@icp-sdk/auth 8.0.2 → 9.0.0

package/dist/esm/client/session-minter.d.ts

@@ -0,0 +1,94 @@
+import { type DerEncodedPublicKey, type HttpAgentOptions, type SignIdentity } from '@icp-sdk/core/agent';
+import { DelegationChain } from '@icp-sdk/core/identity';
+import type { Principal } from '@icp-sdk/core/principal';
+import { type AppDelegationSource } from './app-delegation-source.js';
+type AppSessionError = {
+    NoSuchSession: null;
+} | {
+    NoSuchDelegation: null;
+} | {
+    InternalCanisterError: string;
+};
+type Result<T> = {
+    Ok: T;
+} | {
+    Err: AppSessionError;
+};
+/**
+ * Unwraps a canister result, turning the one terminal error into
+ * {@link SessionGoneError}, the retryable one into
+ * {@link NoSuchDelegationError}, and everything else into a plain failure.
+ */
+export declare const unwrapSessionResult: <T>(result: Result<T>) => T;
+export interface SessionMinterOptions {
+    /** The key the session chain delegates to. Signs the calls made here. */
+    sessionKey: SignIdentity;
+    /** The chain proving those calls come from the session. Restricted to II. */
+    sessionChain: DelegationChain;
+    /** The canister these calls go to. */
+    canisterId: Principal;
+    /**
+     * Options for the agent making them. `identity` is not among them: the agent
+     * signs as the session, which is what a mint call rests on.
+     */
+    agentOptions?: Omit<HttpAgentOptions, 'identity'>;
+}
+/** Mints app delegations by asking the Internet Identity canister for one. */
+export declare class SessionMinter implements AppDelegationSource {
+    #private;
+    private constructor();
+    static create(options: SessionMinterOptions): Promise<SessionMinter>;
+    /**
+     * Prepares and fetches an app delegation, once more if the fetch finds nothing
+     * signed for what the prepare handed out.
+     *
+     * The pair is two calls, and only the first of them is an update: an expiration
+     * the canister will not sign for is one this session no longer holds, and the
+     * answer is to prepare again rather than to sign in again. Attempted a second
+     * time and no further — a third would be pursuing something other than the race
+     * this covers.
+     */
+    mint(appPublicKey: DerEncodedPublicKey): Promise<DelegationChain>;
+    /**
+     * Ends the session at the canister.
+     *
+     * Idempotent at the canister: a session that is already gone is `Ok`, because
+     * the caller wanted it gone and it is gone. What comes back as an error is the
+     * canister failing to write, and it is raised rather than dropped — an
+     * application that told a user it signed them out of their apps should be able
+     * to find out that it did not. The call can also fail the way any update call
+     * can, and that rejection is the caller's to decide about too.
+     */
+    revoke(): Promise<void>;
+}
+/**
+ * Assembles the one-hop chain an app signs its calls with, rooted at the
+ * account's own key.
+ */
+export declare function appDelegationChain(userKey: Uint8Array, signed: {
+    delegation: {
+        pubkey: Uint8Array;
+        expiration: bigint;
+        targets: [] | [Principal[]];
+        permissions: [] | [string];
+    };
+    signature: Uint8Array;
+}): DelegationChain;
+/**
+ * Refuses a chain that is not a session for `canisterId`.
+ *
+ * Targets restrict what the chain's final key may call, and the effective
+ * restriction is the intersection of the hops that name any: a hop with no
+ * targets imposes nothing, so one restricting hop is enough to confine the key.
+ * Internet Identity names the canister on both of its hops — on the one the
+ * canister signs to the provider's own key, and again on the provider's
+ * extension to the application's key — and the intersection is what is checked,
+ * so a hop that stopped naming it would still leave the chain confined by the
+ * other.
+ *
+ * So what is refused is a chain no hop restricts, which the session key would
+ * otherwise be able to sign any call with, and one whose restrictions do not
+ * come out as this canister alone.
