@authrim/sveltekit 0.1.0

package/dist/direct-auth/social.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Social Login Authentication
+ */
+import { type CryptoProvider, type AuthrimStorage, type SocialAuth, type SocialProvider, type SocialLoginOptions, type AuthResult, type Session, type User } from '@authrim/core';
+export interface SocialAuthOptions {
+    issuer: string;
+    clientId: string;
+    crypto: CryptoProvider;
+    storage: AuthrimStorage;
+    exchangeToken: (authCode: string, codeVerifier: string) => Promise<{
+        session?: Session;
+        user?: User;
+    }>;
+    /**
+     * Popup close detection interval in milliseconds.
+     * Lower values provide faster detection but use more CPU.
+     * Default: 200ms
+     */
+    popupCheckInterval?: number;
+}
+export declare class SocialAuthImpl implements SocialAuth {
+    private readonly issuer;
+    private readonly clientId;
+    private readonly pkce;
+    private readonly storage;
+    private readonly exchangeToken;
+    private readonly popupCheckIntervalMs;
+    private popupWindow;
+    private popupCheckIntervalId;
+    private popupResolve;
+    private readonly boundHandlePopupMessage;
+    constructor(options: SocialAuthOptions);
+    /**
+     * Cleanup resources (must be called when the auth client is destroyed)
+     */
+    destroy(): void;
+    loginWithPopup(provider: SocialProvider, options?: SocialLoginOptions & {
+        redirectTo?: string;
+    }): Promise<AuthResult>;
+    loginWithRedirect(provider: SocialProvider, options?: SocialLoginOptions & {
+        redirectTo?: string;
+    }): Promise<void>;
+    handleCallback(): Promise<AuthResult>;
+    hasCallbackParams(): boolean;
+    getSupportedProviders(): SocialProvider[];
+    private generateState;
+    private buildAuthorizationUrl;
+    private getPopupCallbackUrl;
+    private getPopupFeatures;
+    private buildPopupFeaturesString;
+    private handlePopupMessage;
+    private cleanupPopup;
+    private clearStoredState;
+    private clearUrlParams;
+}
+//# sourceMappingURL=social.d.ts.map

package/dist/direct-auth/social.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/social.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAwGvB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC,CAAC;IACH;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAYD,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;gBAE5D,OAAO,EAAE,iBAAiB;IActC;;OAEG;IACH,OAAO,IAAI,IAAI;IAOT,cAAc,CAClB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,UAAU,CAAC;IAmEhB,iBAAiB,CACrB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,IAAI,CAAC;IA6BV,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC;IA+G3C,iBAAiB,IAAI,OAAO;IAK5B,qBAAqB,IAAI,cAAc,EAAE;YAI3B,aAAa;IAM3B,OAAO,CAAC,qBAAqB;IA+B7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,wBAAwB;YAelB,kBAAkB;IAoHhC,OAAO,CAAC,YAAY;YAaN,gBAAgB;IAO9B,OAAO,CAAC,cAAc;CAQvB"}

package/dist/direct-auth/social.js

@@ -0,0 +1,484 @@
+/**
+ * Social Login Authentication
+ */
+import { AuthrimError, PKCEHelper, } from '@authrim/core';
+import { getAuthrimCode, mapSeverity } from '../utils/error-mapping.js';
+const STORAGE_KEYS = {
+    STATE: 'authrim:direct:social:state',
+    CODE_VERIFIER: 'authrim:direct:social:code_verifier',
+    PROVIDER: 'authrim:direct:social:provider',
+    REDIRECT_URI: 'authrim:direct:social:redirect_uri',
+};
+// =============================================================================
+// Redirect Path Validation & State Encoding
+// =============================================================================
+/**
+ * Validates that a path is a safe relative path (no open redirect).
+ * Only allows paths starting with '/' and blocks protocol schemes.
