@atlasauth/js 0.6.0 → 0.8.0

package/dist/sign-out-guard.d.ts

@@ -0,0 +1,114 @@
+/**
+ * The whole safer sign-out, once, for every framework provider.
+ *
+ * `@atlasauth/react` grew this inline; every other provider (Vue, Svelte,
+ * Angular, Solid, Qwik, the native SDKs) drives the same steps through a
+ * {@link SignOutGuard} so the behaviour cannot drift:
+ *
+ *   - `signOut()` remembers the session id BEFORE revoking (a tombstone), revokes
+ *     it on the Frontend API (retried once), runs front-channel logout, and
+ *     reports `{ revoked, activeSessionId? }` — or rejects with a
+ *     {@link SignOutError} under `{ strict: true }`;
+ *   - every boot / reload / refresh / sibling-tab broadcast asks
+ *     {@link SignOutGuard.refuse} before adopting a session, so a session this
+ *     browser signed out of is never re-adopted from a refresh cookie (or a
+ *     stored token) the revoke did not clear;
+ *   - a refused session is revoked again in the background, and its tombstone is
+ *     dropped once the server confirms;
+ *   - a parked session the server promoted on revoke is adopted
+ *     ({@link SignOutGuard.promoted}).
+ *
+ * The provider keeps its own state and calls these at the matching points.
+ */
+import type { SignOutOptions } from './frontchannel-logout';
+import { SessionTombstones, type RevokeSessionOutcome, type SignOutResult, type TombstoneStore } from './sign-out';
+/** A credentialed Frontend API request (`path` is relative to the FAPI base URL). */
+export type FapiRequest = (path: string, init?: RequestInit) => Promise<Response>;
+/** Options for {@link SignOutGuard}. */
+export interface SignOutGuardOptions {
+    /** The provider's FAPI request: cookies (web) or its bearer token (native). */
+    request: FapiRequest;
+    /** The Frontend API base URL — tombstones are kept per Frontend API origin. */
+    frontendApi?: string;
+    /** A persistent store for platforms without `localStorage` (see {@link TombstoneStore}). */
+    store?: TombstoneStore;
+    /** Bring your own tombstones (tests, or a set shared with other code). */
+    tombstones?: SessionTombstones;
+    /**
+     * Delays (ms) between background re-tries of a revoke `signOut()` could not
+     * complete. Default `[15_000, 60_000, 300_000]`; `[]` re-tries only when a
+     * refused session shows up on a later boot.
+     */
+    retryDelaysMs?: number[];
+    /** Skip front-channel logout entirely (runtimes without a DOM). */
+    frontChannelLogout?: boolean;
+}
+/** What {@link SignOutGuard.revoke} did on the server. */
+export interface SignOutAttempt {
+    /** The session that was signed out of, or null when there was none. */
+    sessionId: string | null;
+    outcome: RevokeSessionOutcome;
+}
+/** The cross-tab sign-out signal: session ids (never tokens) a tab signed out of. */
+export interface SignedOutSignal {
+    signedOut?: string[];
+}
+export declare class SignOutGuard {
+    /** The sessions this browser (or app) signed out of. */
+    readonly tombstones: SessionTombstones;
+    private readonly request;
+    private readonly retryDelaysMs;
+    private readonly frontChannelLogout;
+    /** Sessions with a background revoke in flight or scheduled. */
+    private readonly retrying;
+    private readonly timers;
+    constructor(options: SignOutGuardOptions);
+    /** Settles once persisted tombstones are loaded — await it before the first boot. */
+    get ready(): Promise<void>;
+    /** Whether this browser signed out of `sessionId`. */
+    isSignedOut(sessionId: string | null | undefined): boolean;
+    /**
+     * Call with the session a boot / reload / refresh is about to adopt. True when
+     * it must NOT be adopted (this browser signed out of it); the revoke is then
+     * re-tried in the background and the tombstone dropped once it lands.
