@estiva-app/identity 0.1.0

package/dist/shell.d.ts

@@ -0,0 +1,195 @@
+/**
+ * The auth shell's contract: what a boot may conclude, and what to say about it.
+ *
+ * Pure decision logic and vocabulary. No I/O, no globals, no rendering — the
+ * shell's *appearance* stays in each app, because it is a full-page surface and
+ * each app will want its own. What is shared is the state machine and the
+ * reason vocabulary, which is where the expensive mistakes live.
+ *
+ * ## This file was duplicated verbatim, and said so
+ *
+ * Until SHA-4 it existed twice — `peek-app/src/auth/shell/contract.ts` and
+ * `estiva-ship/lib/auth/shell/contract.ts` — and each copy's header pointed at
+ * the other. They were byte-identical apart from that sentence, which is a file
+ * asking to be a package. Now it is one, and the claim is true by construction
+ * rather than by discipline.
+ *
+ * ## Why `token_rejected` is not "session expired"
+ *
+ * The distinction below is load-bearing and asserted by a test that travelled
+ * here with the code. Telling somebody their session expired when their token
+ * was refused for a *configuration* fault sends them to re-authenticate against
+ * a wall: they will succeed at signing in and fail in exactly the same way, and
+ * nothing in the message points at the real cause.
+ *
+ * ## `Storage` is not named here
+ *
+ * The guard helpers take a local {@link KeyValueStore} rather than the DOM's
+ * `Storage`. Both `sessionStorage` and `localStorage` satisfy it structurally,
+ * and it keeps the published declarations free of an ambient DOM type — a `.d.ts`
+ * that names one compiles in a browser app and fails in a Node consumer
+ * (ADR 0002 §4a).
+ */
+/**
+ * The subset of a web Storage this package uses.
+ *
+ * Structural, so `sessionStorage`, `localStorage` and a plain object all satisfy
+ * it. Which one an app passes is an app decision with real consequences — see
+ * the note on storage in `client.ts`.
+ */
+export interface KeyValueStore {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+/**
+ * Five states, and no more.
+ *
+ * `checking` and `entering` deliberately render the same thing: the difference
+ * is not information a person entering their own app needs, and distinguishing
+ * them visually produces two loading screens for one boot.
+ */
+export type ShellPhase = 'checking' | 'entering' | 'authenticating' | 'ready' | 'failed';
+/**
+ * Why the shell is not simply entering.
+ *
+ * These are not interchangeable. The whole reason the list is this long is that
+ * "your session expired" told to somebody whose token was refused for a
+ * configuration fault sends them to re-authenticate against a wall.
+ */
+export type ShellReason = 'no_session' | 'session_expired' | 'identity_inactive' | 'token_rejected' | 'exchange_failed' | 'network' | 'timeout' | 'loop_guard';
+export type ShellState = {
+    phase: 'checking';
+} | {
+    phase: 'entering';
+} | {
+    phase: 'authenticating';
+    reason: ShellReason;
+} | {
+    phase: 'ready';
+} | {
+    phase: 'failed';
+    reason: ShellReason;
+};
+/** Whether a reason can be cleared by authenticating, or needs somebody else. */
+export declare function isRecoverable(reason: ShellReason): boolean;
+/**
+ * What the shell says, per reason.
+ *
+ * Deliberately plain and deliberately short. This is a bootstrap surface, not a
+ * login page, and a paragraph of reassurance here reads as a product asking to
+ * be trusted rather than an app starting up.
+ *
+ * `token_rejected` is the one that must never read as "signed out" — it is a
+ * configuration fault that signing in again cannot fix, and saying otherwise
+ * cost a real debugging detour the first time it appeared.
+ */
+export declare const SHELL_COPY: Record<ShellReason, string>;
+/** The label on the one affordance the shell ever shows. */
+export declare const CONTINUE_LABEL = "Continue with passkey";
+export declare const RETRY_LABEL = "Try again";
+/** What the app observed before deciding anything. */
+export interface BootObservation {
+    /** Parsed from the address bar, if this load is a return trip. */
+    callback: {
+        code?: string | undefined;
+        error?: string | undefined;
+    } | null;
+    /** A stored token that is present *and* still usable. */
+    hasValidToken: boolean;
+    /** The silent-attempt marker, if one is set. */
+    guardAttemptedAt: number | null;
+    /**
+     * Whether this page load has already been inside the app.
+     *
+     * A cold boot and a token dying under somebody's hands are the same
+     * observation — no valid token — and they must not get the same treatment.
+     * Silent entry is right on boot, where there is nothing on screen to lose.
+     * Mid-session it navigates away and takes whatever they were doing with it,
+     * which is how "enter automatically" turned into "the page left on its own".
