@monterosa/sdk-identify-kit 2.0.0-rc.2 → 2.0.0-rc.4

package/dist/index.cjs

@@ -0,0 +1,1224 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var sdkUtil = require('@monterosa/sdk-util');
+var sdkLauncherKit = require('@monterosa/sdk-launcher-kit');
+var sdkCore = require('@monterosa/sdk-core');
+var sdkConnectKit = require('@monterosa/sdk-connect-kit');
+var sdkInteractInterop = require('@monterosa/sdk-interact-interop');
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2023-2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+/**
+ * @internal
+ */
+var IdentifyEvent;
+(function (IdentifyEvent) {
+    IdentifyEvent["StateUpdated"] = "state_updated";
+    IdentifyEvent["LoginRequested"] = "login_requested";
+    IdentifyEvent["LogoutRequested"] = "logout_requested";
+    IdentifyEvent["CredentialsUpdated"] = "credentials_updated";
+    IdentifyEvent["LoginPolicyUpdated"] = "login_policy_updated";
+})(IdentifyEvent || (IdentifyEvent = {}));
+/**
+ * Defines a set of error codes that may be encountered when using the
+ * Identify kit of the Monterosa SDK.
+ *
+ * @example
+ * ```javascript
+ * try {
+ *   // some code that uses the IdentifyKit
+ * } catch (err) {
+ *   if (err.code === IdentifyError.NoCredentials) {
+ *     // handle missing credentials error
+ *   } else {
+ *     // handle other error types
+ *   }
+ * }
+ * ```
+ *
+ * @remarks
+ * - The `IdentifyError` enum provides a convenient way to handle errors
+ *   encountered when using the `IdentifyKit` module. By checking the code
+ *   property of the caught error against the values of the enum, the error
+ *   type can be determined and appropriate action taken.
+ *
+ * - The `IdentifyError` enum is not intended to be instantiated or extended.
+ */
+exports.IdentifyError = void 0;
+(function (IdentifyError) {
+    /**
+     * Indicates an error occurred during the call to the extension API.
+     */
+    IdentifyError["ExtensionApiError"] = "extension_api_error";
+    /**
+     * Indicates the extension required by the IdentifyKit is not set up properly.
+     */
+    IdentifyError["ExtensionNotSetup"] = "extension_not_setup";
+    /**
+     * Indicates the user's authentication credentials are not available
+     * or have expired.
+     */
+    IdentifyError["NoCredentials"] = "no_credentials";
+    /**
+     * Indicates an error occurred in the parent app.
+     */
+    IdentifyError["ParentAppError"] = "parent_app_error";
+    /**
+     * Indicates an unexpected or invalid login state was encountered.
+     */
+    IdentifyError["UnexpectedState"] = "unexpected_state";
+    /**
+     * Indicates there is no parent application to delegate to.
+     */
+    IdentifyError["NoParentApplication"] = "no_parent_application";
+    /**
+     * Indicates a timeout occurred when communicating with the parent app.
