     * plaintext at rest.
+     */
+    storage?: TokenStore;
+    /** Where the transient PKCE material is stashed on the WEB redirect path. */
+    pkceStore?: TokenStore;
+    /** Inject the Capacitor plugins (tests). Defaults to a lazy, guarded load. */
+    plugins?: CapacitorPlugins;
+    /** Injectable for tests; defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable clock, epoch ms. Defaults to `Date.now`. */
+    now?: () => number;
+    /** Navigate the page on the web redirect path. @default `window.location.assign` */
+    navigate?: (url: string) => void;
+}
+/** Per-call overrides for {@link AtlasCapacitor.signIn}. */
+export interface SignInOptions {
+    clientId?: string;
+    redirectUri?: string;
+    scope?: string;
+}
+/**
+ * The Atlas handle a Capacitor app holds. Wraps the `@atlasauth/js`
+ * {@link NativeSessionManager}: {@link signIn} runs the browser flow and seeds
+ * the manager, {@link getToken} hands out a live (auto-refreshing) JWT, and
+ * {@link onChange} fires on every session change.
+ */
+export interface AtlasCapacitor {
+    /**
+     * Run the native-session sign-in: open the system browser, catch the deep-link
+     * callback, complete PKCE, exchange for a session, and store it. On the web
+     * target it falls back to the standard redirect (navigates away, `pending:
+     * true`) — finish with {@link handleRedirectCallback} on the next load.
+     */
+    signIn(options?: SignInOptions): Promise<SignInOutcome>;
+    /**
+     * Finish a WEB redirect sign-in on app load: read the callback `url` (defaults
+     * to `window.location.href`), complete PKCE, store the session, and return it
+     * (or null when there is nothing to complete).
+     */
+    handleRedirectCallback(url?: string): Promise<NativeSession | null>;
+    /** Forget the session and clear the store (sign-out). */
+    signOut(): Promise<void>;
+    /** The current session JWT, auto-refreshed near expiry; null when signed out. */
+    getToken(): Promise<string | null>;
+    /** The headers an authenticated `/v1/client/me/*` call needs (bearer + pk). */
+    authHeaders(): Promise<Record<string, string>>;
+    /** The current session, or null when signed out. Does NOT refresh. */
+    getSession(): NativeSession | null;
+    /** Register a listener fired with the session on every change; returns unsubscribe. */
+    onChange(listener: (session: NativeSession) => void): () => void;
+    /** The underlying `@atlasauth/js` manager, for advanced use. */
+    readonly manager: NativeSessionManager;
+}
+/**
+ * Create the Atlas handle for a Capacitor app.
+ *
+ * Async because it lazily loads the Capacitor plugins and rehydrates the session
+ * manager from the store, so a returning user is signed in before the first
+ * request. Call it once at startup and keep the result.
+ *
+ * ```ts
+ * import { createAtlasCapacitor } from '@atlasauth/capacitor';
+ *
+ * const atlas = await createAtlasCapacitor({
+ *   publishableKey: 'pk_live_…',
+ *   frontendApi: 'https://fapi.acme.atlasauth.net',
+ *   clientId: 'client_…',
+ *   redirectUri: 'com.acme.app://auth',
+ * });
+ * await atlas.signIn();
+ * const token = await atlas.getToken();
+ * ```
+ */
+export declare function createAtlasCapacitor(config: CreateAtlasCapacitorConfig): Promise<AtlasCapacitor>;
+export * from './plugins';
+export * from './pkce';
+export * from './token-store';
+export * from './sign-in';
+export { createNativeSessionManager, clearNativeSession, NativeSessionManager, exchangeForSession, refreshNativeSession, type NativeSession, type NativeSessionConfig, } from './native-session';

package/dist/index.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * `@atlasauth/capacitor` — the Atlas SDK for Capacitor / Ionic.
+ *
+ * A Capacitor app is a web layer (WebView on iOS/Android, a real browser on the
+ * web target) with no cookie against the Atlas FAPI origin, so it cannot carry a
+ * session the way a web page does. This package gives it the NATIVE-session flow
+ * instead: sign in through the SYSTEM browser, catch the deep-link callback,
+ * complete PKCE, trade the code for a cookie-free Atlas session, and keep that
+ * session live — auto-refreshing the short-lived JWT and persisting each rotated
+ * refresh token into secure storage. It is the Capacitor sibling of
+ * `@atlasauth/electron` and `@atlasauth/expo`, wrapping the very same
+ * `@atlasauth/js` `NativeSessionManager` / `exchangeForSession` /
+ * `refreshNativeSession` core.
