@icp-sdk/auth 8.0.3 → 10.0.0

package/dist/esm/client/db.js

@@ -1,13 +1,9 @@
 import { openDB } from 'idb';
-import { DB_VERSION, KEY_STORAGE_DELEGATION, KEY_STORAGE_KEY } from './storage.js';
+// Increment when the shape of what is stored changes.
+export const DB_VERSION = 1;
 const AUTH_DB_NAME = 'auth-client-db';
 const OBJECT_STORE_NAME = 'ic-keyval';
-const _openDbStore = async (dbName = AUTH_DB_NAME, storeName = OBJECT_STORE_NAME, version) => {
-    // Clear legacy stored delegations
-    if (globalThis.localStorage?.getItem(KEY_STORAGE_DELEGATION)) {
-        globalThis.localStorage.removeItem(KEY_STORAGE_DELEGATION);
-        globalThis.localStorage.removeItem(KEY_STORAGE_KEY);
-    }
+const _openDbStore = async (dbName = AUTH_DB_NAME, storeName = OBJECT_STORE_NAME, version, onTerminated) => {
     return await openDB(dbName, version, {
         upgrade: (database) => {
             if (database.objectStoreNames.contains(storeName)) {
@@ -15,6 +11,7 @@ const _openDbStore = async (dbName = AUTH_DB_NAME, storeName = OBJECT_STORE_NAME
             }
             database.createObjectStore(storeName);
         },
+        terminated: onTerminated,
     });
 };
 async function _getValue(db, storeName, key) {
@@ -31,8 +28,9 @@ async function _removeValue(db, storeName, key) {
  * Defaults to `'auth-client-db'` with an object store of `'ic-keyval'`
  */
 export class IdbKeyVal {
-    _db;
+    _dbName;
     _storeName;
+    _version;
     /**
      * @param {DBCreateOptions} options - DBCreateOptions
      * @param {DBCreateOptions['dbName']} options.dbName name for the indexeddb database
@@ -43,13 +41,56 @@ export class IdbKeyVal {
      */
     static async create(options) {
         const { dbName = AUTH_DB_NAME, storeName = OBJECT_STORE_NAME, version = DB_VERSION, } = options ?? {};
-        const db = await _openDbStore(dbName, storeName, version);
-        return new IdbKeyVal(db, storeName);
+        const keyVal = new IdbKeyVal(dbName, storeName, version);
+        // Open eagerly so an unavailable database fails at creation time.
+        await keyVal._openDb();
+        return keyVal;
     }
+    _dbPromise = null;
     // Do not use - instead prefer create
-    constructor(_db, _storeName) {
-        this._db = _db;
+    constructor(_dbName, _storeName, _version) {
+        this._dbName = _dbName;
         this._storeName = _storeName;
+        this._version = _version;
+    }
+    // The browser can force-close the connection at any time; the `terminated`
+    // hook drops it so the next operation opens a fresh one.
+    _openDb() {
+        if (this._dbPromise === null) {
+            const promise = _openDbStore(this._dbName, this._storeName, this._version, () => {
+                if (this._dbPromise === promise) {
+                    this._dbPromise = null;
+                }
+            }).catch((error) => {
+                if (this._dbPromise === promise) {
+                    this._dbPromise = null;
+                }
+                throw error;
+            });
+            this._dbPromise = promise;
+        }
+        return this._dbPromise;
+    }
+    // Chrome can force-close a connection without firing `terminated`; the next
+    // transaction then throws an InvalidStateError. Drop the dead connection and
+    // retry once on a fresh one.
+    async _withDb(action) {
+        const promise = this._openDb();
+        const db = await promise;
+        try {
+            return await action(db);
+        }
+        catch (error) {
+            // Matched by name: a DOMException does not inherit from Error.
+            const name = error !== null && typeof error === 'object' && 'name' in error && error.name;
+            if (name !== 'InvalidStateError') {
+                throw error;
+            }
+            if (this._dbPromise === promise) {
+                this._dbPromise = null;
+            }
+            return await action(await this._openDb());
+        }
     }
     /**
      * Basic setter
@@ -58,7 +99,7 @@ export class IdbKeyVal {
      * @returns void
      */
     async set(key, value) {
-        return await _setValue(this._db, this._storeName, key, value);
+        return await this._withDb((db) => _setValue(db, this._storeName, key, value));
     }
     /**
      * Basic getter
@@ -69,7 +110,7 @@ export class IdbKeyVal {
      * await get<string>('exampleKey') -> 'exampleValue'
      */
     async get(key) {
-        return (await _getValue(this._db, this._storeName, key)) ?? null;
+        return await this._withDb(async (db) => (await _getValue(db, this._storeName, key)) ?? null);
     }
     /**
      * Remove a key
@@ -77,7 +118,7 @@ export class IdbKeyVal {
      * @returns void
      */
     async remove(key) {
-        return await _removeValue(this._db, this._storeName, key);
+        return await this._withDb((db) => _removeValue(db, this._storeName, key));
     }
 }
 //# sourceMappingURL=db.js.map

