@benlampson/heimdall-browser 0.0.0-stage → 5.5.3

package/dist/protocol-types.d.ts

@@ -0,0 +1,74 @@
+/** 原始 Token 结果交给调用方保存，不强制任何持久化。 */
+export interface HeimdallTokenSet {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    scope?: string;
+    refresh_token?: string;
+    id_token?: string;
+    obtained_at: number;
+}
+/** 协议配置只描述 public Client，服务端入口另提供机密凭据。 */
+export interface HeimdallProtocolOptions {
+    authority: string;
+    clientId: string;
+    audience: string;
+    tenantId?: string;
+    applicationId?: string;
+    scope?: string;
+    redirectUri?: string;
+    postLogoutRedirectUri?: string;
+    accessTokenFormat?: 'jwt' | 'opaque';
+    allowLocalhostHttp?: boolean;
+}
+/** 由调用方保管的一次性事务；回调消费与防重放由调用方保证。 */
+export interface HeimdallLoginRequest {
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    authority: string;
+    clientId: string;
+    redirectUri: string;
+    createdAt: number;
+}
+/** 只提供现有授权端点已支持的交互参数。 */
+export interface HeimdallLoginOptions {
+    prompt?: 'none' | 'login' | 'consent' | 'select_account';
+    maxAge?: number;
+    responseMode?: 'query' | 'form_post';
+}
+/** 设备审批地址由调用方展示，SDK 不生成界面或自动批准。 */
+export interface HeimdallDeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval: number;
+    obtained_at: number;
+    authority: string;
+    client_id: string;
+}
+/** 单次设备码兑换的中间态；其他 OAuth 错误明确抛出。 */
+export type HeimdallDeviceTokenResult = {
+    status: 'pending' | 'slow_down';
+} | {
+    status: 'complete';
+    tokens: HeimdallTokenSet;
+};
+/** JWT 校验可明确指定 ID Token 或 Access Token 的受众与身份种类。 */
+export interface HeimdallJwtValidation {
+    audience?: string;
+    tokenType?: 'UserLogin' | 'BackendService';
+    idToken?: boolean;
+    nonce?: string;
+    subjectId?: string;
+    sessionId?: string;
+}
+/** 元数据与 OIDC 协议错误保持独立，不暴露响应正文、Token 或 Secret。 */
+export declare class HeimdallProtocolError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    constructor(code: string, status?: number | undefined);
+}

package/dist/protocol-types.js

@@ -0,0 +1,12 @@
+/** 元数据与 OIDC 协议错误保持独立，不暴露响应正文、Token 或 Secret。 */
+export class HeimdallProtocolError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(`Heimdall protocol failed: ${code}.`);
+        this.code = code;
+        this.status = status;
+        this.name = 'HeimdallProtocolError';
+    }
+}
+//# sourceMappingURL=protocol-types.js.map

package/dist/protocol-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-types.js","sourceRoot":"","sources":["../src/protocol-types.ts"],"names":[],"mappings":"AA2BA,iDAAiD;AACjD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAClB;IAA8B;IAA1D,YAA4B,IAAY,EAAkB,MAAe;QAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;QAA7F,SAAI,GAAJ,IAAI,CAAQ;QAAkB,WAAM,GAAN,MAAM,CAAS;QAAiD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IAAC,CAAC;CACjK"}

