@atlasauth/expo 0.1.0

package/README.md

@@ -0,0 +1,143 @@
+# @atlasauth/expo
+
+The official Atlas SDK for **Expo** — the Expo-native peer of
+[`@atlasauth/react`](../react) and the Expo sibling of
+[`@atlasauth/react-native`](../react-native). It wraps the React provider and
+re-exports the same headless hooks and control components (`useAuth`, `useUser`,
+`useSession`, `SignedIn`, `SignedOut`, `<Protect>`), so auth reads identically to
+the web — swapping only the one thing Expo must change: **how the session is
+carried.**
+
+The web SDK keeps the session in an HttpOnly cookie. Expo / React Native has no
+cookie jar, so `@atlasauth/expo` carries the session token in a **`tokenCache`**
+backed by [`expo-secure-store`](https://docs.expo.dev/versions/latest/sdk/securestore/)
+(hardware-backed Keychain / Keystore) and sends it as a bearer header.
+
+## Install
+
+```sh
+npx expo install @atlasauth/expo expo-secure-store
+# plus, as you use them:
+#   expo-web-browser expo-auth-session   (OAuth)
+```
+
+`react` and `react-native` come from your Expo app. `expo-secure-store`,
+`expo-web-browser` and `expo-auth-session` are all **optional peers** — install
+only what you use.
+
+## Token cache
+
+```ts
+// lib/tokenCache.ts
+import * as SecureStore from 'expo-secure-store';
+import { createSecureStoreTokenCache } from '@atlasauth/expo';
+
+export const tokenCache = createSecureStoreTokenCache(SecureStore);
+```
+
+The package ships a non-persistent in-memory cache so it runs out of the box in
+Expo Go and tests, but **production apps must pass a persistent cache** — the
+secure-store one above.
+
+## Provider (Expo Router)
+
+Mount it once at the app root:
+
+```tsx
+// app/_layout.tsx
+import { Slot } from 'expo-router';
+import { AtlasProvider } from '@atlasauth/expo';
+import { tokenCache } from '../lib/tokenCache';
+
+export default function RootLayout() {
+  return (
+    <AtlasProvider
+      publishableKey="pk_live_…"
+      frontendApi="https://fapi.your-instance.atlasauth.net"
+      tokenCache={tokenCache}
+    >
+      <Slot />
+    </AtlasProvider>
+  );
+}
+```
+
+`frontendApi` is required — the publishable key encodes the instance id but not a
+host. Use `https://atlasauth.net` before you verify a custom domain, your custom
+domain after.
+
+## Reading auth
+
+```tsx
+import { Text } from 'react-native';
+import { useAuth, useUser, SignedIn, SignedOut } from '@atlasauth/expo';
+
+function Screen() {
+  const { isLoaded, isSignedIn, signOut } = useAuth();
+  const { user } = useUser();
+  if (!isLoaded) return <Text>Loading…</Text>;
+  return (
+    <>
+      <SignedIn>
+        <Text>Hello {user?.first_name}</Text>
+      </SignedIn>
+      <SignedOut>
+        <Text>Please sign in</Text>
+      </SignedOut>
+    </>
+  );
+}
+```
+
+`getToken()` from `useAuth()` returns the stored session JWT for your own API
+calls; `getProviderToken(provider)` returns the user's own live token at a
+connected social provider.
+
+> **Headless only on native.** The hooks and the conditional-render controls
+> (`SignedIn` / `SignedOut` / `Protect` / `AtlasLoading` / `AtlasLoaded`) render
+> no host element, so they run under React Native. The prebuilt web UI
+> components (`<SignIn>`, `<UserButton>`, …) render DOM and are **web-only** —
+> build those screens with React Native primitives and these hooks.
+
+## OAuth with expo-web-browser
+
+The provider exposes the same flow helpers as the web SDK; open the authorization
+URL with `expo-web-browser` and let the provider complete the redirect. See
+[`@atlasauth/react-native`](../react-native#oauth-with-expo-auth-session) for the
+full pattern — it is identical here.
+
+## Native session (first-party OAuth → session)
+
+A first-party app that already holds an Atlas OAuth access token can trade it for
+a cookie-free session with `createNativeSessionManager` — it exchanges once, then
+auto-refreshes the short-lived JWT and persists each rotated refresh token into
+the secure store:
+
+```ts
+import {
+  createNativeSessionManager,
+  exchangeForSession,
+  tokenStorageFor,
+} from '@atlasauth/expo';
+import { tokenCache } from '../lib/tokenCache';
+
+const mgr = await createNativeSessionManager({
+  frontendApi: 'https://fapi.your-instance.atlasauth.net',
+  publishableKey: 'pk_…',
+  // a slot DEDICATED to the native session, separate from the provider's.
+  storage: tokenStorageFor(tokenCache, 'atlas.native-session'),
+});
+
+const session = await exchangeForSession({ baseUrl, clientId, accessToken });
+if (session) mgr.setSession(session);
+
+const headers = await mgr.authHeaders(); // { Authorization, 'x-publishable-key' }
+```
+
+## Companion packages
+
+| Package | What it adds |
+| --- | --- |
+| [`@atlasauth/expo-passkeys`](../expo-passkeys) | Passkey register / sign-in via `react-native-passkey` |
+| [`@atlasauth/expo-biometrics`](../expo-biometrics) | Gate a stored session behind Face ID / Touch ID |
+| [`@atlasauth/expo-google-signin`](../expo-google-signin) | Native Google sign-in → Atlas id_token sign-in |