+ */
+function isValidRelativePath(path) {
+    if (!path || typeof path !== 'string')
+        return false;
+    // Block protocol schemes (e.g., https:, javascript:, data:)
+    if (/^[a-z][a-z0-9+.-]*:/i.test(path))
+        return false;
+    // Block protocol-relative URLs (e.g., //evil.com)
+    if (path.startsWith('//'))
+        return false;
+    // Block backslashes (some browsers normalize \/ to //)
+    if (path.includes('\\'))
+        return false;
+    // Must start with '/' (relative to origin)
+    if (!path.startsWith('/'))
+        return false;
+    return true;
+}
+/**
+ * Base64url encode (URL-safe base64 without padding)
+ */
+function base64urlEncode(bytes) {
+    // Use reduce instead of spread to avoid stack overflow with large arrays
+    const binary = bytes.reduce((str, byte) => str + String.fromCharCode(byte), '');
+    const base64 = btoa(binary);
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Base64url decode (URL-safe base64)
+ */
+function base64urlDecode(encoded) {
+    // Restore standard base64 characters
+    let base64 = encoded.replace(/-/g, '+').replace(/_/g, '/');
+    // Add padding if needed
+    while (base64.length % 4) {
+        base64 += '=';
+    }
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Encode state data (nonce + optional redirectTo) into a string.
+ * Uses base64url encoding with TextEncoder for Unicode support.
+ */
+function encodeStateData(nonce, redirectTo) {
+    // If no redirectTo, return plain nonce for backwards compatibility
+    if (!redirectTo)
+        return nonce;
+    const data = { nonce, redirectTo };
+    const json = JSON.stringify(data);
+    const bytes = new TextEncoder().encode(json);
+    return base64urlEncode(bytes);
+}
+/**
+ * Decode state data from encoded string.
+ * Supports both legacy plain nonce and new JSON format.
+ */
+function decodeStateData(encoded) {
+    if (!encoded)
+        return null;
+    // Legacy format: plain hex nonce (64 chars of hex)
+    if (/^[0-9a-f]+$/i.test(encoded)) {
+        return { nonce: encoded };
+    }
+    // New format: base64url encoded JSON
+    try {
+        const bytes = base64urlDecode(encoded);
+        const json = new TextDecoder().decode(bytes);
+        const data = JSON.parse(json);
+        // Validate structure
+        if (typeof data.nonce !== 'string')
+            return null;
+        if (data.redirectTo !== undefined && typeof data.redirectTo !== 'string')
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/** Default interval for checking if popup is closed (ms) */
+const DEFAULT_POPUP_CHECK_INTERVAL = 200;
+export class SocialAuthImpl {
+    issuer;
+    clientId;
+    pkce;
+    storage;
+    exchangeToken;
+    popupCheckIntervalMs;
+    popupWindow = null;
+    popupCheckIntervalId = null;
+    popupResolve = null;
+    boundHandlePopupMessage;
+    constructor(options) {
+        this.issuer = options.issuer;
+        this.clientId = options.clientId;
+        this.pkce = new PKCEHelper(options.crypto);
+        this.storage = options.storage;
+        this.exchangeToken = options.exchangeToken;
+        this.popupCheckIntervalMs = options.popupCheckInterval ?? DEFAULT_POPUP_CHECK_INTERVAL;
+        this.boundHandlePopupMessage = this.handlePopupMessage.bind(this);
+        if (typeof window !== 'undefined') {
+            window.addEventListener('message', this.boundHandlePopupMessage);
+        }
+    }
+    /**
+     * Cleanup resources (must be called when the auth client is destroyed)
+     */
+    destroy() {
+        this.cleanupPopup();
+        if (typeof window !== 'undefined') {
+            window.removeEventListener('message', this.boundHandlePopupMessage);
+        }
+    }
+    async loginWithPopup(provider, options) {
+        const { codeVerifier, codeChallenge } = await this.pkce.generatePKCE();
+        const nonce = await this.generateState();
+        // Validate redirectTo and encode into state
+        const validatedRedirectTo = options?.redirectTo && isValidRelativePath(options.redirectTo)
+            ? options.redirectTo
+            : undefined;
+        const state = encodeStateData(nonce, validatedRedirectTo);
+        const redirectUri = options?.redirectUri || this.getPopupCallbackUrl();
+        const authUrl = this.buildAuthorizationUrl(provider, {
+            state,
+            codeChallenge,
+            redirectUri,
+            scopes: options?.scopes,
+            loginHint: options?.loginHint,
+        });
+        const popupFeatures = this.getPopupFeatures(options?.popupFeatures);
+        const popup = window.open(authUrl, 'authrim_social_popup', this.buildPopupFeaturesString(popupFeatures));
