@monterosa/sdk-identify-kit 2.0.0-rc.2 → 2.0.0-rc.4

package/dist/api.d.ts

@@ -9,19 +9,60 @@
 import { MonterosaSdk } from '@monterosa/sdk-core';
 import { Unsubscribe, TaskQueue } from '@monterosa/sdk-util';
 import { Payload } from '@monterosa/sdk-launcher-kit';
-import { IdentifyKit, LoginState, Credentials, Signature, UserData, IdentifyOptions, IdentifyAction, IdentifyHook } from './types';
+import { IdentifyKit, LoginState, Credentials, Signature, UserData, IdentifyOptions, IdentifyAction, LoginPolicy } from './types';
+import { Identify } from './identify';
 /**
  * @internal
  */
-export declare const taskQueue: TaskQueue;
+export declare const identifyKits: Map<string, Identify>;
 /**
+ * Read the current locally-owned login policy.
+ *
+ * Returns `'disabled'` by default.
+ *
  * @internal
  */
-export declare function parentAppRequest<T>(identify: IdentifyKit, action: IdentifyAction, payload?: Payload): Promise<T>;
+export declare function getLoginPolicy(): LoginPolicy;
+/**
+ * Set the locally-owned login policy.
+ *
+ * All `Identify` instances at this level honour the same policy; the
+ * value is never propagated across the wire (each level of a multi-level
+ * integration owns its own policy).
+ *
+ * Policy gates the Enmasse `loginTask` only — credentials always mirror
+ * from upstream regardless of policy. A `'disabled'` level still
+ * receives credentials via the module-load pull and the cascading
+ * `Login` / `Logout` broadcasts; it just doesn't attempt Enmasse
+ * validation against them.
+ *
+ * When the policy transitions to `'auto'`, enqueues a sync-state task
+ * for every existing identify so that any in-flight session is picked
+ * up.
+ *
+ * Idempotent: setting the same policy that's already in effect is a
+ * no-op.
+ *
+ * @param policy - `'auto'` to enable auto-login, `'disabled'` to opt out.
+ */
+export declare function setLoginPolicy(policy: LoginPolicy): void;
+/**
+ * Whether the user should be auto-logged in on reconnect.
+ *
+ * True when the user was previously logged in, the policy is `'auto'`,
+ * and credentials are available on the identify instance.
+ *
+ * @internal
+ */
+export declare function shouldLoginOnReconnect(identify: IdentifyKit): boolean;
 /**
  * @internal
  */
-export declare function registerIdentifyHook(hook: IdentifyHook): void;
+export declare const taskQueue: TaskQueue;
+/**
+ * @internal
+ */
+export declare function sendParentRequest<T>(action: IdentifyAction, payload?: Payload): Promise<T>;
 /**
  * @internal
  */
@@ -31,13 +72,56 @@ export declare function loginTask(identify: IdentifyKit, credentials: Credential
  */
 export declare function logoutTask(identify: IdentifyKit): Promise<void>;
 /**
+ * Enqueue a `loginTask` for the given identify when `policy === 'auto'`.
+ * The downstream `Login` broadcast is emitted by {@link applyLogin}.
+ *
  * @internal
  */
 export declare function enqueueLogin(identify: IdentifyKit, credentials: Credentials, prioritise?: boolean): void;
 /**
+ * Reset the identify's identity-derived caches and enqueue a `logoutTask`
+ * when `policy === 'auto'`.
+ *
  * @internal
  */
 export declare function enqueueLogout(identify: IdentifyKit): void;
+/**
+ * Apply new credentials at this level: update the slot, enqueue a
+ * `loginTask` for every existing identify on the null-to-set transition,
+ * and broadcast `Login` downstream to every embedded experience.
+ *
+ * Idempotent on token refresh: re-setting an already-set slot updates
+ * the value and broadcasts, but does not re-enqueue logins (their
+ * `loginTask` would short-circuit on `state === 'logged_in'` anyway).