package/dist/AtlasProvider.d.ts

@@ -0,0 +1,35 @@
+import { type ReactElement } from 'react';
+import { type AtlasProviderProps as ReactAtlasProviderProps } from '@atlasauth/react';
+import { type TokenCache } from './token-cache';
+/**
+ * `<AtlasProvider>` — the Expo peer of the web provider.
+ *
+ * It does NOT re-implement the auth state machine: it wraps `@atlasauth/react`'s
+ * provider (so every hook and control component in this package is the exact web
+ * one) and swaps one thing — the transport. The web provider carries the session
+ * in an HttpOnly cookie; Expo has no cookie jar, so this provider injects a
+ * {@link createCacheFetch} that bearer-authenticates from, and persists rotated
+ * tokens into, an `expo-secure-store`-backed {@link TokenCache}.
+ *
+ * Expo Router friendly: mount it once at the app root (e.g. in `app/_layout.tsx`)
+ * and read auth anywhere with `useAuth()` / `useUser()` / `<SignedIn>` — the
+ * token cache, not a cookie, is what carries the session across a cold start.
+ */
+/**
+ * Props mirror `@atlasauth/react`'s provider (publishableKey, frontendApi,
+ * appearance, localization, oauthMode, onSignedIn) and add the two Expo knobs.
+ * `fetchImpl` is replaced by the cache-backed fetch, so it is not forwardable.
+ */
+export interface AtlasProviderProps extends Omit<ReactAtlasProviderProps, 'fetchImpl'> {
+    /**
+     * Where the session token is kept. Defaults to a NON-persistent in-memory
+     * cache — pass `createSecureStoreTokenCache(SecureStore)` in production so the
+     * session survives an app restart.
+     */
+    tokenCache?: TokenCache;
+    /** The cache key the session token is stored under. */
+    tokenKey?: string;
+    /** Injectable for tests; defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+export declare function AtlasProvider(props: AtlasProviderProps): ReactElement;

package/dist/AtlasProvider.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AtlasProvider = AtlasProvider;
+const react_1 = require("react");
+const react_2 = require("@atlasauth/react");
+const cache_fetch_1 = require("./cache-fetch");
+const token_cache_1 = require("./token-cache");
+function AtlasProvider(props) {
+    const { tokenCache, tokenKey = token_cache_1.DEFAULT_SESSION_KEY, fetchImpl, ...rest } = props;
+    // Built exactly once — the initializer runs on first render only, so the cache
+    // (and the default in-memory one, when no adapter is passed) survives
+    // re-renders rather than being re-created and losing the session every render.
+    const [cacheFetch] = (0, react_1.useState)(() => (0, cache_fetch_1.createCacheFetch)({
+        cache: tokenCache ?? (0, token_cache_1.createInMemoryTokenCache)(),
+        key: tokenKey,
+        fetchImpl: fetchImpl ?? fetch,
+    }));
+    return (0, react_1.createElement)(react_2.AtlasProvider, { ...rest, fetchImpl: cacheFetch });
+}
+//# sourceMappingURL=AtlasProvider.js.map