+        if (!popup) {
+            return {
+                success: false,
+                error: {
+                    error: 'popup_blocked',
+                    error_description: 'Popup was blocked by the browser. Please allow popups and try again.',
+                    code: 'AR004001',
+                    meta: { retryable: false, severity: 'warn' },
+                },
+            };
+        }
+        this.popupWindow = popup;
+        await this.storage.set(STORAGE_KEYS.STATE, state);
+        await this.storage.set(STORAGE_KEYS.CODE_VERIFIER, codeVerifier);
+        await this.storage.set(STORAGE_KEYS.PROVIDER, provider);
+        await this.storage.set(STORAGE_KEYS.REDIRECT_URI, redirectUri);
+        return new Promise((resolve, reject) => {
+            this.popupResolve = resolve;
+            void reject;
+            this.popupCheckIntervalId = window.setInterval(() => {
+                if (popup.closed) {
+                    this.cleanupPopup();
+                    resolve({
+                        success: false,
+                        error: {
+                            error: 'popup_closed',
+                            error_description: 'The login popup was closed before completing authentication.',
+                            code: 'AR004002',
+                            meta: { retryable: false, severity: 'warn' },
+                        },
+                    });
+                }
+            }, this.popupCheckIntervalMs);
+        });
+    }
+    async loginWithRedirect(provider, options) {
+        const { codeVerifier, codeChallenge } = await this.pkce.generatePKCE();
+        const nonce = await this.generateState();
+        // Validate redirectTo and encode into state
+        const validatedRedirectTo = options?.redirectTo && isValidRelativePath(options.redirectTo)
+            ? options.redirectTo
+            : undefined;
+        const state = encodeStateData(nonce, validatedRedirectTo);
+        const redirectUri = options?.redirectUri || window.location.href.split('?')[0];
+        await this.storage.set(STORAGE_KEYS.STATE, state);
+        await this.storage.set(STORAGE_KEYS.CODE_VERIFIER, codeVerifier);
+        await this.storage.set(STORAGE_KEYS.PROVIDER, provider);
+        await this.storage.set(STORAGE_KEYS.REDIRECT_URI, redirectUri);
+        const authUrl = this.buildAuthorizationUrl(provider, {
+            state,
+            codeChallenge,
+            redirectUri,
+            scopes: options?.scopes,
+            loginHint: options?.loginHint,
+        });
+        window.location.href = authUrl;
+    }
+    async handleCallback() {
+        const params = new URLSearchParams(window.location.search);
+        const code = params.get('code');
+        const state = params.get('state');
+        const error = params.get('error');
+        const errorDescription = params.get('error_description');
+        if (error) {
+            await this.clearStoredState();
+            return {
+                success: false,
+                error: {
+                    error: error,
+                    error_description: errorDescription || 'Authentication failed',
+                    code: 'AR004003',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
+        if (!code || !state) {
+            await this.clearStoredState();
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_response',
+                    error_description: 'Missing authorization code or state parameter',
+                    code: 'AR004004',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
+        const storedState = await this.storage.get(STORAGE_KEYS.STATE);
+        const codeVerifier = await this.storage.get(STORAGE_KEYS.CODE_VERIFIER);
+        if (state !== storedState) {
+            await this.clearStoredState();
+            return {
+                success: false,
+                error: {
+                    error: 'state_mismatch',
+                    error_description: 'State parameter mismatch. Please try again.',
+                    code: 'AR004005',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
+        if (!codeVerifier) {
+            await this.clearStoredState();
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_state',
+                    error_description: 'No code verifier found. Please try again.',
+                    code: 'AR004006',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
+        try {
+            const { session, user } = await this.exchangeToken(code, codeVerifier);
+            // Extract redirectTo from state (after validation)