+ *
+ * @internal
+ */
+export declare function applyLogin(credentials: Credentials): void;
+/**
+ * Clear credentials at this level: null out the slot, enqueue a
+ * `logoutTask` for every existing identify on the set-to-null
+ * transition, and broadcast `Logout` downstream to every embedded
+ * experience.
+ *
+ * @internal
+ */
+export declare function applyLogout(): void;
+/**
+ * Pull state from the parent application and apply locally.
+ *
+ * Fires once at non-root bridge module load, regardless of
+ * `loginPolicy` — token presence is the customer-side sign-in state and
+ * must mirror upstream whether or not we choose to validate against
+ * Enmasse. Best-effort: a missing or non-identify-kit parent silently
+ * resolves with no slot change.
+ *
+ * Uses {@link applyLogin} so the slot update cascades downstream to
+ * this level's own embedded experiences and per-identify loginTasks
+ * are enqueued under `loginPolicy === 'auto'`.
+ *
+ * @internal
+ */
+export declare function pullStateFromParent(): Promise<void>;
 /**
  * A factory function that creates a new instance of the `IdentifyKit` class,
  * which is a kit of the Monterosa SDK used for user identification.
@@ -59,15 +143,16 @@ export declare function enqueueLogout(identify: IdentifyKit): void;
  * - The `IdentifyKit` instance returned by `getIdentify` can be used to authenticate
  *   users and perform other user identification-related operations.
  *
- * - Subsequent calls to getIdentify with the same MonterosaSdk instance will return
- *   the same `IdentifyKit` instance.
+ * - Subsequent calls return the cached `IdentifyKit` instance for the same
+ *   project. The `options` argument is honoured only on the first call;
+ *   later calls ignore it and return the instance configured by the first.
  *
  * @param sdk - An instance of the MonterosaSdk class.
  * @param options - List of `IdentifyKit` options
  * @returns An instance of the `IdentifyKit` class, which is used for user
  * identification.
  */
-export declare function getIdentify(sdk?: MonterosaSdk, options?: IdentifyOptions): IdentifyKit;
+export declare function getIdentify(sdk?: MonterosaSdk, options?: Partial<IdentifyOptions>): IdentifyKit;
 /**
  * A factory function that creates a new instance of the `IdentifyKit` class,
  * which is a kit of the Monterosa SDK used for user identification.
@@ -89,32 +174,31 @@ export declare function getIdentify(sdk?: MonterosaSdk, options?: IdentifyOption
  * - The `IdentifyKit` instance returned by `getIdentify` can be used to authenticate
  *   users and perform other user identification-related operations.
  *
- * - Subsequent calls to getIdentify with the same MonterosaSdk instance will return
- *   the same `IdentifyKit` instance.
+ * - Subsequent calls return the cached `IdentifyKit` instance for the same
+ *   project. The `options` argument is honoured only on the first call;
+ *   later calls ignore it and return the instance configured by the first.
  *
  * @param options - List of `IdentifyKit` options
  * @returns An instance of the `IdentifyKit` class, which is used for user
  * identification.
  */
-export declare function getIdentify(options?: IdentifyOptions): IdentifyKit;
+export declare function getIdentify(options?: Partial<IdentifyOptions>): IdentifyKit;
 /**
- * A function that requests a user login via the `IdentifyKit` of the Monterosa SDK.
+ * Requests a user login.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, requestLogin } from '@monterosa/sdk-identify-kit';
+ * import { requestLogin } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
  * try {
- *   const identify = getIdentify();
- *
- *   await requestLogin(identify);
+ *   await requestLogin();
  *
  *   console.log('Login request successful');
  * } catch (err) {
- *   console.error('Error requesting login:', error.message)
+ *   console.error('Error requesting login:', err.message)
  * }
  * ```
  *
@@ -123,43 +207,51 @@ export declare function getIdentify(options?: IdentifyOptions): IdentifyKit;
  *   the Monterosa SDK, the function delegates to the parent app
  *   to handle the login process.