+ */
+export declare function assertChainReaches(chain: DelegationChain, canisterId: Principal): void;
+export {};

package/dist/esm/client/session-minter.js

@@ -0,0 +1,185 @@
+import { Actor, HttpAgent, } from '@icp-sdk/core/agent';
+import { Delegation, DelegationChain, DelegationIdentity } from '@icp-sdk/core/identity';
+import { SessionGoneError } from './app-delegation-source.js';
+/**
+ * Just the three methods an app calls with a session chain. Written out rather
+ * than generated because this package carries no Internet Identity declarations,
+ * and generating them for three methods would mean carrying the whole interface.
+ */
+const idlFactory = ({ IDL }) => {
+    const SessionKey = IDL.Vec(IDL.Nat8);
+    const Timestamp = IDL.Nat64;
+    const AppSessionError = IDL.Variant({
+        NoSuchSession: IDL.Null,
+        NoSuchDelegation: IDL.Null,
+        InternalCanisterError: IDL.Text,
+    });
+    const CandidDelegation = IDL.Record({
+        pubkey: SessionKey,
+        expiration: Timestamp,
+        targets: IDL.Opt(IDL.Vec(IDL.Principal)),
+        permissions: IDL.Opt(IDL.Text),
+    });
+    return IDL.Service({
+        app_prepare_delegation: IDL.Func([IDL.Record({ session_key: SessionKey })], [
+            IDL.Variant({
+                Ok: IDL.Record({ user_key: SessionKey, expiration: Timestamp }),
+                Err: AppSessionError,
+            }),
+        ], []),
+        app_get_delegation: IDL.Func([IDL.Record({ session_key: SessionKey, expiration: Timestamp })], [
+            IDL.Variant({
+                Ok: IDL.Record({ delegation: CandidDelegation, signature: SessionKey }),
+                Err: AppSessionError,
+            }),
+        ], ['query']),
+        app_revoke_session: IDL.Func([], [IDL.Variant({ Ok: IDL.Null, Err: AppSessionError })], []),
+    });
+};
+const isGone = (error) => 'NoSuchSession' in error;
+/**
+ * Raised when the canister signed nothing for the key and expiration asked for,
+ * which means the expiration was not one `app_prepare_delegation` returned.
+ *
+ * Its own error because the remedy is its own: prepare again and use what comes
+ * back. Signing in afresh is not it — the session is live, or the call would have
+ * been refused for being no session at all.
+ */
+class NoSuchDelegationError extends Error {
+    constructor() {
+        super('Internet Identity signed no delegation for this key and expiration');
+        this.name = 'NoSuchDelegationError';
+    }
+}
+/**
+ * Unwraps a canister result, turning the one terminal error into
+ * {@link SessionGoneError}, the retryable one into
+ * {@link NoSuchDelegationError}, and everything else into a plain failure.
+ */
+export const unwrapSessionResult = (result) => {
+    if ('Ok' in result)
+        return result.Ok;
+    if (isGone(result.Err))
+        throw new SessionGoneError();
+    if ('NoSuchDelegation' in result.Err)
+        throw new NoSuchDelegationError();
+    // A candid variant, so interpolating it directly renders "[object Object]" and
+    // throws away the canister's own explanation of what went wrong.
+    const detail = 'InternalCanisterError' in result.Err ? result.Err.InternalCanisterError : '';
+    throw new Error(`Internet Identity could not mint a delegation${detail === '' ? '' : `: ${detail}`}`);
+};
+/** Mints app delegations by asking the Internet Identity canister for one. */
+export class SessionMinter {
+    #service;
+    constructor(service) {
+        this.#service = service;
+    }
+    static async create(options) {
+        const { canisterId } = options;
+        assertChainReaches(options.sessionChain, canisterId);
+        const agent = await HttpAgent.create({
+            ...options.agentOptions,
+            // Last, so no agent option can replace the session these calls are made as.
+            identity: DelegationIdentity.fromDelegation(options.sessionKey, options.sessionChain),
+        });
+        return new SessionMinter(Actor.createActor(idlFactory, { agent, canisterId }));
+    }
+    /**
+     * Prepares and fetches an app delegation, once more if the fetch finds nothing
+     * signed for what the prepare handed out.
