@iaurelius/accounts-expo 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 iAurelius
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,78 @@
+# @iaurelius/accounts-expo
+
+Accounts by iAurelius for Expo (iOS, Android and web).
+
+People sign in on your application's hosted page, with passkeys, email codes and Google. The page opens in the system's authentication session: `ASWebAuthenticationSession` on iOS, Custom Tabs on Android. The SDK then:
+- keeps the tokens in SecureStore;
+- refreshes the access token when it is about to expire;
+- signs out here and on the hosted pages.
+
+## Quick start
+
+```sh
+npx @iaurelius/accounts init --code aci_…   # the command from the console: Apps and APIs → Integrate your app
+```
+
+What it does:
+- registers your mobile app with its bundle id as the scheme (`com.example.app:/oauth/callback`, RFC 8252);
+- installs this package and its Expo modules with `npx expo install`;
+- writes `.env.local`;
+- adds the scheme to `app.json`.
+
+Rebuild the app afterwards, because the scheme is native. By hand, the steps are:
+
+```sh
+npx expo install @iaurelius/accounts-expo expo-crypto expo-secure-store expo-web-browser
+```
+
+```tsx
+// app/_layout.tsx
+import { AccountsProvider } from "@iaurelius/accounts-expo";
+import { Stack } from "expo-router";
+
+export default function RootLayout() {
+  return (
+    <AccountsProvider
+      publishableKey={process.env.EXPO_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY!}
+      clientId={process.env.EXPO_PUBLIC_ACCOUNTS_CLIENT_ID!}
+      scheme="com.example.app"
+    >
+      <Stack />
+    </AccountsProvider>
+  );
+}
+```
+
+```tsx
+import { SignedIn, SignedOut, useAuth, useUser } from "@iaurelius/accounts-expo";
+import { Button, Text } from "react-native";
+
+function Profile() {
+  const { signIn, signOut, getToken } = useAuth();
+  const { user } = useUser();
+  return (
+    <>
+      <SignedOut><Button title="Sign in" onPress={signIn} /></SignedOut>
+      <SignedIn>
+        <Text>{user?.email}</Text>
+        <Button title="Call my API" onPress={async () => fetch("https://api.example.com/me", { headers: { authorization: `Bearer ${await getToken()}` } })} />
+        <Button title="Sign out" onPress={() => signOut()} />
+      </SignedIn>
+    </>
+  );
+}
+```
+
+On the web, add the route `app/oauth/callback.tsx`, which calls `completeSignIn()` from this package.
+
+## Security
+
+- **Sign-in:** authorization code with PKCE (S256), `state` and `nonce`, and RFC 9207's `iss` checked. The app is public, with no secret on the device.
+- **ID token:** it comes straight from the token endpoint over TLS, so its issuer, audience, nonce and expiry are checked (OIDC Core 3.1.3.7).
+- **On the device:** tokens stay in SecureStore, split in parts because Android is unreliable past 2 KB.
+- **Revocation:** a person who is banned or signed out everywhere is out at the next refresh. Sign-out revokes the refresh token.
+- **Bundle size:** the package uses no Node APIs and no WebCrypto (`expo-crypto` instead), and does not pull jose into your bundle.