+     */
+    refuse(sessionId: string | null | undefined, request?: FapiRequest): boolean;
+    /**
+     * The server half of `signOut()`. Finds the session to end when the provider
+     * does not know it (`GET /v1/client` — the revoke works from the cookies, so a
+     * missing in-memory token never skips it), tombstones it, revokes it (retried
+     * once) and runs front-channel logout. A failed revoke is re-tried in the
+     * background. Pass `request` to revoke with a credential the provider is about
+     * to drop (a native bearer token).
+     */
+    revoke(sessionId: string | null | undefined, options?: SignOutOptions & {
+        request?: FapiRequest;
+    }): Promise<SignOutAttempt>;
+    /** The parked session the server promoted on revoke, when it should be adopted. */
+    promoted(attempt: SignOutAttempt): string | null;
+    /**
+     * What `signOut()` resolves with — or, with `{ strict: true }` and a revoke the
+     * server never confirmed, the {@link SignOutError} it rejects with. Call after
+     * the local sign-out.
+     */
+    settle(attempt: SignOutAttempt, options?: SignOutOptions): SignOutResult;
+    /** The cross-tab message announcing a sign-out (`{}` when there was no session). */
+    signal(attempt: SignOutAttempt): SignedOutSignal;
+    /**
+     * Learn the sessions a sibling tab signed out of from its broadcast — call it
+     * BEFORE re-checking, so the re-check cannot re-adopt one. Returns the ids.
+     */
+    learn(message: unknown): string[];
+    /**
+     * Call `onSignedOut` when another tab signs out of the session `current()`
+     * returns (its tombstone reached the shared store). Returns the unsubscribe.
+     */
+    watch(current: () => string | null | undefined, onSignedOut: () => void): () => void;
+    /** Cancel scheduled background re-tries (provider teardown). */
+    dispose(): void;
+    /**
+     * Revoke `sessionId` again: now when `delays` is empty, else after each delay
+     * in turn until one lands. Drops the tombstone on success. One chain per session.
+     */
+    private retryInBackground;
+}

package/dist/sign-out-guard.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * The whole safer sign-out, once, for every framework provider.
+ *
+ * `@atlasauth/react` grew this inline; every other provider (Vue, Svelte,
+ * Angular, Solid, Qwik, the native SDKs) drives the same steps through a
+ * {@link SignOutGuard} so the behaviour cannot drift:
+ *
+ *   - `signOut()` remembers the session id BEFORE revoking (a tombstone), revokes
+ *     it on the Frontend API (retried once), runs front-channel logout, and
+ *     reports `{ revoked, activeSessionId? }` — or rejects with a
+ *     {@link SignOutError} under `{ strict: true }`;
+ *   - every boot / reload / refresh / sibling-tab broadcast asks
+ *     {@link SignOutGuard.refuse} before adopting a session, so a session this
+ *     browser signed out of is never re-adopted from a refresh cookie (or a
+ *     stored token) the revoke did not clear;
+ *   - a refused session is revoked again in the background, and its tombstone is
+ *     dropped once the server confirms;
+ *   - a parked session the server promoted on revoke is adopted
+ *     ({@link SignOutGuard.promoted}).
+ *
+ * The provider keeps its own state and calls these at the matching points.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignOutGuard = void 0;
+const frontchannel_logout_1 = require("./frontchannel-logout");
+const sign_out_1 = require("./sign-out");
+const DEFAULT_RETRY_DELAYS_MS = [15_000, 60_000, 300_000];
+class SignOutGuard {
+    /** The sessions this browser (or app) signed out of. */
+    tombstones;
+    request;
+    retryDelaysMs;
+    frontChannelLogout;
+    /** Sessions with a background revoke in flight or scheduled. */
+    retrying = new Set();
+    timers = new Set();
+    constructor(options) {
+        this.request = options.request;
+        this.tombstones =
+            options.tombstones ??