+     *
+     * The pair is two calls, and only the first of them is an update: an expiration
+     * the canister will not sign for is one this session no longer holds, and the
+     * answer is to prepare again rather than to sign in again. Attempted a second
+     * time and no further — a third would be pursuing something other than the race
+     * this covers.
+     */
+    async mint(appPublicKey) {
+        try {
+            return await this.#mintOnce(appPublicKey);
+        }
+        catch (error) {
+            if (!(error instanceof NoSuchDelegationError))
+                throw error;
+            return await this.#mintOnce(appPublicKey);
+        }
+    }
+    /**
+     * Ends the session at the canister.
+     *
+     * Idempotent at the canister: a session that is already gone is `Ok`, because
+     * the caller wanted it gone and it is gone. What comes back as an error is the
+     * canister failing to write, and it is raised rather than dropped — an
+     * application that told a user it signed them out of their apps should be able
+     * to find out that it did not. The call can also fail the way any update call
+     * can, and that rejection is the caller's to decide about too.
+     */
+    async revoke() {
+        unwrapSessionResult(await this.#service.app_revoke_session());
+    }
+    async #mintOnce(appPublicKey) {
+        const prepared = unwrapSessionResult(await this.#service.app_prepare_delegation({ session_key: appPublicKey }));
+        const signed = unwrapSessionResult(await this.#service.app_get_delegation({
+            session_key: appPublicKey,
+            // Exactly what was prepared. A different value is a different signature.
+            expiration: prepared.expiration,
+        }));
+        return appDelegationChain(prepared.user_key, signed);
+    }
+}
+/**
+ * Assembles the one-hop chain an app signs its calls with, rooted at the
+ * account's own key.
+ */
+export function appDelegationChain(userKey, signed) {
+    // The signature covers whatever fields the canister set, and a delegation
+    // carrying permissions cannot be represented by the chain type, so sending one
+    // without it would fail verification at the boundary node with nothing to point
+    // at. Read-only sessions are unsupported until the type carries the field.
+    if (signed.delegation.permissions.length > 0) {
+        throw new Error('This session is read-only, which @icp-sdk/auth cannot act for yet: its delegations carry permissions that a delegation chain has no room for');
+    }
+    return DelegationChain.fromDelegations([
+        {
+            delegation: new Delegation(signed.delegation.pubkey, signed.delegation.expiration, signed.delegation.targets[0]),
+            signature: signed.signature,
+        },
+    ], userKey);
+}
+/**
+ * Refuses a chain that is not a session for `canisterId`.
+ *
+ * Targets restrict what the chain's final key may call, and the effective
+ * restriction is the intersection of the hops that name any: a hop with no
+ * targets imposes nothing, so one restricting hop is enough to confine the key.
+ * Internet Identity names the canister on both of its hops — on the one the
+ * canister signs to the provider's own key, and again on the provider's
+ * extension to the application's key — and the intersection is what is checked,
+ * so a hop that stopped naming it would still leave the chain confined by the
+ * other.
+ *
+ * So what is refused is a chain no hop restricts, which the session key would
+ * otherwise be able to sign any call with, and one whose restrictions do not
+ * come out as this canister alone.
+ */
+export function assertChainReaches(chain, canisterId) {
+    const hops = chain.delegations.map(({ delegation }) => delegation.targets);
+    const restricting = hops.filter((hopTargets) => hopTargets !== undefined);
+    if (restricting.length === 0) {
+        throw new Error(`A session chain must be restricted to ${canisterId.toText()}, but no hop of this one names any canister`);
+    }
+    // An empty list names nothing rather than naming this canister, and a chain
+    // that can call nothing is not a session either.