+            const stateData = storedState ? decodeStateData(storedState) : null;
+            const redirectTo = stateData?.redirectTo && isValidRelativePath(stateData.redirectTo)
+                ? stateData.redirectTo
+                : undefined;
+            await this.clearStoredState();
+            this.clearUrlParams();
+            return {
+                success: true,
+                session,
+                user,
+                redirectTo,
+            };
+        }
+        catch (err) {
+            await this.clearStoredState();
+            if (err instanceof AuthrimError) {
+                return {
+                    success: false,
+                    error: {
+                        error: err.code,
+                        error_description: err.message,
+                        code: getAuthrimCode(err.code, 'AR004000'),
+                        meta: {
+                            retryable: err.meta.retryable,
+                            severity: mapSeverity(err.meta.severity),
+                        },
+                    },
+                };
+            }
+            return {
+                success: false,
+                error: {
+                    error: 'token_error',
+                    error_description: err instanceof Error ? err.message : 'Failed to exchange token',
+                    code: 'AR004007',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
+    }
+    hasCallbackParams() {
+        const params = new URLSearchParams(window.location.search);
+        return params.has('code') || params.has('error');
+    }
+    getSupportedProviders() {
+        return ['google', 'github', 'apple', 'microsoft', 'facebook'];
+    }
+    async generateState() {
+        const bytes = new Uint8Array(32);
+        crypto.getRandomValues(bytes);
+        return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    }
+    buildAuthorizationUrl(provider, options) {
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.clientId,
+            redirect_uri: options.redirectUri,
+            state: options.state,
+            code_challenge: options.codeChallenge,
+            code_challenge_method: 'S256',
+            provider,
+        });
+        if (options.scopes && options.scopes.length > 0) {
+            params.set('scope', options.scopes.join(' '));
+        }
+        if (options.loginHint) {
+            params.set('login_hint', options.loginHint);
+        }
+        return `${this.issuer}/api/v1/auth/authorize?${params.toString()}`;
+    }
+    getPopupCallbackUrl() {
+        return `${window.location.origin}/auth/callback/popup`;
+    }
+    getPopupFeatures(options) {
+        const width = options?.width || 500;
+        const height = options?.height || 600;
+        const left = Math.max(0, (window.screen.width - width) / 2);
+        const top = Math.max(0, (window.screen.height - height) / 2);
+        return { width, height, left, top };
+    }
+    buildPopupFeaturesString(features) {
+        return [
+            `width=${features.width}`,
+            `height=${features.height}`,
+            `left=${features.left}`,
+            `top=${features.top}`,
+            'scrollbars=yes',
+            'resizable=yes',
+            'status=no',
+            'menubar=no',
+            'toolbar=no',
+            'location=yes',
+        ].join(',');
+    }
+    async handlePopupMessage(event) {
+        if (event.origin !== window.location.origin) {
+            return;
+        }
+        const data = event.data;
+        if (data.type !== 'authrim:social:callback') {
+            return;
+        }
+        const resolve = this.popupResolve;
+        if (!resolve) {
+            return;
+        }
+        this.cleanupPopup();
+        if (data.error) {
+            resolve({
+                success: false,
+                error: {
+                    error: data.error,
+                    error_description: data.error_description || 'Authentication failed',
+                    code: 'AR004003',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            });
+            await this.clearStoredState();
+            return;
+        }
+        if (!data.code || !data.state) {
+            resolve({
+                success: false,
+                error: {
+                    error: 'invalid_response',
+                    error_description: 'Missing authorization code or state',
+                    code: 'AR004004',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            });
+            await this.clearStoredState();
+            return;
+        }