package/dist/esm/client/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/client/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,MAAM,EAAE,MAAM,KAAK,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAInF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC,MAAM,YAAY,GAAG,KAAK,EACxB,MAAM,GAAG,YAAY,EACrB,SAAS,GAAG,iBAAiB,EAC7B,OAAe,EACf,EAAE;IACF,kCAAkC;IAClC,IAAI,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7D,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC3D,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE;QACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YACpB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YACD,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,EAAY,EACZ,SAAiB,EACjB,GAAgB;IAEhB,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,EAAY,EACZ,SAAiB,EACjB,GAAgB,EAChB,KAAQ;IAER,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,SAAiB,EAAE,GAAgB;IAC3E,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAQD;;;GAGG;AACH,MAAM,OAAO,SAAS;IAqBV;IACA;IArBV;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAyB;QAClD,MAAM,EACJ,MAAM,GAAG,YAAY,EACrB,SAAS,GAAG,iBAAiB,EAC7B,OAAO,GAAG,UAAU,GACrB,GAAG,OAAO,IAAI,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,qCAAqC;IACrC,YACU,GAAa,EACb,UAAkB;QADlB,QAAG,GAAH,GAAG,CAAU;QACb,eAAU,GAAV,UAAU,CAAQ;IACzB,CAAC;IAEJ;;;;;OAKG;IACI,KAAK,CAAC,GAAG,CAAI,GAAgB,EAAE,KAAQ;QAC5C,OAAO,MAAM,SAAS,CAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IACD;;;;;;;OAOG;IACI,KAAK,CAAC,GAAG,CAAI,GAAgB;QAClC,OAAO,CAAC,MAAM,SAAS,CAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,GAAgB;QAClC,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;CACF"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/client/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,MAAM,EAAE,MAAM,KAAK,CAAC;AAEhD,sDAAsD;AACtD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAI5B,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC,MAAM,YAAY,GAAG,KAAK,EACxB,MAAM,GAAG,YAAY,EACrB,SAAS,GAAG,iBAAiB,EAC7B,OAAe,EACf,YAAyB,EACzB,EAAE;IACF,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE;QACnC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YACpB,IAAI,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;YACD,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QACD,UAAU,EAAE,YAAY;KACzB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,KAAK,UAAU,SAAS,CACtB,EAAY,EACZ,SAAiB,EACjB,GAAgB;IAEhB,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,EAAY,EACZ,SAAiB,EACjB,GAAgB,EAChB,KAAQ;IAER,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,SAAiB,EAAE,GAAgB;IAC3E,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAQD;;;GAGG;AACH,MAAM,OAAO,SAAS;IAyBV;IACA;IACA;IA1BV;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAyB;QAClD,MAAM,EACJ,MAAM,GAAG,YAAY,EACrB,SAAS,GAAG,iBAAiB,EAC7B,OAAO,GAAG,UAAU,GACrB,GAAG,OAAO,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACzD,kEAAkE;QAClE