+ *
+ * The one call an app makes is {@link createAtlasCapacitor}; everything else here
+ * (the sign-in flow, the token store, the PKCE helpers) is exposed for apps that
+ * want to drive the pieces themselves.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshNativeSession = exports.exchangeForSession = exports.NativeSessionManager = exports.clearNativeSession = exports.createNativeSessionManager = void 0;
+exports.createAtlasCapacitor = createAtlasCapacitor;
+const plugins_1 = require("./plugins");
+const sign_in_1 = require("./sign-in");
+const token_store_1 = require("./token-store");
+const native_session_1 = require("./native-session");
+/**
+ * Create the Atlas handle for a Capacitor app.
+ *
+ * Async because it lazily loads the Capacitor plugins and rehydrates the session
+ * manager from the store, so a returning user is signed in before the first
+ * request. Call it once at startup and keep the result.
+ *
+ * ```ts
+ * import { createAtlasCapacitor } from '@atlasauth/capacitor';
+ *
+ * const atlas = await createAtlasCapacitor({
+ *   publishableKey: 'pk_live_…',
+ *   frontendApi: 'https://fapi.acme.atlasauth.net',
+ *   clientId: 'client_…',
+ *   redirectUri: 'com.acme.app://auth',
+ * });
+ * await atlas.signIn();
+ * const token = await atlas.getToken();
+ * ```
+ */
+async function createAtlasCapacitor(config) {
+    const plugins = config.plugins ?? (await (0, plugins_1.loadCapacitorPlugins)());
+    const storage = config.storage ??
+        (plugins.Preferences
+            ? (0, token_store_1.createPreferencesTokenStore)(plugins.Preferences, token_store_1.DEFAULT_SESSION_KEY)
+            : (0, token_store_1.createInMemoryTokenStore)());
+    const pkceStore = config.pkceStore ??
+        (plugins.Preferences
+            ? (0, token_store_1.createPreferencesTokenStore)(plugins.Preferences, sign_in_1.PKCE_STASH_KEY)
+            : (0, token_store_1.createInMemoryTokenStore)());
+    const manager = await (0, native_session_1.createNativeSessionManager)({
+        frontendApi: config.frontendApi,
+        publishableKey: config.publishableKey,
+        clientId: config.clientId,
+        storage,
+        fetchImpl: config.fetchImpl,
+        now: config.now,
+    });
+    const requireString = (value, name) => {
+        if (!value)
+            throw new Error(`Atlas: \`${name}\` is required to sign in.`);
+        return value;
+    };
+    return {
+        manager,
+        async signIn(options = {}) {
+            const clientId = requireString(options.clientId ?? config.clientId, 'clientId');
+            const redirectUri = requireString(options.redirectUri ?? config.redirectUri, 'redirectUri');
+            const outcome = await (0, sign_in_1.signInWithBrowser)({
+                frontendApi: config.frontendApi,
+                clientId,
+                redirectUri,
+                scope: options.scope ?? config.scope,
+                browser: plugins.Browser,
+                app: plugins.App,
+                capacitor: plugins.Capacitor,
+                pkceStore,
+                fetchImpl: config.fetchImpl,
+                navigate: config.navigate,
+            });
+            if (outcome.session)
+                manager.setSession(outcome.session);
+            return outcome;
+        },
+        async handleRedirectCallback(url) {
+            // Only meaningful on the web redirect path; a native target never lands here.
