@icp-sdk/auth 8.0.2 → 9.0.0

package/src/client/sso.ts

@@ -0,0 +1,122 @@
+// The identity provider's cap on the domain it will fetch.
+const MAX_AUTHORITY_LENGTH = 255;
+
+const WELL_KNOWN_PATH = '/.well-known/ii-openid-configuration';
+
+/**
+ * `localhost` / `127.0.0.1`, optionally followed by `:<port>`. IPv6 loopback
+ * (`[::1]`, etc.) is intentionally not handled — the identity provider doesn't
+ * recognise it either, and its e2e setup uses the hostname form.
+ */
+function isLoopbackHost(host: string): boolean {
+  let url: URL;
+  try {
+    // Parse as a URL authority so the optional `:<port>` is split off for us
+    // rather than by hand. Invalid input throws and is treated as non-loopback.
+    url = new URL(`http://${host}`);
+  } catch {
+    return false;
+  }
+  // A bare `host[:port]` has no path/query/fragment; reject e.g. `localhost/x`.
+  if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
+    return false;
+  }
+  return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+}
+
+/**
+ * Normalizes an SSO domain to the authority the identity provider fetches the
+ * discovery document from: lowercased, IDNA-encoded, host and optional port.
+ *
+ * @param domain - The organization domain.
+ * @returns The normalized authority.
+ * @throws When `domain` is not a domain with an optional port.
+ */
+export function normalizeSsoDomain(domain: string): string {
+  const trimmed = domain.trim();
+  if (trimmed.length === 0) {
+    throw new Error('ssoDomain cannot be empty');
+  }
+  let url: URL;
+  try {
+    url = new URL(`https://${trimmed}`);
+  } catch {
+    throw new Error(`ssoDomain is not a domain: ${trimmed}`);
+  }
+  const authority = url.host;
+  // Rebuilding from the host and port alone has to reproduce what was parsed,
+  // so anything else the domain carried shows up as a difference.
+  if (new URL(`https://${authority}`).href !== url.href) {
+    throw new Error(`ssoDomain must be a domain and optional port, nothing else: ${trimmed}`);
+  }
+  if (authority.length > MAX_AUTHORITY_LENGTH) {
+    throw new Error(`ssoDomain exceeds ${MAX_AUTHORITY_LENGTH} characters`);
+  }
+  // A bare hostname is a half-typed domain, not something worth a request.
+  if (!authority.includes('.') && !isLoopbackHost(authority)) {
+    throw new Error(`ssoDomain is not a domain name: ${trimmed}`);
+  }
+  return authority;
+}
+
+function publishesSsoConfiguration(value: unknown): boolean {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+  const { client_id, openid_configuration } = value as Record<string, unknown>;
+  return typeof client_id === 'string' && typeof openid_configuration === 'string';
+}
+
+/**
+ * Checks whether an organization domain can be used for SSO sign-in: it is a
+ * domain name, and it publishes `/.well-known/ii-openid-configuration` with a
+ * `client_id` and an `openid_configuration` URL.
+ *
+ * The document must be served with `Access-Control-Allow-Origin: *`.
+ *
+ * The check waits on a third-party server and has no deadline of its own, so
+ * `signal` sets one. Pass `AbortSignal.timeout(...)` for a one-shot check, or a
+ * controller you abort per keystroke when checking as the user types.
+ *
+ * @param domain - The organization domain.
+ * @param signal - Bounds the check.
+ * @returns Whether the domain is usable for SSO sign-in.
+ * @throws When `signal` aborts — an abandoned check is not a verdict on the
+ *   domain, so it must not be read as `false`.
