@mediaviz/sdk 1.9.0-dev.106 → 1.9.0-dev.117

package/dist/sdk.cjs

@@ -4,36 +4,181 @@ function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
 
-var pkce;
-var hasRequiredPkce;
+var base64;
+var hasRequiredBase64;
 
-function requirePkce () {
-	if (hasRequiredPkce) return pkce;
-	hasRequiredPkce = 1;
+function requireBase64 () {
+	if (hasRequiredBase64) return base64;
+	hasRequiredBase64 = 1;
 
-	// base64url-encode a Uint8Array without padding
+	// Base64URL codec, used by PKCE (encode) and JWT payload decoding (decode).
+	// Hand-rolled rather than delegating to atob/btoa, Buffer, or TextDecoder:
+	// none of those is present on every target runtime — React Native's Hermes has
+	// no Buffer and does not guarantee atob — and the alphabet here is URL-safe and
+	// unpadded, which the standard helpers do not produce.
+
+	const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+	/**
+	 * @param {Uint8Array} bytes
+	 * @returns {string} unpadded base64url
+	 */
 	function base64urlEncode(bytes) {
-	  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
 	  let result = '';
 	  for (let i = 0; i < bytes.length; i += 3) {
 	    const b0 = bytes[i];
 	    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
 	    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
-	    result += chars[b0 >> 2];
-	    result += chars[((b0 & 3) << 4) | (b1 >> 4)];
-	    if (i + 1 < bytes.length) result += chars[((b1 & 0xf) << 2) | (b2 >> 6)];
-	    if (i + 2 < bytes.length) result += chars[b2 & 0x3f];
+	    result += ALPHABET[b0 >> 2];
+	    result += ALPHABET[((b0 & 3) << 4) | (b1 >> 4)];
+	    if (i + 1 < bytes.length) result += ALPHABET[((b1 & 0xf) << 2) | (b2 >> 6)];
+	    if (i + 2 < bytes.length) result += ALPHABET[b2 & 0x3f];
 	  }
 	  return result;
 	}
 
+	/**
+	 * Decodes base64url or standard base64, padded or not.
+	 * @param {string} str
+	 * @returns {Uint8Array}
+	 */
+	function base64urlDecode(str) {
+	  const clean = String(str).replace(/=+$/, '');
+	  const out = new Uint8Array((clean.length * 3) >> 2);
+	  let acc = 0;
+	  let bits = 0;
+	  let i = 0;
+	  for (const ch of clean) {
+	    const value = decodeChar(ch);
+	    if (value < 0) throw new TypeError(`Invalid base64url character: ${JSON.stringify(ch)}`);
+	    acc = (acc << 6) | value;
+	    bits += 6;
+	    if (bits >= 8) {
+	      bits -= 8;
+	      out[i++] = (acc >> bits) & 0xff;
+	    }
+	  }
+	  return out.subarray(0, i);
+	}
+
+	/**
+	 * @param {Uint8Array} bytes
+	 * @returns {string}
+	 */
+	function utf8Decode(bytes) {
+	  let out = '';
+	  let i = 0;
+	  while (i < bytes.length) {
+	    const b0 = bytes[i++];
+	    let codePoint;
+	    if (b0 < 0x80) codePoint = b0;
+	    else if ((b0 & 0xe0) === 0xc0) codePoint = ((b0 & 0x1f) << 6) | (bytes[i++] & 0x3f);
+	    else if ((b0 & 0xf0) === 0xe0)
+	      codePoint = ((b0 & 0x0f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f);
+	    else
+	      codePoint =
+	        ((b0 & 0x07) << 18) | ((bytes[i++] & 0x3f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f);
+	    out += String.fromCodePoint(codePoint);
+	  }
+	  return out;
+	}
+
+	// helpers
+	function decodeChar(ch) {
+	  // '+' and '/' map onto the URL-safe alphabet's '-' and '_' slots, so standard
+	  // base64 decodes through the same table.
+	  if (ch === '+') return 62;
+	  if (ch === '/') return 63;
+	  return ALPHABET.indexOf(ch);
+	}
+
+	base64 = { base64urlEncode, base64urlDecode, utf8Decode };
+	return base64;
+}
+
+var crypto;
+var hasRequiredCrypto;
+
+function requireCrypto () {
+	if (hasRequiredCrypto) return crypto;
+	hasRequiredCrypto = 1;
+
+	// Crypto seam for PKCE.
+	//
+	// Defaults to WebCrypto, which covers browsers and Node >= 18. React Native's
+	// Hermes runtime provides neither half of what PKCE needs: there is no
+	// SubtleCrypto at all (so no SHA-256), and no crypto.getRandomValues without a
+	// polyfill. Hosts on such runtimes call configureCrypto() once at startup with
+	// native-backed equivalents (expo-crypto, react-native-quick-crypto).
+
+	/** @typedef {{getRandomValues: (bytes: Uint8Array) => Uint8Array, sha256: (bytes: Uint8Array) => Promise<Uint8Array>}} CryptoProvider */
+
+	let _provider = null;
+
+	/**
+	 * Installs a crypto provider, replacing the WebCrypto default.
+	 * @param {CryptoProvider} provider
+	 */
+	function configureCrypto(provider) {
+	  if (!provider || typeof provider.getRandomValues !== 'function' || typeof provider.sha256 !== 'function') {
+	    throw new TypeError(
+	      'configureCrypto requires { getRandomValues(bytes) => bytes, sha256(bytes) => Promise<Uint8Array> }'
+	    );
+	  }
+	  _provider = provider;
+	}
+
+	/** Restores the WebCrypto default. Primarily for tests. */
+	function resetCrypto() {
+	  _provider = null;
+	}
+
+	/**
+	 * @returns {CryptoProvider}
+	 */
+	function getCrypto() {
+	  return _provider ?? webCryptoProvider();
+	}
+
+	// helpers
+	function webCryptoProvider() {
+	  const wc = globalThis.crypto;
+	  // Named explicitly rather than letting a property access blow up deep inside
+	  // PKCE: on React Native the failure is a missing polyfill, and the message
+	  // has to say so.
+	  if (!wc || typeof wc.getRandomValues !== 'function' || !wc.subtle) {
+	    throw new Error(
+	      'No WebCrypto available in this runtime. On React Native (or any host without ' +
+	        'SubtleCrypto), call configureCrypto({ getRandomValues, sha256 }) before using PKCE.'
+	    );
+	  }
+	  return {
+	    getRandomValues: (bytes) => wc.getRandomValues(bytes),
+	    sha256: async (bytes) => new Uint8Array(await wc.subtle.digest('SHA-256', bytes)),
+	  };
+	}
+
+	crypto = { configureCrypto, resetCrypto, getCrypto };
+	return crypto;
+}
+
+var pkce;
+var hasRequiredPkce;
+
+function requirePkce () {
+	if (hasRequiredPkce) return pkce;
+	hasRequiredPkce = 1;
+
+	const { base64urlEncode } = requireBase64();
+	const { getCrypto } = requireCrypto();
+
 	/**
 	 * Generates a 64-character PKCE code verifier from [A-Za-z0-9-._~].
 	 * @returns {string}
 	 */
 	function generateCodeVerifier() {
 	  const bytes = new Uint8Array(48);
-	  globalThis.crypto.getRandomValues(bytes);
+	  getCrypto().getRandomValues(bytes);
 	  return base64urlEncode(bytes).slice(0, 64);
 	}
 