+
+## License
+
+MIT

package/dist/core.d.ts

@@ -0,0 +1,62 @@
+import { type FetchLike, type SessionUser } from "@iaurelius/accounts/oidc";
+export type { SessionUser };
+export type Storage = {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+};
+export type AuthSessionResult = {
+    type: "success";
+    url: string;
+} | {
+    type: "cancel" | "dismiss" | "opened" | "locked";
+};
+export type Browser = {
+    openAuthSession(url: string, redirectUri: string): Promise<AuthSessionResult>;
+};
+export type Crypto = {
+    randomString(bytes: number): string;
+    sha256Base64Url(input: string): Promise<string>;
+};
+export type AccountsState = {
+    isLoaded: boolean;
+    isSignedIn: boolean;
+    user: SessionUser | null;
+    sessionId: string | null;
+};
+export type ClientOptions = {
+    publishableKey: string;
+    clientId: string;
+    /** Where the hosted page sends the person back: the app's scheme (com.example.app:/oauth/callback) or, on the web, its origin. */
+    redirectUri: string;
+    /** Your API's identifier: getToken() gives tokens for it. */
+    audience?: string;
+    storage: Storage;
+    browser: Browser;
+    crypto: Crypto;
+    fetch?: FetchLike;
+    /** Refresh when the access token has less than this left (default 60 s). */
+    refreshBeforeSeconds?: number;
+};
+/** A store that splits big values (SecureStore is unreliable past ~2 KB on Android): key.n holds the count. */
+export declare function chunked(storage: Storage, size?: number): Storage;
+/** The query of a redirect URL, by hand: React Native's URL does not parse custom schemes reliably. */
+export declare function queryOf(url: string): Record<string, string>;
+export declare function createAccountsClient(o: ClientOptions): {
+    readonly state: AccountsState;
+    subscribe(l: (s: AccountsState) => void): () => void;
+    /** The session kept on the device, refreshed if needed. */
+    load(): Promise<AccountsState>;
+    /** Opens the hosted page; resolves once the person is back (signed in, or unchanged if they closed it). */
+    signIn: () => Promise<AccountsState>;
+    /** The same, on "create an account". */
+    signUp: () => Promise<AccountsState>;
+    /** An access token for your API, refreshed if it is about to expire; null when signed out. */
+    getToken(): Promise<string | null>;
+    /** Out here (the refresh token revoked) and, unless told otherwise, on the hosted pages too. */
+    signOut(opts?: {
+        endSession?: boolean;
+    }): Promise<void>;
+};
+export type AccountsClient = ReturnType<typeof createAccountsClient>;
+//# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAIA,OAAO,EAWL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,MAAM,OAAO,GAAG;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AACvJ,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAAC;AACxH,MAAM,MAAM,OAAO,GAAG;IAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAAE,CAAC;AACxG,MAAM,MAAM,MAAM,GAAG;IAAE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAE9G,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI3H,MAAM,MAAM,aAAa,GAAG;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kIAAkI;IAClI,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAIF,+GAA+G;AAC/G,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,SAAO,GAAG,OAAO,CAqB9D;AAED,uGAAuG;AACvG,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU3D;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,aAAa;aAoG7C,KAAK;IAGT,SAAS,IAAI,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI;IAMvC,2DAA2D;IACrD,IAAI;IAaV,2GAA2G;IAC3G,MAAM;IACN,wCAAwC;IACxC,MAAM;IACN,8FAA8F;IACxF,QAAQ;IAGd,gGAAgG;IAC1F,OAAO,QAAO;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;EAQ/C;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/core.js

@@ -0,0 +1,206 @@
+// The Expo SDK's logic, without Expo: sign-in on the hosted page in an authentication session (PKCE
+// S256, state, nonce, RFC 9207's iss), the session kept in a secure store, an access token that refreshes
+// itself, and sign-out. The platform's parts (store, browser, crypto) are passed in: src/expo.ts gives
+// Expo's; the tests give Node's and the platform's own server.
+import { OAuthError, authorizationUrl, endSessionUrl, exchangeCode, fetchUserInfo, issuerFromPublishableKey, readIdToken, refreshTokens, revokeToken, userFromClaims, } from "@iaurelius/accounts/oidc";
+const now = () => Math.floor(Date.now() / 1000);
+/** A store that splits big values (SecureStore is unreliable past ~2 KB on Android): key.n holds the count. */