package/dist/AtlasProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AtlasProvider.js","sourceRoot":"","sources":["../src/AtlasProvider.tsx"],"names":[],"mappings":";;AA6CA,sCAeC;AA5DD,iCAAmE;AACnE,4CAG0B;AAC1B,+CAAiD;AACjD,+CAIuB;AAmCvB,SAAgB,aAAa,CAAC,KAAyB;IACrD,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,iCAAmB,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAEjF,+EAA+E;IAC/E,sEAAsE;IACtE,+EAA+E;IAC/E,MAAM,CAAC,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,GAAG,EAAE,CACjC,IAAA,8BAAgB,EAAC;QACf,KAAK,EAAE,UAAU,IAAI,IAAA,sCAAwB,GAAE;QAC/C,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,SAAS,IAAI,KAAK;KAC9B,CAAC,CACH,CAAC;IAEF,OAAO,IAAA,qBAAa,EAAC,qBAAkB,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/cache-fetch.d.ts

@@ -0,0 +1,27 @@
+import type { TokenCache } from './token-cache';
+/**
+ * The bridge that makes `@atlasauth/react`'s cookie-based provider work on Expo.
+ *
+ * The web provider authenticates with an HttpOnly cookie (`credentials:
+ * 'include'`) and reads the rotated `jwt` out of each `/v1/client*` response into
+ * an in-memory cache. React Native has no cookie jar, so neither half survives on
+ * its own:
+ *
+ *   1. REQUEST — attach the session token from the {@link TokenCache} as an
+ *      `Authorization: Bearer` header, so an authenticated call is recognised
+ *      without a cookie. The token is read FRESH on every call (never captured),
+ *      so a refresh or sign-out between requests is always reflected.
+ *   2. RESPONSE — when a JSON body carries a fresh `jwt`, persist it back to the
+ *      cache so the rotated session survives an app restart. The web provider
+ *      also keeps that jwt in memory for the tab's lifetime; this adds the
+ *      durable copy native needs. Reading the body is done on a `clone()` so the
+ *      provider still gets to consume the original.
+ *
+ * The persist is fire-and-forget: a secure-store write failure must not break a
+ * live, already-parsed response.
+ */
+export declare function createCacheFetch(opts: {
+    cache: TokenCache;
+    key: string;
+    fetchImpl: typeof fetch;
+}): typeof fetch;

package/dist/cache-fetch.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCacheFetch = createCacheFetch;
+/**
+ * The bridge that makes `@atlasauth/react`'s cookie-based provider work on Expo.
+ *
+ * The web provider authenticates with an HttpOnly cookie (`credentials:
+ * 'include'`) and reads the rotated `jwt` out of each `/v1/client*` response into
+ * an in-memory cache. React Native has no cookie jar, so neither half survives on
+ * its own:
+ *
+ *   1. REQUEST — attach the session token from the {@link TokenCache} as an
+ *      `Authorization: Bearer` header, so an authenticated call is recognised
+ *      without a cookie. The token is read FRESH on every call (never captured),
+ *      so a refresh or sign-out between requests is always reflected.
+ *   2. RESPONSE — when a JSON body carries a fresh `jwt`, persist it back to the
+ *      cache so the rotated session survives an app restart. The web provider
+ *      also keeps that jwt in memory for the tab's lifetime; this adds the
+ *      durable copy native needs. Reading the body is done on a `clone()` so the
+ *      provider still gets to consume the original.
+ *
+ * The persist is fire-and-forget: a secure-store write failure must not break a
+ * live, already-parsed response.
+ */
+function createCacheFetch(opts) {
+    const { cache, key, fetchImpl } = opts;
+    return async (input, init) => {
+        const token = (await cache.getToken(key)) ?? null;
+        const headers = new Headers(init?.headers);
+        if (token)
+            headers.set('authorization', `Bearer ${token}`);
+        const response = await fetchImpl(input, { ...init, headers });
+        // Capture a rotated session token for persistence, without consuming the
+        // body the caller still needs.
+        const contentType = response.headers.get('content-type') ?? '';
+        if (response.ok && contentType.includes('application/json')) {
+            void (async () => {
+                try {
+                    const body = (await response.clone().json());
+                    if (typeof body.jwt === 'string' && body.jwt) {
+                        await cache.saveToken(key, body.jwt);
+                    }
+                }
+                catch {
+                    // Not JSON, an empty body, or a secure-store write failure — the live
+                    // response is unaffected.
+                }
+            })();
+        }
+        return response;
+    };
+}
+//# sourceMappingURL=cache-fetch.js.map