+                new sign_out_1.SessionTombstones({ frontendApi: options.frontendApi, ...(options.store ? { store: options.store } : {}) });
+        this.retryDelaysMs = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+        this.frontChannelLogout = options.frontChannelLogout !== false;
+    }
+    /** Settles once persisted tombstones are loaded — await it before the first boot. */
+    get ready() {
+        return this.tombstones.ready;
+    }
+    /** Whether this browser signed out of `sessionId`. */
+    isSignedOut(sessionId) {
+        return this.tombstones.has(sessionId);
+    }
+    /**
+     * Call with the session a boot / reload / refresh is about to adopt. True when
+     * it must NOT be adopted (this browser signed out of it); the revoke is then
+     * re-tried in the background and the tombstone dropped once it lands.
+     */
+    refuse(sessionId, request) {
+        if (!this.tombstones.has(sessionId))
+            return false;
+        this.retryInBackground(sessionId, request ?? this.request, []);
+        return true;
+    }
+    /**
+     * The server half of `signOut()`. Finds the session to end when the provider
+     * does not know it (`GET /v1/client` — the revoke works from the cookies, so a
+     * missing in-memory token never skips it), tombstones it, revokes it (retried
+     * once) and runs front-channel logout. A failed revoke is re-tried in the
+     * background. Pass `request` to revoke with a credential the provider is about
+     * to drop (a native bearer token).
+     */
+    async revoke(sessionId, options = {}) {
+        const request = options.request ?? this.request;
+        let id = sessionId || null;
+        let outcome = { revoked: true, status: 200 };
+        if (!id) {
+            try {
+                const response = await request('/v1/client');
+                if (!response.ok)
+                    throw new Error('boot failed');
+                const body = (await response.json());
+                id = typeof body?.session?.id === 'string' ? body.session.id : null;
+            }
+            catch {
+                outcome = { revoked: false, status: 0 };
+            }
+        }
+        if (id) {
+            // Remember it first: from here on nothing may re-adopt it.
+            this.tombstones.add(id);
+            outcome = await (0, sign_out_1.revokeSession)(request, id);
+            // OIDC Front-Channel Logout: let the apps signed in through this session
+            // clear theirs in this browser (hidden iframes, capped at 5 s). Best-effort.
+            if (this.frontChannelLogout && options.frontchannel !== false && typeof document !== 'undefined') {
+                await (0, frontchannel_logout_1.runFrontChannelLogoutFromResponse)(outcome.response);
+            }
+            if (!outcome.revoked)
+                this.retryInBackground(id, request, this.retryDelaysMs);
+        }
+        return { sessionId: id, outcome };
+    }
+    /** The parked session the server promoted on revoke, when it should be adopted. */
+    promoted(attempt) {
+        const id = attempt.outcome.activeSessionId;
+        return id && !this.tombstones.has(id) ? id : null;
+    }
+    /**
+     * What `signOut()` resolves with — or, with `{ strict: true }` and a revoke the
+     * server never confirmed, the {@link SignOutError} it rejects with. Call after
+     * the local sign-out.
+     */
+    settle(attempt, options = {}) {
+        const { outcome, sessionId } = attempt;
+        if (!outcome.revoked && options.strict)
+            throw new sign_out_1.SignOutError(sessionId ?? '', outcome.status);
+        return outcome.activeSessionId
+            ? { revoked: outcome.revoked, activeSessionId: outcome.activeSessionId }
+            : { revoked: outcome.revoked };
+    }
+    /** The cross-tab message announcing a sign-out (`{}` when there was no session). */
+    signal(attempt) {
+        return attempt.sessionId ? { signedOut: [attempt.sessionId] } : {};
+    }
+    /**
+     * Learn the sessions a sibling tab signed out of from its broadcast — call it
+     * BEFORE re-checking, so the re-check cannot re-adopt one. Returns the ids.
+     */
+    learn(message) {
+        const list = message?.signedOut;
+        if (!Array.isArray(list))
+            return [];
+        const ids = list.filter((id) => typeof id === 'string' && !!id);
+        this.tombstones.add(...ids);
+        return ids;
+    }
+    /**
+     * Call `onSignedOut` when another tab signs out of the session `current()`
+     * returns (its tombstone reached the shared store). Returns the unsubscribe.