+export function chunked(storage, size = 1800) {
+    return {
+        async get(key) {
+            const n = Number(await storage.get(`${key}.n`));
+            if (!Number.isInteger(n) || n < 1)
+                return null;
+            const parts = await Promise.all(Array.from({ length: n }, (_, i) => storage.get(`${key}.${i}`)));
+            return parts.some((p) => p === null) ? null : parts.join("");
+        },
+        async set(key, value) {
+            const old = Number(await storage.get(`${key}.n`)) || 0;
+            const parts = Array.from({ length: Math.max(1, Math.ceil(value.length / size)) }, (_, i) => value.slice(i * size, (i + 1) * size));
+            for (const [i, p] of parts.entries())
+                await storage.set(`${key}.${i}`, p);
+            await storage.set(`${key}.n`, String(parts.length));
+            for (let i = parts.length; i < old; i++)
+                await storage.remove(`${key}.${i}`);
+        },
+        async remove(key) {
+            const n = Number(await storage.get(`${key}.n`)) || 0;
+            await storage.remove(`${key}.n`);
+            for (let i = 0; i < n; i++)
+                await storage.remove(`${key}.${i}`);
+        },
+    };
+}
+/** The query of a redirect URL, by hand: React Native's URL does not parse custom schemes reliably. */
+export function queryOf(url) {
+    const q = url.split("#")[0].split("?")[1] ?? "";
+    const out = {};
+    for (const pair of q.split("&")) {
+        if (!pair)
+            continue;
+        const i = pair.indexOf("=");
+        const k = decodeURIComponent((i < 0 ? pair : pair.slice(0, i)).replace(/\+/g, " "));
+        if (!(k in out))
+            out[k] = i < 0 ? "" : decodeURIComponent(pair.slice(i + 1).replace(/\+/g, " "));
+    }
+    return out;
+}
+export function createAccountsClient(o) {
+    const issuer = issuerFromPublishableKey(o.publishableKey);
+    const creds = { issuer, clientId: o.clientId, fetch: o.fetch };
+    const store = chunked(o.storage);
+    const key = `accounts.${o.clientId.replace(/[^A-Za-z0-9._-]/g, "_")}`;
+    let session = null;
+    let state = { isLoaded: false, isSignedIn: false, user: null, sessionId: null };
+    const listeners = new Set();
+    function publish(loaded = true) {
+        let user = null;
+        let sid = null;
+        if (session) {
+            const c = readIdToken(session.it);
+            user = userFromClaims({ ...c, ...session.u, sub: c.sub });
+            sid = typeof c.sid === "string" ? c.sid : null;
+        }
+        state = { isLoaded: loaded, isSignedIn: !!session, user, sessionId: sid };
+        for (const l of listeners)
+            l(state);
+    }
+    async function save(s) {
+        session = s;
+        if (s)
+            await store.set(key, JSON.stringify(s));
+        else
+            await store.remove(key);
+        publish();
+    }
+    async function profile(accessToken) {
+        const c = await fetchUserInfo({ issuer, accessToken, fetch: o.fetch });
+        if (!c)
+            return undefined;
+        const p = {};
+        if (typeof c.email === "string")
+            p.email = c.email;
+        if (typeof c.email_verified === "boolean")
+            p.email_verified = c.email_verified;
+        if (typeof c.name === "string" && c.name)
+            p.name = c.name;
+        if (typeof c.picture === "string" && c.picture)
+            p.picture = c.picture;
+        return p;
+    }
+    // One refresh at a time: two screens asking for a token at once share it (the refresh token rotates).
+    let refreshing = null;
+    async function fresh() {
+        const s = session;
+        if (!s)
+            return null;
+        if (s.exp - now() > (o.refreshBeforeSeconds ?? 60))
+            return s;
+        if (!s.rt) {
+            if (s.exp > now())
+                return s;
+            await save(null);
+            return null;
+        }
+        refreshing ??= (async () => {
+            try {
+                const t = await refreshTokens(creds, { refreshToken: s.rt, resource: o.audience });
+                const next = { at: t.accessToken, rt: t.refreshToken ?? s.rt, it: t.idToken ?? s.it, exp: t.expiresAt, u: (await profile(t.accessToken)) ?? s.u };
+                await save(next);
+                return next;
+            }
+            catch (e) {
+                // Refused (revoked, banned, session over): out. Unreachable: the token while it lasts.