@@ -43,9 +188,8 @@ function requirePkce () {
 	 * @returns {Promise<string>}
 	 */
 	async function generateCodeChallenge(verifier) {
-	  const encoded = new TextEncoder().encode(verifier);
-	  const hashBuf = await globalThis.crypto.subtle.digest('SHA-256', encoded);
-	  return base64urlEncode(new Uint8Array(hashBuf));
+	  const hash = await getCrypto().sha256(asciiEncode(verifier));
+	  return base64urlEncode(hash);
 	}
 
 	/**
@@ -54,8 +198,24 @@ function requirePkce () {
 	 */
 	function generateState() {
 	  const bytes = new Uint8Array(16);
-	  globalThis.crypto.getRandomValues(bytes);
-	  return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
+	  getCrypto().getRandomValues(bytes);
+	  return Array.from(bytes).map((b) => b.toString(16).padStart(2, '0')).join('');
+	}
+
+	// helpers
+
+	// The RFC 7636 §4.1 verifier alphabet is ASCII-only, so a byte-per-char encode
+	// is exact and keeps TextEncoder — absent on some React Native versions — off
+	// the PKCE path entirely. A non-ASCII verifier is invalid input, not something
+	// to silently re-encode.
+	function asciiEncode(str) {
+	  const out = new Uint8Array(str.length);
+	  for (let i = 0; i < str.length; i++) {
+	    const code = str.charCodeAt(i);
+	    if (code > 0x7f) throw new TypeError('PKCE code_verifier must be ASCII (RFC 7636 §4.1)');
+	    out[i] = code;
+	  }
+	  return out;
 	}
 
 	pkce = { generateCodeVerifier, generateCodeChallenge, generateState };
@@ -178,6 +338,7 @@ function requireClient () {
 
 	const { generateCodeVerifier, generateCodeChallenge, generateState } = requirePkce();
 	const { postForm, postJson } = requireHttp();
+	const { base64urlDecode, utf8Decode } = requireBase64();
 	const { OAuthError } = requireErrors();
 
 	// In-flight dedup key for client_credentials re-mints (no refresh_token to key on).
@@ -253,8 +414,7 @@ function requireClient () {
 	      code,
 	      code_verifier: codeVerifier,
 	      redirect_uri: redirectUri ?? this._config.redirectUri,
-	      client_id: this._config.clientId,
-	      client_secret: this._config.clientSecret,
+	      ...this._clientAuth(),
 	    });
 	  }
 
@@ -266,8 +426,7 @@ function requireClient () {
 	  async getClientCredentialsToken() {
 	    return postForm(`${this._config.baseUrl}/oauth/token`, {
 	      grant_type: 'client_credentials',
-	      client_id: this._config.clientId,
-	      client_secret: this._config.clientSecret,
+	      ...this._clientAuth(),
 	    });
 	  }
 
@@ -279,8 +438,7 @@ function requireClient () {
 	    return postForm(`${this._config.baseUrl}/oauth/token`, {
 	      grant_type: 'refresh_token',
 	      refresh_token: refreshToken,
-	      client_id: this._config.clientId,
-	      client_secret: this._config.clientSecret,
+	      ...this._clientAuth(),
 	    });
 	  }
 
@@ -290,7 +448,7 @@ function requireClient () {
 	   * @returns {Promise<void>}
 	   */
 	  async revokeToken(token, tokenTypeHint) {
-	    const params = { token, client_id: this._config.clientId, client_secret: this._config.clientSecret };
+	    const params = { token, ...this._clientAuth() };
 	    if (tokenTypeHint) params.token_type_hint = tokenTypeHint;
 	    await postForm(`${this._config.baseUrl}/oauth/revoke`, params);
 	  }
@@ -371,10 +529,22 @@ function requireClient () {
 	  decodeAccessToken(accessToken) {
 	    const segment = accessToken.split('.')[1];
 	    if (!segment) throw new OAuthError('invalid_token', 'Malformed JWT', 400);
-	    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(segment.length / 4) * 4, '=');
-	    const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
-	    const payload = JSON.parse(new TextDecoder().decode(bytes));
-	    return payload;
+	    return JSON.parse(utf8Decode(base64urlDecode(segment)));
+	  }
+
+	  /**
+	   * Client-authentication params for a token-endpoint request.
+	   *
+	   * A public client (mobile, SPA) holds no secret, and the authorization server
+	   * rejects the request outright if one is present, so the key is omitted
+	   * entirely rather than sent empty. Passing it through unconditionally
+	   * serializes `undefined` into the form body as that literal string.
+	   * @returns {Record<string, string>}
+	   */
+	  _clientAuth() {
+	    const params = { client_id: this._config.clientId };
+	    if (this._config.clientSecret) params.client_secret = this._config.clientSecret;
+	    return params;
 	  }
 	}
 