+            if ((0, plugins_1.isNativePlatform)({ Capacitor: plugins.Capacitor }))
+                return null;
+            const landingUrl = url ?? (typeof window !== 'undefined' ? window.location.href : undefined);
+            if (!landingUrl)
+                return null;
+            const clientId = requireString(config.clientId, 'clientId');
+            const redirectUri = requireString(config.redirectUri, 'redirectUri');
+            const session = await (0, sign_in_1.completeRedirectSignIn)({
+                frontendApi: config.frontendApi,
+                clientId,
+                redirectUri,
+                url: landingUrl,
+                pkceStore,
+                fetchImpl: config.fetchImpl,
+            });
+            if (session)
+                manager.setSession(session);
+            return session;
+        },
+        async signOut() {
+            manager.clear();
+            await (0, native_session_1.clearNativeSession)(storage);
+        },
+        getToken() {
+            return manager.getToken();
+        },
+        authHeaders() {
+            return manager.authHeaders();
+        },
+        getSession() {
+            return manager.current;
+        },
+        onChange(listener) {
+            return manager.onChange(listener);
+        },
+    };
+}
+// ── Re-exports: the pieces, for apps that drive the flow themselves ──────────
+__exportStar(require("./plugins"), exports);
+__exportStar(require("./pkce"), exports);
+__exportStar(require("./token-store"), exports);
+__exportStar(require("./sign-in"), exports);
+var native_session_2 = require("./native-session");
+Object.defineProperty(exports, "createNativeSessionManager", { enumerable: true, get: function () { return native_session_2.createNativeSessionManager; } });
+Object.defineProperty(exports, "clearNativeSession", { enumerable: true, get: function () { return native_session_2.clearNativeSession; } });
+Object.defineProperty(exports, "NativeSessionManager", { enumerable: true, get: function () { return native_session_2.NativeSessionManager; } });
+Object.defineProperty(exports, "exchangeForSession", { enumerable: true, get: function () { return native_session_2.exchangeForSession; } });
+Object.defineProperty(exports, "refreshNativeSession", { enumerable: true, get: function () { return native_session_2.refreshNativeSession; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;AAiHH,oDA8FC;AA5MD,uCAImB;AACnB,uCAKmB;AACnB,+CAKuB;AACvB,qDAAkF;AAyElF;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,IAAA,8BAAoB,GAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,CAAC,OAAO,CAAC,WAAW;YAClB,CAAC,CAAC,IAAA,yCAA2B,EAAC,OAAO,CAAC,WAAW,EAAE,iCAAmB,CAAC;YACvE,CAAC,CAAC,IAAA,sCAAwB,GAAE,CAAC,CAAC;IAElC,MAAM,SAAS,GACb,MAAM,CAAC,SAAS;QAChB,CAAC,OAAO,CAAC,WAAW;YAClB,CAAC,CAAC,IAAA,yCAA2B,EAAC,OAAO,CAAC,WAAW,EAAE,wBAAc,CAAC;YAClE,CAAC,CAAC,IAAA,sCAAwB,GAAE,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,IAAA,2CAA0B,EAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAE,IAAY,EAAU,EAAE;QACxE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,4BAA4B,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QAEP,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE;YACvB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChF,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC;gBACtC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ;gBACR,WAAW;gBACX,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK;gBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,GAAG;YAC9B,8EAA8E;YAC9E,IAAI,IAAA,0BAAgB,EAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,UAAU,GACd,GAAG,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAsB,EAAC;gBAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ;gBACR,WAAW;gBACX,GAAG,EAAE,UAAU;gBACf,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO;YACX,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAA,mCAAkB,EAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,QAAQ;YACN,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC;QAED,WAAW;YACT,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC;QAED,UAAU;YACR,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,QAAQ,CAAC,QAAQ;YACf,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,4CAA0B;AAC1B,yCAAuB;AACvB,gDAA8B;AAC9B,4CAA0B;AAC1B,mDAQ0B;AAPxB,4HAAA,0BAA0B,OAAA;AAC1B,oHAAA,kBAAkB,OAAA;AAClB,sHAAA,oBAAoB,OAAA;AACpB,oHAAA,kBAAkB,OAAA;AAClB,sHAAA,oBAAoB,OAAA"}

package/dist/native-session.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Native session for Capacitor.
+ *
+ * A thin wiring of the framework-agnostic {@link NativeSessionManager} from
+ * `@atlasauth/js` to this package's {@link TokenStore}. The core manager owns the
+ * exchange / refresh / rotation logic; this file's only job is to PERSIST each
+ * rotated session into the store (so the rotating refresh token survives an app
+ * restart) and to rehydrate the manager from it on boot.
+ *
+ * The whole session is stored as one JSON string under the store's single slot —
+ * the refresh token (which rotates and must survive a restart) alongside the
+ * session id the refresh call needs and the current JWT. Give the native session
+ * its OWN store/key, separate from any other value the app keeps.