package/dist/cache-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-fetch.js","sourceRoot":"","sources":["../src/cache-fetch.ts"],"names":[],"mappings":";;AAuBA,4CAiCC;AAtDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,gBAAgB,CAAC,IAIhC;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAEvC,OAAO,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QAC/E,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,QAAQ,CAAC,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAsB,CAAC;oBAClE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;wBAC7C,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sEAAsE;oBACtE,0BAA0B;gBAC5B,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './token-cache';
+export * from './cache-fetch';
+export * from './AtlasProvider';
+export * from './native-session';
+export { useAuth, useUser, useSession, useSessionList, useOrganization, SignedIn, SignedOut, Protect, AtlasLoading, AtlasLoaded, } from '@atlasauth/react';

package/dist/index.js

@@ -0,0 +1,47 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AtlasLoaded = exports.AtlasLoading = exports.Protect = exports.SignedOut = exports.SignedIn = exports.useOrganization = exports.useSessionList = exports.useSession = exports.useUser = exports.useAuth = void 0;
+// Expo provider (wraps @atlasauth/react, swaps the cookie transport for an
+// expo-secure-store-backed token cache) + the token cache itself.
+__exportStar(require("./token-cache"), exports);
+__exportStar(require("./cache-fetch"), exports);
+__exportStar(require("./AtlasProvider"), exports);
+// Native session (first-party OAuth → cookie-free session with auto-refresh).
+__exportStar(require("./native-session"), exports);
+/*
+ * Re-export the NATIVE-SAFE React surface from @atlasauth/react, so an Expo app
+ * reads auth with the very same hooks and control components a web app does.
+ *
+ * Deliberately a NAMED re-export, not `export *`: the hooks and the
+ * conditional-render controls (`SignedIn` / `SignedOut` / `Protect`) decide
+ * whether their children appear and render no host element, so they run fine
+ * under React Native. The prebuilt UI components (`<SignIn>`, `<UserButton>`, …)
+ * render DOM (`<div>`, `<input>`, `<style>`) and are web-only — build those
+ * screens with React Native primitives and these headless hooks instead.
+ */
+var react_1 = require("@atlasauth/react");
+Object.defineProperty(exports, "useAuth", { enumerable: true, get: function () { return react_1.useAuth; } });
+Object.defineProperty(exports, "useUser", { enumerable: true, get: function () { return react_1.useUser; } });
+Object.defineProperty(exports, "useSession", { enumerable: true, get: function () { return react_1.useSession; } });
+Object.defineProperty(exports, "useSessionList", { enumerable: true, get: function () { return react_1.useSessionList; } });
+Object.defineProperty(exports, "useOrganization", { enumerable: true, get: function () { return react_1.useOrganization; } });
+Object.defineProperty(exports, "SignedIn", { enumerable: true, get: function () { return react_1.SignedIn; } });
+Object.defineProperty(exports, "SignedOut", { enumerable: true, get: function () { return react_1.SignedOut; } });
+Object.defineProperty(exports, "Protect", { enumerable: true, get: function () { return react_1.Protect; } });
+Object.defineProperty(exports, "AtlasLoading", { enumerable: true, get: function () { return react_1.AtlasLoading; } });
+Object.defineProperty(exports, "AtlasLoaded", { enumerable: true, get: function () { return react_1.AtlasLoaded; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,gDAA8B;AAC9B,gDAA8B;AAC9B,kDAAgC;AAEhC,8EAA8E;AAC9E,mDAAiC;AAEjC;;;;;;;;;;GAUG;AACH,0CAW0B;AAVxB,gGAAA,OAAO,OAAA;AACP,gGAAA,OAAO,OAAA;AACP,mGAAA,UAAU,OAAA;AACV,uGAAA,cAAc,OAAA;AACd,wGAAA,eAAe,OAAA;AACf,iGAAA,QAAQ,OAAA;AACR,kGAAA,SAAS,OAAA;AACT,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA"}

