@espuni/browser 0.1.1 → 0.1.2

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "@espuni/browser",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Browser SDK for the espuni Age Verification flow (DC API → OID4VP/QR fallback)",
   "license": "MIT",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "//": "Workspace resolves from ./src (no build-order coupling); publishConfig below repoints the *published* manifest at the compiled ./dist so npm consumers (bundlers and the portal) resolve real files, not the unshipped src.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./global": "./dist/index.global.js"
   },
   "browser": "dist/index.global.js",
   "unpkg": "dist/index.global.js",
@@ -20,10 +26,11 @@
   "devDependencies": {
     "tsup": "^8.0.0",
     "typescript": "^5.4.5",
-    "@espuni/core": "0.1.1"
+    "@espuni/core": "0.1.2"
   },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch"
-  }
+  },
+  "module": "./dist/index.mjs"
 }

package/src/index.ts

@@ -1,308 +0,0 @@
-// @espuni/browser — browser SDK for the espuni Age Verification flow.
-//
-// Encapsulates the DC API → OID4VP/QR fallback so relying parties don't
-// reimplement it. Pure decisions (protocol selection, av:// scheme rewrite,
-// QR/deeplink derivation, claim extraction) come from @espuni/core, bundled in
-// at build time.
-//
-// The SDK never touches secrets: it asks YOUR backend for an offer per protocol
-// via the `createSession` factory, then runs the wallet flow and resolves the
-// result via your poll/SSE endpoints. DC API (ISO 18013-7) and the OID4VP
-// fallback are separate espuni offers, so the factory is called per protocol.
-
-import {
-  buildAvOfferLinks,
-  extractAgeOver18,
-  isDcApiProtocol,
-  resolveAvProtocol,
-  type AvProtocol,
-} from '@espuni/core';
-
-export * from '@espuni/core';
-
-/** Session/offer as returned by espuni's `createSession` (server-side). */
-export interface EspuniSession {
-  sessionId: string;
-  /** OID4VP deeplink `openid4vp://...` (same-device). */
-  uri?: string;
-  /** OID4VP cross-device URI to encode as a QR. */
-  crossDeviceUri?: string;
-  /** Present for the ISO 18013-7 DC API flow. */
-  orgIsoMdoc?: { deviceRequest: string; encryptionInfo?: string };
-}
-
-/** What the `createSession` factory returns for a given protocol. */
-export interface SessionBundle {
-  session: EspuniSession;
-  /** Endpoint on YOUR backend that forwards the DC API response to espuni. */
-  dcApiSubmitUrl?: string;
-  /** GET endpoint returning `{ status, claims }` (polled with no-store). */
-  pollUrl?: string;
-  /** SSE endpoint streaming `{ status, claims }` events. */
-  eventsUrl?: string;
-}
-
-export interface VerifyResult {
-  status: 'completed';
-  claims: unknown;
-  /** Derived from `claims` via @espuni/core. */
-  ageOver18: boolean;
-}
-
-export interface VerifyFailure {
-  error: string;
-  status?: string;
-  claims?: unknown;
-}
-
-export interface VerifyOptions {
-  /**
-   * Factory the SDK calls to obtain an offer for a chosen protocol. Called with
-   * `'dc-api-iso'` first when the browser supports the DC API, then `'oid4vp'`
-   * as fallback (or just `'oid4vp'` when the DC API is unavailable).
-   */
-  createSession: (protocol: AvProtocol) => Promise<SessionBundle>;
-  /** Force a protocol. Default `'auto'` (capability-based). */
-  protocol?: 'auto' | AvProtocol;
-
-  /** Custom wallet scheme for the QR/deeplink (default `av`; `openid4vp` disables the rewrite). */
-  deeplinkScheme?: string;
-  /**
-   * Container to render the QR into. May be a lazy getter — useful in
-   * frameworks where the element mounts after `verify()` is called (the SDK
-   * resolves it only when it actually renders the QR).