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,UAAU,GAA6B,IAAI,CAAC;IAEpD,qCAAqC;IACrC,YACU,OAAe,EACf,UAAkB,EAClB,QAAgB;QAFhB,YAAO,GAAP,OAAO,CAAQ;QACf,eAAU,GAAV,UAAU,CAAQ;QAClB,aAAQ,GAAR,QAAQ,CAAQ;IACvB,CAAC;IAEJ,2EAA2E;IAC3E,yDAAyD;IACjD,OAAO;QACb,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;gBAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjB,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,6BAA6B;IACrB,KAAK,CAAC,OAAO,CAAI,MAAoC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+DAA+D;YAC/D,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;YAC1F,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,GAAG,CAAI,GAAgB,EAAE,KAAQ;QAC5C,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAI,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;IACD;;;;;;;OAOG;IACI,KAAK,CAAC,GAAG,CAAI,GAAgB;QAClC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,SAAS,CAAI,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,GAAgB;QAClC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/dist/esm/client/foreground-refresh.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Calls back when the page is shown or the window regains focus.
+ *
+ * Its own module because it is the one part of the session machinery that needs a
+ * DOM. `AuthClient` runs outside a browser too, so nothing else may assume these
+ * APIs exist: where they do not, this and {@link watchActivity} return
+ * `undefined` and hook nothing.
+ *
+ * A backgrounded tab has its timers throttled, so a session's scheduled refresh
+ * may not run and its delegation lapses while nobody is looking. Coming back to
+ * the tab happens a second or two before the user's next click, which is room
+ * enough to mint in. Whether a mint is actually due is not decided here.
+ * @param onForeground - Invoked when the page becomes visible or regains focus.
+ * @returns A function that unhooks the listeners, or `undefined` where there is
+ *   no DOM to hook.
+ */
+export declare function watchForeground(onForeground: () => void): (() => void) | undefined;
+/**
+ * Calls back when somebody is using the page.
+ *
+ * A user moving a mouse is very likely about to do something that needs a
+ * delegation, so this is the same claim {@link watchForeground} makes — this
+ * page is in front of a person right now — from the other direction. Whether a
+ * mint is actually due is not decided here, and the identity's pre-mint
+ * threshold is what keeps a resting hand from costing more than one mint per
+ * refresh interval.
+ *
+ * It matters beyond saving the first request a mint: a session bounded by how
+ * long it goes unminted would otherwise end under a user who is reading rather
+ * than clicking.
+ * @param onActivity - Invoked on any sign of use.
+ * @returns A function that unhooks the listeners, or `undefined` where there is
+ *   no DOM to hook.
+ */
+export declare function watchActivity(onActivity: () => void): (() => void) | undefined;