package/dist/protocol.d.ts

@@ -0,0 +1,58 @@
+import { type JWTPayload } from 'jose';
+import { type HeimdallProtocolOptions, type HeimdallTokenSet, type HeimdallLoginRequest, type HeimdallLoginOptions, type HeimdallDeviceAuthorization, type HeimdallDeviceTokenResult, type HeimdallJwtValidation } from './protocol-types.js';
+/** 不依赖 window、路由或存储的协议客户端，浏览器与服务端共享此实现。 */
+export declare class HeimdallProtocolClient {
+    protected readonly options: HeimdallProtocolOptions;
+    private metadata?;
+    private keys?;
+    constructor(options: HeimdallProtocolOptions);
+    /** 固定信任的发行者，不从待验 Token 推导 Discovery。失败允许下一次显式重试。 */
+    getDiscovery(): Promise<Record<string, unknown>>;
+    /** 返回公开 JWKS，不公开任何私钥。 */
+    getJwks(): Promise<Record<string, unknown>>;
+    /** 只解码未验证 claims，调用方不得将其作为授权结果。 */
+    decodeJwt(token: string): {
+        verified: false;
+        claims: JWTPayload;
+    };
+    /** 验签和基本协议边界；ID Token 与资源 AT 使用不同受众。 */
+    validateJwt(token: string, context?: HeimdallJwtValidation): Promise<JWTPayload>;
+    /** 返回 URL 和 PKCE/state/nonce 上下文，接入方自行选择跳转与保存方式。 */
+    createLoginRequest(login?: HeimdallLoginOptions): Promise<HeimdallLoginRequest>;
+    /** 对照保存上下文校验回调参数；接入方原子消费事务，禁止重复调用。 */
+    exchangeCode(callback: URLSearchParams, request: HeimdallLoginRequest, signal?: AbortSignal): Promise<HeimdallTokenSet>;
+    /** 返回设备验证数据，不打开浏览器、不绘制二维码。 */
+    requestDeviceAuthorization(signal?: AbortSignal): Promise<HeimdallDeviceAuthorization>;
+    /** 单次兑换保留 pending/slow_down，拒绝其它错误与过期设备事务。 */
+    exchangeDeviceCode(device: HeimdallDeviceAuthorization, signal?: AbortSignal): Promise<HeimdallDeviceTokenResult>;
+    /** 遵守服务器轮询间隔并可取消，slow_down 后持续增加五秒。 */
+    waitForDeviceToken(device: HeimdallDeviceAuthorization, signal?: AbortSignal): Promise<HeimdallTokenSet>;
+    /** 刷新结果完整返回；可传已验证身份以约束刷新不能换人。 */
+    refreshToken(refreshToken: string, identity?: {
+        subjectId: string;
+        sessionId?: string;
+    }, signal?: AbortSignal): Promise<HeimdallTokenSet>;
+    /** UserInfo 核对 sub；opaque 可以通过此接口获得资料，不假造权限 claims。 */
+    getUserInfo(accessToken: string, subjectId?: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
+    /** public Client 撤销只提交自己的 client_id，机密认证由服务端入口添加。 */
+    revokeToken(token: string, tokenTypeHint: 'access_token' | 'refresh_token', signal?: AbortSignal): Promise<void>;
+    /** 只生成退出请求，接入方决定清理自己的 Cookie/Token 和是否跳转。 */
+    createLogoutRequest(idToken: string): Promise<{
+        url: string;
+        state: string;
+    }>;
+    /** 接入方消费退出事务；拒绝重复参数与错误响应。 */
+    validateLogoutCallback(callback: URLSearchParams, state: string): void;
+    /** MCP 公共资源元数据可匿名读取，OAuth 令牌仍受管理应用边界限制。 */
+    getMcpProtectedResourceMetadata(mcpUrl: string): Promise<Record<string, unknown>>;
+    protected requestToken(fields: Record<string, string>, signal?: AbortSignal, authentication?: (fields: URLSearchParams, headers: Headers) => Promise<void>): Promise<HeimdallTokenSet>;
+    protected validateTokens(tokens: HeimdallTokenSet, tokenType: 'UserLogin' | 'BackendService', knownId?: JWTPayload): Promise<JWTPayload | undefined>;
+    protected authenticate(fields: URLSearchParams, _headers: Headers): Promise<void>;
+    protected endpoint(key: string): Promise<URL>;
+    protected trustedUrl(value: string): URL;
+    protected post(url: URL, fields: Record<string, string>, signal?: AbortSignal, empty?: boolean, authentication?: (fields: URLSearchParams, headers: Headers) => Promise<void>): Promise<Record<string, unknown>>;
+    protected json(url: URL, init?: RequestInit, empty?: boolean): Promise<Record<string, unknown>>;
+    private checkDevice;
+}
+export { HeimdallProtocolError } from './protocol-types.js';
+export type { HeimdallProtocolOptions, HeimdallTokenSet, HeimdallLoginRequest, HeimdallLoginOptions, HeimdallDeviceAuthorization, HeimdallDeviceTokenResult, HeimdallJwtValidation } from './protocol-types.js';