+    const namingNothing = restricting.some((hopTargets) => hopTargets.length === 0);
+    if (namingNothing) {
+        throw new Error(`A session chain must be restricted to ${canisterId.toText()}, but a hop of this one names nothing`);
+    }
+    const elsewhere = restricting
+        .flat()
+        .filter((target) => target.compareTo(canisterId) !== 'eq')
+        .map((target) => target.toText());
+    if (elsewhere.length > 0) {
+        throw new Error(`A session chain must be restricted to ${canisterId.toText()}, but this one also names ${[...new Set(elsewhere)].join(', ')}`);
+    }
+}
+//# sourceMappingURL=session-minter.js.map

package/dist/esm/client/session-minter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-minter.js","sourceRoot":"","sources":["../../../src/client/session-minter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EAEL,SAAS,GAGV,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,EAA4B,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,GAAyB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACnD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;IAC5B,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC;QAClC,aAAa,EAAE,GAAG,CAAC,IAAI;QACvB,gBAAgB,EAAE,GAAG,CAAC,IAAI;QAC1B,qBAAqB,EAAE,GAAG,CAAC,IAAI;KAChC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;KAC/B,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,CAAC;QACjB,sBAAsB,EAAE,GAAG,CAAC,IAAI,CAC9B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,EACzC;YACE,GAAG,CAAC,OAAO,CAAC;gBACV,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;gBAC/D,GAAG,EAAE,eAAe;aACrB,CAAC;SACH,EACD,EAAE,CACH;QACD,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAC1B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,EAChE;YACE,GAAG,CAAC,OAAO,CAAC;gBACV,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;gBACvE,GAAG,EAAE,eAAe;aACrB,CAAC;SACH,EACD,CAAC,OAAO,CAAC,CACV;QACD,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;KAC5F,CAAC,CAAC;AACL,CAAC,CAAC;AA0BF,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAW,EAAE,CAAC,eAAe,IAAI,KAAK,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,qBAAsB,SAAQ,KAAK;IACvC;QACE,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAI,MAAiB,EAAK,EAAE;IAC7D,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IACrD,IAAI,kBAAkB,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;IACxE,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,MAAM,GAAG,uBAAuB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CACrF,CAAC;AACJ,CAAC,CAAC;AAmBF,8EAA8E;AAC9E,MAAM,OAAO,aAAa;IACf,QAAQ,CAAiB;IAElC,YAAoB,OAAuB;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAA6B;QAC/C,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;YACnC,GAAG,OAAO,CAAC,YAAY;YACvB,4EAA4E;YAC5E,QAAQ,EAAE,kBAAkB,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC;SACtF,CAAC,CAAC;QACH,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,WAAW,CAAiB,UAAU,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAC,YAAiC;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3D,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAiC;QAC/C,MAAM,QAAQ,GAAG,mBAAmB,CAClC,MAAM,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAC1E,CAAC;QAEF,MAAM,MAAM,GAAG,mBAAmB,CAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACrC,WAAW,EAAE,YAAY;YACzB,yEAAyE;YACzE,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CACH,CAAC;QAEF,OAAO,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAmB,EACnB,MAQC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,8IAA8I,CAC/I,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,eAAe,CACpC;QACE;YACE,UAAU,EAAE,IAAI,UAAU,CACxB,MAAM,CAAC,UAAU,CAAC,MAAM,EACxB,MAAM,CAAC,UAAU,CAAC,UAAU,EAC5B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAC7B;YACD,SAAS,EAAE,MAAM,CAAC,SAAgE;SACnF;KACF,EACD,OAA8B,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,UAAqB;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC7B,CAAC,UAAU,EAA6B,EAAE,CAAC,UAAU,KAAK,SAAS,CACpE,CAAC;IAEF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,UAAU,CAAC,MAAM,EAAE,6CAA6C,CAC1G,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAChF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yCAAyC,UAAU,CAAC,MAAM,EAAE,uCAAuC,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,WAAW;SAC1B,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;SACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,yCAAyC,UAAU,CAAC,MAAM,EAAE,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9H,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/esm/client/shared-memory-credential-storage.d.ts

@@ -0,0 +1,44 @@
+import { ECDSAKeyIdentity } from '@icp-sdk/core/identity';
+import type { Credential, CredentialStorage } from './credential-storage.js';
+/** The channel and lock prefix every instance agrees on by default. */
+export declare const DEFAULT_SHARED_MEMORY_NAME = "ic-credentials";
+/**
+ * Credentials in memory, replicated to the other tabs of this origin.
+ *
+ * For an environment with no durable medium — a browser with IndexedDB and
+ * `localStorage` both unavailable, or an application that has decided nothing may
+ * reach disk — where every tab minting for itself is still worth avoiding.
