@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/typescript/commonjs/core/profile.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Claims → Profile mapping (FR-006). Tolerant of Apple private-relay emails and
+ * missing display name / given name (edge cases).
+ */
+import type { Profile, ProviderId, ProviderIdentity } from '../config/types';
+/** Map id-token claims to the app-visible Profile. */
+export declare function mapClaimsToProfile(claims: Record<string, unknown>, providerId?: ProviderId): Profile;
+/**
+ * Describe the external provider identity behind the profile (FR-004 edge
+ * cases). `emailBehavior` is what a screen needs to explain an address the user
+ * did not choose: Apple's private relay forwards mail and is not the address
+ * they type anywhere else.
+ */
+export declare function describeProviderIdentity(claims: Record<string, unknown>, providerId?: ProviderId): ProviderIdentity;
+//# sourceMappingURL=profile.d.ts.map

package/lib/typescript/commonjs/core/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/core/profile.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAU7E,sDAAsD;AACtD,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,CAAC,EAAE,UAAU,GACrB,OAAO,CAsBT;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,CAAC,EAAE,UAAU,GACrB,gBAAgB,CASlB"}

package/lib/typescript/commonjs/core/session.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Session restoration (FR-008, R5). Reads the persisted artifact, attempts a
+ * silent refresh, and classifies the outcome:
+ *  - restored: fresh tokens + claims → authenticated
+ *  - offline:  the refresh could not complete for any reason other than the
+ *              session being invalid — no network, a timeout, a 5xx, an error we
+ *              cannot classify → cached profile read-only, tier unverified (fail
+ *              closed) — clarify Q3
+ *  - unavailable: no artifact, or the provider said the refresh token is no
+ *              longer valid → signed-out reauth
+ *
+ * Only `unavailable` deletes the stored session, so it is reserved for a verdict
+ * the provider actually gave. Treating every unclassified error as expiry signed
+ * users out whenever the token endpoint had a bad moment.
+ */
+import type { AccessTier, AccessTierMapping, Profile, RestoreStatus } from '../config/types';
+import type { OidcAuthClient } from '../oidc/authClient';
+import type { SecureTokenStore } from '../tokens/secureStore';
+/**
+ * The identity in the stored artifact: who, not what the token said.
+ *
+ * The whole claim set used to be written to the Keychain on every launch — all
+ * of it, groups included — for a value nothing reads back: the access tier is
+ * recomputed from fresh claims, and a restore that cannot reach the provider
+ * fails closed anyway (AUTH-23).
+ */
+export type StoredProfile = Omit<Profile, 'claims'>;
+export interface PersistedSession {
+    refreshToken: string;
+    profile: StoredProfile;
+    /** The id token hint for end-session (AUTH-04). Absent in artifacts written before 0.2.2. */
+    idToken?: string | undefined;
+}
+/** The artifact's identity as a profile. Artifacts written before 0.4.0 carry claims; they are kept. */
+export declare function profileFromStored(stored: StoredProfile | Profile): Profile;
+/** What goes to the store: everything but the claims. */
+export declare function storedProfileFrom(profile: Profile): StoredProfile;
+/** True when the artifact would be byte-identical, so the write can be skipped. */
+export declare function sameSession(a: PersistedSession, b: PersistedSession): boolean;
+export interface RestoreDeps {
+    secureStore: SecureTokenStore;
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    scopes: string[];
+    authClient: OidcAuthClient;
+    mapping: AccessTierMapping;
+}
+export interface RestoreResult {
+    outcome: RestoreStatus;
+    profile?: Profile;
+    /** The artifact this restore read, so a rewrite that changes nothing can be skipped. */
+    persisted?: PersistedSession;
+    accessTier?: AccessTier;
+    refreshToken?: string;
+    idToken?: string | undefined;
+}
+export declare function parsePersistedSession(raw: string | null): PersistedSession | null;
+export declare function restoreSession(deps: RestoreDeps): Promise<RestoreResult>;
+//# sourceMappingURL=session.d.ts.map

package/lib/typescript/commonjs/core/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAM9D;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,GAAG,OAAO,CAE1E;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAOjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAS7E;AAED,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAajF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C9E"}