  *
- * @param identify - An instance of the `IdentifyKit` class used for user
- *   identification.
  * @returns A Promise that resolves with `void` when the login request
  *   is completed.
  */
-export declare function requestLogin(identify: IdentifyKit): Promise<void>;
+export declare function requestLogin(): Promise<void>;
 /**
- * A function that requests a user login via the `IdentifyKit` of the Space.
+ * Read the current credentials, pulling from the parent application when
+ * called from an embedded experience.
+ *
+ * At the root this returns the canonical slot value. At a non-root
+ * experience this dispatches a `GetCredentials` request upstream and
+ * resolves with the response, ensuring the caller always sees the
+ * authoritative value rather than a possibly-stale local mirror.
+ *
+ * @returns A Promise that resolves to the current credentials, or `null`
+ *   if none are set.
+ */
+export declare function getCredentials(): Promise<Credentials | null>;
+/**
+ * Requests a user logout.
  *
  * @example
  * ```javascript
- * import { getSpace } from '@monterosa/sdk-core';
- * import { getIdentify, requestLogout } from '@monterosa/sdk-identify-kit';
+ * import { configure } from '@monterosa/sdk-core';
+ * import { requestLogout } from '@monterosa/sdk-identify-kit';
  *
- * const space = getSpace('host', 'space-id');
- * const identify = getIdentify(space);
+ * configure({ host: '...', projectId: '...' });
  *
  * try {
- *   await requestLogout(identify);
+ *   await requestLogout();
  *
  *   console.log('Logout request successful');
  * } catch (err) {
- *   console.error('Error requesting logout:', error.message)
+ *   console.error('Error requesting logout:', err.message)
  * }
  * ```
  *
  * @remarks
  * - If the app is running within a third-party application that uses
- *   the Space, the function delegates to the parent app
+ *   the Monterosa SDK, the function delegates to the parent app
  *   to handle the logout process.
  *
- * @param identify - An instance of the `IdentifyKit` class used for user
- *   identification.
  * @returns A Promise that resolves with `void` when the logout request
  *   is completed.
  */
-export declare function requestLogout(identify: IdentifyKit): Promise<void>;
+export declare function requestLogout(): Promise<void>;
 /**
  * @internal
  *
@@ -178,101 +270,104 @@ export declare function requestLogout(identify: IdentifyKit): Promise<void>;
  */
 export declare function getSessionSignature(identify: IdentifyKit, credentials: Credentials): Promise<Signature>;
 /**
- * A memoized version of the `getSessionSignature` function.
+ * A memoized version of the `getSessionSignature` function. Memo key is
+ * the credentials token, so both leaf-side and bridge-side callers share
+ * the same cache for the same token.
  */
 export declare const getSessionSignatureMemoized: (...args: any[]) => Promise<Signature>;
 /**
- * The function that takes an instance of `IdentifyKit` as its argument and
- * returns a Promise that resolves to a key-value object representing user data.
+ * Fetches user data for the given credentials.
+ *
+ * Credentials are required explicitly so the precondition is visible at
+ * the call site — without them the function cannot be called. Obtain a
+ * `Credentials` value via {@link getCredentials} or the
+ * {@link onCredentialsUpdated} callback.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, getUserData } from '@monterosa/sdk-identify-kit';
+ * import {
+ *   getIdentify,
+ *   getUserData,
+ *   getCredentials,
+ * } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
  * const identify = getIdentify();
- * const userData = await getUserData(identify);
+ * const credentials = await getCredentials();
  *
- * console.log('User data:', userData);
+ * if (credentials !== null) {
+ *   const userData = await getUserData(identify, credentials);
+ *   console.log('User data:', userData);
+ * }
  * ```
  *
  * @remarks
- * - If the app is running within a third-party application that uses
- *   the Monterosa SDK, the function delegates to the parent app
- *   to get user data.
- *
- * - If the request is successful, the function resolves with a key-value object
- *   representing user data. If not, a `MonterosaError` is thrown.
+ * Cached on the identify instance after the first successful fetch.