+     */
+    IdentifyError["ParentTimeoutError"] = "parent_timeout_error";
+})(exports.IdentifyError || (exports.IdentifyError = {}));
+/**
+ * @internal
+ */
+const IdentifyErrorMessages = {
+    [exports.IdentifyError.ExtensionApiError]: (error) => `Identify extension API returned an error: ${error}`,
+    [exports.IdentifyError.ExtensionNotSetup]: () => 'Identify extension is not set up for this project',
+    [exports.IdentifyError.NoCredentials]: () => 'Identify credentials are not set',
+    [exports.IdentifyError.ParentAppError]: (error) => `Parent application error: ${error}`,
+    [exports.IdentifyError.UnexpectedState]: (state) => `Unexpected LoginState: ${state}`,
+    [exports.IdentifyError.NoParentApplication]: () => 'No parent application available for delegation',
+    [exports.IdentifyError.ParentTimeoutError]: (error) => `Parent application timeout: ${error}. Please check if the identify-kit is imported on the parent page.`,
+};
+var IdentifyAction;
+(function (IdentifyAction) {
+    IdentifyAction["Login"] = "identifyLogin";
+    IdentifyAction["Logout"] = "identifyLogout";
+    IdentifyAction["RequestLogin"] = "identifyRequestLogin";
+    IdentifyAction["RequestLogout"] = "identifyRequestLogout";
+    IdentifyAction["GetCredentials"] = "identifyGetCredentials";
+    IdentifyAction["SetCredentials"] = "identifySetCredentials";
+    IdentifyAction["ClearCredentials"] = "identifyClearCredentials";
+})(IdentifyAction || (IdentifyAction = {}));
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2023 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+const EXTENSION_ID = 'lvis-id-custom-tab';
+const SIGNATURE_TTL = 10000;
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2023 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+class Identify extends sdkUtil.Emitter {
+    constructor(sdk, options = {}) {
+        super();
+        this.sdk = sdk;
+        this.wasLoggedIn = false;
+        this._signature = null;
+        this._userData = null;
+        this._state = {
+            state: 'logged_out',
+        };
+        this._options = Object.assign({ strategy: 'email', version: 1 }, options);
+    }
+    static async fetchIdentifyHost(host, projectId) {
+        var _a, _b;
+        const listings = await sdkInteractInterop.fetchListings(host, projectId);
+        const extensionAssets = (_b = (_a = listings.assets) === null || _a === void 0 ? void 0 : _a[EXTENSION_ID]) !== null && _b !== void 0 ? _b : [];
+        const endpointAsset = extensionAssets.find(({ name }) => name === 'endpoint');
+        if (!endpointAsset) {
+            throw sdkUtil.createError(exports.IdentifyError.ExtensionNotSetup, IdentifyErrorMessages);
+        }
+        return endpointAsset.data;
+    }
+    get state() {
+        return this._state;
+    }
+    set state(state) {
+        if (this._state.state === state.state) {
+            return;
+        }
+        switch (state.state) {
+            case 'logged_in':
+                this.wasLoggedIn = true;
+                break;
+            case 'error':
+                this.wasLoggedIn = false;
+                break;
+            case 'logged_out':
+            case 'pending':
+                // preserve wasLoggedIn — these states reflect transient transport
+                // state, not a deliberate logout (credentials are the gate for that)
+                break;
+            default: {
+                // Exhaustiveness check: TypeScript errors if a new state is added
+                // but not handled. This is a compile-time error.
+                //
+                // See: https://www.typescriptlang.org/docs/handbook/2/narrowing.html#exhaustiveness-checking
+                const exhaustiveCheck = state.state;
+                throw sdkUtil.createError(exports.IdentifyError.UnexpectedState, IdentifyErrorMessages, String(exhaustiveCheck));
+            }
+        }
+        this._state = state;
+        this.emit(IdentifyEvent.StateUpdated, state);
+    }
+    get options() {
+        return this._options;
+    }
+    set signature(signature) {
+        if (this._signature === signature) {
+            return;
+        }
+        this._signature = signature;
+        clearTimeout(this.signatureExpireTimeout);
+        if (signature !== null) {
+            this.signatureExpireTimeout = setTimeout(() => {
+                this.signature = null;
+            }, SIGNATURE_TTL);
+        }
+    }
+    get signature() {
+        return this._signature;
+    }
+    set userData(data) {
+        if (this._userData === data) {
+            return;
+        }
+        this._userData = data;
+    }
+    get userData() {
+        return this._userData;
+    }
+    async getUrl(path = '') {
+        const { host, projectId } = this.sdk.options;
+        if (this.host === undefined) {
+            this.host = await Identify.fetchIdentifyHost(host, projectId);
+        }
+        const url = new URL(this.host);
+        const { version, strategy, provider } = this._options;
+        url.pathname = `/v${version}${path}`;
+        url.searchParams.set('projectId', projectId);
+        url.searchParams.set('deviceId', sdkCore.getDeviceId());
+        url.searchParams.set('strategy', strategy);
+        if (provider !== undefined) {
+            url.searchParams.set('provider', provider);
+        }
+        return url.toString();
+    }
+}
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2025-2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+const entries = new Map();
+function getExperiences() {
+    return Array.from(entries.values()).map((entry) => entry.experience);
+}
+function addExperience(experience, unsubs = []) {
+    entries.set(experience.id, {
+        experience,
+        unsubs: new Set(unsubs),
+    });
+}
+function deleteExperience(experience) {
+    const entry = entries.get(experience.id);
+    if (entry) {
+        entry.unsubs.forEach((unsub) => unsub());
+        entries.delete(experience.id);
+    }
+}
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+/**
+ * Locally-owned login policy.