+ *
+ * @example
+ * if (await isValidSsoDomain(input.value, AbortSignal.timeout(5_000))) {
+ *   const authClient = new AuthClient({ ssoDomain: input.value });
+ *   await authClient.signIn();
+ * }
+ */
+export async function isValidSsoDomain(domain: string, signal: AbortSignal): Promise<boolean> {
+  signal.throwIfAborted();
+
+  let normalized: string;
+  try {
+    normalized = normalizeSsoDomain(domain);
+  } catch {
+    return false;
+  }
+
+  const scheme = isLoopbackHost(normalized) ? 'http' : 'https';
+  try {
+    const response = await fetch(`${scheme}://${normalized}${WELL_KNOWN_PATH}`, {
+      headers: { Accept: 'application/json' },
+      signal,
+    });
+    if (!response.ok) {
+      return false;
+    }
+    const valid = publishesSsoConfiguration(await response.json());
+    signal.throwIfAborted();
+    return valid;
+  } catch (error) {
+    if (signal.aborted) {
+      throw error;
+    }
+    // A DNS, TLS, CORS, or parse failure all leave the domain unusable.
+    return false;
+  }
+}

package/src/client/state-storage.ts

@@ -0,0 +1,284 @@
+import { Principal } from '@icp-sdk/core/principal';
+
+/**
+ * What a client knows about its sign-in without holding a credential: which
+ * account is signed in here, and when that ends.
+ *
+ * Both fields are public. The principal is what an application's canisters see
+ * as the caller, and the expiration is what the identity provider granted, so
+ * neither is a secret and both can live somewhere a page reads synchronously.
+ */
+export interface SessionState {
+  principal: Principal;
+
+  /** Nanoseconds since the epoch, matching `Delegation.expiration`. */
+  expiration: bigint;
+
+  /**
+   * Whether this origin holds a credential for that account, or only knows the
+   * sign-in exists.
+   *
+   * Derived on read and never published: where the record reaches further than
+   * one origin, the record itself cannot carry a per-origin fact. A sibling
+   * subdomain that has not acquired its own credential reads the sign-in with
+   * `held: false`, which is what tells it to acquire one.
+   */
+  held: boolean;
+}
+
+/**
+ * Holds the state of a sign-in.
+ *
+ * This is what decides whether this origin is signed in and as whom. It is a
+ * store of its own because it has to be readable without awaiting, which a
+ * credential store does not.
+ *
+ * A record can be stale — a session revoked at the canister still reads as
+ * signed in until something calls and is refused — so it is the state as this
+ * browser knows it rather than an authority against the network.
+ */
+export interface StateStorage {
+  /** The state, or `null` where nothing is signed in within this store's reach. */
+  get(key: string): SessionState | null;
+
+  set(key: string, state: Omit<SessionState, 'held'>): void;
+
+  /**
+   * Removes the state, and anything this store publishes beyond this origin.
+   *
+   * What signing out does: the user ended the sign-in, so a sibling reading a
+   * shared record must stop seeing one.
+   */
+  remove(key: string): void;
+
+  /**
+   * Removes what this origin holds, leaving anything shared alone.
+   *
+   * What finding out does, which is a different act. An origin whose chain turns
+   * out to be dead cannot tell whether the session was revoked or replaced by a
+   * sibling signing in — and in the second case the shared record was written by
+   * that sibling a moment ago, so retracting it would tell it that the session it
+   * just obtained is gone.
+   *
+   * A store that publishes nothing beyond this origin answers it with
+   * {@link remove}, which is one line and the right answer.
+   */
+  discard(key: string): void;
+
+  /**
+   * Whether a sign-in kept in this store may be resumed without a ceremony.
+   *
+   * True only where the record reaches past this origin, because that is the
+   * case a silent re-issue exists for: a sibling reads the sign-in, holds no
+   * credential of its own, and needs the identity provider to remember the
+   * session it can extend. A store the origin keeps to itself has nothing to
+   * gain and would only be asking the provider to persist a sign-in on a device
+   * where nothing wanted one kept.
+   *
+   * Absent means false, which is the answer for a store that never considered
+   * the question.
+   */
+  readonly resumable?: boolean;
+
+  /**
+   * Registers a listener fired when the state under `key` changes, including
+   * when something other than this client changed it. Returns a function that
+   * unregisters it.
+   *
+   * Required rather than optional: two clients can share one store, even a
+   * store with no medium behind it, and a client that cannot be told the record
+   * changed under it goes on answering for a sign-in that is no longer there.
+   */
+  subscribe(key: string, listener: () => void): () => void;
+}
+
+/**
+ * State held for the lifetime of the instance and shared with nothing.