@@ -471,8 +641,9 @@ function requireSrc$1 () {
 	const { OAuthClient } = requireClient();
 	const { OAuthError } = requireErrors();
 	const { OAuthErrorCode } = requireTypes();
+	const { configureCrypto } = requireCrypto();
 
-	src$1 = { OAuthClient, OAuthError, OAuthErrorCode };
+	src$1 = { OAuthClient, OAuthError, OAuthErrorCode, configureCrypto };
 	return src$1;
 }
 
@@ -480,7 +651,7 @@ var srcExports$1 = requireSrc$1();
 var _oauth = /*@__PURE__*/getDefaultExportFromCjs(srcExports$1);
 
 // Auto-generated — do not edit
-const { OAuthClient, OAuthError, OAuthErrorCode } = _oauth;
+const { OAuthClient, OAuthError, OAuthErrorCode, configureCrypto } = _oauth;
 
 var signing;
 var hasRequiredSigning;
@@ -497,12 +668,21 @@ function requireSigning () {
 	// constant time. Web Crypto only, so the same code runs in Node >= 18 and
 	// browsers.
 
-	const _encoder = new TextEncoder();
+	// Built on first use, not at import. These functions are a server-side concern
+	// (only the endpoint receiving a push verifies a signature), but the module is
+	// bundled into every SDK including React Native — and constructing this at
+	// module scope made merely importing the SDK crash on any runtime without a
+	// TextEncoder global.
+	let _encoderInstance = null;
+	function _encode(text) {
+	  if (!_encoderInstance) _encoderInstance = new TextEncoder();
+	  return _encoderInstance.encode(text);
+	}
 
 	async function signWebhookPayload(secret, timestamp, rawBody) {
 	  const key = await globalThis.crypto.subtle.importKey(
-	    'raw', _encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-	  const payload = _concat(_encoder.encode(`${timestamp}.`), toBytes(rawBody));
+	    'raw', _encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+	  const payload = _concat(_encode(`${timestamp}.`), toBytes(rawBody));
 	  const digest = await globalThis.crypto.subtle.sign('HMAC', key, payload);
 	  return 'sha256=' + _hex(new Uint8Array(digest));
 	}
@@ -526,7 +706,7 @@ function requireSigning () {
 
 	// helpers
 	function toBytes(rawBody) {
-	  if (typeof rawBody === 'string') return _encoder.encode(rawBody);
+	  if (typeof rawBody === 'string') return _encode(rawBody);
 	  if (rawBody instanceof Uint8Array) return rawBody;
 	  if (rawBody instanceof ArrayBuffer) return new Uint8Array(rawBody);
 	  throw new TypeError('rawBody must be a string, Uint8Array, or ArrayBuffer');
@@ -2396,6 +2576,7 @@ exports.ValidationError = ValidationError;
 exports.WEBHOOK_MODEL_COLUMNS = WEBHOOK_MODEL_COLUMNS;
 exports.WEBHOOK_OUTCOME_MODELS = WEBHOOK_OUTCOME_MODELS;
 exports.WebhookConsumer = WebhookConsumer;
+exports.configureCrypto = configureCrypto;
 exports.handleResponse = handleResponse;
 exports.selectResultColumns = selectResultColumns;
 exports.signWebhookPayload = signWebhookPayload;

package/dist/sdk.esm.js

@@ -2,36 +2,181 @@ function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
 
-var pkce;
-var hasRequiredPkce;
+var base64;
+var hasRequiredBase64;
 
-function requirePkce () {
-	if (hasRequiredPkce) return pkce;
-	hasRequiredPkce = 1;
+function requireBase64 () {
+	if (hasRequiredBase64) return base64;
+	hasRequiredBase64 = 1;
 
-	// base64url-encode a Uint8Array without padding
+	// Base64URL codec, used by PKCE (encode) and JWT payload decoding (decode).
+	// Hand-rolled rather than delegating to atob/btoa, Buffer, or TextDecoder:
+	// none of those is present on every target runtime — React Native's Hermes has
+	// no Buffer and does not guarantee atob — and the alphabet here is URL-safe and
+	// unpadded, which the standard helpers do not produce.
+
+	const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+	/**
+	 * @param {Uint8Array} bytes
+	 * @returns {string} unpadded base64url
+	 */
 	function base64urlEncode(bytes) {
-	  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
 	  let result = '';
 	  for (let i = 0; i < bytes.length; i += 3) {
 	    const b0 = bytes[i];
 	    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
 	    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
-	    result += chars[b0 >> 2];
-	    result += chars[((b0 & 3) << 4) | (b1 >> 4)];
-	    if (i + 1 < bytes.length) result += chars[((b1 & 0xf) << 2) | (b2 >> 6)];
-	    if (i + 2 < bytes.length) result += chars[b2 & 0x3f];
+	    result += ALPHABET[b0 >> 2];
+	    result += ALPHABET[((b0 & 3) << 4) | (b1 >> 4)];
+	    if (i + 1 < bytes.length) result += ALPHABET[((b1 & 0xf) << 2) | (b2 >> 6)];
+	    if (i + 2 < bytes.length) result += ALPHABET[b2 & 0x3f];
 	  }
 	  return result;
 	}
 