package/lib/typescript/commonjs/diagnostics/errors.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Developer-facing diagnostics. AuthError carries a stable machine-readable
+ * code, an audience (user vs developer/tenant), and a localizable message key.
+ * `detail` is always passed through `redact` so tokens and secrets never appear
+ * in logs or error objects (FR-014).
+ */
+import { SdkError } from '@chipmobilesdk/rn-core';
+import type { AuthMessageKey } from './messageKeys';
+export type AuthErrorCode = 'configuration-error' | 'provider-cancelled' | 'redirect-mismatch' | 'token-acquisition-failed' | 'session-expired' | 'consent-denied' | 'network-unavailable';
+export type AuthErrorAudience = 'user' | 'developer';
+export interface AuthErrorArgs {
+    code: AuthErrorCode;
+    /** A key of this package's catalogue: the copy an app shows for this error. */
+    messageKey: AuthMessageKey;
+    audience?: AuthErrorAudience;
+    detail?: string | undefined;
+}
+/**
+ * Replace token-like substrings with a placeholder so diagnostics never leak
+ * secrets or token values (FR-014): JWTs become `[redacted-token]`; URLs, e-mail
+ * addresses, UUIDs and other opaque runs become `[redacted]` (rn-core's patterns).
+ */
+export declare function redact(value: string | undefined): string | undefined;
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-auth'`. */
+export declare class AuthError extends SdkError<AuthErrorCode> {
+    readonly audience: AuthErrorAudience;
+    readonly messageKey: AuthMessageKey;
+    readonly detail?: string | undefined;
+    constructor(args: AuthErrorArgs);
+}
+export declare class AuthConfigError extends AuthError {
+    constructor(messageKey: AuthMessageKey, detail?: string);
+}
+export declare function isAuthError(value: unknown): value is AuthError;
+/** Normalize any thrown value into an AuthError without leaking secrets. */
+export declare function toAuthError(value: unknown, fallbackCode?: AuthErrorCode, fallbackMessageKey?: AuthMessageKey): AuthError;
+//# sourceMappingURL=errors.d.ts.map

package/lib/typescript/commonjs/diagnostics/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAmB,QAAQ,EAAkB,MAAM,wBAAwB,CAAC;AAEnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,MAAM,aAAa,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,mBAAmB,GACnB,0BAA0B,GAC1B,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,WAAW,CAAC;AAErD,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,+EAA+E;IAC/E,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAOD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQpE;AAKD,2FAA2F;AAC3F,qBAAa,SAAU,SAAQ,QAAQ,CAAC,aAAa,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEzB,IAAI,EAAE,aAAa;CAY/B;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBACjC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM;CAIvD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAC1B,KAAK,EAAE,OAAO,EACd,YAAY,GAAE,aAA0C,EACxD,kBAAkB,GAAE,cAAmC,GACrD,SAAS,CAWX"}

package/lib/typescript/commonjs/diagnostics/messageKeys.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Stable, localizable message keys with English default copy (UX-006 / LIB-011).
+ * The library takes no i18n runtime dependency: consuming apps map these keys to
+ * localized strings via their own i18n system. User-actionable copy and
+ * developer/tenant-configuration copy are kept separate (UX-005).
+ */
+export interface AuthMessageMap {
+    'auth.action.continueGoogle': string;
+    'auth.action.continueApple': string;
+    'auth.action.continueFacebook': string;
+    'auth.state.signedOut': string;
+    'auth.state.authenticating': string;
+    'auth.state.signedIn': string;
+    'auth.state.signingOut': string;
+    'auth.tier.free': string;
+    'auth.tier.premium': string;
+    'auth.tier.unverified': string;
+    'auth.error.cancelled': string;
+    'auth.error.sessionExpired': string;
+    'auth.error.entitlement': string;
+    'auth.error.network': string;
+    'auth.error.configuration': string;
+    'auth.error.redirectMismatch': string;
+    'auth.error.token': string;
+    'auth.error.consentDenied': string;
+}
+export type AuthMessageKey = keyof AuthMessageMap;
+/**
+ * The catalog, as an rn-core message set: `user` copy may reach an end user,
+ * `developer` copy describes a tenant or configuration fault (UX-005). Register
+ * `authMessages.user` with rn-i18n to translate it like app copy.
+ */
+export declare const authMessages: import("@chipmobilesdk/rn-core").MessageSet<{
+    'auth.action.continueGoogle': string;
+    'auth.action.continueApple': string;
+    'auth.action.continueFacebook': string;
+    'auth.state.signedOut': string;
+    'auth.state.authenticating': string;
+    'auth.state.signedIn': string;
+    'auth.state.signingOut': string;
+    'auth.tier.free': string;
+    'auth.tier.premium': string;
+    'auth.tier.unverified': string;
+    'auth.error.cancelled': string;
+    'auth.error.sessionExpired': string;
+    'auth.error.entitlement': string;
+    'auth.error.network': string;
+}, {
+    'auth.error.configuration': string;
+    'auth.error.redirectMismatch': string;
+    'auth.error.token': string;
+    'auth.error.consentDenied': string;
+}>;
+export declare const DEFAULT_MESSAGES: AuthMessageMap;
+/** Resolve a message, preferring app overrides over the English defaults. */
+export declare function resolveMessages(overrides?: Partial<AuthMessageMap>): AuthMessageMap;
+//# sourceMappingURL=messageKeys.d.ts.map