package/dist/protocol.js

@@ -0,0 +1,273 @@
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
+import { HeimdallProtocolError } from './protocol-types.js';
+/** 不依赖 window、路由或存储的协议客户端，浏览器与服务端共享此实现。 */
+export class HeimdallProtocolClient {
+    options;
+    metadata;
+    keys;
+    constructor(options) {
+        this.options = options;
+        this.trustedUrl(options.authority);
+        if (!options.clientId || !options.audience || !['jwt', 'opaque'].includes(options.accessTokenFormat ?? 'jwt'))
+            throw new HeimdallProtocolError('invalid_configuration');
+        for (const url of [options.redirectUri, options.postLogoutRedirectUri])
+            if (url)
+                this.trustedUrl(url);
+    }
+    /** 固定信任的发行者，不从待验 Token 推导 Discovery。失败允许下一次显式重试。 */
+    async getDiscovery() {
+        this.metadata ??= this.json(new URL(this.options.authority.replace(/\/$/, '') + '/.well-known/openid-configuration'))
+            .then(value => { if (value.issuer !== this.options.authority)
+            throw new HeimdallProtocolError('issuer_mismatch'); return value; })
+            .catch(error => { this.metadata = undefined; throw error; });
+        return { ...await this.metadata };
+    }
+    /** 返回公开 JWKS，不公开任何私钥。 */
+    async getJwks() { return this.json(await this.endpoint('jwks_uri')); }
+    /** 只解码未验证 claims，调用方不得将其作为授权结果。 */
+    decodeJwt(token) {
+        try {
+            return { verified: false, claims: decodeJwt(token) };
+        }
+        catch {
+            throw new HeimdallProtocolError('invalid_jwt');
+        }
+    }
+    /** 验签和基本协议边界；ID Token 与资源 AT 使用不同受众。 */
+    async validateJwt(token, context = {}) {
+        this.keys ??= createRemoteJWKSet(await this.endpoint('jwks_uri'));
+        let claims;
+        try {
+            ({ payload: claims } = await jwtVerify(token, this.keys, { issuer: this.options.authority,
+                audience: context.audience ?? (context.idToken ? this.options.clientId : this.options.audience), algorithms: ['RS256'], requiredClaims: ['exp', 'iat', 'sub'] }));
+        }
+        catch {
+            throw new HeimdallProtocolError('invalid_jwt');
+        }
+        if (typeof claims.sub !== 'string' || !claims.sub || typeof claims.iat !== 'number' || claims.iat > Math.floor(Date.now() / 1000) + 30)
+            throw new HeimdallProtocolError('invalid_token_time');
+        if (context.idToken) {
+            if ((Array.isArray(claims.aud) && claims.aud.length > 1 && claims.azp !== this.options.clientId)
+                || (claims.azp !== undefined && claims.azp !== this.options.clientId) || (context.nonce !== undefined && claims.nonce !== context.nonce))
+                throw new HeimdallProtocolError('invalid_id_token');
+        }
+        else if (claims.client_id !== this.options.clientId
+            || (this.options.tenantId !== undefined && (claims.tenant_id ?? '') !== this.options.tenantId)
+            || (this.options.applicationId !== undefined && claims.application_id !== this.options.applicationId)
+            || (context.tokenType !== undefined && claims.token_type !== context.tokenType))
+            throw new HeimdallProtocolError('token_boundary_mismatch');
+        if ((context.subjectId !== undefined && claims.sub !== context.subjectId) || (context.sessionId !== undefined && claims.sid !== context.sessionId))
+            throw new HeimdallProtocolError('identity_changed');
+        return claims;
+    }
+    /** 返回 URL 和 PKCE/state/nonce 上下文，接入方自行选择跳转与保存方式。 */
+    async createLoginRequest(login = {}) {
+        if (!this.options.redirectUri || !(this.options.scope ?? 'openid profile email offline_access').split(' ').includes('openid'))
+            throw new HeimdallProtocolError('invalid_login_configuration');
+        if (login.maxAge !== undefined && (!Number.isSafeInteger(login.maxAge) || login.maxAge < 0))
+            throw new HeimdallProtocolError('invalid_max_age');
+        if ((login.prompt !== undefined && !['none', 'login', 'consent', 'select_account'].includes(login.prompt))
+            || (login.responseMode !== undefined && !['query', 'form_post'].includes(login.responseMode)))
+            throw new HeimdallProtocolError('invalid_login_parameters');
+        const request = { state: random(), nonce: random(), codeVerifier: random(), authority: this.options.authority,
+            clientId: this.options.clientId, redirectUri: this.options.redirectUri, createdAt: Date.now() };
+        const challenge = base64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(request.codeVerifier))));
+        const url = await this.endpoint('authorization_endpoint');
+        for (const [key, value] of Object.entries({ client_id: request.clientId, redirect_uri: request.redirectUri, response_type: 'code',
+            scope: this.options.scope ?? 'openid profile email offline_access', state: request.state, nonce: request.nonce,
+            code_challenge: challenge, code_challenge_method: 'S256', response_mode: login.responseMode ?? 'query' }))