package/dist/esm/client/foreground-refresh.js

@@ -0,0 +1,83 @@
+/**
+ * Calls back when the page is shown or the window regains focus.
+ *
+ * Its own module because it is the one part of the session machinery that needs a
+ * DOM. `AuthClient` runs outside a browser too, so nothing else may assume these
+ * APIs exist: where they do not, this and {@link watchActivity} return
+ * `undefined` and hook nothing.
+ *
+ * A backgrounded tab has its timers throttled, so a session's scheduled refresh
+ * may not run and its delegation lapses while nobody is looking. Coming back to
+ * the tab happens a second or two before the user's next click, which is room
+ * enough to mint in. Whether a mint is actually due is not decided here.
+ * @param onForeground - Invoked when the page becomes visible or regains focus.
+ * @returns A function that unhooks the listeners, or `undefined` where there is
+ *   no DOM to hook.
+ */
+export function watchForeground(onForeground) {
+    // Every API this hooks, checked one at a time: a partial DOM polyfill can
+    // define `document` without the event methods, and throwing there would
+    // contradict the promise that this hooks nothing where there is no DOM.
+    if (typeof document === 'undefined' ||
+        typeof document.addEventListener !== 'function' ||
+        typeof document.removeEventListener !== 'function' ||
+        typeof globalThis.addEventListener !== 'function' ||
+        typeof globalThis.removeEventListener !== 'function') {
+        return undefined;
+    }
+    const onVisible = () => {
+        if (document.visibilityState === 'visible')
+            onForeground();
+    };
+    document.addEventListener('visibilitychange', onVisible);
+    // `focus` catches two visible windows side by side, where moving between them
+    // is not a visibility change. `pageshow` catches a page restored from the
+    // back-forward cache, which resumes with timers that never ran.
+    globalThis.addEventListener('focus', onForeground);
+    globalThis.addEventListener('pageshow', onForeground);
+    return () => {
+        document.removeEventListener('visibilitychange', onVisible);
+        globalThis.removeEventListener('focus', onForeground);
+        globalThis.removeEventListener('pageshow', onForeground);
+    };
+}
+// `pointerdown` covers a mouse, a finger and a pen in one, which is the only
+// press event a phone reliably produces. The list the retired idle timer
+// listened to, put to the opposite use: it ended a session on their absence,
+// and they now keep one alive by their presence.
+const ACTIVITY_EVENTS = ['pointerdown', 'mousedown', 'mousemove', 'keydown', 'touchstart', 'wheel'];
+/**
+ * Calls back when somebody is using the page.
+ *
+ * A user moving a mouse is very likely about to do something that needs a
+ * delegation, so this is the same claim {@link watchForeground} makes — this
+ * page is in front of a person right now — from the other direction. Whether a
+ * mint is actually due is not decided here, and the identity's pre-mint
+ * threshold is what keeps a resting hand from costing more than one mint per
+ * refresh interval.
+ *
+ * It matters beyond saving the first request a mint: a session bounded by how
+ * long it goes unminted would otherwise end under a user who is reading rather
+ * than clicking.
+ * @param onActivity - Invoked on any sign of use.
+ * @returns A function that unhooks the listeners, or `undefined` where there is
+ *   no DOM to hook.
+ */
+export function watchActivity(onActivity) {
+    if (typeof document === 'undefined' ||
+        typeof document.addEventListener !== 'function' ||
+        typeof document.removeEventListener !== 'function') {
+        return undefined;
+    }
+    // Passive: these never call `preventDefault`, and saying so keeps a listener on
+    // `mousemove` and `wheel` off the path that decides whether a scroll may start.
+    for (const event of ACTIVITY_EVENTS) {
+        document.addEventListener(event, onActivity, { passive: true });
+    }
+    return () => {
+        for (const event of ACTIVITY_EVENTS) {
+            document.removeEventListener(event, onActivity);
+        }
+    };
+}
+//# sourceMappingURL=foreground-refresh.js.map

package/dist/esm/client/foreground-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreground-refresh.js","sourceRoot":"","sources":["../../../src/client/foreground-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,YAAwB;IACtD,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,IACE,OAAO,QAAQ,KAAK,WAAW;QAC/B,OAAO,QAAQ,CAAC,gBAAgB,KAAK,UAAU;QAC/C,OAAO,QAAQ,CAAC,mBAAmB,KAAK,UAAU;QAClD,OAAO,UAAU,CAAC,gBAAgB,KAAK,UAAU;QACjD,OAAO,UAAU,CAAC,mBAAmB,KAAK,UAAU,EACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;YAAE,YAAY,EAAE,CAAC;IAC7D,CAAC,CAAC;IAEF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IACzD,8EAA8E;IAC9E,0EAA0E;IAC1E,gEAAgE;IAChE,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEtD,OAAO,GAAG,EAAE;QACV,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC5D,UAAU,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACtD,UAAU,CAAC,mBAAmB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,iDAAiD;AACjD,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,UAAsB;IAClD,IACE,OAAO,QAAQ,KAAK,WAAW;QAC/B,OAAO,QAAQ,CAAC,gBAAgB,KAAK,UAAU;QAC/C,OAAO,QAAQ,CAAC,mBAAmB,KAAK,UAAU,EAClD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/client/idb-credential-storage.d.ts