package/lib/typescript/commonjs/diagnostics/messageKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageKeys.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/messageKeys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,cAAc;IAE9B,4BAA4B,EAAE,MAAM,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,8BAA8B,EAAE,MAAM,CAAC;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2BAA2B,EAAE,MAAM,CAAC;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAEhC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAE/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2BAA2B,EAAE,MAAM,CAAC;IACpC,wBAAwB,EAAE,MAAM,CAAC;IACjC,oBAAoB,EAAE,MAAM,CAAC;IAE7B,0BAA0B,EAAE,MAAM,CAAC;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;EAuBvB,CAAC;AAEH,eAAO,MAAM,gBAAgB,EAAE,cAAsC,CAAC;AAEtE,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAEnF"}

package/lib/typescript/commonjs/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @chipmobilesdk/rn-auth — reusable Microsoft Entra External ID authentication
+ * for ChipMobileSdk-family React Native apps (public OIDC/PKCE client, no
+ * backend). This is the single public entrypoint (LIB-003); modules under
+ * `core/`, `tokens/`, `oidc/`, `access/`, and `diagnostics/` are private.
+ */
+import type { Auth, AuthConfig, CreateAuthOptions } from './config/types';
+/** Create the auth controller. Throws AuthConfigError on invalid config (FR-005). */
+export declare function createAuth(config: AuthConfig, options?: CreateAuthOptions): Auth;
+export type { Auth, AuthConfig, CreateAuthOptions, AuthState, AuthStatus, RestoreStatus, Profile, ProviderIdentity, ProviderConfig, ProviderId, KnownProviderId, DevicePlatform, ResourceConfig, ClaimMatcher, AccessTierMapping, AccessTier, AccessTokenResult, AccessTokenStatus, PremiumGateResult, GlobalSignOutResult, } from './config/types';
+export { describeProviderIdentity, mapClaimsToProfile } from './core/profile';
+export type { AccessTokenRequestOptions } from './tokens/accessToken';
+export type { SecureTokenStore } from './tokens/secureStore';
+export { createKeychainSecureStore, AUTH_STORAGE_KEY } from './tokens/secureStore';
+export type { OidcAuthClient, OidcTokens, OidcServiceConfiguration, AppAuthClientOptions, AuthorizeParams, RefreshParams, EndSessionParams, } from './oidc/authClient';
+export { createAppAuthClient } from './oidc/authClient';
+export { evaluateAccessTier, failClosedTier } from './access/accessTier';
+export { AuthError, AuthConfigError, isAuthError, redact } from './diagnostics/errors';
+export type { AuthErrorCode, AuthErrorAudience } from './diagnostics/errors';
+export { DEFAULT_MESSAGES, authMessages, resolveMessages } from './diagnostics/messageKeys';
+export type { AuthMessageMap, AuthMessageKey } from './diagnostics/messageKeys';
+export { AuthProvider } from './react/AuthProvider';
+export { useAuthSelector } from './react/hooks';
+export type { AuthProviderProps } from './react/AuthProvider';
+export { useAuth, useAuthMessages, useProfile, useAccessTier, useAccessToken, useSignInProvider, useSignInProviders, } from './react/hooks';
+export type { UseAuthResult, UseAccessTokenResult, UseAccessTokenStatus } from './react/hooks';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAEhF;AAGD,YAAY,EACX,IAAI,EACJ,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,aAAa,EACb,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnF,YAAY,EACX,cAAc,EACd,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,gBAAgB,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGzE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACN,OAAO,EACP,eAAe,EACf,UAAU,EACV,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/lib/typescript/commonjs/keychain.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@chipmobilesdk/rn-auth/keychain`: the default secure token store over
+ * react-native-keychain (AUTH-09). Its own entrypoint, so an app with its own
+ * secure storage never reaches this module.
+ */
+export { createKeychainSecureStore, type KeychainSecureStoreOptions } from './tokens/secureStore';
+//# sourceMappingURL=keychain.d.ts.map