-   */
-  container?: HTMLElement | null | (() => HTMLElement | null);
-  /** Custom QR renderer. Defaults to qrcodejs (`window.QRCode`, lazy-loaded from `qrCdnUrl`). */
-  renderQr?: (container: HTMLElement, uri: string) => void;
-  /** CDN URL for the default QR lib (qrcodejs). */
-  qrCdnUrl?: string;
-  /** Called with the derived links so the host can render its own QR/buttons. */
-  onLinks?: (links: { qrUri: string; deepLinkUri: string; avLinkUri: string }) => void;
-
-  /** Poll cadence in ms (default 2500). */
-  pollIntervalMs?: number;
-
-  onSuccess?: (result: VerifyResult) => void;
-  onFailure?: (err: VerifyFailure) => void;
-}
-
-const DEFAULT_QR_CDN = 'https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js';
-
-/** True when the browser exposes the Digital Credentials API. */
-export function hasDcApi(): boolean {
-  try {
-    return (
-      typeof window !== 'undefined' &&
-      typeof (window as unknown as { DigitalCredential?: unknown }).DigitalCredential !== 'undefined'
-    );
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Runs the AV verification: DC API (ISO 18013-7) when available, otherwise the
- * OID4VP QR/deeplink fallback (and DC API falls back to OID4VP on error). The
- * result is resolved via the bundle's `pollUrl` / `eventsUrl`.
- */
-export function verify(opts: VerifyOptions): void {
-  const primary = resolveAvProtocol(hasDcApi(), opts.protocol ?? 'auto');
-  const fallback: AvProtocol | null = isDcApiProtocol(primary) ? 'oid4vp' : null;
-  void attempt(opts, primary, fallback);
-}
-
-async function attempt(opts: VerifyOptions, protocol: AvProtocol, fallback: AvProtocol | null): Promise<void> {
-  const toFallback = () => {
-    if (fallback) void attempt(opts, fallback, null);
-    else opts.onFailure?.({ error: 'error' });
-  };
-
-  let bundle: SessionBundle;
-  try {
-    bundle = await opts.createSession(protocol);
-  } catch (err) {
-    // Fall back to the next protocol on a create-session error; only surface
-    // the failure once there is no fallback left (preserves the last error,
-    // e.g. a "not configured" from the OID4VP attempt).
-    if (fallback) void attempt(opts, fallback, null);
-    else opts.onFailure?.({ error: (err as Error)?.message || 'create_session_failed' });
-    return;
-  }
-  if (!bundle?.session?.sessionId) {
-    toFallback();
-    return;
-  }
-
-  if (isDcApiProtocol(protocol)) {
-    if (!bundle.session.orgIsoMdoc || !bundle.dcApiSubmitUrl) {
-      toFallback();
-      return;
-    }
-    try {
-      await runDcApi(bundle);
-      startResultWatch(opts, bundle);
-    } catch (err) {
-      const name = (err as { name?: string } | undefined)?.name;
-      if (name === 'NotAllowedError' || name === 'AbortError') {
-        opts.onFailure?.({ error: 'cancelled' });
-      } else {
-        toFallback();
-      }
-    }
-    return;
-  }
-
-  runOid4vp(opts, bundle);
-  startResultWatch(opts, bundle);
-}
-
-async function runDcApi(bundle: SessionBundle): Promise<void> {
-  const mdoc = bundle.session.orgIsoMdoc!;
-  const nav = navigator as unknown as {
-    credentials: { get: (o: unknown) => Promise<{ protocol: string; data: unknown } | null> };
-  };
-  const result = await nav.credentials.get({
-    digital: {
-      requests: [
-        {
-          protocol: 'org-iso-mdoc',
-          data: { deviceRequest: mdoc.deviceRequest, encryptionInfo: mdoc.encryptionInfo },
-        },
-      ],
-    },
-  });
-  if (!result) throw new Error('empty_result');
-
-  let data: unknown = result.data;
-  if (data instanceof ArrayBuffer) data = toBase64url(new Uint8Array(data));
-  else if (data instanceof Uint8Array) data = toBase64url(data);
-  else if (data && typeof data === 'object') {
-    const d = data as { response?: unknown };
-    data = d.response != null ? d.response : JSON.stringify(data);
-  }
-
-  const res = await fetch(bundle.dcApiSubmitUrl!, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ protocol: result.protocol, data }),
-  });
-  const body: unknown = await res.json().catch(() => ({}));
-  if (!res.ok) throw Object.assign(new Error('dc_api_submit_failed'), { body });