@@ -0,0 +1,25 @@
+import { ECDSAKeyIdentity } from '@icp-sdk/core/identity';
+import type { Credential, CredentialStorage } from './credential-storage.js';
+import { type DBCreateOptions } from './db.js';
+/**
+ * Credentials in IndexedDB, which is what a browser offers that can hold a key
+ * whose private half is unreadable.
+ *
+ * A non-extractable `CryptoKeyPair` survives a structured clone, so what another
+ * tab reads is a handle that signs and cannot be exported — no key material is
+ * written anywhere.
+ * @see implements {@link CredentialStorage}
+ */
+export declare class IdbCredentialStorage implements CredentialStorage<ECDSAKeyIdentity> {
+    #private;
+    readonly shared = true;
+    readonly durable = true;
+    /**
+     * @param options - Database name, store name and version.
+     */
+    constructor(options?: DBCreateOptions);
+    create(): Promise<ECDSAKeyIdentity>;
+    get(slot: string): Promise<Credential<ECDSAKeyIdentity> | null>;
+    set(slot: string, credential: Credential<ECDSAKeyIdentity>): Promise<void>;
+    remove(slot: string): Promise<void>;
+}

package/dist/esm/client/idb-credential-storage.js

@@ -0,0 +1,69 @@
+import { DelegationChain, ECDSAKeyIdentity } from '@icp-sdk/core/identity';
+import { IdbKeyVal } from './db.js';
+/**
+ * Credentials in IndexedDB, which is what a browser offers that can hold a key
+ * whose private half is unreadable.
+ *
+ * A non-extractable `CryptoKeyPair` survives a structured clone, so what another
+ * tab reads is a handle that signs and cannot be exported — no key material is
+ * written anywhere.
+ * @see implements {@link CredentialStorage}
+ */
+export class IdbCredentialStorage {
+    shared = true;
+    durable = true;
+    #options;
+    /**
+     * @param options - Database name, store name and version.
+     */
+    constructor(options) {
+        this.#options = options ?? {};
+    }
+    // Opened on first use, and forgotten again if opening failed, so a later call
+    // retries rather than reusing a rejected promise.
+    #dbPromise = null;
+    get #db() {
+        if (this.#dbPromise === null) {
+            const promise = IdbKeyVal.create(this.#options).catch((error) => {
+                if (this.#dbPromise === promise) {
+                    this.#dbPromise = null;
+                }
+                throw error;
+            });
+            this.#dbPromise = promise;
+        }
+        return this.#dbPromise;
+    }
+    create() {
+        return ECDSAKeyIdentity.generate({ extractable: false });
+    }
+    async get(slot) {
+        const db = await this.#db;
+        const stored = await db.get(slot);
+        if (!stored)
+            return null;
+        try {
+            const identity = await ECDSAKeyIdentity.fromKeyPair(stored.keyPair);
+            const chain = stored.chain === undefined ? undefined : DelegationChain.fromJSON(stored.chain);
+            return { identity, chain };
+        }
+        catch {
+            // A record written by an incompatible version, or one the browser has
+            // truncated. Reporting nothing lets the caller acquire again, which is
+            // safer than throwing on a page load.
+            return null;
+        }
+    }
+    async set(slot, credential) {
+        const db = await this.#db;
+        await db.set(slot, {
+            keyPair: credential.identity.getKeyPair(),
+            chain: credential.chain && JSON.stringify(credential.chain.toJSON()),
+        });
+    }
+    async remove(slot) {
+        const db = await this.#db;
+        await db.remove(slot);
+    }
+}
+//# sourceMappingURL=idb-credential-storage.js.map

package/dist/esm/client/idb-credential-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idb-credential-storage.js","sourceRoot":"","sources":["../../../src/client/idb-credential-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,EAAwB,SAAS,EAAE,MAAM,SAAS,CAAC;AAQ1D;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACf,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,GAAG,IAAI,CAAC;IAE/B,QAAQ,CAAkB;IAE1B;;OAEG;IACH,YAAY,OAAyB;QACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,UAAU,GAA8B,IAAI,CAAC;IAC7C,IAAI,GAAG;QACL,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACzB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEM,MAAM;QACX,OAAO,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,IAAY;QAC3B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAmB,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9F,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,uEAAuE;YACvE,sCAAsC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,UAAwC;QACrE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAC1B,MAAM,EAAE,CAAC,GAAG,CAAmB,IAAI,EAAE;YACnC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE;YACzC,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAY;QAC9B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/esm/client/index.d.ts