+	/**
+	 * Decodes base64url or standard base64, padded or not.
+	 * @param {string} str
+	 * @returns {Uint8Array}
+	 */
+	function base64urlDecode(str) {
+	  const clean = String(str).replace(/=+$/, '');
+	  const out = new Uint8Array((clean.length * 3) >> 2);
+	  let acc = 0;
+	  let bits = 0;
+	  let i = 0;
+	  for (const ch of clean) {
+	    const value = decodeChar(ch);
+	    if (value < 0) throw new TypeError(`Invalid base64url character: ${JSON.stringify(ch)}`);
+	    acc = (acc << 6) | value;
+	    bits += 6;
+	    if (bits >= 8) {
+	      bits -= 8;
+	      out[i++] = (acc >> bits) & 0xff;
+	    }
+	  }
+	  return out.subarray(0, i);
+	}
+
+	/**
+	 * @param {Uint8Array} bytes
+	 * @returns {string}
+	 */
+	function utf8Decode(bytes) {
+	  let out = '';
+	  let i = 0;
+	  while (i < bytes.length) {
+	    const b0 = bytes[i++];
+	    let codePoint;
+	    if (b0 < 0x80) codePoint = b0;
+	    else if ((b0 & 0xe0) === 0xc0) codePoint = ((b0 & 0x1f) << 6) | (bytes[i++] & 0x3f);
+	    else if ((b0 & 0xf0) === 0xe0)
+	      codePoint = ((b0 & 0x0f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f);
+	    else
+	      codePoint =
+	        ((b0 & 0x07) << 18) | ((bytes[i++] & 0x3f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f);
+	    out += String.fromCodePoint(codePoint);
+	  }
+	  return out;
+	}
+
+	// helpers
+	function decodeChar(ch) {
+	  // '+' and '/' map onto the URL-safe alphabet's '-' and '_' slots, so standard
+	  // base64 decodes through the same table.
+	  if (ch === '+') return 62;
+	  if (ch === '/') return 63;
+	  return ALPHABET.indexOf(ch);
+	}
+
+	base64 = { base64urlEncode, base64urlDecode, utf8Decode };
+	return base64;
+}
+
+var crypto;
+var hasRequiredCrypto;
+
+function requireCrypto () {
+	if (hasRequiredCrypto) return crypto;
+	hasRequiredCrypto = 1;
+
+	// Crypto seam for PKCE.
+	//
+	// Defaults to WebCrypto, which covers browsers and Node >= 18. React Native's
+	// Hermes runtime provides neither half of what PKCE needs: there is no
+	// SubtleCrypto at all (so no SHA-256), and no crypto.getRandomValues without a
+	// polyfill. Hosts on such runtimes call configureCrypto() once at startup with
+	// native-backed equivalents (expo-crypto, react-native-quick-crypto).
+
+	/** @typedef {{getRandomValues: (bytes: Uint8Array) => Uint8Array, sha256: (bytes: Uint8Array) => Promise<Uint8Array>}} CryptoProvider */
+
+	let _provider = null;
+
+	/**
+	 * Installs a crypto provider, replacing the WebCrypto default.
+	 * @param {CryptoProvider} provider
+	 */
+	function configureCrypto(provider) {
+	  if (!provider || typeof provider.getRandomValues !== 'function' || typeof provider.sha256 !== 'function') {
+	    throw new TypeError(
+	      'configureCrypto requires { getRandomValues(bytes) => bytes, sha256(bytes) => Promise<Uint8Array> }'
+	    );
+	  }
+	  _provider = provider;
+	}
+
+	/** Restores the WebCrypto default. Primarily for tests. */
+	function resetCrypto() {
+	  _provider = null;
+	}
+
+	/**
+	 * @returns {CryptoProvider}
+	 */
+	function getCrypto() {
+	  return _provider ?? webCryptoProvider();
+	}
+
+	// helpers
+	function webCryptoProvider() {
+	  const wc = globalThis.crypto;
+	  // Named explicitly rather than letting a property access blow up deep inside
+	  // PKCE: on React Native the failure is a missing polyfill, and the message
+	  // has to say so.
+	  if (!wc || typeof wc.getRandomValues !== 'function' || !wc.subtle) {
+	    throw new Error(
+	      'No WebCrypto available in this runtime. On React Native (or any host without ' +
+	        'SubtleCrypto), call configureCrypto({ getRandomValues, sha256 }) before using PKCE.'
+	    );
+	  }
+	  return {
+	    getRandomValues: (bytes) => wc.getRandomValues(bytes),
+	    sha256: async (bytes) => new Uint8Array(await wc.subtle.digest('SHA-256', bytes)),
+	  };
+	}
+
+	crypto = { configureCrypto, resetCrypto, getCrypto };
+	return crypto;
+}
+
+var pkce;
+var hasRequiredPkce;
+
+function requirePkce () {
+	if (hasRequiredPkce) return pkce;
+	hasRequiredPkce = 1;
+
+	const { base64urlEncode } = requireBase64();
+	const { getCrypto } = requireCrypto();
+
 	/**
 	 * Generates a 64-character PKCE code verifier from [A-Za-z0-9-._~].
 	 * @returns {string}
 	 */
 	function generateCodeVerifier() {
 	  const bytes = new Uint8Array(48);
-	  globalThis.crypto.getRandomValues(bytes);
+	  getCrypto().getRandomValues(bytes);
 	  return base64urlEncode(bytes).slice(0, 64);
 	}
 
@@ -41,9 +186,8 @@ function requirePkce () {
 	 * @returns {Promise<string>}
 	 */
 	async function generateCodeChallenge(verifier) {
-	  const encoded = new TextEncoder().encode(verifier);
-	  const hashBuf = await globalThis.crypto.subtle.digest('SHA-256', encoded);
-	  return base64urlEncode(new Uint8Array(hashBuf));
+	  const hash = await getCrypto().sha256(asciiEncode(verifier));
+	  return base64urlEncode(hash);
 	}
 