+ *
+ * Every write is broadcast and every instance applies what it receives, so a
+ * steady-state read is local and immediate: the medium is a `Map`, and the channel
+ * is what keeps the Maps agreeing. A `CryptoKeyPair` survives a structured clone
+ * as a handle that signs and cannot be exported, so what crosses is usable
+ * without key material having been sent.
+ *
+ * Nothing survives the document, which is what `durable` says. What that costs is
+ * the last tab of an origin closing: the credentials go with it, and the next load
+ * signs in again.
+ * @see implements {@link CredentialStorage}
+ */
+export declare class SharedMemoryCredentialStorage implements CredentialStorage<ECDSAKeyIdentity> {
+    #private;
+    readonly shared = true;
+    readonly durable = false;
+    /**
+     * @param options - The channel and lock prefix the tabs of this origin share.
+     */
+    constructor(options?: {
+        name?: string;
+    });
+    /**
+     * Stops replicating and lets go of the name a peer waits on.
+     *
+     * Only needed when you replace a store while the page lives; the document
+     * going away does the same thing.
+     */
+    close(): void;
+    create(): Promise<ECDSAKeyIdentity>;
+    get(slot: string): Promise<Credential<ECDSAKeyIdentity> | null>;
+    set(slot: string, credential: Credential<ECDSAKeyIdentity>): Promise<void>;
+    remove(slot: string): Promise<void>;
+}

package/dist/esm/client/shared-memory-credential-storage.js

@@ -0,0 +1,243 @@
+import { DelegationChain, ECDSAKeyIdentity } from '@icp-sdk/core/identity';
+/** The channel and lock prefix every instance agrees on by default. */
+export const DEFAULT_SHARED_MEMORY_NAME = 'ic-credentials';
+// Narrowing, not protection. A channel reaches one origin, so a stranger on the
+// name is our own code through a deploy or an application posting on it, and what
+// keeps those harmless is elsewhere: the switch answers nothing it does not
+// recognise, and rebuilding a record catches its own failures. This is what gives
+// `data` a type, so the switch can read the fields it needs.
+const isMessage = (value) => {
+    if (typeof value !== 'object' || value === null || !('kind' in value))
+        return false;
+    const message = value;
+    switch (message.kind) {
+        case 'ask':
+            return true;
+        case 'drop':
+            return typeof message.slot === 'string';
+        case 'put':
+            return typeof message.slot === 'string' && 'keyPair' in message;
+        case 'offer':
+            return Array.isArray(message.entries);
+        default:
+            return false;
+    }
+};
+/**
+ * Credentials in memory, replicated to the other tabs of this origin.
+ *
+ * For an environment with no durable medium — a browser with IndexedDB and
+ * `localStorage` both unavailable, or an application that has decided nothing may
+ * reach disk — where every tab minting for itself is still worth avoiding.
+ *
+ * Every write is broadcast and every instance applies what it receives, so a
+ * steady-state read is local and immediate: the medium is a `Map`, and the channel
+ * is what keeps the Maps agreeing. A `CryptoKeyPair` survives a structured clone
+ * as a handle that signs and cannot be exported, so what crosses is usable
+ * without key material having been sent.
+ *
+ * Nothing survives the document, which is what `durable` says. What that costs is
+ * the last tab of an origin closing: the credentials go with it, and the next load
+ * signs in again.
+ * @see implements {@link CredentialStorage}
+ */
+export class SharedMemoryCredentialStorage {
+    shared = true;
+    durable = false;
+    #name;
+    #channel;
+    // On the instance and never on the module, so two clients on one page keep
+    // their own replicas and no state carries between tests in one process.
+    #replica = new Map();
+    // Held for this instance's life under a name only this instance uses, so a peer
+    // can wait for the grant that means this one is gone. The browser releases it
+    // when the document is torn down, which is the signal no message could carry.
+    #id = crypto.randomUUID();
+    #releasePresence;
+    #announceOffer;
+    // Applying an incoming record is asynchronous, because a key handle and a chain
+    // have to be rebuilt from what crossed. Queued so they land in the order they
+    // arrived: a put applied after the drop that followed it would resurrect a slot
+    // its owner had already cleared.