@@ -1,7 +1,18 @@
 /**
  * @module api/client
  */
+export { type AppDelegationSource, SessionGoneError } from './app-delegation-source.js';
 export * from './auth-client.js';
-export { type DBCreateOptions, IdbKeyVal } from './db.js';
-export * from './idle-manager.js';
-export { type AuthClientStorage, IdbStorage, KEY_STORAGE_DELEGATION, KEY_STORAGE_KEY, LocalStorage, } from './storage.js';
+export { CookieStateStorage, type CookieStateStorageOptions, } from './cookie-state-storage.js';
+export type { Credential, CredentialStorage } from './credential-storage.js';
+export { DB_VERSION, type DBCreateOptions, IdbKeyVal } from './db.js';
+export { watchActivity, watchForeground } from './foreground-refresh.js';
+export { IdbCredentialStorage } from './idb-credential-storage.js';
+export { LocalCredentialStorage } from './local-credential-storage.js';
+export { MemoryCredentialStorage } from './memory-credential-storage.js';
+export { InteractionRequiredError, requestSessionDelegation } from './session-delegation.js';
+export { SessionIdentity, type SessionIdentityOptions } from './session-identity.js';
+export { SessionMinter, type SessionMinterOptions } from './session-minter.js';
+export { DEFAULT_SHARED_MEMORY_NAME, SharedMemoryCredentialStorage, } from './shared-memory-credential-storage.js';
+export { isValidSsoDomain } from './sso.js';
+export { LocalStateStorage, MemoryStateStorage, type SessionState, type StateStorage, } from './state-storage.js';

package/dist/esm/client/index.js

@@ -1,8 +1,18 @@
 /**
  * @module api/client
  */
+export { SessionGoneError } from './app-delegation-source.js';
 export * from './auth-client.js';
-export { IdbKeyVal } from './db.js';
-export * from './idle-manager.js';
-export { IdbStorage, KEY_STORAGE_DELEGATION, KEY_STORAGE_KEY, LocalStorage, } from './storage.js';
+export { CookieStateStorage, } from './cookie-state-storage.js';
+export { DB_VERSION, IdbKeyVal } from './db.js';
+export { watchActivity, watchForeground } from './foreground-refresh.js';
+export { IdbCredentialStorage } from './idb-credential-storage.js';
+export { LocalCredentialStorage } from './local-credential-storage.js';
+export { MemoryCredentialStorage } from './memory-credential-storage.js';
+export { InteractionRequiredError, requestSessionDelegation } from './session-delegation.js';
+export { SessionIdentity } from './session-identity.js';
+export { SessionMinter } from './session-minter.js';
+export { DEFAULT_SHARED_MEMORY_NAME, SharedMemoryCredentialStorage, } from './shared-memory-credential-storage.js';
+export { isValidSsoDomain } from './sso.js';
+export { LocalStateStorage, MemoryStateStorage, } from './state-storage.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAwB,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1D,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAEL,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAA4B,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACxF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EACL,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAwB,SAAS,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,aAAa,EAA6B,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}

package/dist/esm/client/local-credential-storage.d.ts

@@ -0,0 +1,26 @@
+import { Ed25519KeyIdentity } from '@icp-sdk/core/identity';
+import type { Credential, CredentialStorage } from './credential-storage.js';
+/**
+ * Credentials in `localStorage`, for where IndexedDB is unavailable.
+ *
+ * `localStorage` holds strings, so the key has to be one: this generates an
+ * Ed25519 identity, whose private bytes serialise, rather than the
+ * non-extractable key {@link IdbCredentialStorage} uses. That is the trade the
+ * medium imposes, and it is why generation belongs to the store.
+ * @see implements {@link CredentialStorage}
+ */
+export declare class LocalCredentialStorage implements CredentialStorage<Ed25519KeyIdentity> {
+    #private;
+    readonly prefix: string;
+    readonly shared = true;
+    readonly durable = true;
+    /**
+     * @param prefix - Prepended to every slot, so two clients under one origin can
+     *   be kept apart.
+     */
+    constructor(prefix?: string);
+    create(): Promise<Ed25519KeyIdentity>;
+    get(slot: string): Promise<Credential<Ed25519KeyIdentity> | null>;
+    set(slot: string, credential: Credential<Ed25519KeyIdentity>): Promise<void>;
+    remove(slot: string): Promise<void>;
+}