 	/**
@@ -52,8 +196,24 @@ function requirePkce () {
 	 */
 	function generateState() {
 	  const bytes = new Uint8Array(16);
-	  globalThis.crypto.getRandomValues(bytes);
-	  return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
+	  getCrypto().getRandomValues(bytes);
+	  return Array.from(bytes).map((b) => b.toString(16).padStart(2, '0')).join('');
+	}
+
+	// helpers
+
+	// The RFC 7636 §4.1 verifier alphabet is ASCII-only, so a byte-per-char encode
+	// is exact and keeps TextEncoder — absent on some React Native versions — off
+	// the PKCE path entirely. A non-ASCII verifier is invalid input, not something
+	// to silently re-encode.
+	function asciiEncode(str) {
+	  const out = new Uint8Array(str.length);
+	  for (let i = 0; i < str.length; i++) {
+	    const code = str.charCodeAt(i);
+	    if (code > 0x7f) throw new TypeError('PKCE code_verifier must be ASCII (RFC 7636 §4.1)');
+	    out[i] = code;
+	  }
+	  return out;
 	}
 
 	pkce = { generateCodeVerifier, generateCodeChallenge, generateState };
@@ -176,6 +336,7 @@ function requireClient () {
 
 	const { generateCodeVerifier, generateCodeChallenge, generateState } = requirePkce();
 	const { postForm, postJson } = requireHttp();
+	const { base64urlDecode, utf8Decode } = requireBase64();
 	const { OAuthError } = requireErrors();
 
 	// In-flight dedup key for client_credentials re-mints (no refresh_token to key on).
@@ -251,8 +412,7 @@ function requireClient () {
 	      code,
 	      code_verifier: codeVerifier,
 	      redirect_uri: redirectUri ?? this._config.redirectUri,
-	      client_id: this._config.clientId,
-	      client_secret: this._config.clientSecret,
+	      ...this._clientAuth(),
 	    });
 	  }
 
@@ -264,8 +424,7 @@ function requireClient () {
 	  async getClientCredentialsToken() {
 	    return postForm(`${this._config.baseUrl}/oauth/token`, {
 	      grant_type: 'client_credentials',
-	      client_id: this._config.clientId,
-	      client_secret: this._config.clientSecret,
+	      ...this._clientAuth(),
 	    });
 	  }
 
@@ -277,8 +436,7 @@ function requireClient () {
 	    return postForm(`${this._config.baseUrl}/oauth/token`, {
 	      grant_type: 'refresh_token',
 	      refresh_token: refreshToken,
-	      client_id: this._config.clientId,
-	      client_secret: this._config.clientSecret,
+	      ...this._clientAuth(),
 	    });
 	  }
 
@@ -288,7 +446,7 @@ function requireClient () {
 	   * @returns {Promise<void>}
 	   */
 	  async revokeToken(token, tokenTypeHint) {
-	    const params = { token, client_id: this._config.clientId, client_secret: this._config.clientSecret };
+	    const params = { token, ...this._clientAuth() };
 	    if (tokenTypeHint) params.token_type_hint = tokenTypeHint;
 	    await postForm(`${this._config.baseUrl}/oauth/revoke`, params);
 	  }
@@ -369,10 +527,22 @@ function requireClient () {
 	  decodeAccessToken(accessToken) {
 	    const segment = accessToken.split('.')[1];
 	    if (!segment) throw new OAuthError('invalid_token', 'Malformed JWT', 400);
-	    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(segment.length / 4) * 4, '=');
-	    const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
-	    const payload = JSON.parse(new TextDecoder().decode(bytes));
-	    return payload;
+	    return JSON.parse(utf8Decode(base64urlDecode(segment)));
+	  }
+
+	  /**
+	   * Client-authentication params for a token-endpoint request.
+	   *
+	   * A public client (mobile, SPA) holds no secret, and the authorization server
+	   * rejects the request outright if one is present, so the key is omitted
+	   * entirely rather than sent empty. Passing it through unconditionally
+	   * serializes `undefined` into the form body as that literal string.
+	   * @returns {Record<string, string>}
+	   */
+	  _clientAuth() {
+	    const params = { client_id: this._config.clientId };
+	    if (this._config.clientSecret) params.client_secret = this._config.clientSecret;
+	    return params;
 	  }
 	}
 
@@ -469,8 +639,9 @@ function requireSrc$1 () {
 	const { OAuthClient } = requireClient();
 	const { OAuthError } = requireErrors();
 	const { OAuthErrorCode } = requireTypes();
+	const { configureCrypto } = requireCrypto();
 
-	src$1 = { OAuthClient, OAuthError, OAuthErrorCode };
+	src$1 = { OAuthClient, OAuthError, OAuthErrorCode, configureCrypto };
 	return src$1;
 }
 
@@ -478,7 +649,7 @@ var srcExports$1 = requireSrc$1();
 var _oauth = /*@__PURE__*/getDefaultExportFromCjs(srcExports$1);
 
 // Auto-generated — do not edit
-const { OAuthClient, OAuthError, OAuthErrorCode } = _oauth;
+const { OAuthClient, OAuthError, OAuthErrorCode, configureCrypto } = _oauth;
 
 var signing;
 var hasRequiredSigning;
@@ -495,12 +666,21 @@ function requireSigning () {
 	// constant time. Web Crypto only, so the same code runs in Node >= 18 and
 	// browsers.
 