+ */
+import { NativeSessionManager } from '@atlasauth/js';
+import { type TokenStore } from './token-store';
+export interface NativeSessionConfig {
+    /** The instance's FAPI origin, e.g. `https://fapi.acme.atlasauth.net`. */
+    frontendApi: string;
+    /** The publishable key — sent on the refresh call and in `authHeaders()`. */
+    publishableKey: string;
+    /** The first-party OAuth client id (for a later in-manager exchange). */
+    clientId?: string;
+    /**
+     * Where the rotated session is persisted. Defaults to a NON-persistent
+     * in-memory store — ship a `@capacitor/preferences` (or secure-storage) store
+     * (see {@link TokenStore}) in production.
+     */
+    storage?: TokenStore;
+    /** Injectable for tests; defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable clock, epoch ms. Defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Build a {@link NativeSessionManager} wired to a Capacitor token store.
+ *
+ * Async because the store may be async: it reads whatever session the store
+ * holds and seeds the manager with it, so a returning user is signed in before
+ * the first request. Thereafter every rotation is written straight back to the
+ * store via the manager's `persist` hook.
+ */
+export declare function createNativeSessionManager(config: NativeSessionConfig): Promise<NativeSessionManager>;
+/** Clear the persisted native session (sign-out). */
+export declare function clearNativeSession(storage: TokenStore): Promise<void>;
+export { NativeSessionManager, exchangeForSession, refreshNativeSession, type NativeSession, } from '@atlasauth/js';

package/dist/native-session.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Native session for Capacitor.
+ *
+ * A thin wiring of the framework-agnostic {@link NativeSessionManager} from
+ * `@atlasauth/js` to this package's {@link TokenStore}. The core manager owns the
+ * exchange / refresh / rotation logic; this file's only job is to PERSIST each
+ * rotated session into the store (so the rotating refresh token survives an app
+ * restart) and to rehydrate the manager from it on boot.
+ *
+ * The whole session is stored as one JSON string under the store's single slot —
+ * the refresh token (which rotates and must survive a restart) alongside the
+ * session id the refresh call needs and the current JWT. Give the native session
+ * its OWN store/key, separate from any other value the app keeps.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshNativeSession = exports.exchangeForSession = exports.NativeSessionManager = void 0;
+exports.createNativeSessionManager = createNativeSessionManager;
+exports.clearNativeSession = clearNativeSession;
+const js_1 = require("@atlasauth/js");
+const token_store_1 = require("./token-store");
+/**
+ * Build a {@link NativeSessionManager} wired to a Capacitor token store.
+ *
+ * Async because the store may be async: it reads whatever session the store
+ * holds and seeds the manager with it, so a returning user is signed in before
+ * the first request. Thereafter every rotation is written straight back to the
+ * store via the manager's `persist` hook.
+ */
+async function createNativeSessionManager(config) {
+    const storage = config.storage ?? (0, token_store_1.createInMemoryTokenStore)();
+    const initial = (0, js_1.parseNativeSession)(await storage.getToken()) ?? undefined;
+    return new js_1.NativeSessionManager({
+        baseUrl: config.frontendApi,
+        publishableKey: config.publishableKey,
+        clientId: config.clientId,
+        initial,
+        fetchImpl: config.fetchImpl,
+        now: config.now,
+        // The manager calls this on every set/rotate; persist the fresh session so
+        // the rotated refresh token survives an app restart. Fire-and-forget — the
+        // store may be async, and a write failure must not break the live session.
+        persist: (session) => {
+            void Promise.resolve(storage.setToken((0, js_1.serializeNativeSession)(session))).catch(() => undefined);
+        },
+    });
+}
+/** Clear the persisted native session (sign-out). */
+async function clearNativeSession(storage) {
+    await storage.clearToken();
+}
+var js_2 = require("@atlasauth/js");
+Object.defineProperty(exports, "NativeSessionManager", { enumerable: true, get: function () { return js_2.NativeSessionManager; } });
+Object.defineProperty(exports, "exchangeForSession", { enumerable: true, get: function () { return js_2.exchangeForSession; } });
+Object.defineProperty(exports, "refreshNativeSession", { enumerable: true, get: function () { return js_2.refreshNativeSession; } });
+//# sourceMappingURL=native-session.js.map

package/dist/native-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../src/native-session.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAqCH,gEAsBC;AAGD,gDAEC;AA9DD,sCAKuB;AACvB,+CAA0E;AAqB1E;;;;;;;GAOG;AACI,KAAK,UAAU,0BAA0B,CAC9C,MAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAA,sCAAwB,GAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAA,uBAAkB,EAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS,CAAC;IAE1E,OAAO,IAAI,yBAAoB,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO,EAAE,CAAC,OAAsB,EAAE,EAAE;YAClC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAA,2BAAsB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAC3E,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC1D,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,oCAKuB;AAJrB,0GAAA,oBAAoB,OAAA;AACpB,wGAAA,kBAAkB,OAAA;AAClB,0GAAA,oBAAoB,OAAA"}

package/dist/pkce.d.ts

@@ -0,0 +1,34 @@
+/**
+ * PKCE (RFC 7636, S256) for the native authorization-code flow.