+ *
+ * For tests and for environments with no `localStorage`, where a client is
+ * alone and a reload starts from nothing.
+ * @see implements {@link StateStorage}
+ */
+export class MemoryStateStorage implements StateStorage {
+  #state = new Map<string, Omit<SessionState, 'held'>>();
+  #subscribers = new Map<string, Set<() => void>>();
+
+  public get(key: string): SessionState | null {
+    // Nothing reaches past this instance, so a record here is always one it holds.
+    const state = this.#state.get(key);
+    return state === undefined ? null : { ...state, held: true };
+  }
+
+  public set(key: string, state: Omit<SessionState, 'held'>): void {
+    this.#state.set(key, state);
+    this.#fire(key);
+  }
+
+  public remove(key: string): void {
+    this.#state.delete(key);
+    this.#fire(key);
+  }
+
+  /** The same as {@link remove}: this store publishes nothing at all. */
+  public discard(key: string): void {
+    this.remove(key);
+  }
+
+  /**
+   * Fires when the state changes, which here means when something writes to
+   * this instance.
+   *
+   * Nothing outside the process can reach a `Map`, so a medium is not what makes
+   * this worth having: two clients can be handed the same instance, and this is
+   * how the one that did not write finds out. Each listener is told only when the
+   * record actually changed since it was last told, so a client's own writes do
+   * not come back to it as news.
+   */
+  public subscribe(key: string, listener: () => void): () => void {
+    let last = this.#raw(key);
+    const check = (): void => {
+      const now = this.#raw(key);
+      if (now !== last) {
+        last = now;
+        listener();
+      }
+    };
+    const listeners = this.#subscribers.get(key) ?? new Set();
+    listeners.add(check);
+    this.#subscribers.set(key, listeners);
+
+    return () => {
+      listeners.delete(check);
+    };
+  }
+
+  #fire(key: string): void {
+    for (const check of [...(this.#subscribers.get(key) ?? [])]) check();
+  }
+
+  // The same shape `LocalStateStorage` keeps, so "changed" means the same thing
+  // in both: a record is one string, and comparing strings needs no field walk.
+  #raw(key: string): string | null {
+    const state = this.#state.get(key);
+    return state === undefined
+      ? null
+      : `${state.principal.toText()}|${state.expiration.toString()}`;
+  }
+}
+
+/**
+ * State in `localStorage`, so every tab of an origin agrees on it and it
+ * survives a reload.
+ *
+ * The two fields are written as `<principal>|<expiration>` rather than JSON,
+ * because an expiration is a `bigint` and JSON has no way to carry one.
+ * @see implements {@link StateStorage}
+ */
+export class LocalStateStorage implements StateStorage {
+  // Fired on a same-tab write: `storage` reaches the other tabs of an origin and
+  // deliberately not the one that wrote. Per key, because one store answers for
+  // whatever key it is handed.
+  #subscribers = new Map<string, Set<() => void>>();
+
+  public get(key: string): SessionState | null {
+    const raw = this.#localStorage().getItem(key);
+    if (raw === null) return null;
+
+    const [principalText, expiration] = raw.split('|');
+    if (principalText === undefined || expiration === undefined) return null;
+    try {
+      return {
+        principal: Principal.fromText(principalText),
+        expiration: BigInt(expiration),
+        // This record is written by this origin and read by no other, so having
+        // one and holding a credential for it are the same thing.
+        held: true,
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  public set(key: string, state: Omit<SessionState, 'held'>): void {
+    this.#localStorage().setItem(key, `${state.principal.toText()}|${state.expiration.toString()}`);
+    this.#fire(key);
+  }
+
+  public remove(key: string): void {
+    this.#localStorage().removeItem(key);
+    this.#fire(key);
+  }
+
+  /** The same as {@link remove}: this store publishes nothing beyond the origin. */
+  public discard(key: string): void {
+    this.remove(key);
+  }
+
+  /**
+   * Fires when the state changes, here or in another tab of this origin.
+   *
+   * `localStorage` raises `storage` in every tab except the one that wrote, so
+   * that event carries a change between tabs and a same-tab write is announced
+   * directly. Either way the record is readable before it is announced, so a
+   * listener asking who is signed in sees what it was told about.