+     */
+    watch(current, onSignedOut) {
+        return this.tombstones.subscribe((ids) => {
+            const id = current();
+            if (id && ids.includes(id))
+                onSignedOut();
+        });
+    }
+    /** Cancel scheduled background re-tries (provider teardown). */
+    dispose() {
+        for (const t of this.timers)
+            clearTimeout(t);
+        this.timers.clear();
+        this.retrying.clear();
+    }
+    /**
+     * Revoke `sessionId` again: now when `delays` is empty, else after each delay
+     * in turn until one lands. Drops the tombstone on success. One chain per session.
+     */
+    retryInBackground(sessionId, request, delays) {
+        if (this.retrying.has(sessionId))
+            return;
+        this.retrying.add(sessionId);
+        const attempt = async (index) => {
+            let revoked = false;
+            try {
+                revoked = (await (0, sign_out_1.revokeSession)(request, sessionId, { retries: 0 })).revoked;
+            }
+            catch {
+                revoked = false;
+            }
+            if (revoked) {
+                this.tombstones.remove(sessionId);
+                this.retrying.delete(sessionId);
+                return;
+            }
+            if (index >= delays.length || !this.retrying.has(sessionId)) {
+                this.retrying.delete(sessionId);
+                return;
+            }
+            schedule(index);
+        };
+        const schedule = (index) => {
+            const timer = setTimeout(() => {
+                this.timers.delete(timer);
+                void attempt(index + 1);
+            }, delays[index]);
+            timer.unref?.();
+            this.timers.add(timer);
+        };
+        if (delays.length === 0)
+            void attempt(0);
+        else
+            schedule(0);
+    }
+}
+exports.SignOutGuard = SignOutGuard;
+//# sourceMappingURL=sign-out-guard.js.map

package/dist/sign-out-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out-guard.js","sourceRoot":"","sources":["../src/sign-out-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAGH,+DAA0E;AAC1E,yCAOoB;AAqCpB,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAa,YAAY;IACvB,wDAAwD;IAC/C,UAAU,CAAoB;IACtB,OAAO,CAAc;IACrB,aAAa,CAAW;IACxB,kBAAkB,CAAU;IAC7C,gEAAgE;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEnE,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,UAAU;gBAClB,IAAI,4BAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC;IACjE,CAAC;IAED,qFAAqF;IACrF,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,SAAoC;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAoC,EAAE,OAAqB;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,SAAmB,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,SAAoC,EACpC,UAAsD,EAAE;QAExD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAChD,IAAI,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC;QAC3B,IAAI,OAAO,GAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACrF,EAAE,GAAG,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,2DAA2D;YAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjG,MAAM,IAAA,uDAAiC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,OAAuB;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAuB,EAAE,UAA0B,EAAE;QAC1D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,uBAAY,CAAC,SAAS,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC,eAAe;YAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;YACxE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,OAAuB;QAC5B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAgB;QACpB,MAAM,IAAI,GAAI,OAAkC,EAAE,SAAS,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAwC,EAAE,WAAuB;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrB,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,SAAiB,EAAE,OAAoB,EAAE,MAAgB;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAiB,EAAE;YACrD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;;YACpC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;CACF;AAzKD,oCAyKC"}

package/dist/sign-out.d.ts

@@ -10,9 +10,9 @@
  *
  * These helpers close that gap: {@link revokeSession} retries once and reports
  * what the server did (including the parked session it promoted, if any), and
- * {@link SessionTombstones} remembers the ids of sessions this tab signed out of
- * so a reload never re-adopts one, even when the revoke never reached the
- * server.
+ * {@link SessionTombstones} remembers the ids of sessions this browser signed
+ * out of so a reload — or a tab opened later — never re-adopts one, even when
+ * the revoke never reached the server.