-	const _encoder = new TextEncoder();
+	// Built on first use, not at import. These functions are a server-side concern
+	// (only the endpoint receiving a push verifies a signature), but the module is
+	// bundled into every SDK including React Native — and constructing this at
+	// module scope made merely importing the SDK crash on any runtime without a
+	// TextEncoder global.
+	let _encoderInstance = null;
+	function _encode(text) {
+	  if (!_encoderInstance) _encoderInstance = new TextEncoder();
+	  return _encoderInstance.encode(text);
+	}
 
 	async function signWebhookPayload(secret, timestamp, rawBody) {
 	  const key = await globalThis.crypto.subtle.importKey(
-	    'raw', _encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-	  const payload = _concat(_encoder.encode(`${timestamp}.`), toBytes(rawBody));
+	    'raw', _encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+	  const payload = _concat(_encode(`${timestamp}.`), toBytes(rawBody));
 	  const digest = await globalThis.crypto.subtle.sign('HMAC', key, payload);
 	  return 'sha256=' + _hex(new Uint8Array(digest));
 	}
@@ -524,7 +704,7 @@ function requireSigning () {
 
 	// helpers
 	function toBytes(rawBody) {
-	  if (typeof rawBody === 'string') return _encoder.encode(rawBody);
+	  if (typeof rawBody === 'string') return _encode(rawBody);
 	  if (rawBody instanceof Uint8Array) return rawBody;
 	  if (rawBody instanceof ArrayBuffer) return new Uint8Array(rawBody);
 	  throw new TypeError('rawBody must be a string, Uint8Array, or ArrayBuffer');
@@ -2363,4 +2543,4 @@ class MediaViz {
   get refreshToken() { return this._refreshToken; }
 }
 
-export { Admin, AiModelCredits, ApiError, Company, CuratedAlbums, CustomAlbums, EmailTokens, Health, InMemoryWebhookStore, Keywords, MediaViz, NotFoundError, OAuthClient, OAuthError, OAuthErrorCode, OauthAuthorization, OauthLogin, OauthToken, Person, Photos, Photoupload, Projects, RateLimitError, Search, ServerError, Subscription, Users, ValidationError, WEBHOOK_MODEL_COLUMNS, WEBHOOK_OUTCOME_MODELS, WebhookConsumer, handleResponse, selectResultColumns, signWebhookPayload, verifyWebhookSignature };
+export { Admin, AiModelCredits, ApiError, Company, CuratedAlbums, CustomAlbums, EmailTokens, Health, InMemoryWebhookStore, Keywords, MediaViz, NotFoundError, OAuthClient, OAuthError, OAuthErrorCode, OauthAuthorization, OauthLogin, OauthToken, Person, Photos, Photoupload, Projects, RateLimitError, Search, ServerError, Subscription, Users, ValidationError, WEBHOOK_MODEL_COLUMNS, WEBHOOK_OUTCOME_MODELS, WebhookConsumer, configureCrypto, handleResponse, selectResultColumns, signWebhookPayload, verifyWebhookSignature };

package/dist/sdk.umd.js

@@ -8,36 +8,181 @@
 		return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 	}
 
-	var pkce;
-	var hasRequiredPkce;
+	var base64;
+	var hasRequiredBase64;
 
-	function requirePkce () {
-		if (hasRequiredPkce) return pkce;
-		hasRequiredPkce = 1;
+	function requireBase64 () {
+		if (hasRequiredBase64) return base64;
+		hasRequiredBase64 = 1;
 
-		// base64url-encode a Uint8Array without padding
+		// Base64URL codec, used by PKCE (encode) and JWT payload decoding (decode).
+		// Hand-rolled rather than delegating to atob/btoa, Buffer, or TextDecoder:
+		// none of those is present on every target runtime — React Native's Hermes has
+		// no Buffer and does not guarantee atob — and the alphabet here is URL-safe and
+		// unpadded, which the standard helpers do not produce.
+
+		const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+		/**
+		 * @param {Uint8Array} bytes
+		 * @returns {string} unpadded base64url
+		 */
 		function base64urlEncode(bytes) {
-		  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
 		  let result = '';
 		  for (let i = 0; i < bytes.length; i += 3) {
 		    const b0 = bytes[i];
 		    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
 		    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
-		    result += chars[b0 >> 2];
-		    result += chars[((b0 & 3) << 4) | (b1 >> 4)];
-		    if (i + 1 < bytes.length) result += chars[((b1 & 0xf) << 2) | (b2 >> 6)];
-		    if (i + 2 < bytes.length) result += chars[b2 & 0x3f];
+		    result += ALPHABET[b0 >> 2];
+		    result += ALPHABET[((b0 & 3) << 4) | (b1 >> 4)];
+		    if (i + 1 < bytes.length) result += ALPHABET[((b1 & 0xf) << 2) | (b2 >> 6)];
+		    if (i + 2 < bytes.length) result += ALPHABET[b2 & 0x3f];
 		  }
 		  return result;
 		}
 