+                if (e instanceof OAuthError && e.status >= 400 && e.status < 500) {
+                    await save(null);
+                    return null;
+                }
+                return s.exp > now() ? s : null;
+            }
+            finally {
+                refreshing = null;
+            }
+        })();
+        return refreshing;
+    }
+    /** The ID token straight from the token endpoint over TLS (OIDC Core 3.1.3.7): its claims are checked. */
+    function checkIdToken(token, nonce) {
+        const c = readIdToken(token);
+        const aud = Array.isArray(c.aud) ? c.aud : [c.aud];
+        if (c.iss !== issuer || !aud.includes(o.clientId) || c.nonce !== nonce || typeof c.exp !== "number" || c.exp < now() - 5 || typeof c.sub !== "string")
+            throw new OAuthError("invalid_id_token", "The ID token is not for this sign-in.");
+    }
+    async function signIn(prompt) {
+        const verifier = o.crypto.randomString(32);
+        const challenge = await o.crypto.sha256Base64Url(verifier);
+        const expected = o.crypto.randomString(24);
+        const nonce = o.crypto.randomString(24);
+        const url = authorizationUrl({ issuer, clientId: o.clientId, redirectUri: o.redirectUri, state: expected, nonce, codeChallenge: challenge, resource: o.audience, prompt });
+        const r = await o.browser.openAuthSession(url, o.redirectUri);
+        if (r.type !== "success")
+            return state; // closed: nothing changes
+        const q = queryOf(r.url);
+        if (q.state !== expected)
+            throw new OAuthError("invalid_state", "The answer does not belong to this sign-in.");
+        if (q.error) {
+            if (q.error === "access_denied")
+                return state;
+            throw new OAuthError(q.error, q.error_description);
+        }
+        if (q.iss !== issuer)
+            throw new OAuthError("invalid_issuer", "The answer did not come from this app's sign-in.");
+        if (!q.code)
+            throw new OAuthError("invalid_request", "The answer has no code.");
+        const t = await exchangeCode(creds, { code: q.code, redirectUri: o.redirectUri, codeVerifier: verifier, resource: o.audience });
+        if (!t.idToken)
+            throw new OAuthError("invalid_response", "No ID token: the app needs the openid scope.");
+        checkIdToken(t.idToken, nonce);
+        await save({ at: t.accessToken, rt: t.refreshToken, it: t.idToken, exp: t.expiresAt, u: await profile(t.accessToken) });
+        return state;
+    }
+    return {
+        get state() {
+            return state;
+        },
+        subscribe(l) {
+            listeners.add(l);
+            return () => {
+                listeners.delete(l);
+            };
+        },
+        /** The session kept on the device, refreshed if needed. */
+        async load() {
+            try {
+                const raw = await store.get(key);
+                const s = raw ? JSON.parse(raw) : null;
+                session = s && typeof s.at === "string" && typeof s.it === "string" && typeof s.exp === "number" ? s : null;
+                if (session)
+                    readIdToken(session.it);
+            }
+            catch {
+                session = null;
+            }
+            await fresh();
+            publish();
+            return state;
+        },
+        /** Opens the hosted page; resolves once the person is back (signed in, or unchanged if they closed it). */
+        signIn: () => signIn(),
+        /** The same, on "create an account". */
+        signUp: () => signIn("create"),
+        /** An access token for your API, refreshed if it is about to expire; null when signed out. */
+        async getToken() {
+            return (await fresh())?.at ?? null;
+        },
+        /** Out here (the refresh token revoked) and, unless told otherwise, on the hosted pages too. */
+        async signOut(opts = {}) {
+            const s = session;
+            await save(null);
+            if (s?.rt)
+                await revokeToken(creds, { token: s.rt, hint: "refresh_token" });
+            if (s && opts.endSession !== false)
+                await o.browser.openAuthSession(endSessionUrl({ issuer, clientId: o.clientId, idTokenHint: s.it, postLogoutRedirectUri: o.redirectUri }), o.redirectUri).catch(() => undefined);
+        },
+    };
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,0GAA0G;AAC1G,uGAAuG;AACvG,+DAA+D;AAC/D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,GAGf,MAAM,0BAA0B,CAAC;AA4BlC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEhD,+GAA+G;AAC/G,MAAM,UAAU,OAAO,CAAC,OAAgB,EAAE,IAAI,GAAG,IAAI;IACnD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACnI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;gBAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAgB;IACnD,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;IACtE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,GAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IAExD,SAAS,OAAO,CAAC,MAAM,GAAG,IAAI;QAC5B,IAAI,IAAI,GAAuB,IAAI,CAAC;QACpC,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,UAAU,IAAI,CAAC,CAAgB;QAClC,OAAO,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC1C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,UAAU,OAAO,CAAC,WAAmB;QACxC,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,MAAM,CAAC,GAAY,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;QAC/E,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1D,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sGAAsG;IACtG,IAAI,UAAU,GAAkC,IAAI,CAAC;IACrD,KAAK,UAAU,KAAK;QAClB,MAAM,CAAC,GAAG,OAAO,CAAC;QAClB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE;gBAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpF,MAAM,IAAI,GAAW,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1J,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,uFAAuF;gBACvF,IAAI,CAAC,YAAY,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBACjE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;oBAAS,CAAC;gBACT,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,0GAA0G;IAC1G,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;QAChD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YACnJ,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAiB;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3K,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,0BAA0B;QAClE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAC;QACjH,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QACzG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,CAA6B;YACrC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnD,OAAO,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5G,IAAI,OAAO;oBAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2GAA2G;QAC3G,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE;QACtB,wCAAwC;QACxC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B,8FAA8F;QAC9F,KAAK,CAAC,QAAQ;YACZ,OAAO,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QACrC,CAAC;QACD,gGAAgG;QAChG,KAAK,CAAC,OAAO,CAAC,IAAI,GAA6B,EAAE;YAC/C,MAAM,CAAC,GAAG,OAAO,CAAC;YAClB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,EAAE,EAAE;gBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;gBAChC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/expo.d.ts

@@ -0,0 +1,13 @@
+import type { Browser, Crypto, Storage } from "./core.js";
+export declare const secureStorage: Storage;
+/** ephemeral: no cookies shared with the system browser (each sign-in starts from scratch). */
+export declare const authSessionBrowser: (ephemeral?: boolean) => Browser;
+export declare const expoCrypto: Crypto;
+/** Where the hosted page sends people back: the app's own scheme, or the web page's origin. */
+export declare function redirectUriFor(scheme: string | undefined): string;
+/** On the web, the page at /oauth/callback calls this to hand the answer back to the page that opened the sign-in. */
+export declare const completeSignIn: () => {
+    type: "success" | "failed";
+    message: string;
+};
+//# sourceMappingURL=expo.d.ts.map

package/dist/expo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expo.d.ts","sourceRoot":"","sources":["../src/expo.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1D,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,kBAAkB,2BAAwB,OAErD,CAAC;AAGH,eAAO,MAAM,UAAU,EAAE,MAGxB,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,UAKxD;AAED,sHAAsH;AACtH,eAAO,MAAM,cAAc;;;CAA8C,CAAC"}

package/dist/expo.js

@@ -0,0 +1,31 @@
+// Expo's parts for the client (src/core.ts): SecureStore, the authentication session of expo-web-browser
+// (ASWebAuthenticationSession on iOS, Custom Tabs on Android, a popup on the web) and expo-crypto.
+import * as ExpoCrypto from "expo-crypto";
+import * as SecureStore from "expo-secure-store";
+import * as WebBrowser from "expo-web-browser";
+export const secureStorage = {
+    get: (k) => SecureStore.getItemAsync(k),
+    set: (k, v) => SecureStore.setItemAsync(k, v),
+    remove: (k) => SecureStore.deleteItemAsync(k),
+};
+/** ephemeral: no cookies shared with the system browser (each sign-in starts from scratch). */
+export const authSessionBrowser = (ephemeral = false) => ({
+    openAuthSession: (url, redirectUri) => WebBrowser.openAuthSessionAsync(url, redirectUri, { preferEphemeralSession: ephemeral }),
+});
+const b64url = (b64) => b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+export const expoCrypto = {
+    randomString: (bytes) => b64url(btoa(String.fromCharCode(...ExpoCrypto.getRandomBytes(bytes)))),
+    sha256Base64Url: async (input) => b64url(await ExpoCrypto.digestStringAsync(ExpoCrypto.CryptoDigestAlgorithm.SHA256, input, { encoding: ExpoCrypto.CryptoEncoding.BASE64 })),
+};
+/** Where the hosted page sends people back: the app's own scheme, or the web page's origin. */
+export function redirectUriFor(scheme) {
+    const g = globalThis;
+    if (typeof g.document !== "undefined" && g.location)
+        return `${g.location.origin}/oauth/callback`;
+    if (!scheme)
+        throw new Error("Pass scheme to <AccountsProvider> (your app's bundle id, such as com.example.app): the hosted page sends people back to com.example.app:/oauth/callback.");
+    return `${scheme}:/oauth/callback`;
+}
+/** On the web, the page at /oauth/callback calls this to hand the answer back to the page that opened the sign-in. */
+export const completeSignIn = () => WebBrowser.maybeCompleteAuthSession();