+     */
+    enteredThisPageLoad: boolean;
+    now: number;
+}
+export type BootAction = 
+/** Redeem the code in the address bar. */
+{
+    do: 'complete_callback';
+}
+/** Enter with what is already held. */
+ | {
+    do: 'enter';
+}
+/** Navigate to `/authorize?prompt=none`. Sets the marker first. */
+ | {
+    do: 'probe_silently';
+}
+/** Show the one affordance and wait for the tap. */
+ | {
+    do: 'prompt_passkey';
+    reason: ShellReason;
+}
+/** Stop, with something honest on screen. */
+ | {
+    do: 'fail';
+    reason: ShellReason;
+};
+/**
+ * How long a silent attempt may take before the return trip counts as a timeout.
+ *
+ * A navigation cannot be timed out from the page being unloaded, so this is
+ * measured across the round trip instead: the marker carries when we left, and
+ * a return that took this long means a slow or half-failing identity service.
+ * Generous, because it is competing with a cold DNS lookup and a redirect, and
+ * a false timeout is worse than a slow entry.
+ */
+export declare const PROBE_TIMEOUT_MS = 15000;
+/**
+ * How long the guard remembers a silent attempt.
+ *
+ * Long enough that an immediate bounce is caught, short enough that a person
+ * who left the tab open and came back gets a real attempt rather than an
+ * affordance explaining a failure from an hour ago.
+ */
+export declare const GUARD_TTL_MS = 60000;
+/**
+ * The whole entry decision, as a pure function.
+ *
+ * Ordering is the contract. A callback is handled before a stored token because
+ * the code in the address bar is fresher and must be spent or discarded either
+ * way; the guard is consulted before a new probe because that is what stops the
+ * bounce.
+ */
+export declare function decideBoot(o: BootObservation): BootAction;
+/**
+ * Map what `/authorize` sent back onto a reason.
+ *
+ * `login_required` is the expected negative answer from `prompt=none`, not a
+ * fault. `access_denied` is a suspended or offboarded identity, which is the
+ * one refusal a person genuinely cannot clear themselves.
+ */
+export declare function reasonForCallbackError(error: string): ShellReason;
+export declare const GUARD_KEY = "estiva.authShell.silentAttempt";
+/**
+ * Per-tab, on purpose. `sessionStorage` dies with the tab, so a genuinely new
+ * session gets a genuinely fresh silent attempt rather than inheriting a
+ * failure somebody hit yesterday.
+ */
+export declare function readGuard(store: Pick<KeyValueStore, 'getItem'>): number | null;
+export declare function markGuard(store: Pick<KeyValueStore, 'setItem'>, now: number): void;
+export declare function clearGuard(store: Pick<KeyValueStore, 'removeItem'>): void;
+export interface ShellEvent {
+    app: string;
+    phase: ShellPhase;
+    reason?: ShellReason;
+    /** Milliseconds since the shell started, for the drop-off view. */
+    elapsedMs: number;
+}
+/**
+ * Failures are logged at `error`, not `warn`.
+ *
+ * The point of PEEK-120 is that a broken entry is loud. A `warn` in a browser
+ * console is indistinguishable from the noise every app emits at boot.
+ */
+export declare function logShellEvent(e: ShellEvent): void;
+//# sourceMappingURL=shell.d.ts.map

package/dist/shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAA;AAExF;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,SAAS,GACT,SAAS,GACT,YAAY,CAAA;AAEhB,MAAM,MAAM,UAAU,GAClB;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAA;AAE5C,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAUlD,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,cAAc,0BAA0B,CAAA;AACrD,eAAO,MAAM,WAAW,cAAc,CAAA;AAItC,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAAA;IAC1E,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAA;IACtB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B;;;;;;;;OAQG;IACH,mBAAmB,EAAE,OAAO,CAAA;IAC5B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,UAAU;AACpB,0CAA0C;AACxC;IAAE,EAAE,EAAE,mBAAmB,CAAA;CAAE;AAC7B,uCAAuC;GACrC;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE;AACjB,mEAAmE;GACjE;IAAE,EAAE,EAAE,gBAAgB,CAAA;CAAE;AAC1B,oDAAoD;GAClD;IAAE,EAAE,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE;AAC/C,6CAA6C;GAC3C;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAA;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAA;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAS,CAAA;AAElC;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,GAAG,UAAU,CA4BzD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CASjE;AAID,eAAO,MAAM,SAAS,mCAAmC,CAAA;AAEzD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAElF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,IAAI,CAEzE;AAiBD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,CAIjD"}

package/dist/shell.js

@@ -0,0 +1,166 @@
+/**
+ * The auth shell's contract: what a boot may conclude, and what to say about it.