package/lib/typescript/commonjs/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/typescript/commonjs/oidc/authClient.d.ts

@@ -0,0 +1,75 @@
+/**
+ * OidcAuthClient port + default react-native-app-auth adapter (R1).
+ *
+ * The port abstracts the Authorization Code + PKCE public-client flow so the
+ * auth engine is testable without native code. The default adapter lazily
+ * requires react-native-app-auth and is validated on device.
+ */
+export interface OidcTokens {
+    /** Resource/audience access token (present for authorize and resource refresh). */
+    accessToken?: string | undefined;
+    /**
+     * Refresh token used for silent acquisition and restore. Absent when the
+     * provider issued none — a refresh that does not rotate, or an authorize the
+     * tenant answered without `offline_access`.
+     */
+    refreshToken?: string | undefined;
+    /** Raw id token (JWT). Absent from a refresh requested without `openid`. */
+    idToken?: string | undefined;
+    /** Decoded id-token (or access-token) claims used for profile + access tier. */
+    claims: Record<string, unknown>;
+    /** Access-token expiry in epoch milliseconds, when available. */
+    accessTokenExpiresAt?: number | undefined;
+}
+export interface AuthorizeParams {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    scopes: string[];
+    /** Additional OIDC parameters, e.g. `domain_hint` for social routing. */
+    additionalParameters?: Record<string, string>;
+}
+export interface RefreshParams {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    refreshToken: string;
+    scopes: string[];
+}
+export interface EndSessionParams {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    idToken?: string | undefined;
+}
+export interface OidcAuthClient {
+    authorize(params: AuthorizeParams): Promise<OidcTokens>;
+    refresh(params: RefreshParams): Promise<OidcTokens>;
+    endSession(params: EndSessionParams): Promise<void>;
+}
+/** Decode the payload segment of a JWT without any dependency (device-safe). */
+export declare function decodeJwtClaims(jwt: string | null | undefined): Record<string, unknown>;
+/** The endpoints discovery would have returned, when an app already knows them. */
+export interface OidcServiceConfiguration {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    endSessionEndpoint?: string;
+    revocationEndpoint?: string;
+    registrationEndpoint?: string;
+}
+export interface AppAuthClientOptions {
+    /** When true, the OIDC discovery document is fetched from `${authority}`. */
+    useDiscovery?: boolean;
+    /**
+     * Static endpoints, used instead of discovery. Every authorize, refresh and
+     * sign-out otherwise costs the native module one `.well-known` round-trip,
+     * including the refresh on the startup path (AUTH-08).
+     */
+    serviceConfiguration?: OidcServiceConfiguration;
+}
+/**
+ * Default OidcAuthClient adapter wrapping react-native-app-auth (PKCE public
+ * client). Validated on device (R8).
+ */
+export declare function createAppAuthClient(options?: AppAuthClientOptions): OidcAuthClient;
+//# sourceMappingURL=authClient.d.ts.map

package/lib/typescript/commonjs/oidc/authClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authClient.d.ts","sourceRoot":"","sources":["../../../../src/oidc/authClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,MAAM,WAAW,UAAU;IAC1B,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,iEAAiE;IACjE,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC9B,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcvF;AA0CD,mFAAmF;AACnF,MAAM,WAAW,wBAAwB;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CAChD;AAyCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,cAAc,CAwEtF"}