+ *
+ * Defaults to `'disabled'`. Set via the public `setLoginPolicy`. Never
+ * propagated across the wire — each level owns its own policy.
+ *
+ * @internal
+ */
+class LoginPolicyStore extends sdkUtil.Emitter {
+    constructor() {
+        super();
+        this._policy = 'disabled';
+    }
+    static getInstance() {
+        if (!LoginPolicyStore.instance) {
+            LoginPolicyStore.instance = new LoginPolicyStore();
+        }
+        return LoginPolicyStore.instance;
+    }
+    get policy() {
+        return this._policy;
+    }
+    set policy(next) {
+        if (this._policy === next) {
+            return;
+        }
+        this._policy = next;
+        this.emit(IdentifyEvent.LoginPolicyUpdated, next);
+    }
+    subscribe(handler) {
+        return sdkUtil.subscribe(this, IdentifyEvent.LoginPolicyUpdated, handler);
+    }
+    reset() {
+        this._policy = 'disabled';
+        this.off(IdentifyEvent.LoginPolicyUpdated);
+    }
+}
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+/**
+ * Root-owned credentials slot.
+ *
+ * Single source of truth at the root of an integration; an internal
+ * mirror at every other level, kept in sync via `Login` / `Logout`
+ * broadcasts. Not exposed publicly — public access flows through
+ * `setCredentials` / `getCredentials` / `clearCredentials` and
+ * `onCredentialsUpdated`.
+ *
+ * @internal
+ */
+class CredentialsStore extends sdkUtil.Emitter {
+    constructor() {
+        super();
+        this._credentials = null;
+    }
+    static getInstance() {
+        if (!CredentialsStore.instance) {
+            CredentialsStore.instance = new CredentialsStore();
+        }
+        return CredentialsStore.instance;
+    }
+    get credentials() {
+        return this._credentials;
+    }
+    set credentials(next) {
+        if (this._credentials === next) {
+            return;
+        }
+        this._credentials = next;
+        this.emit(IdentifyEvent.CredentialsUpdated, next);
+    }
+    subscribe(handler) {
+        return sdkUtil.subscribe(this, IdentifyEvent.CredentialsUpdated, handler);
+    }
+    reset() {
+        this._credentials = null;
+        this.off(IdentifyEvent.CredentialsUpdated);
+    }
+}
+
+/**
+ * @license
+ * identify-kit
+ *
+ * Copyright © 2023-2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+const loginPolicyStore = LoginPolicyStore.getInstance();
+const credentialsStore = CredentialsStore.getInstance();
+/**
+ * @internal
+ */
+const identifyKits = new Map();
+/**
+ * Emitter for identify request events that are not tied to a specific
+ * identify instance (login / logout requests).
+ *
+ * @internal
+ */
+const requestsEmitter = new sdkUtil.Emitter();
+/**
+ * Read the current locally-owned login policy.
+ *
+ * Returns `'disabled'` by default.