package/dist/esm/client/local-credential-storage.js

@@ -0,0 +1,59 @@
+import { DelegationChain, Ed25519KeyIdentity } from '@icp-sdk/core/identity';
+/**
+ * Credentials in `localStorage`, for where IndexedDB is unavailable.
+ *
+ * `localStorage` holds strings, so the key has to be one: this generates an
+ * Ed25519 identity, whose private bytes serialise, rather than the
+ * non-extractable key {@link IdbCredentialStorage} uses. That is the trade the
+ * medium imposes, and it is why generation belongs to the store.
+ * @see implements {@link CredentialStorage}
+ */
+export class LocalCredentialStorage {
+    prefix;
+    shared = true;
+    durable = true;
+    /**
+     * @param prefix - Prepended to every slot, so two clients under one origin can
+     *   be kept apart.
+     */
+    constructor(prefix = 'ic-') {
+        this.prefix = prefix;
+    }
+    create() {
+        return Promise.resolve(Ed25519KeyIdentity.generate());
+    }
+    get(slot) {
+        const raw = this.#localStorage().getItem(this.prefix + slot);
+        if (raw === null)
+            return Promise.resolve(null);
+        try {
+            const stored = JSON.parse(raw);
+            const identity = Ed25519KeyIdentity.fromJSON(stored.key);
+            const chain = stored.chain === undefined ? undefined : DelegationChain.fromJSON(stored.chain);
+            return Promise.resolve({ identity, chain });
+        }
+        catch {
+            return Promise.resolve(null);
+        }
+    }
+    set(slot, credential) {
+        const stored = {
+            key: JSON.stringify(credential.identity.toJSON()),
+            chain: credential.chain && JSON.stringify(credential.chain.toJSON()),
+        };
+        this.#localStorage().setItem(this.prefix + slot, JSON.stringify(stored));
+        return Promise.resolve();
+    }
+    remove(slot) {
+        this.#localStorage().removeItem(this.prefix + slot);
+        return Promise.resolve();
+    }
+    #localStorage() {
+        const ls = globalThis.localStorage;
+        if (!ls) {
+            throw new Error('Could not find local storage.');
+        }
+        return ls;
+    }
+}
+//# sourceMappingURL=local-credential-storage.js.map

package/dist/esm/client/local-credential-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-credential-storage.js","sourceRoot":"","sources":["../../../src/client/local-credential-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAS7E;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAQL;IAPZ,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,GAAG,IAAI,CAAC;IAE/B;;;OAGG;IACH,YAA4B,SAAS,KAAK;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAEvC,MAAM;QACX,OAAO,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAEM,GAAG,CAAC,IAAY;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAC7D,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;YACnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9F,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEM,GAAG,CAAC,IAAY,EAAE,UAA0C;QACjE,MAAM,MAAM,GAAqB;YAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEM,MAAM,CAAC,IAAY;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC;QACnC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/esm/client/memory-credential-storage.d.ts

@@ -0,0 +1,22 @@
+import { ECDSAKeyIdentity } from '@icp-sdk/core/identity';
+import type { Credential, CredentialStorage } from './credential-storage.js';
+/**
+ * Credentials held for the lifetime of the instance and shared with nothing.
+ *
+ * For tests and for environments with neither IndexedDB nor `localStorage`. A
+ * reload starts from nothing, and other tabs see nothing, so every tab of an
+ * origin is alone.
+ *
+ * Records are handed back as they were given rather than round-tripped through
+ * an encoding, which is what lets this hold a non-extractable key at all.
+ * @see implements {@link CredentialStorage}
+ */
+export declare class MemoryCredentialStorage implements CredentialStorage<ECDSAKeyIdentity> {
+    #private;
+    readonly shared = false;
+    readonly durable = false;
+    create(): Promise<ECDSAKeyIdentity>;
+    get(slot: string): Promise<Credential<ECDSAKeyIdentity> | null>;
+    set(slot: string, credential: Credential<ECDSAKeyIdentity>): Promise<void>;
+    remove(slot: string): Promise<void>;
+}