+    #applying = Promise.resolve();
+    /**
+     * Resolves once there is nothing left to wait for: a peer has answered, or
+     * every peer that existed when this instance started has gone.
+     *
+     * Reads await it, so the first one after a cold start sees what the other tabs
+     * hold rather than a miss. There is no deadline in it — waiting ends on a lock
+     * grant, and a lone instance waits not at all because there is no peer to hold
+     * one.
+     */
+    #synced;
+    /**
+     * @param options - The channel and lock prefix the tabs of this origin share.
+     */
+    constructor(options) {
+        this.#name = options?.name ?? DEFAULT_SHARED_MEMORY_NAME;
+        this.#channel =
+            typeof BroadcastChannel === 'undefined' ? undefined : new BroadcastChannel(this.#name);
+        this.#channel?.addEventListener('message', (event) => this.#receive(event.data));
+        this.#synced = this.#openReplica();
+    }
+    /**
+     * Stops replicating and lets go of the name a peer waits on.
+     *
+     * Only needed when you replace a store while the page lives; the document
+     * going away does the same thing.
+     */
+    close() {
+        this.#channel?.close();
+        this.#releasePresence?.();
+        this.#releasePresence = undefined;
+    }
+    create() {
+        return ECDSAKeyIdentity.generate({ extractable: false });
+    }
+    async get(slot) {
+        await this.#synced;
+        // A read reflects everything received, not everything that has finished being
+        // rebuilt: applying is asynchronous, so a message already in hand would
+        // otherwise read as a miss and cost the caller a credential it had.
+        await this.#applying;
+        return this.#replica.get(slot) ?? null;
+    }
+    async set(slot, credential) {
+        this.#replica.set(slot, credential);
+        this.#post({ kind: 'put', ...this.#toWire(slot, credential) });
+    }
+    async remove(slot) {
+        this.#replica.delete(slot);
+        this.#post({ kind: 'drop', slot });
+    }
+    #presenceName(id) {
+        return `${this.#name}:alive:${id}`;
+    }
+    /**
+     * Takes this instance's presence lock, then waits for the peers that already
+     * had one — asking them for what they hold.
+     */
+    async #openReplica() {
+        const locks = globalThis.navigator?.locks;
+        if (locks === undefined || this.#channel === undefined) {
+            // Nothing can be enumerated and nothing can answer, so waiting could only
+            // cost a load. Every instance is alone, which is calls and not correctness.
+            return;
+        }
+        const peers = await this.#claimPresence(locks);
+        if (peers.length === 0)
+            return;
+        const answered = new Promise((resolve) => {
+            this.#announceOffer = resolve;
+        });
+        this.#post({ kind: 'ask' });
+        // A peer that answers ends the wait; a peer that dies without answering ends
+        // it too, because its lock is granted the moment the browser releases it. So
+        // the wait is bounded by the peers themselves rather than by a number.
+        const goneEverywhere = Promise.all(peers.map((name) => locks.request(name, { mode: 'exclusive' }, () => undefined)));
+        await Promise.race([answered, goneEverywhere]);
+    }
+    /**
+     * Enumerates the peers holding a presence lock, then takes this instance's own.
+     *
+     * In that order: a snapshot taken after would include this instance, and it
+     * would then wait for a lock it holds itself and never be granted.
+     */
+    async #claimPresence(locks) {
+        const mine = this.#presenceName(this.#id);
+        const prefix = `${this.#name}:alive:`;
+        let peers = [];
+        try {
+            const snapshot = await locks.query();
+            peers = (snapshot.held ?? [])
+                .map((lock) => lock.name)
+                .filter((name) => name !== undefined && name !== mine)
+                .filter((name) => name.startsWith(prefix));
+        }
+        catch {
+            // query() is not everywhere, and a caller cannot act on its absence. With
+            // no snapshot there is no peer to wait for, so this instance starts alone.
+        }
+        // Not awaited: the request resolves only when the lock is released, which is
+        // when this instance is done with it.