+ * Cleared on {@link clearCredentials} via the logout path.
  *
  * @param identify - An instance of `IdentifyKit` that provides the user
  *   identification functionality.
- * @returns A Promise that resolves to a key-value object representing user data.
- *   The structure and content of the user data object depend on the identify
- *   service provider and may vary. It typically contains information about the user,
- *   but the specific fields are determined by the Identify service provider.
+ * @param credentials - The user's authentication credentials. The
+ *   request authorises against the value's token.
+ * @returns A Promise that resolves to a key-value object representing
+ *   user data. The structure and content of the user data object depend
+ *   on the identify service provider and may vary.
  */
-export declare function getUserData(identify: IdentifyKit): Promise<UserData>;
+export declare function getUserData(identify: IdentifyKit, credentials: Credentials): Promise<UserData>;
 /**
  * Sets the user's authentication credentials.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, setCredentials } from '@monterosa/sdk-identify-kit';
+ * import { setCredentials } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const credentials = { token: 'abc123' };
- * const identify = getIdentify();
- *
- * await setCredentials(identify, credentials)
+ * await setCredentials({ token: 'abc123' });
  * ```
  *
  * @remarks
- * - If the app is running within a third-party application that uses
- *   the Monterosa SDK, the function delegates to the parent app
- *   to set user credentials.
- *
- * - If the request is successful, the function resolves to `void`.
- *   If not, a `MonterosaError` is thrown.
+ * - At the root of an integration, the credentials are stored locally
+ *   and a `Login` broadcast is sent to every embedded experience.
+ * - When called from an embedded experience, the call is relayed
+ *   upstream via the `SetCredentials` wire action. The credentials are
+ *   ultimately applied at the root and propagate back down via the
+ *   cascading `Login` broadcast.
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param credentials - An object representing the user's authentication
  *   credentials.
- * @returns A Promise that resolves to `void`.
+ * @returns A Promise that resolves to `void` once the credentials have
+ *   been written (root) or the upstream relay has completed (non-root).
  */
-export declare function setCredentials(identify: IdentifyKit, credentials: Credentials): Promise<void>;
+export declare function setCredentials(credentials: Credentials): Promise<void>;
 /**
  * Clears the user's authentication credentials.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, clearCredentials } from '@monterosa/sdk-identify-kit';
+ * import { clearCredentials } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const identify = getIdentify();
- *
- * await clearCredentials(identify);
+ * await clearCredentials();
  * ```
  *
  * @remarks
- * - If the app is running within a third-party application that uses
- *   the Monterosa SDK, the function delegates to the parent app
- *   to clear user credentials.
- *
- * - If the request is successful, the function resolves to `void`.
- *   If not, a `MonterosaError` is thrown.
- *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
- * @returns A Promise that resolves to `void`.
+ * - At the root of an integration, the credentials slot is cleared and
+ *   a `Logout` broadcast is sent to every embedded experience.
+ * - When called from an embedded experience, the call is relayed
+ *   upstream via the `ClearCredentials` wire action. The slot is
+ *   cleared at the root and the cascading `Logout` broadcast propagates
+ *   back down.
+ *
+ * @returns A Promise that resolves to `void` once the slot has been
+ *   cleared (root) or the upstream relay has completed (non-root).
  */
-export declare function clearCredentials(identify: IdentifyKit): Promise<void>;
+export declare function clearCredentials(): Promise<void>;
 /**
  * Registers a callback function that will be called whenever the `LoginState`
  * object associated with the `IdentifyKit` instance is updated.
@@ -303,19 +398,17 @@ export declare function clearCredentials(identify: IdentifyKit): Promise<void>;
  */
 export declare function onStateUpdated(identify: IdentifyKit, callback: (state: LoginState) => void): Unsubscribe;
 /**
- * Registers a callback function that will be called whenever the `Credentials`
- * object associated with the `IdentifyKit` instance is updated.