+        const storedState = await this.storage.get(STORAGE_KEYS.STATE);
+        const codeVerifier = await this.storage.get(STORAGE_KEYS.CODE_VERIFIER);
+        if (data.state !== storedState) {
+            resolve({
+                success: false,
+                error: {
+                    error: 'state_mismatch',
+                    error_description: 'State parameter mismatch',
+                    code: 'AR004005',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            });
+            await this.clearStoredState();
+            return;
+        }
+        if (!codeVerifier) {
+            resolve({
+                success: false,
+                error: {
+                    error: 'invalid_state',
+                    error_description: 'No code verifier found',
+                    code: 'AR004006',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            });
+            await this.clearStoredState();
+            return;
+        }
+        try {
+            const { session, user } = await this.exchangeToken(data.code, codeVerifier);
+            // Extract redirectTo from state (after validation)
+            const stateData = storedState ? decodeStateData(storedState) : null;
+            const redirectTo = stateData?.redirectTo && isValidRelativePath(stateData.redirectTo)
+                ? stateData.redirectTo
+                : undefined;
+            await this.clearStoredState();
+            resolve({
+                success: true,
+                session,
+                user,
+                redirectTo,
+            });
+        }
+        catch (err) {
+            await this.clearStoredState();
+            resolve({
+                success: false,
+                error: {
+                    error: 'token_error',
+                    error_description: err instanceof Error ? err.message : 'Failed to exchange token',
+                    code: 'AR004007',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            });
+        }
+    }
+    cleanupPopup() {
+        if (this.popupCheckIntervalId) {
+            clearInterval(this.popupCheckIntervalId);
+            this.popupCheckIntervalId = null;
+        }
+        if (this.popupWindow && !this.popupWindow.closed) {
+            this.popupWindow.close();
+        }
+        this.popupWindow = null;
+        this.popupResolve = null;
+    }
+    async clearStoredState() {
+        await this.storage.remove(STORAGE_KEYS.STATE);
+        await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
+        await this.storage.remove(STORAGE_KEYS.PROVIDER);
+        await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
+    }
+    clearUrlParams() {
+        const url = new URL(window.location.href);
+        url.searchParams.delete('code');
+        url.searchParams.delete('state');
+        url.searchParams.delete('error');
+        url.searchParams.delete('error_description');
+        window.history.replaceState({}, '', url.toString());
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @authrim/sveltekit - SvelteKit SDK for Authrim
+ */
+export { createAuthrim } from "./client.js";
+export { setAuthContext, getAuthContext, hasAuthContext, AUTH_CONTEXT_KEY, } from "./utils/context.js";
+export type { AuthrimConfig, StorageOptions, StorageType, AuthrimClient, AuthResponse, AuthError, AuthSessionData, PasskeyNamespace, EmailCodeNamespace, SocialNamespace, SessionNamespace, ConsentNamespace, DeviceFlowNamespace, CIBANamespace, LoginChallengeNamespace, SignInShortcuts, SignUpShortcuts, SignOutOptions, AuthEventName, AuthEventPayloads, AuthEventHandler, AuthStores, Session, User, SocialProvider, PasskeyLoginOptions, PasskeySignUpOptions, PasskeyRegisterOptions, PasskeyCredential, EmailCodeSendOptions, EmailCodeSendResult, EmailCodeVerifyOptions, SocialLoginOptions, DirectAuthLogoutOptions, NextAction, AuthLoadingState, } from "./types.js";
+export { createAuthStores, toAuthError as toStoreAuthError, } from "./stores/auth.js";
+export type { AuthError as StoreAuthError, InternalAuthStores, } from "./stores/auth.js";
+export { BrowserHttpClient, type BrowserHttpClientOptions, } from "./providers/http.js";
+export { BrowserCryptoProvider } from "./providers/crypto.js";
+export { createBrowserStorage, type BrowserStorageOptions, } from "./providers/storage.js";
+export type { ConsentScreenData, ConsentClientInfo, ConsentScopeInfo, ConsentUserInfo, ConsentOrgInfo, ConsentActingAsInfo, ConsentFeatureFlags, ConsentSubmitOptions, ConsentSubmitResult, } from "./direct-auth/consent.js";
+export type { DeviceFlowSubmitResult } from "./direct-auth/device-flow.js";