package/dist/native-session.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Native session for Expo / React Native.
+ *
+ * A thin wiring of the framework-agnostic {@link NativeSessionManager} from
+ * `@atlasauth/js` to this package's {@link TokenStorage} secure-store adapter.
+ * The core manager owns the exchange / refresh / rotation logic; this file's only
+ * job is to PERSIST each rotated session into `expo-secure-store` (or whatever
+ * adapter the app wired) and to rehydrate the manager from it on boot.
+ *
+ * The whole session is stored as one JSON string under the adapter's single
+ * slot — the refresh token (which rotates and must survive a restart) alongside
+ * the session id the refresh call needs and the current JWT. Use a storage slot
+ * DEDICATED to the native session (its own key), separate from the one you pass
+ * to `AtlasProvider`, since each slot holds one value. `tokenStorageFor(cache,
+ * 'atlas.native-session')` builds such a slot from the same token cache.
+ */
+import { NativeSessionManager } from '@atlasauth/js';
+import { type TokenStorage } from './token-cache';
+export interface NativeSessionConfig {
+    /** The instance's FAPI origin, e.g. `https://fapi.acme.atlasauth.net`. */
+    frontendApi: string;
+    /** The publishable key — sent on the refresh call and in `authHeaders()`. */
+    publishableKey: string;
+    /** The first-party OAuth client id (for a later in-manager exchange). */
+    clientId?: string;
+    /**
+     * Where the rotated session is persisted. Defaults to a NON-persistent
+     * in-memory store — ship an `expo-secure-store` adapter (see {@link
+     * TokenStorage}) in production, dedicated to the native session.
+     */
+    storage?: TokenStorage;
+    /** Injectable for tests; defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable clock, epoch ms. Defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Build a {@link NativeSessionManager} wired to an Expo secure store.
+ *
+ * Async because the secure store is async: it reads whatever session the adapter
+ * holds and seeds the manager with it, so a returning user is signed in before
+ * the first request. Thereafter every rotation is written straight back to the
+ * adapter via the manager's `persist` hook.
+ */
+export declare function createNativeSessionManager(config: NativeSessionConfig): Promise<NativeSessionManager>;
+/** Clear the persisted native session (sign-out). */
+export declare function clearNativeSession(storage: TokenStorage): Promise<void>;
+export { NativeSessionManager, type NativeSession } from '@atlasauth/js';
+export { exchangeForSession, refreshNativeSession } from '@atlasauth/js';