+   */
+  public subscribe(key: string, listener: () => void): () => void {
+    let last = this.#raw(key);
+    const check = (): void => {
+      const now = this.#raw(key);
+      if (now !== last) {
+        last = now;
+        listener();
+      }
+    };
+    const listeners = this.#subscribers.get(key) ?? new Set();
+    listeners.add(check);
+    this.#subscribers.set(key, listeners);
+
+    const onStorage = (event: StorageEvent): void => {
+      // `key` is null when a tab cleared the whole store, which changes this too.
+      if (event.key === key || event.key === null) check();
+    };
+    globalThis.addEventListener('storage', onStorage);
+
+    // `storage` is the only notice this store gets, and a page restored from the
+    // back-forward cache was not listening while it was frozen. So the record is
+    // re-read when the page is shown or its window regains focus, which is when
+    // somebody is about to act on the answer.
+    const onVisible = (): void => {
+      if (document.visibilityState === 'visible') check();
+    };
+    const hooked = typeof document !== 'undefined';
+    if (hooked) {
+      document.addEventListener('visibilitychange', onVisible);
+      globalThis.addEventListener('pageshow', check);
+      globalThis.addEventListener('focus', check);
+    }
+
+    return () => {
+      listeners.delete(check);
+      globalThis.removeEventListener('storage', onStorage);
+      if (hooked) {
+        document.removeEventListener('visibilitychange', onVisible);
+        globalThis.removeEventListener('pageshow', check);
+        globalThis.removeEventListener('focus', check);
+      }
+    };
+  }
+
+  #fire(key: string): void {
+    for (const check of [...(this.#subscribers.get(key) ?? [])]) check();
+  }
+
+  #raw(key: string): string | null {
+    return this.#localStorage().getItem(key);
+  }
+
+  #localStorage(): Storage {
+    const ls = globalThis.localStorage;
+    if (!ls) {
+      throw new Error('Could not find local storage.');
+    }
+    return ls;
+  }
+}

package/dist/esm/client/idle-manager.d.ts

@@ -1,83 +0,0 @@
-type IdleCB = () => unknown;
-export type IdleManagerOptions = {
-    /**
-     * Callback after the user has gone idle
-     */
-    onIdle?: IdleCB;
-    /**
-     * timeout in ms
-     * @default 30 minutes [600_000]
-     */
-    idleTimeout?: number;
-    /**
-     * capture scroll events
-     * @default false
-     */
-    captureScroll?: boolean;
-    /**
-     * scroll debounce time in ms
-     * @default 100
-     */
-    scrollDebounce?: number;
-};
-/**
- * Detects if the user has been idle for a duration of `idleTimeout` ms, and calls `onIdle` and registered callbacks.
- * By default, the IdleManager will log a user out after 10 minutes of inactivity.
- * To override these defaults, you can pass an `onIdle` callback, or configure a custom `idleTimeout` in milliseconds.
- *
- * IdleManager is a singleton: multiple calls to `create()` return the same instance,
- * registering any new `onIdle` callback. Call `exit()` to tear down the singleton.
- */
-export declare class IdleManager {
-    #private;
-    /**
-     * Creates or returns the singleton {@link IdleManager}.
-     * If the instance already exists, any provided `onIdle` callback is registered
-     * on the existing instance.
-     * @param {IdleManagerOptions} options Optional configuration
-     * @see {@link IdleManagerOptions}
-     * @param options.onIdle Callback once user has been idle. Use to prompt for fresh sign-in, and use `Actor.agentOf(your_actor).invalidateIdentity()` to protect the user
-     * @param options.idleTimeout timeout in ms
-     * @param options.captureScroll capture scroll events
-     * @param options.scrollDebounce scroll debounce time in ms
-     */
-    static create(options?: {
-        /**
-         * Callback after the user has gone idle
-         * @see {@link IdleCB}
-         */
-        onIdle?: () => unknown;
-        /**
-         * timeout in ms
-         * @default 10 minutes [600_000]
-         */
-        idleTimeout?: number;
-        /**
-         * capture scroll events
-         * @default false
-         */
-        captureScroll?: boolean;
-        /**
-         * scroll debounce time in ms
-         * @default 100
-         */
-        scrollDebounce?: number;
-    }): IdleManager;
-    /**
-     * @param options {@link IdleManagerOptions}
-     */
-    private constructor();
-    /**
-     * @param {IdleCB} callback function to be called when user goes idle
-     */
-    registerCallback(callback: IdleCB): void;
-    /**
-     * Tears down listeners, fires all callbacks, and clears the singleton.