+		/**
+		 * Decodes base64url or standard base64, padded or not.
+		 * @param {string} str
+		 * @returns {Uint8Array}
+		 */
+		function base64urlDecode(str) {
+		  const clean = String(str).replace(/=+$/, '');
+		  const out = new Uint8Array((clean.length * 3) >> 2);
+		  let acc = 0;
+		  let bits = 0;
+		  let i = 0;
+		  for (const ch of clean) {
+		    const value = decodeChar(ch);
+		    if (value < 0) throw new TypeError(`Invalid base64url character: ${JSON.stringify(ch)}`);
+		    acc = (acc << 6) | value;
+		    bits += 6;
+		    if (bits >= 8) {
+		      bits -= 8;
+		      out[i++] = (acc >> bits) & 0xff;
+		    }
+		  }
+		  return out.subarray(0, i);
+		}
+
+		/**
+		 * @param {Uint8Array} bytes
+		 * @returns {string}
+		 */
+		function utf8Decode(bytes) {
+		  let out = '';
+		  let i = 0;
+		  while (i < bytes.length) {
+		    const b0 = bytes[i++];
+		    let codePoint;
+		    if (b0 < 0x80) codePoint = b0;
+		    else if ((b0 & 0xe0) === 0xc0) codePoint = ((b0 & 0x1f) << 6) | (bytes[i++] & 0x3f);
+		    else if ((b0 & 0xf0) === 0xe0)
+		      codePoint = ((b0 & 0x0f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f);
+		    else
+		      codePoint =
+		        ((b0 & 0x07) << 18) | ((bytes[i++] & 0x3f) << 12) | ((bytes[i++] & 0x3f) << 6) | (bytes[i++] & 0x3f);
+		    out += String.fromCodePoint(codePoint);
+		  }
+		  return out;
+		}
+
+		// helpers
+		function decodeChar(ch) {
+		  // '+' and '/' map onto the URL-safe alphabet's '-' and '_' slots, so standard
+		  // base64 decodes through the same table.
+		  if (ch === '+') return 62;
+		  if (ch === '/') return 63;
+		  return ALPHABET.indexOf(ch);
+		}
+
+		base64 = { base64urlEncode, base64urlDecode, utf8Decode };
+		return base64;
+	}
+
+	var crypto;
+	var hasRequiredCrypto;
+
+	function requireCrypto () {
+		if (hasRequiredCrypto) return crypto;
+		hasRequiredCrypto = 1;
+
+		// Crypto seam for PKCE.
+		//
+		// Defaults to WebCrypto, which covers browsers and Node >= 18. React Native's
+		// Hermes runtime provides neither half of what PKCE needs: there is no
+		// SubtleCrypto at all (so no SHA-256), and no crypto.getRandomValues without a
+		// polyfill. Hosts on such runtimes call configureCrypto() once at startup with
+		// native-backed equivalents (expo-crypto, react-native-quick-crypto).
+
+		/** @typedef {{getRandomValues: (bytes: Uint8Array) => Uint8Array, sha256: (bytes: Uint8Array) => Promise<Uint8Array>}} CryptoProvider */
+
+		let _provider = null;
+
+		/**
+		 * Installs a crypto provider, replacing the WebCrypto default.
+		 * @param {CryptoProvider} provider
+		 */
+		function configureCrypto(provider) {
+		  if (!provider || typeof provider.getRandomValues !== 'function' || typeof provider.sha256 !== 'function') {
+		    throw new TypeError(
+		      'configureCrypto requires { getRandomValues(bytes) => bytes, sha256(bytes) => Promise<Uint8Array> }'
+		    );
+		  }
+		  _provider = provider;
+		}
+
+		/** Restores the WebCrypto default. Primarily for tests. */
+		function resetCrypto() {
+		  _provider = null;
+		}
+
+		/**
+		 * @returns {CryptoProvider}
+		 */
+		function getCrypto() {
+		  return _provider ?? webCryptoProvider();
+		}
+
+		// helpers
+		function webCryptoProvider() {
+		  const wc = globalThis.crypto;
+		  // Named explicitly rather than letting a property access blow up deep inside
+		  // PKCE: on React Native the failure is a missing polyfill, and the message
+		  // has to say so.
+		  if (!wc || typeof wc.getRandomValues !== 'function' || !wc.subtle) {
+		    throw new Error(
+		      'No WebCrypto available in this runtime. On React Native (or any host without ' +
+		        'SubtleCrypto), call configureCrypto({ getRandomValues, sha256 }) before using PKCE.'
+		    );
+		  }
+		  return {
+		    getRandomValues: (bytes) => wc.getRandomValues(bytes),
+		    sha256: async (bytes) => new Uint8Array(await wc.subtle.digest('SHA-256', bytes)),
+		  };
+		}
+
+		crypto = { configureCrypto, resetCrypto, getCrypto };
+		return crypto;
+	}
+
+	var pkce;
+	var hasRequiredPkce;
+
+	function requirePkce () {
+		if (hasRequiredPkce) return pkce;
+		hasRequiredPkce = 1;
+
+		const { base64urlEncode } = requireBase64();
+		const { getCrypto } = requireCrypto();
+
 		/**
 		 * Generates a 64-character PKCE code verifier from [A-Za-z0-9-._~].
 		 * @returns {string}
 		 */
 		function generateCodeVerifier() {
 		  const bytes = new Uint8Array(48);
-		  globalThis.crypto.getRandomValues(bytes);
+		  getCrypto().getRandomValues(bytes);
 		  return base64urlEncode(bytes).slice(0, 64);
 		}
 
@@ -47,9 +192,8 @@
 		 * @returns {Promise<string>}
 		 */
 		async function generateCodeChallenge(verifier) {
-		  const encoded = new TextEncoder().encode(verifier);
-		  const hashBuf = await globalThis.crypto.subtle.digest('SHA-256', encoded);
-		  return base64urlEncode(new Uint8Array(hashBuf));
+		  const hash = await getCrypto().sha256(asciiEncode(verifier));
+		  return base64urlEncode(hash);
 		}
 
 		/**
@@ -58,8 +202,24 @@
 		 */
 		function generateState() {
 		  const bytes = new Uint8Array(16);
-		  globalThis.crypto.getRandomValues(bytes);
-		  return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
+		  getCrypto().getRandomValues(bytes);
+		  return Array.from(bytes).map((b) => b.toString(16).padStart(2, '0')).join('');
+		}
+
+		// helpers
+
+		// The RFC 7636 §4.1 verifier alphabet is ASCII-only, so a byte-per-char encode
+		// is exact and keeps TextEncoder — absent on some React Native versions — off
+		// the PKCE path entirely. A non-ASCII verifier is invalid input, not something
+		// to silently re-encode.
+		function asciiEncode(str) {
+		  const out = new Uint8Array(str.length);
+		  for (let i = 0; i < str.length; i++) {
+		    const code = str.charCodeAt(i);
+		    if (code > 0x7f) throw new TypeError('PKCE code_verifier must be ASCII (RFC 7636 §4.1)');
+		    out[i] = code;
+		  }
+		  return out;
 		}
 
 		pkce = { generateCodeVerifier, generateCodeChallenge, generateState };
@@ -182,6 +342,7 @@
 
 		const { generateCodeVerifier, generateCodeChallenge, generateState } = requirePkce();
 		const { postForm, postJson } = requireHttp();
+		const { base64urlDecode, utf8Decode } = requireBase64();
 		const { OAuthError } = requireErrors();
 