package/lib/typescript/commonjs/oidc/classifyError.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Classifies a native OIDC error into an `AuthErrorCode`.
+ *
+ * The rules are an ordered table rather than a chain of substring checks, so a
+ * platform adapter (the iOS one, later) adds its own rows without touching the
+ * engine. Order matters: the first matching rule wins.
+ *
+ * The default is deliberately not "session expired". Restore clears the stored
+ * session only on `session-expired`, so anything this table cannot name — a
+ * timeout, a 5xx, a discovery failure, a localized message — must keep the
+ * session rather than sign the user out.
+ */
+import { AuthError, type AuthErrorCode } from '../diagnostics/errors';
+import type { AuthMessageKey } from '../diagnostics/messageKeys';
+export interface ClassificationRule {
+    readonly code: AuthErrorCode;
+    readonly messageKey: AuthMessageKey;
+    /** Matched against the native error's `code` and `message`, case-insensitively. */
+    readonly pattern: RegExp;
+}
+/**
+ * OAuth error codes (RFC 6749 §5.2, OIDC Core §3.1.2.6) and the Entra ID AADSTS
+ * codes that mean the same thing, plus the transport failures app-auth reports.
+ */
+export declare const DEFAULT_CLASSIFICATION_RULES: readonly ClassificationRule[];
+/** Maps a native app-auth error to a classified AuthError without leaking tokens. */
+export declare function classifyAppAuthError(error: unknown, rules?: readonly ClassificationRule[]): AuthError;
+//# sourceMappingURL=classifyError.d.ts.map

package/lib/typescript/commonjs/oidc/classifyError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifyError.d.ts","sourceRoot":"","sources":["../../../../src/oidc/classifyError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,kBAAkB,EA8BrE,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,SAAS,kBAAkB,EAAiC,GACjE,SAAS,CAaX"}

package/lib/typescript/commonjs/oidc/socialRouting.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Social provider routing (FR-002/FR-003, R3). Google and Apple are federated
+ * inside the External ID tenant; the app presents the platform-correct action
+ * and starts the user flow with a per-provider `domain_hint`.
+ */
+import type { AuthConfig, DevicePlatform, ProviderConfig, ProviderId } from '../config/types';
+/** Find the configured provider, ensuring it is enabled for the platform. */
+export declare function resolveProvider(config: AuthConfig, providerId: ProviderId, platform: DevicePlatform): ProviderConfig;
+/** Build the OIDC additional parameters that route to the chosen IdP. */
+export declare function buildAdditionalParameters(provider: ProviderConfig): Record<string, string>;
+/**
+ * All providers to present on a given platform, in configuration array order
+ * (FR-003/FR-004). Filtered to providers enabled for the platform and not marked
+ * unavailable.
+ */
+export declare function availableProvidersForPlatform(config: AuthConfig, platform: DevicePlatform): ProviderConfig[];
+/**
+ * The first available provider for a platform (UX-004, back-compat). Equals
+ * `availableProvidersForPlatform(config, platform)[0]`.
+ */
+export declare function defaultProviderForPlatform(config: AuthConfig, platform: DevicePlatform): ProviderConfig | undefined;
+//# sourceMappingURL=socialRouting.d.ts.map

package/lib/typescript/commonjs/oidc/socialRouting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socialRouting.d.ts","sourceRoot":"","sources":["../../../../src/oidc/socialRouting.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG9F,6EAA6E;AAC7E,wBAAgB,eAAe,CAC9B,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,GACtB,cAAc,CAqBhB;AAED,yEAAyE;AACzE,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI1F;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,cAAc,GACtB,cAAc,EAAE,CAIlB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,cAAc,GACtB,cAAc,GAAG,SAAS,CAE5B"}

package/lib/typescript/commonjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/typescript/commonjs/react/AuthProvider.d.ts

@@ -0,0 +1,17 @@
+/**
+ * React context boundary for the auth controller (LIB-002).
+ *
+ * The context carries the controller only, never its state: a context value that
+ * changed on every transition re-rendered every consumer on every transition
+ * (PERF-02). Hooks read the state through `useSyncExternalStore` with a selector,
+ * so a component re-renders only when the part it reads changes.
+ */
+import React from 'react';
+import type { Auth } from '../config/types';
+export interface AuthProviderProps {
+    auth: Auth;
+    children: React.ReactNode;
+}
+export declare function AuthProvider({ auth, children }: AuthProviderProps): React.JSX.Element;
+export declare function useAuthInstance(): Auth;
+//# sourceMappingURL=AuthProvider.d.ts.map