package/dist/native-session.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Native session for Expo / React Native.
+ *
+ * A thin wiring of the framework-agnostic {@link NativeSessionManager} from
+ * `@atlasauth/js` to this package's {@link TokenStorage} secure-store adapter.
+ * The core manager owns the exchange / refresh / rotation logic; this file's only
+ * job is to PERSIST each rotated session into `expo-secure-store` (or whatever
+ * adapter the app wired) and to rehydrate the manager from it on boot.
+ *
+ * The whole session is stored as one JSON string under the adapter's single
+ * slot — the refresh token (which rotates and must survive a restart) alongside
+ * the session id the refresh call needs and the current JWT. Use a storage slot
+ * DEDICATED to the native session (its own key), separate from the one you pass
+ * to `AtlasProvider`, since each slot holds one value. `tokenStorageFor(cache,
+ * 'atlas.native-session')` builds such a slot from the same token cache.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshNativeSession = exports.exchangeForSession = exports.NativeSessionManager = void 0;
+exports.createNativeSessionManager = createNativeSessionManager;
+exports.clearNativeSession = clearNativeSession;
+const js_1 = require("@atlasauth/js");
+const token_cache_1 = require("./token-cache");
+/**
+ * Build a {@link NativeSessionManager} wired to an Expo secure store.
+ *
+ * Async because the secure store is async: it reads whatever session the adapter
+ * holds and seeds the manager with it, so a returning user is signed in before
+ * the first request. Thereafter every rotation is written straight back to the
+ * adapter via the manager's `persist` hook.
+ */
+async function createNativeSessionManager(config) {
+    const storage = config.storage ?? (0, token_cache_1.createInMemoryStorage)();
+    const initial = (0, js_1.parseNativeSession)(await storage.getToken()) ?? undefined;
+    return new js_1.NativeSessionManager({
+        baseUrl: config.frontendApi,
+        publishableKey: config.publishableKey,
+        clientId: config.clientId,
+        initial,
+        fetchImpl: config.fetchImpl,
+        now: config.now,
+        // The manager calls this on every set/rotate; persist the fresh session so
+        // the rotated refresh token survives an app restart. Fire-and-forget — the
+        // adapter may be async, and a write failure must not break the live session.
+        persist: (session) => {
+            void Promise.resolve(storage.setToken((0, js_1.serializeNativeSession)(session))).catch(() => undefined);
+        },
+    });
+}
+/** Clear the persisted native session (sign-out). */
+async function clearNativeSession(storage) {
+    await storage.clearToken();
+}
+var js_2 = require("@atlasauth/js");
+Object.defineProperty(exports, "NativeSessionManager", { enumerable: true, get: function () { return js_2.NativeSessionManager; } });
+var js_3 = require("@atlasauth/js");
+Object.defineProperty(exports, "exchangeForSession", { enumerable: true, get: function () { return js_3.exchangeForSession; } });
+Object.defineProperty(exports, "refreshNativeSession", { enumerable: true, get: function () { return js_3.refreshNativeSession; } });
+//# sourceMappingURL=native-session.js.map

package/dist/native-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../src/native-session.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAqCH,gEAsBC;AAGD,gDAEC;AA9DD,sCAKuB;AACvB,+CAAyE;AAqBzE;;;;;;;GAOG;AACI,KAAK,UAAU,0BAA0B,CAC9C,MAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAA,mCAAqB,GAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAA,uBAAkB,EAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS,CAAC;IAE1E,OAAO,IAAI,yBAAoB,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,OAAO,EAAE,CAAC,OAAsB,EAAE,EAAE;YAClC,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAA,2BAAsB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAC3E,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,kBAAkB,CAAC,OAAqB;IAC5D,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,oCAAyE;AAAhE,0GAAA,oBAAoB,OAAA;AAC7B,oCAAyE;AAAhE,wGAAA,kBAAkB,OAAA;AAAE,0GAAA,oBAAoB,OAAA"}