+        void locks
+            .request(mine, { mode: 'exclusive' }, () => {
+            return new Promise((resolve) => {
+                this.#releasePresence = resolve;
+            });
+        })
+            .catch(() => undefined);
+        return peers;
+    }
+    #receive(data) {
+        if (!isMessage(data))
+            return;
+        if (data.kind === 'ask') {
+            // Answered from what is queued as well as what has landed, so an instance
+            // asked while still applying an earlier message does not describe a state
+            // it is halfway out of.
+            this.#enqueue(() => {
+                const entries = [...this.#replica].map(([slot, credential]) => this.#toWire(slot, credential));
+                // Answered even when empty, because the asker is waiting on an answer and
+                // "I have nothing" is one. Staying silent would make it wait for this
+                // instance to close.
+                this.#post({ kind: 'offer', entries });
+            });
+            return;
+        }
+        this.#enqueue(async () => {
+            switch (data.kind) {
+                case 'offer':
+                    for (const entry of data.entries)
+                        await this.#apply(entry, { overwrite: false });
+                    // Last, so the answer is complete before anything waiting on it wakes.
+                    this.#announceOffer?.();
+                    this.#announceOffer = undefined;
+                    return;
+                case 'put':
+                    await this.#apply(data, { overwrite: true });
+                    return;
+                case 'drop':
+                    this.#replica.delete(data.slot);
+                    return;
+            }
+        });
+    }
+    #enqueue(work) {
+        this.#applying = this.#applying.then(work).catch(() => undefined);
+    }
+    async #apply(entry, { overwrite }) {
+        // An offer answers a question asked before anything local was written, so it
+        // fills gaps rather than replacing: a write that happened in the meantime is
+        // this instance's own and newer than the snapshot being described.
+        if (!overwrite && this.#replica.has(entry.slot))
+            return;
+        try {
+            const identity = await ECDSAKeyIdentity.fromKeyPair(entry.keyPair);
+            const chain = entry.chain === undefined ? undefined : DelegationChain.fromJSON(entry.chain);
+            this.#replica.set(entry.slot, { identity, chain });
+        }
+        catch {
+            // A record from an incompatible version, or a handle this context cannot
+            // adopt. Holding nothing lets the reader acquire again.
+        }
+    }
+    #toWire(slot, credential) {
+        return {
+            slot,
+            keyPair: credential.identity.getKeyPair(),
+            chain: credential.chain && JSON.stringify(credential.chain.toJSON()),
+        };
+    }
+    #post(message) {
+        try {
+            this.#channel?.postMessage(message);
+        }
+        catch {
+            // A closed channel, or a payload this browser will not clone. The write has
+            // already landed in this instance's own replica, so the cost is a peer
+            // missing it and minting for itself.
+        }
+    }
+}
+//# sourceMappingURL=shared-memory-credential-storage.js.map

package/dist/esm/client/shared-memory-credential-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-memory-credential-storage.js","sourceRoot":"","sources":["../../../src/client/shared-memory-credential-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG3E,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAiC3D,gFAAgF;AAChF,kFAAkF;AAClF,4EAA4E;AAC5E,kFAAkF;AAClF,6DAA6D;AAC7D,MAAM,SAAS,GAAG,CAAC,KAAc,EAAoB,EAAE;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,OAAO,GAAG,KAA6D,CAAC;IAC9E,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC1C,KAAK,KAAK;YACR,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,OAAO,CAAC;QAClE,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,6BAA6B;IACxB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,GAAG,KAAK,CAAC;IAEvB,KAAK,CAAS;IACd,QAAQ,CAA+B;IAEhD,2EAA2E;IAC3E,wEAAwE;IAC/D,QAAQ,GAAG,IAAI,GAAG,EAAwC,CAAC;IAEpE,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IACrE,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACnC,gBAAgB,CAA2B;IAE3C,cAAc,CAA2B;IAEzC,gFAAgF;IAChF,8EAA8E;IAC9E,gFAAgF;IAChF,iCAAiC;IACjC,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C;;;;;;;;OAQG;IACM,OAAO,CAAgB;IAEhC;;OAEG;IACH,YAAY,OAA2B;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,IAAI,IAAI,0BAA0B,CAAC;QACzD,IAAI,CAAC,QAAQ;YACX,OAAO,gBAAgB,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACI,KAAK;QACV,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAEM,MAAM;QACX,OAAO,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,IAAY;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC;QACnB,8EAA8E;QAC9E,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,IAAI,CAAC,SAAS,CAAC;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,UAAwC;QACrE