-}
-
-function runOid4vp(opts: VerifyOptions, bundle: SessionBundle): void {
-  const links = buildAvOfferLinks(
-    { uri: bundle.session.uri ?? '', crossDeviceUri: bundle.session.crossDeviceUri },
-    opts.deeplinkScheme,
-  );
-  opts.onLinks?.(links);
-  const container = typeof opts.container === 'function' ? opts.container() : opts.container;
-  if (container && links.qrUri) {
-    (opts.renderQr ?? makeDefaultRenderQr(opts.qrCdnUrl))(container, links.qrUri);
-  }
-}
-
-interface StatusMessage {
-  status?: string;
-  claims?: unknown;
-  errorReason?: string | null;
-}
-
-/** Polls `pollUrl` and/or listens to `eventsUrl` until a terminal status. */
-function startResultWatch(opts: VerifyOptions, bundle: SessionBundle): void {
-  let resolved = false;
-  let sse: EventSource | null = null;
-  let pollTimer: ReturnType<typeof setInterval> | null = null;
-
-  const stop = () => {
-    if (sse) { try { sse.close(); } catch { /* noop */ } sse = null; }
-    if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
-  };
-  const handle = (msg: StatusMessage) => {
-    if (resolved || !msg) return;
-    if (msg.status === 'completed') {
-      resolved = true;
-      stop();
-      opts.onSuccess?.({
-        status: 'completed',
-        claims: msg.claims ?? null,
-        ageOver18: extractAgeOver18(msg.claims as never),
-      });
-    } else if (msg.status === 'failed' || msg.status === 'expired') {
-      resolved = true;
-      stop();
-      opts.onFailure?.({ error: msg.status, status: msg.status, claims: msg.claims });
-    }
-  };
-
-  if (bundle.eventsUrl) {
-    try {
-      sse = new EventSource(bundle.eventsUrl);
-      sse.onmessage = (e) => {
-        try { handle(JSON.parse(e.data) as StatusMessage); } catch { /* ignore */ }
-      };
-      sse.onerror = () => { if (sse && !resolved) { sse.close(); sse = null; } };
-    } catch { /* SSE optional */ }
-  }
-
-  if (bundle.pollUrl) {
-    const url = bundle.pollUrl;
-    pollTimer = setInterval(() => {
-      // no-store: the first poll usually returns `pending`; a cached response
-      // would be served stale forever and the completion never observed.
-      fetch(url, { cache: 'no-store' })
-        .then((r) => (r.ok ? r.json() : null))
-        .then((d) => { if (d) handle(d as StatusMessage); })
-        .catch(() => { /* transient */ });
-    }, opts.pollIntervalMs ?? 2500);
-  }
-}
-
-// ── QR lib (qrcodejs) lazy loader — mirrors the original espuni-av.js snippet ──
-let qrState = 0; // 0 idle, 1 loading, 2 ready
-let qrQueue: Array<() => void> = [];
-
-function withQrLib(cdnUrl: string, fn: () => void): void {
-  const g = window as unknown as { QRCode?: unknown };
-  if (typeof g.QRCode !== 'undefined' || qrState === 2) { fn(); return; }
-  qrQueue.push(fn);
-  if (qrState === 1) return;
-  qrState = 1;
-  const s = document.createElement('script');
-  s.src = cdnUrl;
-  s.onload = () => { qrState = 2; qrQueue.forEach((f) => f()); qrQueue = []; };
-  s.onerror = () => { qrState = 0; qrQueue = []; };
-  (document.head || document.body).appendChild(s);
-}
-
-function makeDefaultRenderQr(cdnUrl = DEFAULT_QR_CDN) {
-  return (container: HTMLElement, uri: string): void => {
-    container.innerHTML = '';
-    withQrLib(cdnUrl, () => {
-      const g = window as unknown as {
-        QRCode?: (new (el: HTMLElement, cfg: Record<string, unknown>) => void) & {
-          CorrectLevel: { L: number };
-        };
-      };
-      if (typeof g.QRCode === 'function') {
-        try {
-          // Level L = fewest modules for the long by-value redirect_uri payload.
-          new g.QRCode(container, { text: uri, width: 260, height: 260, correctLevel: g.QRCode.CorrectLevel.L });
-          return;
-        } catch { /* fall through */ }
-      }
-      container.textContent = uri;
-    });
-  };
-}
-
-function toBase64url(bytes: Uint8Array): string {
-  let s = '';
-  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
-  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-
-/** Namespaced default export for the IIFE build (`window.espuni`). */
-const espuni = { hasDcApi, verify };
-export default espuni;