+            url.searchParams.set(key, value);
+        if (login.prompt)
+            url.searchParams.set('prompt', login.prompt);
+        if (login.maxAge !== undefined)
+            url.searchParams.set('max_age', String(login.maxAge));
+        return { ...request, url: url.href };
+    }
+    /** 对照保存上下文校验回调参数；接入方原子消费事务，禁止重复调用。 */
+    async exchangeCode(callback, request, signal) {
+        if (request.authority !== this.options.authority || request.clientId !== this.options.clientId || request.redirectUri !== this.options.redirectUri
+            || !request.state || !request.nonce || !/^[A-Za-z0-9_-]{43,128}$/.test(request.codeVerifier)
+            || !Number.isFinite(request.createdAt) || Date.now() - request.createdAt > 600000 || request.createdAt > Date.now() + 30000
+            || callback.getAll('state').length !== 1 || callback.get('state') !== request.state)
+            throw new HeimdallProtocolError('invalid_callback_state');
+        if (callback.has('error'))
+            throw new HeimdallProtocolError(oauthCode(callback.get('error')));
+        if (callback.getAll('code').length !== 1 || !callback.get('code'))
+            throw new HeimdallProtocolError('invalid_callback');
+        const tokens = await this.requestToken({ grant_type: 'authorization_code', code: callback.get('code'), redirect_uri: request.redirectUri, code_verifier: request.codeVerifier }, signal);
+        if (!tokens.id_token)
+            throw new HeimdallProtocolError('id_token_missing');
+        const id = await this.validateJwt(tokens.id_token, { idToken: true, nonce: request.nonce });
+        await this.validateTokens(tokens, 'UserLogin', id);
+        return tokens;
+    }
+    /** 返回设备验证数据，不打开浏览器、不绘制二维码。 */
+    async requestDeviceAuthorization(signal) {
+        const value = await this.post(await this.endpoint('device_authorization_endpoint'), { scope: this.options.scope ?? 'openid profile email offline_access' }, signal);
+        if (!text(value.device_code) || !text(value.user_code) || !text(value.verification_uri) || !positive(value.expires_in) || !positive(value.interval))
+            throw new HeimdallProtocolError('invalid_device_response');
+        this.trustedUrl(value.verification_uri);
+        if (value.verification_uri_complete !== undefined)
+            this.trustedUrl(value.verification_uri_complete);
+        return { ...value, obtained_at: Date.now(), authority: this.options.authority, client_id: this.options.clientId };
+    }
+    /** 单次兑换保留 pending/slow_down，拒绝其它错误与过期设备事务。 */
+    async exchangeDeviceCode(device, signal) {
+        this.checkDevice(device);
+        try {
+            const tokens = await this.requestToken({ grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: device.device_code }, signal);
+            await this.validateTokens(tokens, 'UserLogin');
+            return { status: 'complete', tokens };
+        }
+        catch (error) {
+            if (error instanceof HeimdallProtocolError && ['authorization_pending', 'slow_down'].includes(error.code))
+                return { status: error.code === 'slow_down' ? 'slow_down' : 'pending' };
+            throw error;
+        }
+    }
+    /** 遵守服务器轮询间隔并可取消，slow_down 后持续增加五秒。 */
+    async waitForDeviceToken(device, signal) {
+        this.checkDevice(device);
+        let interval = device.interval;
+        while (true) {
+            const remaining = device.obtained_at + device.expires_in * 1000 - Date.now();
+            await delay(Math.min(interval * 1000, remaining), signal);
+            // 剩余寿命不足下一次合法轮询时只等待过期，提前唤醒的计时器不能触发额外 POST。
+            if (remaining <= interval * 1000)
+                throw new HeimdallProtocolError('device_expired');
+            const result = await this.exchangeDeviceCode(device, signal);
+            if (result.status === 'complete')
+                return result.tokens;
+            if (result.status === 'slow_down')
+                interval += 5;
+        }
+    }
+    /** 刷新结果完整返回；可传已验证身份以约束刷新不能换人。 */
+    async refreshToken(refreshToken, identity, signal) {
+        if (!refreshToken)
+            throw new HeimdallProtocolError('invalid_refresh_token');
+        const tokens = await this.requestToken({ grant_type: 'refresh_token', refresh_token: refreshToken }, signal);
+        await this.validateTokens(tokens, 'UserLogin');
+        if (identity) {
+            const claims = tokens.id_token ? await this.validateJwt(tokens.id_token, { idToken: true, ...identity })
+                : (this.options.accessTokenFormat ?? 'jwt') === 'jwt' ? await this.validateJwt(tokens.access_token, { tokenType: 'UserLogin', ...identity }) : undefined;
+            if (!claims)
+                throw new HeimdallProtocolError('identity_unverifiable');
+        }
+        return tokens;
+    }
+    /** UserInfo 核对 sub；opaque 可以通过此接口获得资料，不假造权限 claims。 */
+    async getUserInfo(accessToken, subjectId, signal) {
+        const profile = await this.json(await this.endpoint('userinfo_endpoint'), { headers: { Authorization: `Bearer ${accessToken}` }, signal });