+ *
+ * Pure decision logic and vocabulary. No I/O, no globals, no rendering — the
+ * shell's *appearance* stays in each app, because it is a full-page surface and
+ * each app will want its own. What is shared is the state machine and the
+ * reason vocabulary, which is where the expensive mistakes live.
+ *
+ * ## This file was duplicated verbatim, and said so
+ *
+ * Until SHA-4 it existed twice — `peek-app/src/auth/shell/contract.ts` and
+ * `estiva-ship/lib/auth/shell/contract.ts` — and each copy's header pointed at
+ * the other. They were byte-identical apart from that sentence, which is a file
+ * asking to be a package. Now it is one, and the claim is true by construction
+ * rather than by discipline.
+ *
+ * ## Why `token_rejected` is not "session expired"
+ *
+ * The distinction below is load-bearing and asserted by a test that travelled
+ * here with the code. Telling somebody their session expired when their token
+ * was refused for a *configuration* fault sends them to re-authenticate against
+ * a wall: they will succeed at signing in and fail in exactly the same way, and
+ * nothing in the message points at the real cause.
+ *
+ * ## `Storage` is not named here
+ *
+ * The guard helpers take a local {@link KeyValueStore} rather than the DOM's
+ * `Storage`. Both `sessionStorage` and `localStorage` satisfy it structurally,
+ * and it keeps the published declarations free of an ambient DOM type — a `.d.ts`
+ * that names one compiles in a browser app and fails in a Node consumer
+ * (ADR 0002 §4a).
+ */
+/** Whether a reason can be cleared by authenticating, or needs somebody else. */
+export function isRecoverable(reason) {
+    return reason !== 'identity_inactive' && reason !== 'token_rejected';
+}
+/**
+ * What the shell says, per reason.
+ *
+ * Deliberately plain and deliberately short. This is a bootstrap surface, not a
+ * login page, and a paragraph of reassurance here reads as a product asking to
+ * be trusted rather than an app starting up.
+ *
+ * `token_rejected` is the one that must never read as "signed out" — it is a
+ * configuration fault that signing in again cannot fix, and saying otherwise
+ * cost a real debugging detour the first time it appeared.
+ */
+export const SHELL_COPY = {
+    no_session: 'Continue with your passkey to enter.',
+    session_expired: 'Your Estiva ID session ended. Continue with your passkey.',
+    identity_inactive: 'This identity is not active. An administrator needs to restore it.',
+    token_rejected: 'Signed in to Estiva ID, but this app could not verify the token. That is a configuration problem rather than an expired session — signing in again will not fix it.',
+    exchange_failed: 'That sign-in did not complete. Try again.',
+    network: 'Could not reach Estiva ID. Check your connection and try again.',
+    timeout: 'Estiva ID did not answer in time. Try again.',
+    loop_guard: 'Continue with your passkey to enter.',
+};
+/** The label on the one affordance the shell ever shows. */
+export const CONTINUE_LABEL = 'Continue with passkey';
+export const RETRY_LABEL = 'Try again';
+/**
+ * How long a silent attempt may take before the return trip counts as a timeout.
+ *
+ * A navigation cannot be timed out from the page being unloaded, so this is
+ * measured across the round trip instead: the marker carries when we left, and
+ * a return that took this long means a slow or half-failing identity service.
+ * Generous, because it is competing with a cold DNS lookup and a redirect, and
+ * a false timeout is worse than a slow entry.
+ */
+export const PROBE_TIMEOUT_MS = 15_000;
+/**
+ * How long the guard remembers a silent attempt.
+ *
+ * Long enough that an immediate bounce is caught, short enough that a person
+ * who left the tab open and came back gets a real attempt rather than an
+ * affordance explaining a failure from an hour ago.
+ */
+export const GUARD_TTL_MS = 60_000;
+/**
+ * The whole entry decision, as a pure function.
+ *
+ * Ordering is the contract. A callback is handled before a stored token because
+ * the code in the address bar is fresher and must be spent or discarded either
+ * way; the guard is consulted before a new probe because that is what stops the
+ * bounce.
+ */
+export function decideBoot(o) {
+    if (o.callback) {
+        const { code, error } = o.callback;
+        if (error)
+            return { do: 'prompt_passkey', reason: reasonForCallbackError(error) };
+        if (code)
+            return { do: 'complete_callback' };
+    }
+    if (o.hasValidToken)
+        return { do: 'enter' };
+    /**
+     * The token died while they were working. Offer the passkey and let them
+     * choose when to lose the page, rather than deciding it for them.
+     *
+     * The old signed-out screen was a button partly for this reason. Re-entry is
+     * usually silent, so the cost here is not a prompt — it is a full navigation
+     * out of whatever they had open, and that is not the shell's call to make.
+     * PEEK-108 is what removes the interruption rather than relocating it.