  */
 /** What `signOut()` resolves with. */
 export interface SignOutResult {
@@ -58,17 +58,86 @@ export interface RevokeSessionOutcome {
 export declare function revokeSession(request: (path: string, init?: RequestInit) => Promise<Response>, sessionId: string, options?: {
     retries?: number;
 }): Promise<RevokeSessionOutcome>;
+/** Options for {@link SessionTombstones}. */
+export interface SessionTombstonesOptions {
+    /**
+     * The Frontend API URL or origin the sessions belong to. Tombstones are kept
+     * per Frontend API origin, so two Atlas instances used on one site never
+     * share (or clear) each other's.
+     */
+    frontendApi?: string;
+    /** Override the storage key entirely (the Frontend API scope is then not appended). */
+    storageKey?: string;
+    /** Clock, for tests. */
+    now?: () => number;
+    /**
+     * Where to keep the tombstones instead of `localStorage` — for runtimes
+     * without one (React Native, Expo, Electron's main process, a Capacitor app,
+     * an extension service worker). Pass the platform's persistent store
+     * (AsyncStorage, `expo-secure-store`, `chrome.storage`, Capacitor
+     * Preferences…) through a two-method adapter. Reads may be async: await
+     * {@link SessionTombstones.ready} before trusting `has()` on a cold start.
+     */
+    store?: TombstoneStore;
+}
 /**
- * The ids of sessions this tab signed out of. Held in memory and mirrored to
- * `sessionStorage` (so a page reload in the same tab remembers them); sibling
- * tabs learn them through the SDK's cross-tab session broadcast. Never holds a
- * token — a session id is not a credential.
+ * A key → string store for {@link SessionTombstones} on a platform without
+ * `localStorage`. Either method may be sync or async; errors are swallowed
+ * (memory still protects the running process).
+ */
+export interface TombstoneStore {
+    getItem(key: string): string | null | undefined | Promise<string | null | undefined>;
+    setItem(key: string, value: string): void | Promise<void>;
+}
+/**
+ * The ids of sessions this browser signed out of, so a reload — or a tab opened
+ * later — never re-adopts one from a refresh cookie the revoke did not clear.
+ *
+ * Kept in `localStorage` (shared by every tab of the site and surviving a
+ * restart), at most 20 entries, each for 30 days, pruned whenever it is read,
+ * and keyed per Frontend API origin. Tabs see each other's changes on every
+ * read, and {@link SessionTombstones.subscribe} reports them as they happen
+ * (the `storage` event). `sessionStorage` is used only when `localStorage`
+ * throws (storage disabled, sandboxed frames); memory always backs both. A
+ * confirmed revoke may {@link SessionTombstones.remove} its tombstone. Never
+ * holds a token — a session id is not a credential.
  */
 export declare class SessionTombstones {
+    private entries;
+    /** Ids no storage accepted: only memory remembers them, so a sync keeps them. */
+    private unsaved;
     private readonly storageKey;
-    private readonly ids;
-    constructor(storageKey?: string);
+    private readonly now;
+    private readonly store;
+    /** False until a custom store has been read: writing earlier would drop what it holds. */
+    private hydrated;
+    /**
+     * Settles once the tombstones a {@link SessionTombstonesOptions.store} holds
+     * have been read (at once for `localStorage`). Never rejects.
+     */
+    readonly ready: Promise<void>;
+    constructor(options?: string | SessionTombstonesOptions);
     has(sessionId: string | null | undefined): boolean;
     add(...sessionIds: (string | null | undefined)[]): void;
+    /**
+     * Forget tombstones — called once a later revoke of the session is confirmed
+     * (the server has ended it, so there is nothing left to re-adopt).
+     */
+    remove(...sessionIds: (string | null | undefined)[]): void;
     list(): string[];
+    /**
+     * Call `listener` when another tab adds or removes a tombstone (the `storage`
+     * event). Returns the unsubscribe function; a no-op outside a browser.
+     */
+    subscribe(listener: (ids: string[]) => void): () => void;
+    /**
+     * Re-read storage — the source of truth, so another tab's add or remove is
+     * seen here — keeping only what this tab could not store; then drop expired
+     * entries. With no readable storage, memory is all there is.
+     */
+    private sync;
+    private prune;
+    /** Read a custom store once, merging anything added before it answered. */
+    private hydrate;
+    private persist;
 }