+ * Registers a callback function that will be called whenever the
+ * credentials slot is updated.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onCredentialsUpdated } from '@monterosa/sdk-identify-kit';
+ * import { onCredentialsUpdated } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const identify = getIdentify();
- *
- * const unsubscribe = onCredentialsUpdated(identify, (credentials) => {
+ * const unsubscribe = onCredentialsUpdated((credentials) => {
  *   if (credentials !== null) {
  *     console.log("Credentials updated:", credentials);
  *   } else {
@@ -327,86 +420,14 @@ export declare function onStateUpdated(identify: IdentifyKit, callback: (state:
  * // unsubscribe();
  * ```
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param callback - The callback function to register. This function will be
  *   called with the updated `Credentials` object as its only argument.
- *   If the value `null` is received, it indicates that the signature has
- *   been cleared
+ *   If the value `null` is received, it indicates that the credentials have
+ *   been cleared.
  * @returns An `Unsubscribe` function that can be called to unregister
  *   the callback function.
  */
-export declare function onCredentialsUpdated(identify: IdentifyKit, callback: (credentials: Credentials | null) => void): Unsubscribe;
-/**
- * Registers a callback function that will be called whenever the `Signature`
- * object associated with the `IdentifyKit` instance is updated.
- *
- * @example
- * ```javascript
- * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onSignatureUpdated } from '@monterosa/sdk-identify-kit';
- *
- * configure({ host: '...', projectId: '...' });
- *
- * const identify = getIdentify();
- *
- * const unsubscribe = onSignatureUpdated(identify, (signature) => {
- *   if (signature !== null) {
- *     console.log("Signature updated:", signature);
- *   } else {
- *     console.log("Signature cleared.");
- *   }
- * });
- *
- * // Call unsubscribe() to unregister the callback function
- * // unsubscribe();
- * ```
- *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
- * @param callback - The callback function to register. This function will be
- *   called with the updated `Signature` object as its only argument.
- *   If the value `null` is received, it indicates that the signature has
- *   been cleared
- * @returns An `Unsubscribe` function that can be called to unregister
- *   the callback function.
- */
-export declare function onSignatureUpdated(identify: IdentifyKit, callback: (signature: Signature | null) => void): Unsubscribe;
-/**
- * Registers a callback function that will be called whenever the `UserData`
- * object associated with the `IdentifyKit` instance is updated.
- *
- * @example
- * ```javascript
- * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onUserDataUpdated } from '@monterosa/sdk-identify-kit';
- *
- * configure({ host: '...', projectId: '...' });
- *
- * const identify = getIdentify();
- *
- * const unsubscribe = onUserDataUpdated(identify, (userData) => {
- *   if (userData !== null) {
- *     console.log("User's data updated:", userData);
- *   } else {
- *     console.log("User's data cleared.");
- *   }
- * });
- *
- * // Call unsubscribe() to unregister the callback function
- * // unsubscribe();
- * ```
- *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
- * @param callback - The callback function to register. This function will be
- *   called with the updated `UserData` object as its only argument.
- *   If the value `null` is received, it indicates that the user's data has
- *   been cleared
- * @returns An `Unsubscribe` function that can be called to unregister
- *   the callback function.
- */
-export declare function onUserDataUpdated(identify: IdentifyKit, callback: (userData: UserData | null) => void): Unsubscribe;
+export declare function onCredentialsUpdated(callback: (credentials: Credentials | null) => void): Unsubscribe;
 /**
  * Registers a callback function that will be called when a login is requested
  * by an Experience.
@@ -414,13 +435,11 @@ export declare function onUserDataUpdated(identify: IdentifyKit, callback: (user
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onLoginRequestedByExperience } from '@monterosa/sdk-identify-kit';
+ * import { onLoginRequestedByExperience } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const identify = getIdentify();
- *
- * const unsubscribe = onLoginRequestedByExperience(identify, () => {
+ * const unsubscribe = onLoginRequestedByExperience(() => {
  *   showLoginForm();
  * });
  *
@@ -428,27 +447,24 @@ export declare function onUserDataUpdated(identify: IdentifyKit, callback: (user
  * // unsubscribe();
  * ```
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param callback - The callback function to register. This function will
  *   be called when a login is requested by an Experience.