+//# sourceMappingURL=expo.js.map

package/dist/expo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expo.js","sourceRoot":"","sources":["../src/expo.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,mGAAmG;AACnG,OAAO,KAAK,UAAU,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAC;AAG/C,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;CAC9C,CAAC;AAEF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAS,GAAG,KAAK,EAAW,EAAE,CAAC,CAAC;IACjE,eAAe,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;CAChI,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/F,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7K,CAAC;AAEF,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,MAA0B;IACvD,MAAM,CAAC,GAAG,UAAmE,CAAC;IAC9E,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,iBAAiB,CAAC;IAClG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0JAA0J,CAAC,CAAC;IACzL,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACrC,CAAC;AAED,sHAAsH;AACtH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,wBAAwB,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { completeSignIn } from "./expo.js";
+export declare const AccountsProvider: ({ children, publishableKey, clientId, scheme, audience, ephemeral }: import("./react.js").AccountsProviderProps) => import("react").JSX.Element;
+export { SignedIn, SignedOut, useAuth, useUser, type AccountsProviderProps } from "./react.js";
+export { completeSignIn };
+export type { AccountsState, SessionUser } from "./core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,cAAc,EAA6C,MAAM,WAAW,CAAC;AAG1G,eAAO,MAAM,gBAAgB,kJAA4G,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// @iaurelius/accounts-expo: the provider with Expo's parts, the hooks and the components.
+import { authSessionBrowser, completeSignIn, expoCrypto, redirectUriFor, secureStorage } from "./expo.js";
+import { makeProvider } from "./react.js";
+export const AccountsProvider = makeProvider({ storage: secureStorage, browser: authSessionBrowser, crypto: expoCrypto, redirectUriFor });
+export { SignedIn, SignedOut, useAuth, useUser } from "./react.js";
+export { completeSignIn };
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAA8B,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/react.d.ts

@@ -0,0 +1,47 @@
+import { type ReactNode } from "react";
+import { type AccountsState, type Browser, type Crypto, type Storage } from "./core.js";
+export type AccountsProviderProps = {
+    children?: ReactNode;
+    /** pk_live_… (write it as process.env.EXPO_PUBLIC_ACCOUNTS_PUBLISHABLE_KEY: Expo inlines it in your app's code). */
+    publishableKey: string;
+    /** Your mobile app's client id, from the console (Apps and APIs). */
+    clientId: string;
+    /** Your app's reverse-domain scheme, its bundle id (com.example.app). */
+    scheme?: string;
+    /** Your API's identifier: getToken() gives tokens for it. */
+    audience?: string;
+    /** No cookies shared with the system browser. Default false: signing in again is one tap. */
+    ephemeral?: boolean;
+};
+/** The platform's parts, given by the entry (src/index.tsx: Expo's) or by tests. */
+export type Platform = {
+    storage: Storage;
+    browser: (ephemeral: boolean) => Browser;
+    crypto: Crypto;
+    redirectUriFor: (scheme?: string) => string;
+};
+export declare function makeProvider(platform: Platform): ({ children, publishableKey, clientId, scheme, audience, ephemeral }: AccountsProviderProps) => import("react").JSX.Element;
+export declare function useAuth(): {
+    isLoaded: boolean;
+    isSignedIn: boolean;
+    userId: string | null;
+    sessionId: string | null;
+    getToken: () => Promise<string | null>;
+    signIn: () => Promise<AccountsState>;
+    signUp: () => Promise<AccountsState>;
+    signOut: (opts?: {
+        endSession?: boolean;
+    }) => Promise<void>;
+};
+export declare function useUser(): {
+    isLoaded: boolean;
+    isSignedIn: boolean;
+    user: import("@iaurelius/accounts/oidc").SessionUser | null;
+};
+export declare function SignedIn({ children }: {
+    children?: ReactNode;
+}): import("react").JSX.Element | null;
+export declare function SignedOut({ children }: {
+    children?: ReactNode;
+}): import("react").JSX.Element | null;
+//# sourceMappingURL=react.d.ts.map

package/dist/react.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AACA,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAChG,OAAO,EAA6C,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAInI,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,oHAAoH;IACpH,cAAc,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,QAAQ,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,CAAC;AAEnJ,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,yEACiE,qBAAqB,iCAapI;AAQD,wBAAgB,OAAO;IAGnB,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;;;EAEV;AAED,wBAAgB,OAAO;IAEZ,QAAQ;IAAkB,UAAU;IAAoB,IAAI;EACtE;AAED,wBAAgB,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,sCAG9D;AAED,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,sCAG/D"}

package/dist/react.js

@@ -0,0 +1,49 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+// The provider, the hooks and <SignedIn>/<SignedOut>, over the client (src/core.ts).