package/lib/typescript/commonjs/react/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../../../../src/react/AuthProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAoC,MAAM,OAAO,CAAC;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAI5C,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,iBAAiB,qBAEjE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAMtC"}

package/lib/typescript/commonjs/react/hooks.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Public hooks (LIB-002). Each reads the controller's state through
+ * `useSyncExternalStore` (rn-core's `useExternalStore`), selecting only what it
+ * returns, so `useProfile` does not re-render when only the status changes.
+ */
+import type { AccessTier, AccessTokenResult, AuthState, GlobalSignOutResult, PremiumGateResult, Profile, ProviderConfig, ProviderId } from '../config/types';
+import type { AccessTokenRequestOptions } from '../tokens/accessToken';
+import type { AuthMessageMap } from '../diagnostics/messageKeys';
+export interface UseAuthResult {
+    state: AuthState;
+    signIn(providerId: ProviderId): Promise<AuthState>;
+    signOut(): Promise<void>;
+    signOutGlobal(): Promise<GlobalSignOutResult>;
+    restore(): Promise<AuthState>;
+    /** Whether a premium-only path is open. Changes nothing: show the denial where it happened. */
+    canAccessPremium(): PremiumGateResult;
+    /** @deprecated Use `canAccessPremium`; this moves the whole controller to `access-denied` (AUTH-12). */
+    requirePremium(): PremiumGateResult;
+}
+/**
+ * Any slice of the auth state; the component re-renders only when the slice
+ * changes by `isEqual` (default `Object.is`).
+ */
+export declare function useAuthSelector<Selected>(select: (state: AuthState) => Selected, isEqual?: (a: Selected, b: Selected) => boolean): Selected;
+export declare function useAuth(): UseAuthResult;
+/** This package's copy, with the app's `messages` overrides applied. */
+export declare function useAuthMessages(): AuthMessageMap;
+export declare function useProfile(): Profile | undefined;
+export declare function useAccessTier(): AccessTier;
+/** The first provider to present on the current platform (UX-004), or undefined. */
+export declare function useSignInProvider(): ProviderConfig | undefined;
+/** All available providers for the current platform, in configuration order (FR-003/FR-004). */
+export declare function useSignInProviders(): ProviderConfig[];
+export type UseAccessTokenStatus = 'idle' | 'loading' | 'success' | 'denied' | 'unavailable' | 'error';
+export interface UseAccessTokenResult {
+    status: UseAccessTokenStatus;
+    token?: string | undefined;
+    /** `{ forceRefresh: true }` after a server refused the token this returned. */
+    request(options?: AccessTokenRequestOptions): Promise<AccessTokenResult>;
+}
+export declare function useAccessToken(resourceKey: string): UseAccessTokenResult;
+//# sourceMappingURL=hooks.d.ts.map

package/lib/typescript/commonjs/react/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../../src/react/hooks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EACX,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9B,+FAA+F;IAC/F,gBAAgB,IAAI,iBAAiB,CAAC;IACtC,wGAAwG;IACxG,cAAc,IAAI,iBAAiB,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EACvC,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,QAAQ,EACtC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,KAAK,OAAO,GAC7C,QAAQ,CAGV;AAMD,wBAAgB,OAAO,IAAI,aAAa,CAYvC;AAED,wEAAwE;AACxE,wBAAgB,eAAe,IAAI,cAAc,CAEhD;AAED,wBAAgB,UAAU,IAAI,OAAO,GAAG,SAAS,CAEhD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAE1C;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAG9D;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,IAAI,cAAc,EAAE,CAGrD;AAED,MAAM,MAAM,oBAAoB,GAC/B,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzE;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAyCxE"}