+ *
+ * A first-party native/Capacitor client is a PUBLIC client — it ships no secret
+ * — so it proves possession of its own authorization request with PKCE: it keeps
+ * a random `verifier`, sends only `code_challenge = base64url(SHA-256(verifier))`
+ * on the authorize URL, and presents the `verifier` when it redeems the code. A
+ * code intercepted on the deep-link callback is inert without the verifier, which
+ * never leaves the app.
+ *
+ * Uses only Web Crypto globals (`crypto.getRandomValues`, `crypto.subtle`), which
+ * every Capacitor target provides — the iOS/Android system WebView and the web
+ * build alike — so there is no `node:crypto` import. Mirrors `createPkcePair`
+ * from `@atlasauth/backend`'s handshake, here on the client side of the exchange.
+ */
+export interface PkcePair {
+    /** Kept in the app; presented only when the code is redeemed, never on the URL. */
+    verifier: string;
+    /** base64url(SHA-256(verifier)); the only half that rides the authorize URL. */
+    challenge: string;
+}
+/**
+ * Generate a PKCE S256 pair. The verifier is 32 random bytes, base64url-encoded
+ * (43 chars — within RFC 7636's 43–128 range); the challenge is its SHA-256
+ * digest, base64url-encoded.
+ */
+export declare function createPkcePair(): Promise<PkcePair>;
+/**
+ * Mint a random `state` value for CSRF binding of the authorize request. Sent on
+ * the authorize URL and checked against the value echoed back on the deep-link
+ * callback, so an unsolicited callback (a deep link we did not initiate) is
+ * rejected.
+ */
+export declare function createState(): string;

package/dist/pkce.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * PKCE (RFC 7636, S256) for the native authorization-code flow.
+ *
+ * A first-party native/Capacitor client is a PUBLIC client — it ships no secret
+ * — so it proves possession of its own authorization request with PKCE: it keeps
+ * a random `verifier`, sends only `code_challenge = base64url(SHA-256(verifier))`
+ * on the authorize URL, and presents the `verifier` when it redeems the code. A
+ * code intercepted on the deep-link callback is inert without the verifier, which
+ * never leaves the app.
+ *
+ * Uses only Web Crypto globals (`crypto.getRandomValues`, `crypto.subtle`), which
+ * every Capacitor target provides — the iOS/Android system WebView and the web
+ * build alike — so there is no `node:crypto` import. Mirrors `createPkcePair`
+ * from `@atlasauth/backend`'s handshake, here on the client side of the exchange.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPkcePair = createPkcePair;
+exports.createState = createState;
+/** base64url, no padding — the encoding PKCE and OAuth use for these values. */
+function base64url(bytes) {
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Generate a PKCE S256 pair. The verifier is 32 random bytes, base64url-encoded
+ * (43 chars — within RFC 7636's 43–128 range); the challenge is its SHA-256
+ * digest, base64url-encoded.
+ */
+async function createPkcePair() {
+    const raw = new Uint8Array(32);
+    crypto.getRandomValues(raw);
+    const verifier = base64url(raw);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return { verifier, challenge: base64url(new Uint8Array(digest)) };
+}
+/**
+ * Mint a random `state` value for CSRF binding of the authorize request. Sent on
+ * the authorize URL and checked against the value echoed back on the deep-link
+ * callback, so an unsolicited callback (a deep link we did not initiate) is
+ * rejected.
+ */
+function createState() {
+    const raw = new Uint8Array(16);
+    crypto.getRandomValues(raw);
+    return base64url(raw);
+}
+//# sourceMappingURL=pkce.js.map

package/dist/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAqBH,wCAMC;AAQD,kCAIC;AArCD,gFAAgF;AAChF,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AASD;;;;GAIG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC"}