package/dist/esm/client/memory-credential-storage.js

@@ -0,0 +1,35 @@
+import { ECDSAKeyIdentity } from '@icp-sdk/core/identity';
+/**
+ * Credentials held for the lifetime of the instance and shared with nothing.
+ *
+ * For tests and for environments with neither IndexedDB nor `localStorage`. A
+ * reload starts from nothing, and other tabs see nothing, so every tab of an
+ * origin is alone.
+ *
+ * Records are handed back as they were given rather than round-tripped through
+ * an encoding, which is what lets this hold a non-extractable key at all.
+ * @see implements {@link CredentialStorage}
+ */
+export class MemoryCredentialStorage {
+    shared = false;
+    durable = false;
+    // On the instance and never on the module: two clients on one page must not
+    // see each other's slots, and no state may carry between tests in one process.
+    #credentials = new Map();
+    create() {
+        // Nothing is serialised here, so the key never has to be readable.
+        return ECDSAKeyIdentity.generate({ extractable: false });
+    }
+    get(slot) {
+        return Promise.resolve(this.#credentials.get(slot) ?? null);
+    }
+    set(slot, credential) {
+        this.#credentials.set(slot, credential);
+        return Promise.resolve();
+    }
+    remove(slot) {
+        this.#credentials.delete(slot);
+        return Promise.resolve();
+    }
+}
+//# sourceMappingURL=memory-credential-storage.js.map

package/dist/esm/client/memory-credential-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-credential-storage.js","sourceRoot":"","sources":["../../../src/client/memory-credential-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,uBAAuB;IAClB,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,GAAG,KAAK,CAAC;IAEhC,4EAA4E;IAC5E,+EAA+E;IAC/E,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;IAExD,MAAM;QACX,mEAAmE;QACnE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEM,GAAG,CAAC,IAAY;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC9D,CAAC;IAEM,GAAG,CAAC,IAAY,EAAE,UAAwC;QAC/D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEM,MAAM,CAAC,IAAY;QACxB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/esm/client/session-delegation.d.ts

@@ -0,0 +1,40 @@
+import type { DerEncodedPublicKey } from '@icp-sdk/core/agent';
+import { DelegationChain } from '@icp-sdk/core/identity';
+import type { Signer } from '@icp-sdk/signer';
+/**
+ * Internet Identity had nothing to answer a silent request from.
+ *
+ * The one denial that is not a failure: it says a ceremony is needed, so the
+ * caller signs in interactively rather than retrying. It is also the only
+ * dependable evidence that a shared record is stale rather than replaced, which
+ * is what lets an origin retract a record it did not write.
+ *
+ * Thrown only for a request that asked not to render anything. An interactive
+ * sign-in that the user abandons is a different outcome and is not this.
+ */
+export declare class InteractionRequiredError extends Error {
+    /**
+     * Why, where Internet Identity said: `login_required` where it holds no
+     * session, `account_selection_required` where it holds more than one and the
+     * request named none.
+     *
+     * A caller may word its prompt from this and does not have to branch on it, so
+     * it is deliberately a string rather than a union — a value this library does
+     * not know is not a reason to fail.
+     */
+    readonly reason: string | undefined;
+    constructor(message: string, reason?: string);
+}
+/**
+ * Asks the identity provider for a session, and returns the chain it signed.
+ *
+ * The chain is restricted to the Internet Identity canister, so it is not
+ * something an application can call its own canisters with. It is what app
+ * delegations are minted from.
+ */
+export declare function requestSessionDelegation(signer: Signer, params: {
+    sessionPublicKey: DerEncodedPublicKey;
+    maxTimeToLive?: bigint;
+    maxTimeToIdle?: bigint;
+    derivationOrigin?: string;
+}): Promise<DelegationChain>;