-     */
-    exit(): void;
-    /**
-     * Resets the timeouts during cleanup
-     */
-    private _resetTimer;
-}
-export {};

package/dist/esm/client/idle-manager.js

@@ -1,100 +0,0 @@
-const events = ['mousedown', 'mousemove', 'keydown', 'touchstart', 'wheel'];
-/**
- * Detects if the user has been idle for a duration of `idleTimeout` ms, and calls `onIdle` and registered callbacks.
- * By default, the IdleManager will log a user out after 10 minutes of inactivity.
- * To override these defaults, you can pass an `onIdle` callback, or configure a custom `idleTimeout` in milliseconds.
- *
- * IdleManager is a singleton: multiple calls to `create()` return the same instance,
- * registering any new `onIdle` callback. Call `exit()` to tear down the singleton.
- */
-export class IdleManager {
-    static #instance;
-    #callbacks = [];
-    #idleTimeout;
-    #timeoutID = undefined;
-    #resetTimer;
-    /**
-     * Creates or returns the singleton {@link IdleManager}.
-     * If the instance already exists, any provided `onIdle` callback is registered
-     * on the existing instance.
-     * @param {IdleManagerOptions} options Optional configuration
-     * @see {@link IdleManagerOptions}
-     * @param options.onIdle Callback once user has been idle. Use to prompt for fresh sign-in, and use `Actor.agentOf(your_actor).invalidateIdentity()` to protect the user
-     * @param options.idleTimeout timeout in ms
-     * @param options.captureScroll capture scroll events
-     * @param options.scrollDebounce scroll debounce time in ms
-     */
-    static create(options = {}) {
-        if (IdleManager.#instance) {
-            if (options.onIdle) {
-                IdleManager.#instance.registerCallback(options.onIdle);
-            }
-            return IdleManager.#instance;
-        }
-        const instance = new IdleManager(options);
-        IdleManager.#instance = instance;
-        return instance;
-    }
-    /**
-     * @param options {@link IdleManagerOptions}
-     */
-    constructor(options = {}) {
-        const { onIdle, idleTimeout = 10 * 60 * 1000 } = options || {};
-        this.#callbacks = onIdle ? [onIdle] : [];
-        this.#idleTimeout = idleTimeout;
-        // Store the bound function once so the same reference is used
-        // for both addEventListener and removeEventListener.
-        this.#resetTimer = this._resetTimer.bind(this);
-        window.addEventListener('load', this.#resetTimer, true);
-        events.forEach((name) => {
-            document.addEventListener(name, this.#resetTimer, true);
-        });
-        const debounce = (func, wait) => {
-            let timeout;
-            return (...args) => {
-                const context = this;
-                const later = () => {
-                    timeout = undefined;
-                    func.apply(context, args);
-                };
-                clearTimeout(timeout);
-                timeout = window.setTimeout(later, wait);
-            };
-        };
-        if (options?.captureScroll) {
-            // debounce scroll events
-            const scroll = debounce(this.#resetTimer, options?.scrollDebounce ?? 100);
-            window.addEventListener('scroll', scroll, true);
-        }
-        this.#resetTimer();
-    }
-    /**
-     * @param {IdleCB} callback function to be called when user goes idle
-     */
-    registerCallback(callback) {
-        this.#callbacks.push(callback);
-    }
-    /**
-     * Tears down listeners, fires all callbacks, and clears the singleton.