+export { DeviceFlowVerificationError } from "./direct-auth/device-flow.js";
+export type { CIBAPendingRequest, CIBAActionResult, } from "./direct-auth/ciba.js";
+export type { LoginChallengeData, LoginChallengeClientInfo, } from "./direct-auth/login-challenge.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAEV,aAAa,EACb,cAAc,EACd,WAAW,EAEX,aAAa,EAEb,YAAY,EACZ,SAAS,EACT,eAAe,EAEf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,UAAU,EAEV,OAAO,EACP,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,gBAAgB,EAChB,WAAW,IAAI,gBAAgB,GAChC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,SAAS,IAAI,cAAc,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,YAAY,EACV,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * @authrim/sveltekit - SvelteKit SDK for Authrim
+ */
+// Main client
+export { createAuthrim } from "./client.js";
+// Context utilities
+export { setAuthContext, getAuthContext, hasAuthContext, AUTH_CONTEXT_KEY, } from "./utils/context.js";
+// Stores
+export { createAuthStores, toAuthError as toStoreAuthError, } from "./stores/auth.js";
+// Providers (for advanced use)
+export { BrowserHttpClient, } from "./providers/http.js";
+export { BrowserCryptoProvider } from "./providers/crypto.js";
+export { createBrowserStorage, } from "./providers/storage.js";
+export { DeviceFlowVerificationError } from "./direct-auth/device-flow.js";

package/dist/providers/crypto.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Browser Crypto Provider
+ *
+ * Web Crypto API を使用したプラットフォーム実装
+ */
+import type { CryptoProvider } from '@authrim/core';
+export declare class BrowserCryptoProvider implements CryptoProvider {
+    randomBytes(length: number): Promise<Uint8Array>;
+    sha256(data: string): Promise<Uint8Array>;
+    generateCodeVerifier(): Promise<string>;
+    generateCodeChallenge(verifier: string): Promise<string>;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/providers/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/providers/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,qBAAa,qBAAsB,YAAW,cAAc;IACpD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAMhD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAOzC,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAKvC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAI/D"}

package/dist/providers/crypto.js

@@ -0,0 +1,27 @@
+/**
+ * Browser Crypto Provider
+ *
+ * Web Crypto API を使用したプラットフォーム実装
+ */
+import { base64urlEncode } from '@authrim/core';
+export class BrowserCryptoProvider {
+    async randomBytes(length) {
+        const bytes = new Uint8Array(length);
+        crypto.getRandomValues(bytes);
+        return bytes;
+    }
+    async sha256(data) {
+        const encoder = new TextEncoder();
+        const bytes = encoder.encode(data);
+        const hash = await crypto.subtle.digest('SHA-256', bytes);
+        return new Uint8Array(hash);
+    }
+    async generateCodeVerifier() {
+        const bytes = await this.randomBytes(32);
+        return base64urlEncode(bytes);
+    }
+    async generateCodeChallenge(verifier) {
+        const hash = await this.sha256(verifier);
+        return base64urlEncode(hash);
+    }
+}

package/dist/providers/http.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Browser HTTP Client
+ *
+ * P0: credentials デフォルトは 'omit' - 必要な場合のみ 'include' を明示指定
+ * P0: 機密データのログ出力をマスキング
+ */
+import type { HttpClient, HttpOptions, HttpResponse } from '@authrim/core';
+export interface BrowserHttpClientOptions {
+    /**
+     * Default credentials mode
+     * P0: デフォルトは 'omit' - Cookie を送信しない
+     */
+    credentials?: RequestCredentials;
+    /** Default timeout in ms (default: 30000) */
+    timeout?: number;
+    /** Enable debug logging (default: false) */
+    debug?: boolean;
+}
+export interface BrowserHttpOptions extends HttpOptions {
+    credentials?: RequestCredentials;
+}
+export declare class BrowserHttpClient implements HttpClient {
+    private readonly defaultCredentials;
+    private readonly defaultTimeout;
+    private readonly debug;
+    constructor(options?: BrowserHttpClientOptions);
+    private debugLog;
+    fetch<T = unknown>(url: string, options?: BrowserHttpOptions): Promise<HttpResponse<T>>;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/providers/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/lib/providers/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG3E,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,qBAAa,iBAAkB,YAAW,UAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAU;gBAEpB,OAAO,CAAC,EAAE,wBAAwB;IAM9C,OAAO,CAAC,QAAQ;IAYV,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;CA0C9F"}