+     */
+    if (o.enteredThisPageLoad)
+        return { do: 'prompt_passkey', reason: 'session_expired' };
+    // A silent attempt already ran and we are back here without a token. Never
+    // navigate again — this is the infinite bounce the guard exists to prevent.
+    if (o.guardAttemptedAt !== null && o.now - o.guardAttemptedAt < GUARD_TTL_MS) {
+        const elapsed = o.now - o.guardAttemptedAt;
+        return { do: 'prompt_passkey', reason: elapsed >= PROBE_TIMEOUT_MS ? 'timeout' : 'loop_guard' };
+    }
+    return { do: 'probe_silently' };
+}
+/**
+ * Map what `/authorize` sent back onto a reason.
+ *
+ * `login_required` is the expected negative answer from `prompt=none`, not a
+ * fault. `access_denied` is a suspended or offboarded identity, which is the
+ * one refusal a person genuinely cannot clear themselves.
+ */
+export function reasonForCallbackError(error) {
+    switch (error) {
+        case 'login_required':
+            return 'no_session';
+        case 'access_denied':
+            return 'identity_inactive';
+        default:
+            return 'exchange_failed';
+    }
+}
+// --- The loop guard ----------------------------------------------------------
+export const GUARD_KEY = 'estiva.authShell.silentAttempt';
+/**
+ * Per-tab, on purpose. `sessionStorage` dies with the tab, so a genuinely new
+ * session gets a genuinely fresh silent attempt rather than inheriting a
+ * failure somebody hit yesterday.
+ */
+export function readGuard(store) {
+    const raw = store.getItem(GUARD_KEY);
+    if (!raw)
+        return null;
+    const at = Number(raw);
+    return Number.isFinite(at) ? at : null;
+}
+export function markGuard(store, now) {
+    store.setItem(GUARD_KEY, String(now));
+}
+export function clearGuard(store) {
+    store.removeItem(GUARD_KEY);
+}
+/**
+ * Failures are logged at `error`, not `warn`.
+ *
+ * The point of PEEK-120 is that a broken entry is loud. A `warn` in a browser
+ * console is indistinguishable from the noise every app emits at boot.
+ */
+export function logShellEvent(e) {
+    const line = `[auth-shell] ${e.app} ${e.phase}${e.reason ? ` (${e.reason})` : ''} +${e.elapsedMs}ms`;
+    if (e.phase === 'failed')
+        console.error(line);
+    else
+        console.info(line);
+}
+//# sourceMappingURL=shell.js.map

package/dist/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../src/shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAgDH,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,OAAO,MAAM,KAAK,mBAAmB,IAAI,MAAM,KAAK,gBAAgB,CAAA;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,UAAU,GAAgC;IACrD,UAAU,EAAE,sCAAsC;IAClD,eAAe,EAAE,2DAA2D;IAC5E,iBAAiB,EAAE,oEAAoE;IACvF,cAAc,EACZ,qKAAqK;IACvK,eAAe,EAAE,2CAA2C;IAC5D,OAAO,EAAE,iEAAiE;IAC1E,OAAO,EAAE,8CAA8C;IACvD,UAAU,EAAE,sCAAsC;CACnD,CAAA;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAA;AACrD,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAA;AAqCtC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,CAAkB;IAC3C,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAA;QAClC,IAAI,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAA;QACjF,IAAI,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAA;IAC9C,CAAC;IAED,IAAI,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAA;IAE3C;;;;;;;;OAQG;IACH,IAAI,CAAC,CAAC,mBAAmB;QAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAErF,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,gBAAgB,GAAG,YAAY,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,gBAAgB,CAAA;QAC1C,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAAE,CAAA;IACjG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,gBAAgB;YACnB,OAAO,YAAY,CAAA;QACrB,KAAK,eAAe;YAClB,OAAO,mBAAmB,CAAA;QAC5B;YACE,OAAO,iBAAiB,CAAA;IAC5B,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG,gCAAgC,CAAA;AAEzD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAqC;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAqC,EAAE,GAAW;IAC1E,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAwC;IACjE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;AAC7B,CAAC;AAyBD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAAa;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,IAAI,CAAA;IACpG,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;;QACxC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@estiva-app/identity",
+  "version": "0.1.0",
+  "description": "Estiva ID sign-in: authorization code + PKCE, token storage, silent renewal, sign-out, and the auth-shell state machine. Knows nothing about any app's data layer.",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/estiva-app/estiva-foundation.git",
+    "directory": "packages/identity"
+  },
+  "keywords": [
+    "estiva",
+    "estiva-id",
+    "oauth",
+    "pkce",
+    "nostr"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test test/*.test.mjs test/*.test.ts",
+    "typecheck": "npm run build && tsc -p tsconfig.test.json",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^24.13.3",
+    "typescript": "~5.9.3"
+  }
+}