  * @returns An `Unsubscribe` function that can be called to unregister
  *   the callback function.
  */
-export declare function onLoginRequestedByExperience(identify: IdentifyKit, callback: () => void): Unsubscribe;
+export declare function onLoginRequestedByExperience(callback: () => void): Unsubscribe;
 /**
  * Registers a callback function that will be called when a logout is requested
  * by an Experience.
  *
  * @example
  * ```javascript
- * import { getSpace } from '@monterosa/sdk-core';
- * import { getIdentify, onLogoutRequestedByExperience } from '@monterosa/sdk-identify-kit';
+ * import { configure } from '@monterosa/sdk-core';
+ * import { onLogoutRequestedByExperience } from '@monterosa/sdk-identify-kit';
  *
- * const space = getSpace('host', 'space-id');
- * const identify = getIdentify(space);
+ * configure({ host: '...', projectId: '...' });
  *
- * const unsubscribe = onLogoutRequestedByExperience(identify, () => {
+ * const unsubscribe = onLogoutRequestedByExperience(() => {
  *   // logout requested by experience
  *   // perform logout from Auth service
  * });
@@ -457,14 +473,12 @@ export declare function onLoginRequestedByExperience(identify: IdentifyKit, call
  * // unsubscribe();
  * ```
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param callback - The callback function to register. This function will
  *   be called when a logout is requested by an Experience.
  * @returns An `Unsubscribe` function that can be called to unregister
  *   the callback function.
  */
-export declare function onLogoutRequestedByExperience(identify: IdentifyKit, callback: () => void): Unsubscribe;
+export declare function onLogoutRequestedByExperience(callback: () => void): Unsubscribe;
 /**
  *
  * @internal

package/dist/bridge.d.ts

@@ -6,12 +6,17 @@
  *
  * More details on the license can be found at https://www.monterosa.co/sdk/license
  */
-import { Experience } from '@monterosa/sdk-launcher-kit';
-import { IdentifyKit } from './types';
+import { Experience, ExperienceState, Message } from '@monterosa/sdk-launcher-kit';
 /**
+ * Process an incoming `Login` / `Logout` broadcast from the parent
+ * application. Updates the local credentials slot, enqueues login/logout
+ * for every existing identify, and forwards the broadcast downstream to
+ * this level's own embedded experiences — the mechanism that cascades a
+ * root-level `setCredentials` through every nested experience.
+ *
  * @internal
  */
-export declare function parentMessagesHook(identify: IdentifyKit): () => void;
+export declare function handleParentMessage(message: Message): void;
 /**
  * @internal
  */
@@ -20,3 +25,7 @@ export declare function handleExperienceEmbedded(experience: Experience): void;
  * @internal
  */
 export declare function handleExperienceUnmounted(experience: Experience): void;
+/**
+ * @internal
+ */
+export declare function handleExperienceStateChange(experience: Experience, state: ExperienceState): void;

package/dist/credentials_store.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+import { Emitter, Unsubscribe } from '@monterosa/sdk-util';
+import { Credentials } from './types';
+/**
+ * Root-owned credentials slot.
+ *
+ * Single source of truth at the root of an integration; an internal
+ * mirror at every other level, kept in sync via `Login` / `Logout`
+ * broadcasts. Not exposed publicly — public access flows through
+ * `setCredentials` / `getCredentials` / `clearCredentials` and
+ * `onCredentialsUpdated`.
+ *
+ * @internal
+ */
+export declare class CredentialsStore extends Emitter {
+    private static instance;
+    private _credentials;
+    private constructor();
+    static getInstance(): CredentialsStore;
+    get credentials(): Credentials | null;
+    set credentials(next: Credentials | null);
+    subscribe(handler: (value: Credentials | null) => void): Unsubscribe;
+    reset(): void;
+}