+        if (!text(profile.sub) || (subjectId !== undefined && profile.sub !== subjectId))
+            throw new HeimdallProtocolError('identity_changed');
+        return profile;
+    }
+    /** public Client 撤销只提交自己的 client_id，机密认证由服务端入口添加。 */
+    async revokeToken(token, tokenTypeHint, signal) {
+        if (!token || !['access_token', 'refresh_token'].includes(tokenTypeHint))
+            throw new HeimdallProtocolError('invalid_revocation');
+        await this.post(await this.endpoint('revocation_endpoint'), { token, token_type_hint: tokenTypeHint }, signal, true);
+    }
+    /** 只生成退出请求，接入方决定清理自己的 Cookie/Token 和是否跳转。 */
+    async createLogoutRequest(idToken) {
+        if (!this.options.postLogoutRedirectUri || !idToken)
+            throw new HeimdallProtocolError('logout_configuration_missing');
+        const state = random();
+        const url = await this.endpoint('end_session_endpoint');
+        for (const [key, value] of Object.entries({ client_id: this.options.clientId, id_token_hint: idToken,
+            post_logout_redirect_uri: this.options.postLogoutRedirectUri, state }))
+            url.searchParams.set(key, value);
+        return { url: url.href, state };
+    }
+    /** 接入方消费退出事务；拒绝重复参数与错误响应。 */
+    validateLogoutCallback(callback, state) {
+        if (!state || callback.getAll('state').length !== 1 || callback.get('state') !== state)
+            throw new HeimdallProtocolError('invalid_logout_state');
+        if (callback.has('error'))
+            throw new HeimdallProtocolError(oauthCode(callback.get('error')));
+    }
+    /** MCP 公共资源元数据可匿名读取，OAuth 令牌仍受管理应用边界限制。 */
+    async getMcpProtectedResourceMetadata(mcpUrl) {
+        const url = this.trustedUrl(mcpUrl);
+        if (url.pathname !== '/mcp')
+            throw new HeimdallProtocolError('invalid_mcp_endpoint');
+        return this.json(new URL('/.well-known/oauth-protected-resource/mcp', url));
+    }
+    async requestToken(fields, signal, authentication) {
+        const value = await this.post(await this.endpoint('token_endpoint'), fields, signal, false, authentication);
+        if (!text(value.access_token) || typeof value.token_type !== 'string' || value.token_type.toLowerCase() !== 'bearer' || !positive(value.expires_in)
+            || [value.refresh_token, value.id_token, value.scope].some(field => field !== undefined && !text(field)))
+            throw new HeimdallProtocolError('invalid_token_response');
+        return { ...value, token_type: 'Bearer', obtained_at: Date.now() };
+    }
+    async validateTokens(tokens, tokenType, knownId) {
+        const id = knownId ?? (tokens.id_token ? await this.validateJwt(tokens.id_token, { idToken: true }) : undefined);
+        if ((this.options.accessTokenFormat ?? 'jwt') === 'jwt')
+            return this.validateJwt(tokens.access_token, { tokenType, subjectId: id?.sub, sessionId: typeof id?.sid === 'string' ? id.sid : undefined });
+        return undefined;
+    }
+    async authenticate(fields, _headers) { fields.set('client_id', this.options.clientId); }
+    async endpoint(key) { const value = (await this.getDiscovery())[key]; if (!text(value))
+        throw new HeimdallProtocolError('endpoint_missing'); return this.trustedUrl(value); }
+    trustedUrl(value) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            throw new HeimdallProtocolError('invalid_endpoint');
+        }
+        if (url.username || url.password || url.hash || !(url.protocol === 'https:' || (this.options.allowLocalhostHttp && url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))))
+            throw new HeimdallProtocolError('untrusted_endpoint');
+        return url;
+    }
+    async post(url, fields, signal, empty = false, authentication) {
+        const form = new URLSearchParams(fields);
+        const headers = new Headers({ 'Content-Type': 'application/x-www-form-urlencoded' });
+        await (authentication ?? this.authenticate.bind(this))(form, headers);
+        return this.json(url, { method: 'POST', body: form, headers, signal }, empty);
+    }
+    async json(url, init = {}, empty = false) {
+        const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(15000)]) : AbortSignal.timeout(15000);
+        const response = await fetch(url, { ...init, signal, credentials: 'omit', redirect: 'error', cache: 'no-store' });
+        if (empty && response.ok)
+            return {};
+        let value;
+        try {
+            value = await response.json();
+        }
+        catch {
+            throw new HeimdallProtocolError('invalid_response', response.status);
+        }
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new HeimdallProtocolError('invalid_response', response.status);
+        const record = value;
+        if (!response.ok || record.error)
+            throw new HeimdallProtocolError(record.error ? oauthCode(record.error) : `http_${response.status}`, response.status);
+        return record;
+    }
+    checkDevice(device) {