 		// In-flight dedup key for client_credentials re-mints (no refresh_token to key on).
@@ -257,8 +418,7 @@
 		      code,
 		      code_verifier: codeVerifier,
 		      redirect_uri: redirectUri ?? this._config.redirectUri,
-		      client_id: this._config.clientId,
-		      client_secret: this._config.clientSecret,
+		      ...this._clientAuth(),
 		    });
 		  }
 
@@ -270,8 +430,7 @@
 		  async getClientCredentialsToken() {
 		    return postForm(`${this._config.baseUrl}/oauth/token`, {
 		      grant_type: 'client_credentials',
-		      client_id: this._config.clientId,
-		      client_secret: this._config.clientSecret,
+		      ...this._clientAuth(),
 		    });
 		  }
 
@@ -283,8 +442,7 @@
 		    return postForm(`${this._config.baseUrl}/oauth/token`, {
 		      grant_type: 'refresh_token',
 		      refresh_token: refreshToken,
-		      client_id: this._config.clientId,
-		      client_secret: this._config.clientSecret,
+		      ...this._clientAuth(),
 		    });
 		  }
 
@@ -294,7 +452,7 @@
 		   * @returns {Promise<void>}
 		   */
 		  async revokeToken(token, tokenTypeHint) {
-		    const params = { token, client_id: this._config.clientId, client_secret: this._config.clientSecret };
+		    const params = { token, ...this._clientAuth() };
 		    if (tokenTypeHint) params.token_type_hint = tokenTypeHint;
 		    await postForm(`${this._config.baseUrl}/oauth/revoke`, params);
 		  }
@@ -375,10 +533,22 @@
 		  decodeAccessToken(accessToken) {
 		    const segment = accessToken.split('.')[1];
 		    if (!segment) throw new OAuthError('invalid_token', 'Malformed JWT', 400);
-		    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(segment.length / 4) * 4, '=');
-		    const bytes = Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
-		    const payload = JSON.parse(new TextDecoder().decode(bytes));
-		    return payload;
+		    return JSON.parse(utf8Decode(base64urlDecode(segment)));
+		  }
+
+		  /**
+		   * Client-authentication params for a token-endpoint request.
+		   *
+		   * A public client (mobile, SPA) holds no secret, and the authorization server
+		   * rejects the request outright if one is present, so the key is omitted
+		   * entirely rather than sent empty. Passing it through unconditionally
+		   * serializes `undefined` into the form body as that literal string.
+		   * @returns {Record<string, string>}
+		   */
+		  _clientAuth() {
+		    const params = { client_id: this._config.clientId };
+		    if (this._config.clientSecret) params.client_secret = this._config.clientSecret;
+		    return params;
 		  }
 		}
 
@@ -475,8 +645,9 @@
 		const { OAuthClient } = requireClient();
 		const { OAuthError } = requireErrors();
 		const { OAuthErrorCode } = requireTypes();
+		const { configureCrypto } = requireCrypto();
 
-		src$1 = { OAuthClient, OAuthError, OAuthErrorCode };
+		src$1 = { OAuthClient, OAuthError, OAuthErrorCode, configureCrypto };
 		return src$1;
 	}
 
@@ -484,7 +655,7 @@
 	var _oauth = /*@__PURE__*/getDefaultExportFromCjs(srcExports$1);
 
 	// Auto-generated — do not edit
-	const { OAuthClient, OAuthError, OAuthErrorCode } = _oauth;
+	const { OAuthClient, OAuthError, OAuthErrorCode, configureCrypto } = _oauth;
 
 	var signing;
 	var hasRequiredSigning;
@@ -501,12 +672,21 @@
 		// constant time. Web Crypto only, so the same code runs in Node >= 18 and
 		// browsers.
 
-		const _encoder = new TextEncoder();
+		// Built on first use, not at import. These functions are a server-side concern
+		// (only the endpoint receiving a push verifies a signature), but the module is
+		// bundled into every SDK including React Native — and constructing this at
+		// module scope made merely importing the SDK crash on any runtime without a
+		// TextEncoder global.
+		let _encoderInstance = null;
+		function _encode(text) {
+		  if (!_encoderInstance) _encoderInstance = new TextEncoder();
+		  return _encoderInstance.encode(text);
+		}
 
 		async function signWebhookPayload(secret, timestamp, rawBody) {
 		  const key = await globalThis.crypto.subtle.importKey(
-		    'raw', _encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-		  const payload = _concat(_encoder.encode(`${timestamp}.`), toBytes(rawBody));
+		    'raw', _encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+		  const payload = _concat(_encode(`${timestamp}.`), toBytes(rawBody));
 		  const digest = await globalThis.crypto.subtle.sign('HMAC', key, payload);
 		  return 'sha256=' + _hex(new Uint8Array(digest));
 		}
@@ -530,7 +710,7 @@
 
 		// helpers
 		function toBytes(rawBody) {
-		  if (typeof rawBody === 'string') return _encoder.encode(rawBody);
+		  if (typeof rawBody === 'string') return _encode(rawBody);
 		  if (rawBody instanceof Uint8Array) return rawBody;
 		  if (rawBody instanceof ArrayBuffer) return new Uint8Array(rawBody);
 		  throw new TypeError('rawBody must be a string, Uint8Array, or ArrayBuffer');
@@ -2400,6 +2580,7 @@
 	exports.WEBHOOK_MODEL_COLUMNS = WEBHOOK_MODEL_COLUMNS;
 	exports.WEBHOOK_OUTCOME_MODELS = WEBHOOK_OUTCOME_MODELS;
 	exports.WebhookConsumer = WebhookConsumer;
+	exports.configureCrypto = configureCrypto;
 	exports.handleResponse = handleResponse;
 	exports.selectResultColumns = selectResultColumns;
 	exports.signWebhookPayload = signWebhookPayload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediaviz/sdk",
-  "version": "1.9.0-dev.106",
+  "version": "1.9.0-dev.117",
   "description": "MediaViz JavaScript SDK \u2014 auto-generated public endpoint client.",
   "license": "MIT",
   "repository": {