+import { createContext, useContext, useEffect, useMemo, useState } from "react";
+import { createAccountsClient } from "./core.js";
+const Ctx = createContext(null);
+export function makeProvider(platform) {
+    return function AccountsProvider({ children, publishableKey, clientId, scheme, audience, ephemeral = false }) {
+        const client = useMemo(() => createAccountsClient({ publishableKey, clientId, audience, redirectUri: platform.redirectUriFor(scheme), storage: platform.storage, browser: platform.browser(ephemeral), crypto: platform.crypto }), [publishableKey, clientId, scheme, audience, ephemeral]);
+        const [state, setState] = useState(client.state);
+        useEffect(() => {
+            const off = client.subscribe(setState);
+            void client.load();
+            return off;
+        }, [client]);
+        return _jsx(Ctx.Provider, { value: { client, state }, children: children });
+    };
+}
+function useAccounts() {
+    const c = useContext(Ctx);
+    if (!c)
+        throw new Error("Wrap your app in <AccountsProvider> (app/_layout.tsx) to use Accounts' hooks.");
+    return c;
+}
+export function useAuth() {
+    const { client, state } = useAccounts();
+    return {
+        isLoaded: state.isLoaded,
+        isSignedIn: state.isSignedIn,
+        userId: state.user?.id ?? null,
+        sessionId: state.sessionId,
+        getToken: client.getToken,
+        signIn: client.signIn,
+        signUp: client.signUp,
+        signOut: client.signOut,
+    };
+}
+export function useUser() {
+    const { state } = useAccounts();
+    return { isLoaded: state.isLoaded, isSignedIn: state.isSignedIn, user: state.user };
+}
+export function SignedIn({ children }) {
+    const { state } = useAccounts();
+    return state.isLoaded && state.isSignedIn ? _jsx(_Fragment, { children: children }) : null;
+}
+export function SignedOut({ children }) {
+    const { state } = useAccounts();
+    return state.isLoaded && !state.isSignedIn ? _jsx(_Fragment, { children: children }) : null;
+}
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":";AAAA,qFAAqF;AACrF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAoF,MAAM,WAAW,CAAC;AAEnI,MAAM,GAAG,GAAG,aAAa,CAA0D,IAAI,CAAC,CAAC;AAmBzF,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,OAAO,SAAS,gBAAgB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAyB;QACjI,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,oBAAoB,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,EAC1M,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChE,SAAS,CAAC,GAAG,EAAE;YACb,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACb,OAAO,KAAC,GAAG,CAAC,QAAQ,IAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAG,QAAQ,GAAgB,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACzG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;IACxC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAE,QAAQ,EAA4B;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,4BAAG,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAE,QAAQ,EAA4B;IAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,4BAAG,QAAQ,GAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@iaurelius/accounts-expo",
+  "version": "0.1.0",
+  "description": "Accounts by iAurelius for Expo: sign-in on the hosted page in an authentication session, tokens in SecureStore, useAuth() and getToken() that refreshes itself.",
+  "keywords": [
+    "auth",
+    "authentication",
+    "expo",
+    "react-native",
+    "oidc",
+    "passkeys"
+  ],
+  "homepage": "https://accounts.iaurelius.com",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./core": {
+      "types": "./dist/core.d.ts",
+      "default": "./dist/core.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@iaurelius/accounts": "^0.1.0"
+  },
+  "peerDependencies": {
+    "expo-crypto": "*",
+    "expo-secure-store": "*",
+    "expo-web-browser": "*",
+    "react": ">=18.0.0"
+  },
+  "devDependencies": {
+    "@types/react": "19.3.0",
+    "react": "19.3.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}