+        if (device.authority !== this.options.authority || device.client_id !== this.options.clientId || !device.device_code || !positive(device.interval)
+            || !positive(device.expires_in) || !Number.isFinite(device.obtained_at) || device.obtained_at > Date.now() + 30000)
+            throw new HeimdallProtocolError('invalid_device_context');
+        if (device.obtained_at + device.expires_in * 1000 <= Date.now())
+            throw new HeimdallProtocolError('device_expired');
+    }
+}
+const text = (value) => typeof value === 'string' && value.length > 0;
+const positive = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+const oauthCode = (value) => typeof value === 'string' && /^[a-z_]{1,64}$/.test(value) ? value : 'oauth_error';
+const base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
+/** 等待设备轮询支持 AbortSignal，完成时移除监听避免泄漏。 */
+async function delay(ms, signal) {
+    signal?.throwIfAborted();
+    await new Promise((resolve, reject) => {
+        const abort = () => { clearTimeout(timer); reject(signal.reason); };
+        const timer = setTimeout(() => { signal?.removeEventListener('abort', abort); resolve(); }, Math.max(0, ms));
+        signal?.addEventListener('abort', abort, { once: true });
+    });
+}
+export { HeimdallProtocolError } from './protocol-types.js';
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAC6F,MAAM,qBAAqB,CAAC;AAEvJ,2CAA2C;AAC3C,MAAM,OAAO,sBAAsB;IAGF;IAFvB,QAAQ,CAAoC;IAC5C,IAAI,CAAyC;IACrD,YAA+B,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;QAC7D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;QACxK,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,qBAAqB,CAAC;YAAE,IAAI,GAAG;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,oDAAoD;IACpD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,mCAAmC,CAAC,CAAC;aAClH,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;aACjI,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,yBAAyB;IACzB,KAAK,CAAC,OAAO,KAAuC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,mCAAmC;IACnC,SAAS,CAAC,KAAa;QACrB,IAAI,CAAC;YAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;IACzH,CAAC;IACD,wCAAwC;IACxC,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAiC,EAAE;QAClE,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBAC7F,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QACtK,MAAM,CAAC;YAAC,MAAM,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QACzD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC9L,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;mBAC3F,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAClM,CAAC;aAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;eAChD,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;eAC3F,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;eAClG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC9I,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACxM,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,oDAAoD;IACpD,KAAK,CAAC,kBAAkB,CAAC,QAA8B,EAAE;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,qCAAqC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;QAC9L,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAChJ,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;eACrG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC7J,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAC3G,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAClG,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM;YAC/H,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,qCAAqC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YAC9G,cAAc,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9I,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,sCAAsC;IACtC,KAAK,CAAC,YAAY,CAAC,QAAyB,EAAE,OAA6B,EAAE,MAAoB;QAC/F,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW;eAC7I,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;eACzF,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;eACxH,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QACjJ,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAE,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1L,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACpE,CAAC;IACD,8BAA8B;IAC9B,KAAK,CAAC,0BAA0B,CAAC,MAAoB;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,qCAAqC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAChN,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,gBAA0B,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,yBAAyB,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,yBAAmC,CAAC,CAAC;QAC9G,OAAO,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAA4C,CAAC;IAC9J,CAAC;IACD,8CAA8C;IAC9C,KAAK,CAAC,kBAAkB,CAAC,MAAmC,EAAE,MAAoB;QAChF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,8CAA8C,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;YACpJ,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;QAC1F,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,KAAK,YAAY,qBAAqB,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACpN,CAAC;IACD,uCAAuC;IACvC,KAAK,CAAC,kBAAkB,CAAC,MAAmC,EAAE,MAAoB;QAChF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzD,OAAO,IAAI,EAAE,CAAC;YAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1F,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1D,2CAA2C;YAC3C,IAAI,SAAS,IAAI,QAAQ,GAAG,IAAI;gBAAE,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAAC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YACrH,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,QAAQ,IAAI,CAAC,CAAC;QAAC,CAAC;IACvD,CAAC;IACD,iCAAiC;IACjC,KAAK,CAAC,YAAY,CAAC,YAAoB,EAAE,QAAoD,EAAE,MAAoB;QACjH,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7G,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/C,IAAI,QAAQ,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACtH,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzJ,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;QAAC,CAAC;QAC1E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,uDAAuD;IACvD,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,SAAkB,EAAE,MAAoB;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3I,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAAC,OAAO,OAAO,CAAC;IACxJ,CAAC;IACD,qDAAqD;IACrD,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,aAA+C,EAAE,MAAoB;QACpG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAChI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACvH,CAAC;IACD,6CAA6C;IAC7C,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QAAC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAChF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO;YAClG,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3G,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,6BAA6B;IAC7B,sBAAsB,CAAC,QAAyB,EAAE,KAAa;QAC7D,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAChJ,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,2CAA2C;IAC3C,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IACS,KAAK,CAAC,YAAY,CAAC,MAA8B,EAAE,MAAoB,EAAE,cAA6E;QAC9J,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;eAC9I,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QACtK,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAiC,CAAC;IACpG,CAAC;IACS,KAAK,CAAC,cAAc,CAAC,MAAwB,EAAE,SAAyC,EAAE,OAAoB;QACtH,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACtM,OAAO,SAAS,CAAC;IACnB,CAAC;IACS,KAAK,CAAC,YAAY,CAAC,MAAuB,EAAE,QAAiB,IAAmB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjI,KAAK,CAAC,QAAQ,CAAC,GAAW,IAAkB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC;IAC7M,UAAU,CAAC,KAAa;QAChC,IAAI,GAAQ,CAAC;QAAC,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAC1G,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,GAAG,CAAC;IACjR,CAAC;IACS,KAAK,CAAC,IAAI,CAAC,GAAQ,EAAE,MAA8B,EAAE,MAAoB,EAAE,KAAK,GAAG,KAAK,EAAE,cAA6E;QAC/K,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC/H,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACvJ,CAAC;IACS,KAAK,CAAC,IAAI,CAAC,GAAQ,EAAE,OAAoB,EAAE,EAAE,KAAK,GAAG,KAAK;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAClH,IAAI,KAAK,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACpC,IAAI,KAAc,CAAC;QAAC,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAC1I,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtI,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACxK,CAAC;IACO,WAAW,CAAC,MAAmC;QACrD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;eAC7I,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAChL,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IACrH,CAAC;CACF;AACD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/E,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC3G,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;AACxH,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxI,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,wCAAwC;AACxC,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IACnD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAAG,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC;AAC/K,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,30 @@
+/** 单一记录原子提交版本和凭据，退出留下门闩；独立 app/issuer/client 命名空间。 */
+export interface SessionRecord {
+    version: string;
+    user?: string;
+}
+/** 本地串行锁与跨标签页锁的包装，存储读取失败直接拒绝。 */
+export declare class SessionStore {
+    readonly key: string;
+    private readonly storage;
+    private readonly shared;
+    private queue;
+    constructor(key: string, storage: Storage, shared: boolean);
+    read(): SessionRecord;
+    /** 比较版本后提交；旧回调/刷新永远不能复活退出的会话。 */
+    commit(expected: string, user?: string): SessionRecord;
+    /** 所有同实例变更串行，shared 模式同时使用同源 Web Locks。 */
+    locked<T>(operation: () => Promise<T> | T): Promise<T>;
+    /** 协议刷新与回调串行，但退出能立刻写门闩，不等待网络。 */
+    protocol<T>(operation: () => Promise<T>): Promise<T>;
+}
+/** 候选管理器的用户存储永不直接覆盖正式应用凭据。 */
+export declare class MemoryStorage implements Storage {
+    private readonly values;
+    get length(): number;
+    clear(): void;
+    getItem(key: string): string | null;
+    key(index: number): string | null;
+    removeItem(key: string): void;
+    setItem(key: string, value: string): void;
+}