package/dist/token-cache.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The Expo session token cache.
+ *
+ * The web SDK keeps its short-lived JWT in memory and lets the browser carry the
+ * refresh token in an HttpOnly cookie. Expo / React Native has neither a cookie
+ * jar nor `localStorage`, so the session token has to live somewhere the app
+ * chooses — and where it lives is a security decision this SDK must not make for
+ * the app. A token in AsyncStorage is readable by any code in the process; a
+ * token in `expo-secure-store` is hardware-backed (Keychain / Keystore).
+ *
+ * So the SDK depends only on the small {@link TokenCache} interface below and
+ * ships an in-memory default plus an `expo-secure-store` adapter. The
+ * `expo-secure-store` module is an OPTIONAL peer, so its surface is declared
+ * structurally ({@link SecureStore}) and the app passes the real module in — the
+ * package compiles, typechecks and tests without `expo-secure-store` installed.
+ */
+/**
+ * A key→token cache, the shape `<AtlasProvider tokenCache>` and the native
+ * session wiring both consume. Mirrors Clerk's Expo `tokenCache` contract
+ * (`getToken` / `saveToken` / `clearToken`). Every method may be sync or async,
+ * so the same adapter fits an async `expo-secure-store` and a synchronous MMKV
+ * store alike.
+ */
+export interface TokenCache {
+    /** The token stored under `key`, or null/undefined when absent. */
+    getToken(key: string): string | null | undefined | Promise<string | null | undefined>;
+    /** Persist `value` under `key`. Called on every successful sign-in / refresh. */
+    saveToken(key: string, value: string): void | Promise<void>;
+    /** Drop whatever is stored under `key` (sign-out, or a rejected session). */
+    clearToken(key: string): void | Promise<void>;
+}
+/**
+ * The slice of `expo-secure-store` this package uses, declared structurally so
+ * the package needs no dependency on it. The real module (and a fake in tests)
+ * is structurally compatible.
+ *
+ * Every method is optional-arg-compatible with `expo-secure-store`'s
+ * `SecureStoreOptions` (keychain accessibility, service, etc.), which the app
+ * may pass through via {@link SecureStoreTokenCacheOptions.secureStoreOptions}.
+ */
+export interface SecureStore {
+    getItemAsync(key: string, options?: unknown): Promise<string | null>;
+    setItemAsync(key: string, value: string, options?: unknown): Promise<void>;
+    deleteItemAsync(key: string, options?: unknown): Promise<void>;
+}
+export interface SecureStoreTokenCacheOptions {
+    /**
+     * Pass-through `SecureStoreOptions` (e.g. `{ keychainAccessible:
+     * SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY }`). Forwarded verbatim to every
+     * `expo-secure-store` call.
+     */
+    secureStoreOptions?: unknown;
+}
+/**
+ * Build a {@link TokenCache} backed by `expo-secure-store` (hardware-backed
+ * Keychain / Keystore). The app imports the module and passes it in — the SDK
+ * never imports `expo-secure-store` itself, so it stays an optional peer:
+ *
+ * ```ts
+ * import * as SecureStore from 'expo-secure-store';
+ * import { createSecureStoreTokenCache } from '@atlasauth/expo';
+ *
+ * export const tokenCache = createSecureStoreTokenCache(SecureStore);
+ * ```
+ */
+export declare function createSecureStoreTokenCache(store: SecureStore, options?: SecureStoreTokenCacheOptions): TokenCache;
+/**
+ * A process-memory token cache. The zero-config default so the SDK runs out of
+ * the box in tests, prototypes and Expo Go — but it does NOT survive an app
+ * restart, so ship {@link createSecureStoreTokenCache} in production.
+ */
+export declare function createInMemoryTokenCache(): TokenCache;
+/**
+ * Adapt a single-slot {@link TokenCache} (plus a fixed key) to the three-method
+ * {@link TokenStorage} the native-session manager wants. The native session is
+ * kept under its OWN key, separate from the `AtlasProvider` session, because the
+ * adapter holds one value per slot.
+ */
+export interface TokenStorage {
+    getToken(): string | null | Promise<string | null>;
+    setToken(token: string): void | Promise<void>;
+    clearToken(): void | Promise<void>;
+}
+/** View a {@link TokenCache} + one key as a single-slot {@link TokenStorage}. */
+export declare function tokenStorageFor(cache: TokenCache, key: string): TokenStorage;
+/** A process-memory {@link TokenStorage}. Non-persistent — see note above. */
+export declare function createInMemoryStorage(): TokenStorage;
+/** The default cache key the `<AtlasProvider>` session is stored under. */
+export declare const DEFAULT_SESSION_KEY = "atlas.session";