-     */
-    exit() {
-        clearTimeout(this.#timeoutID);
-        window.removeEventListener('load', this.#resetTimer, true);
-        events.forEach((name) => {
-            document.removeEventListener(name, this.#resetTimer, true);
-        });
-        this.#callbacks.forEach((cb) => {
-            cb();
-        });
-        IdleManager.#instance = undefined;
-    }
-    /**
-     * Resets the timeouts during cleanup
-     */
-    _resetTimer() {
-        const exit = this.exit.bind(this);
-        window.clearTimeout(this.#timeoutID);
-        this.#timeoutID = window.setTimeout(exit, this.#idleTimeout);
-    }
-}
-//# sourceMappingURL=idle-manager.js.map

package/dist/esm/client/idle-manager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"idle-manager.js","sourceRoot":"","sources":["../../../src/client/idle-manager.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACtB,MAAM,CAAC,SAAS,CAA0B;IAE1C,UAAU,GAAa,EAAE,CAAC;IAC1B,YAAY,CAAS;IACrB,UAAU,GAAY,SAAS,CAAC;IAChC,WAAW,CAAa;IAExB;;;;;;;;;;OAUG;IACI,MAAM,CAAC,MAAM,CAClB,UAqBI,EAAE;QAEN,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,WAAW,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,WAAW,CAAC,SAAS,CAAC;QAC/B,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,WAAW,CAAC,SAAS,GAAG,QAAQ,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,YAAoB,UAA8B,EAAE;QAClD,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAE/D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAEhC,8DAA8D;QAC9D,qDAAqD;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAExD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACtB,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,CAAC,IAAkC,EAAE,IAAY,EAAE,EAAE;YACpE,IAAI,OAA2B,CAAC;YAChC,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC;gBACrB,MAAM,KAAK,GAAG,GAAG,EAAE;oBACjB,OAAO,GAAG,SAAS,CAAC;oBACpB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC5B,CAAC,CAAC;gBACF,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC,CAAC;QACJ,CAAC,CAAC;QAEF,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;YAC3B,yBAAyB;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,cAAc,IAAI,GAAG,CAAC,CAAC;YAC1E,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,gBAAgB,CAAC,QAAgB;QACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACI,IAAI;QACT,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAE3D,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACtB,QAAQ,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YAC7B,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/esm/client/storage.d.ts

@@ -1,51 +0,0 @@
-import { type DBCreateOptions, IdbKeyVal } from './db.js';
-export declare const KEY_STORAGE_KEY = "identity";
-export declare const KEY_STORAGE_DELEGATION = "delegation";
-export declare const KEY_VECTOR = "iv";
-export declare const DB_VERSION = 1;
-export type StoredKey = string | CryptoKeyPair;
-/**
- * Interface for persisting user authentication data
- */
-export interface AuthClientStorage {
-    get(key: string): Promise<StoredKey | null>;
-    set(key: string, value: StoredKey): Promise<void>;
-    remove(key: string): Promise<void>;
-}
-/**
- * Legacy implementation of AuthClientStorage, for use where IndexedDb is not available
- */
-export declare class LocalStorage implements AuthClientStorage {
-    readonly prefix: string;
-    private readonly _localStorage?;
-    constructor(prefix?: string, _localStorage?: Storage | undefined);
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string): Promise<void>;
-    remove(key: string): Promise<void>;
-    private _getLocalStorage;
-}
-/**
- * IdbStorage is an interface for simple storage of string key-value pairs built on {@link IdbKeyVal}
- *
- * It replaces {@link LocalStorage}
- * @see implements {@link AuthClientStorage}
- */
-export declare class IdbStorage implements AuthClientStorage {
-    #private;
-    /**
-     * @param options - DBCreateOptions
-     * @param options.dbName - name for the indexeddb database
-     * @param options.storeName - name for the indexeddb Data Store
-     * @param options.version - version of the database. Increment to safely upgrade
-     * @example
-     * ```ts
-     * const storage = new IdbStorage({ dbName: 'my-db', storeName: 'my-store', version: 2 });
-     * ```
-     */
-    constructor(options?: DBCreateOptions);
-    private initializedDb;
-    get _db(): Promise<IdbKeyVal>;
-    get<T = string>(key: string): Promise<T | null>;
-    set<T = string>(key: string, value: T): Promise<void>;
-    remove(key: string): Promise<void>;
-}