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAY;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,GAAG,IAAI,CAAC,KAAK,UAAU,EAAE,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,0EAA0E;YAC1E,4EAA4E;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5B,6EAA6E;QAC7E,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CACjF,CAAC;QACF,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,KAAkB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,SAAS,CAAC;QAEtC,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;iBAC1B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACxB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC;iBACrE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,2EAA2E;QAC7E,CAAC;QAED,6EAA6E;QAC7E,sCAAsC;QACtC,KAAK,KAAK;aACP,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE;YACzC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAa;QACpB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO;QAE7B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,0EAA0E;YAC1E,0EAA0E;YAC1E,wBAAwB;YACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;gBACjB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAC/B,CAAC;gBACF,0EAA0E;gBAC1E,sEAAsE;gBACtE,qBAAqB;gBACrB,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YACvB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,OAAO;oBACV,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;wBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;oBACjF,uEAAuE;oBACvE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBACxB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;oBAChC,OAAO;gBACT,KAAK,KAAK;oBACR,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7C,OAAO;gBACT,KAAK,MAAM;oBACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChC,OAAO;YACX,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,IAAgC;QACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAqB,EAAE,EAAE,SAAS,EAA0B;QACvE,6EAA6E;QAC7E,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QAExD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,wDAAwD;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAY,EAAE,UAAwC;QAC5D,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE;YACzC,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAgB;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,uEAAuE;YACvE,qCAAqC;QACvC,CAAC;IACH,CAAC;CACF"}

package/dist/esm/client/slots.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Every name one client writes under, and the one thing that knows the whole set.
+ *
+ * Its own module rather than living beside the credential store or the state
+ * store, because it belongs to neither: the credentials and the state of a
+ * sign-in are named from one namespace, and a list that sat in either file would
+ * have to reach across to the other.
+ */
+/**
+ * The bare names, before a namespace is applied.
+ *
+ * One list, so a name cannot be added to some of the places that need it and
+ * missed in others. It was two lists and a hand-written mapping, and the state
+ * record was left out of the namespacing for exactly that reason.
+ */
+declare const SLOT_NAMES: {
+    /** The session's key and the chain issued to it. */
+    readonly session: "session";
+    /**
+     * Where a sign-in ceremony keeps its key until it returns.
+     *
+     * Its own name rather than {@link SLOT_NAMES.session}, so a ceremony that is
+     * cancelled or never comes back cannot take a working session with it.
+     */
+    readonly sessionPending: "session-pending";
+    /** The key an application signs with, and its delegation. */
+    readonly app: "app";
+    /**
+     * Where a ceremony keeps the credential it minted until its session is stored.
+     *
+     * The store reaches every tab of the origin, so writing to the app name during
+     * a ceremony — or clearing it first — would change what those tabs act with
+     * before the sign-in has succeeded. This is promoted instead, once there is a
+     * session behind it.
+     */
+    readonly appPending: "app-pending";
+    /**
+     * The record of who is signed in here and until when.
+     *
+     * Not a credential slot, and named here anyway: a namespace that moved the
+     * credentials and left this fixed would give two clients their own keys and one
+     * shared answer to who is signed in.
+     */
+    readonly state: "ic-session-state";
+};
+/** Every name a client writes under, with its namespace already applied. */
+export type Slots = Record<keyof typeof SLOT_NAMES, string>;
+/**
+ * The names one client writes under, prefixed where a namespace is set.
+ *
+ * Assigned in one place rather than defaulted by each store: implementations
+ * choosing their own is what produced three colliding slots in the arrangement
+ * this replaces, and one assigner cannot collide with itself. A namespace moves
+ * all of them at once, so an application running two clients under one origin
+ * separates them with one string rather than renaming some and missing others.
+ * @param namespace - Prefix for every name, or `undefined` for the bare ones.
+ */
+export declare function slotsFor(namespace?: string): Slots;
+export {};