package/lib/typescript/commonjs/testing/conformance.d.ts

@@ -0,0 +1,32 @@
+/**
+ * What any `SecureTokenStore` and `OidcAuthClient` must do (IOS-12, AUTH-13).
+ *
+ * The same checks run against the in-memory doubles and against the keychain and
+ * app-auth adapters (native modules mocked in Jest, or for real from a demo
+ * screen on a device), so a test that drives a double proves something about the
+ * device path. Each check builds its own subject through a harness.
+ */
+import { type Check, type ConformanceReport } from '@chipmobilesdk/rn-core/testing';
+import type { OidcAuthClient } from '../oidc/authClient';
+import type { SecureTokenStore } from '../tokens/secureStore';
+export interface SecureStoreHarness {
+    /** An empty store. */
+    create(): SecureTokenStore;
+}
+export interface OidcSubject {
+    readonly client: OidcAuthClient;
+    /** The identity provider answers sign-in and refresh with tokens for these claims. */
+    issues(claims: Record<string, unknown>): void;
+    /** The user closes the sign-in sheet. */
+    userCancels(): void;
+    /** The provider no longer accepts the refresh token. */
+    rejectsRefresh(): void;
+}
+export interface OidcHarness {
+    create(): OidcSubject;
+}
+export declare const secureTokenStoreChecks: readonly Check<SecureStoreHarness>[];
+export declare const oidcAuthClientChecks: readonly Check<OidcHarness>[];
+export declare function runSecureTokenStoreConformance(harness: SecureStoreHarness): Promise<ConformanceReport>;
+export declare function runOidcAuthClientConformance(harness: OidcHarness): Promise<ConformanceReport>;
+//# sourceMappingURL=conformance.d.ts.map

package/lib/typescript/commonjs/testing/conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.d.ts","sourceRoot":"","sources":["../../../../src/testing/conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAGN,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IAClC,sBAAsB;IACtB,MAAM,IAAI,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,sFAAsF;IACtF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,yCAAyC;IACzC,WAAW,IAAI,IAAI,CAAC;IACpB,wDAAwD;IACxD,cAAc,IAAI,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC3B,MAAM,IAAI,WAAW,CAAC;CACtB;AAKD,eAAO,MAAM,sBAAsB,EAAE,SAAS,KAAK,CAAC,kBAAkB,CAAC,EA+CtE,CAAC;AAaF,eAAO,MAAM,oBAAoB,EAAE,SAAS,KAAK,CAAC,WAAW,CAAC,EAkE7D,CAAC;AAEF,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,kBAAkB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE7F"}

package/lib/typescript/commonjs/testing/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@chipmobilesdk/rn-auth/testing`: test doubles and the port conformance suites.
+ *
+ * A separate entrypoint so neither can reach a production bundle.
+ */
+import type { SecureTokenStore } from '../tokens/secureStore';
+/** A `SecureTokenStore` held in memory, for tests and for the conformance suite. */
+export declare function createMemorySecureStore(seed?: Record<string, string>): SecureTokenStore;
+export { oidcAuthClientChecks, runOidcAuthClientConformance, runSecureTokenStoreConformance, secureTokenStoreChecks, } from './conformance';
+export type { OidcHarness, OidcSubject, SecureStoreHarness } from './conformance';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,gBAAgB,CAa3F;AAED,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,sBAAsB,GACtB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}

package/lib/typescript/commonjs/tokens/accessToken.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Per-resource delegated access-token acquisition with an in-memory cache and
+ * silent refresh (FR-007, PERF-003, R4). Access tokens are never persisted to
+ * disk (FR-021) — only kept in memory keyed by resource until expiry.
+ */
+import type { AccessTokenResult, ResourceConfig } from '../config/types';
+import type { OidcAuthClient } from '../oidc/authClient';
+export interface AccessTokenManagerDeps {
+    authority: string;
+    clientId: string;
+    redirectUrl: string;
+    resources: ResourceConfig[];
+    authClient: OidcAuthClient;
+    getRefreshToken: () => string | null;
+    /**
+     * The session generation, bumped by every sign-in, sign-out and restore. A
+     * refresh that started under one generation and finished under another
+     * belongs to a session that no longer exists, so its result is discarded.
+     */
+    sessionEpoch: () => number;
+    /**
+     * The provider rotated the refresh token. Resolves once the new token is
+     * live, and persisted where it can be: the old one may already be dead, so a
+     * restart must not come back with it.
+     */
+    onRefreshTokenRotated: (token: string, epoch: number) => Promise<void>;
+}
+export interface AccessTokenRequestOptions {
+    /**
+     * Ignore the cached token and ask the provider for a new one.
+     *
+     * For the caller that just had one rejected: a token the server refused is
+     * still unexpired by this device's clock, so asking again without this
+     * returns the same token and the retry is the same request (AI-01).
+     */
+    forceRefresh?: boolean;
+}
+export interface AccessTokenManager {
+    request(resourceKey: string, options?: AccessTokenRequestOptions): Promise<AccessTokenResult>;
+    /** Whether `request` would answer from the cache, without touching the network. */
+    hasFreshToken(resourceKey: string): boolean;
+    clear(): void;
+}
+export declare function createAccessTokenManager(deps: AccessTokenManagerDeps): AccessTokenManager;
+//# sourceMappingURL=accessToken.d.ts.map