package/dist/session.js

@@ -0,0 +1,62 @@
+import { HeimdallBrowserError } from './types.js';
+/** 本地串行锁与跨标签页锁的包装，存储读取失败直接拒绝。 */
+export class SessionStore {
+    key;
+    storage;
+    shared;
+    queue = Promise.resolve();
+    constructor(key, storage, shared) {
+        this.key = key;
+        this.storage = storage;
+        this.shared = shared;
+        if (shared && !globalThis.navigator?.locks)
+            throw new HeimdallBrowserError('web_locks_required');
+    }
+    read() {
+        const raw = this.storage.getItem(this.key);
+        if (!raw)
+            return { version: 'empty' };
+        try {
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== 'object')
+                throw new Error();
+            const value = parsed;
+            if (typeof value.version !== 'string' || (value.user !== undefined && typeof value.user !== 'string'))
+                throw new Error();
+            return value;
+        }
+        catch {
+            throw new HeimdallBrowserError('invalid_session_storage');
+        }
+    }
+    /** 比较版本后提交；旧回调/刷新永远不能复活退出的会话。 */
+    commit(expected, user) {
+        if (this.read().version !== expected)
+            throw new HeimdallBrowserError('session_changed');
+        const result = { version: crypto.randomUUID(), ...(user ? { user } : {}) };
+        this.storage.setItem(this.key, JSON.stringify(result));
+        return result;
+    }
+    /** 所有同实例变更串行，shared 模式同时使用同源 Web Locks。 */
+    async locked(operation) {
+        const run = () => this.shared ? navigator.locks.request(this.key, operation) : Promise.resolve().then(operation);
+        const result = this.queue.then(run, run);
+        this.queue = result.catch(() => undefined);
+        return result;
+    }
+    /** 协议刷新与回调串行，但退出能立刻写门闩，不等待网络。 */
+    async protocol(operation) {
+        return this.shared ? navigator.locks.request(this.key + ':protocol', operation) : operation();
+    }
+}
+/** 候选管理器的用户存储永不直接覆盖正式应用凭据。 */
+export class MemoryStorage {
+    values = new Map();
+    get length() { return this.values.size; }
+    clear() { this.values.clear(); }
+    getItem(key) { return this.values.get(key) ?? null; }
+    key(index) { return [...this.values.keys()][index] ?? null; }
+    removeItem(key) { this.values.delete(key); }
+    setItem(key, value) { this.values.set(key, value); }
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAKlD,iCAAiC;AACjC,MAAM,OAAO,YAAY;IAEF;IAA8B;IAAmC;IAD9E,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACpD,YAAqB,GAAW,EAAmB,OAAgB,EAAmB,MAAe;QAAhF,QAAG,GAAH,GAAG,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAS;QAAmB,WAAM,GAAN,MAAM,CAAS;QACnG,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnG,CAAC;IACD,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAuB,CAAC;YACtC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAAC,CAAC;IACxE,CAAC;IACD,iCAAiC;IACjC,MAAM,CAAC,QAAgB,EAAE,IAAa;QACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACxF,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,2CAA2C;IAC3C,KAAK,CAAC,MAAM,CAAI,SAA+B;QAC7C,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,iCAAiC;IACjC,KAAK,CAAC,QAAQ,CAAI,SAA2B;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAChG,CAAC;CACF;AAED,8BAA8B;AAC9B,MAAM,OAAO,aAAa;IACP,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,GAAW,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,KAAa,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACrE,UAAU,CAAC,GAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAW,EAAE,KAAa,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;CACrE"}

package/dist/types.d.ts

@@ -0,0 +1,45 @@
+/** 身份数据与权限声明；资源服务器仍执行最终授权。 */
+export interface HeimdallIdentity {
+    issuer: string;
+    clientId: string;
+    tenantId: string;
+    applicationId: string;
+    subjectId: string;
+    sessionId: string;
+    roles: readonly string[];
+    permissions: readonly string[];
+}
+/** 登记地址和受信任资源集合，SDK 不接受浏览器 Secret。 */
+export interface HeimdallBrowserOptions {
+    authority: string;
+    clientId: string;
+    tenantId: string;
+    applicationId: string;
+    audience: string;
+    redirectUri: string;
+    postLogoutRedirectUri: string;
+    resourceBaseUrls?: readonly string[];
+    scope?: string;
+    accessTokenFormat?: 'jwt' | 'opaque';
+    allowLocalhostHttp?: boolean;
+    /** 默认 localStorage，自动跨标签页协调，要求 Web Locks；可指定 sessionStorage、自定义 Storage，或 false 仅用内存。 */
+    storage?: Storage | false;
+    sharedStorage?: boolean;
+    /** 自动续期在已登录时启动，退出后绝不自动发起 SSO。 */
+    automaticRenew?: boolean;
+}
+/** 响应与会话变化使用稳定错误分类，避免记录协议 URL 或 Token。 */
+export declare class HeimdallBrowserError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+/** 应用退出和撤销结果独立，不承诺其他应用已退出。 */
+export interface ApplicationLogoutResult {
+    localLogoutCompleted: true;
+    revocationConfirmed: boolean;
+}
+/** 身份数据快照不公开 AT/RT，支持会话变化订阅。 */
+export interface HeimdallSnapshot {
+    identity: HeimdallIdentity | null;
+    version: string;
+}

package/dist/types.js

@@ -0,0 +1,10 @@
+/** 响应与会话变化使用稳定错误分类，避免记录协议 URL 或 Token。 */
+export class HeimdallBrowserError extends Error {
+    code;
+    constructor(code) {
+        super(`Heimdall operation failed: ${code}.`);
+        this.code = code;
+        this.name = 'HeimdallBrowserError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,0CAA0C;AAC1C,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACjB;IAA5B,YAA4B,IAAY;QAAI,KAAK,CAAC,8BAA8B,IAAI,GAAG,CAAC,CAAC;QAA7D,SAAI,GAAJ,IAAI,CAAQ;QAAkD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IAAC,CAAC;CAChI"}