package/dist/token-cache.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * The Expo session token cache.
+ *
+ * The web SDK keeps its short-lived JWT in memory and lets the browser carry the
+ * refresh token in an HttpOnly cookie. Expo / React Native has neither a cookie
+ * jar nor `localStorage`, so the session token has to live somewhere the app
+ * chooses — and where it lives is a security decision this SDK must not make for
+ * the app. A token in AsyncStorage is readable by any code in the process; a
+ * token in `expo-secure-store` is hardware-backed (Keychain / Keystore).
+ *
+ * So the SDK depends only on the small {@link TokenCache} interface below and
+ * ships an in-memory default plus an `expo-secure-store` adapter. The
+ * `expo-secure-store` module is an OPTIONAL peer, so its surface is declared
+ * structurally ({@link SecureStore}) and the app passes the real module in — the
+ * package compiles, typechecks and tests without `expo-secure-store` installed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SESSION_KEY = void 0;
+exports.createSecureStoreTokenCache = createSecureStoreTokenCache;
+exports.createInMemoryTokenCache = createInMemoryTokenCache;
+exports.tokenStorageFor = tokenStorageFor;
+exports.createInMemoryStorage = createInMemoryStorage;
+/**
+ * Build a {@link TokenCache} backed by `expo-secure-store` (hardware-backed
+ * Keychain / Keystore). The app imports the module and passes it in — the SDK
+ * never imports `expo-secure-store` itself, so it stays an optional peer:
+ *
+ * ```ts
+ * import * as SecureStore from 'expo-secure-store';
+ * import { createSecureStoreTokenCache } from '@atlasauth/expo';
+ *
+ * export const tokenCache = createSecureStoreTokenCache(SecureStore);
+ * ```
+ */
+function createSecureStoreTokenCache(store, options = {}) {
+    const opts = options.secureStoreOptions;
+    return {
+        getToken: (key) => store.getItemAsync(key, opts),
+        saveToken: (key, value) => store.setItemAsync(key, value, opts),
+        clearToken: (key) => store.deleteItemAsync(key, opts),
+    };
+}
+/**
+ * A process-memory token cache. The zero-config default so the SDK runs out of
+ * the box in tests, prototypes and Expo Go — but it does NOT survive an app
+ * restart, so ship {@link createSecureStoreTokenCache} in production.
+ */
+function createInMemoryTokenCache() {
+    const map = new Map();
+    return {
+        getToken: (key) => map.get(key) ?? null,
+        saveToken: (key, value) => {
+            map.set(key, value);
+        },
+        clearToken: (key) => {
+            map.delete(key);
+        },
+    };
+}
+/** View a {@link TokenCache} + one key as a single-slot {@link TokenStorage}. */
+function tokenStorageFor(cache, key) {
+    return {
+        getToken: async () => (await cache.getToken(key)) ?? null,
+        setToken: (token) => cache.saveToken(key, token),
+        clearToken: () => cache.clearToken(key),
+    };
+}
+/** A process-memory {@link TokenStorage}. Non-persistent — see note above. */
+function createInMemoryStorage() {
+    let token = null;
+    return {
+        getToken: () => token,
+        setToken: (next) => {
+            token = next;
+        },
+        clearToken: () => {
+            token = null;
+        },
+    };
+}
+/** The default cache key the `<AtlasProvider>` session is stored under. */
+exports.DEFAULT_SESSION_KEY = 'atlas.session';
+//# sourceMappingURL=token-cache.js.map

package/dist/token-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.js","sourceRoot":"","sources":["../src/token-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAsDH,kEAUC;AAOD,4DAWC;AAeD,0CAMC;AAGD,sDAWC;AA3ED;;;;;;;;;;;GAWG;AACH,SAAgB,2BAA2B,CACzC,KAAkB,EAClB,UAAwC,EAAE;IAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC;QAChD,SAAS,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC;QAC/D,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACvC,SAAS,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,iFAAiF;AACjF,SAAgB,eAAe,CAAC,KAAiB,EAAE,GAAW;IAC5D,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI;QACzD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;QAChD,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAgB,qBAAqB;IACnC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;QACrB,QAAQ,EAAE,CAAC,IAAY,EAAE,EAAE;YACzB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC9D,QAAA,mBAAmB,GAAG,eAAe,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@atlasauth/expo",
+  "version": "0.1.0",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@atlasauth/js": "0.2.0",
+    "@atlasauth/react": "0.1.30"
+  },
+  "peerDependencies": {
+    "react": ">=18",
+    "react-native": ">=0.73",
+    "expo-secure-store": ">=12",
+    "expo-web-browser": ">=12",
+    "expo-auth-session": ">=5"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    },
+    "react-native": {
+      "optional": true
+    },
+    "expo-secure-store": {
+      "optional": true
+    },
+    "expo-web-browser": {
+      "optional": true
+    },
+    "expo-auth-session": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.12",
+    "react": "^18.3.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}