package/lib/typescript/commonjs/tokens/accessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessToken.d.ts","sourceRoot":"","sources":["../../../../src/tokens/accessToken.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAUzD,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,eAAe,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,yBAAyB;IACzC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9F,mFAAmF;IACnF,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5C,KAAK,IAAI,IAAI,CAAC;CACd;AAOD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,CA4GzF"}

package/lib/typescript/commonjs/tokens/secureStore.d.ts

@@ -0,0 +1,26 @@
+/**
+ * SecureTokenStore port + default react-native-keychain adapter (FR-021, R2).
+ *
+ * Refresh tokens and the session-restore artifact persist ONLY through this
+ * port, backed by platform secure storage (iOS Keychain / Android Keystore).
+ * Access tokens are never written here — they stay in memory (see accessToken).
+ * The default adapter loads the native module on its first read or write, so
+ * creating it, and unit tests that inject a fake, load no native code.
+ */
+/** Single key under which the persisted session artifact is stored. */
+export declare const AUTH_STORAGE_KEY = "@chipmobilesdk/rn-auth/session";
+export interface SecureTokenStore {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+export interface KeychainSecureStoreOptions {
+    /** Optional Keychain access-control accessibility constant. */
+    accessible?: string;
+}
+/**
+ * Default secure store backed by react-native-keychain. Each logical key maps to
+ * a Keychain "service" so multiple keys can coexist. Validated on device.
+ */
+export declare function createKeychainSecureStore(options?: KeychainSecureStoreOptions): SecureTokenStore;
+//# sourceMappingURL=secureStore.d.ts.map

package/lib/typescript/commonjs/tokens/secureStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secureStore.d.ts","sourceRoot":"","sources":["../../../../src/tokens/secureStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,mCAAmC,CAAC;AAEjE,MAAM,WAAW,gBAAgB;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,0BAA0B;IAC1C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACxC,OAAO,GAAE,0BAA+B,GACtC,gBAAgB,CAoBlB"}

package/lib/typescript/module/access/accessTier.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Access-tier evaluation (FR-010/FR-011/FR-019/FR-020, R6).
+ *
+ * Pure function over the authenticated token's claims and the app-specific
+ * mapping. Object ids are authoritative; display names never grant access.
+ * Missing, stale, ambiguous, or group-overage claims fail closed (premium
+ * denied, verification = 'unverified').
+ */
+import type { AccessTier, AccessTierMapping } from '../config/types.js';
+/** The fail-closed default: free + unverified. */
+export declare function failClosedTier(): AccessTier;
+/** Evaluate the access tier, failing closed when entitlement is unverifiable. */
+export declare function evaluateAccessTier(claims: Record<string, unknown>, mapping: AccessTierMapping, now?: number): AccessTier;
+//# sourceMappingURL=accessTier.d.ts.map

package/lib/typescript/module/access/accessTier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTier.d.ts","sourceRoot":"","sources":["../../../../src/access/accessTier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAgB,MAAM,oBAAiB,CAAC;AAEnF,kDAAkD;AAClD,wBAAgB,cAAc,IAAI,UAAU,CAE3C;AAoCD,iFAAiF;AACjF,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,GAAG,GAAE,MAAmB,GACtB,UAAU,CAgCZ"}

package/lib/typescript/module/app-auth.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@chipmobilesdk/rn-auth/app-auth`: the default OIDC client over
+ * react-native-app-auth (AUTH-09). Its own entrypoint, so an app that injects its
+ * own client never reaches this module.
+ */
+export { createAppAuthClient, type AppAuthClientOptions } from './oidc/authClient.js';
+//# sourceMappingURL=app-auth.d.ts.map

package/lib/typescript/module/app-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-auth.d.ts","sourceRoot":"","sources":["../../../src/app-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAmB,CAAC"}