+ *
+ * @internal
+ */
+function getLoginPolicy() {
+    return loginPolicyStore.policy;
+}
+/**
+ * Set the locally-owned login policy.
+ *
+ * All `Identify` instances at this level honour the same policy; the
+ * value is never propagated across the wire (each level of a multi-level
+ * integration owns its own policy).
+ *
+ * Policy gates the Enmasse `loginTask` only — credentials always mirror
+ * from upstream regardless of policy. A `'disabled'` level still
+ * receives credentials via the module-load pull and the cascading
+ * `Login` / `Logout` broadcasts; it just doesn't attempt Enmasse
+ * validation against them.
+ *
+ * When the policy transitions to `'auto'`, enqueues a sync-state task
+ * for every existing identify so that any in-flight session is picked
+ * up.
+ *
+ * Idempotent: setting the same policy that's already in effect is a
+ * no-op.
+ *
+ * @param policy - `'auto'` to enable auto-login, `'disabled'` to opt out.
+ */
+function setLoginPolicy(policy) {
+    if (loginPolicyStore.policy === policy) {
+        return;
+    }
+    loginPolicyStore.policy = policy;
+    if (policy !== 'auto') {
+        return;
+    }
+    // On transition to 'auto': if the local credentials slot already
+    // has a value (typical after the non-root module-load pull, or after
+    // a setCredentials at the root, or after an upstream Login broadcast
+    // has cascaded down), enqueue a login task for each existing
+    // identify. If the slot is empty, do nothing — a future credentials
+    // arrival via `applyLogin` will trigger the login under this new
+    // policy.
+    const { credentials } = credentialsStore;
+    if (credentials === null) {
+        return;
+    }
+    for (const identify of identifyKits.values()) {
+        enqueueLogin(identify, credentials);
+    }
+}
+/**
+ * Whether the user should be auto-logged in on reconnect.
+ *
+ * True when the user was previously logged in, the policy is `'auto'`,
+ * and credentials are available on the identify instance.
+ *
+ * @internal
+ */
+function shouldLoginOnReconnect(identify) {
+    return (identify.wasLoggedIn &&
+        getLoginPolicy() === 'auto' &&
+        credentialsStore.credentials !== null);
+}
+/**
+ * @internal
+ */
+const taskQueue = new sdkUtil.TaskQueue();
+function isSdk(value) {
+    return value instanceof sdkCore.Sdk;
+}
+async function api(url, token, method = 'GET') {
+    const headers = {
+        accept: 'application/json',
+    };
+    let credentials;
+    // Only include Authorization header for bearer token authentication
+    // When token is 'cookie', use credentials: 'include' to ensure HttpOnly
+    // cookies are sent
+    if (token === 'cookie') {
+        // Use credentials: 'include' to ensure HttpOnly cookies are sent
+        credentials = 'include';
+    }
+    else {
+        headers.Authorization = `Bearer ${token}`;
+    }
+    const response = await fetch(url, {
+        method,
+        headers,
+        credentials,
+    });
+    const data = (await response.json());
+    if (data.result < 0) {
+        throw sdkUtil.createError(exports.IdentifyError.ExtensionApiError, IdentifyErrorMessages, data.message);
+    }
+    return data;
+}
+/**
+ * @internal
+ */
+async function sendParentRequest(action, payload) {
+    const parentApp = sdkLauncherKit.getParentApplication();
+    if (parentApp === null) {
+        throw sdkUtil.createError(exports.IdentifyError.NoParentApplication, IdentifyErrorMessages);
+    }
+    try {
+        const response = await sdkLauncherKit.sendSdkRequest(parentApp, action, payload);
+        const { error, data } = response.payload;
+        if (error !== undefined) {
+            throw sdkUtil.createError(exports.IdentifyError.ParentAppError, IdentifyErrorMessages, error);
+        }
+        return data;
+    }
+    catch (err) {
+        if (err instanceof sdkUtil.MonterosaError &&
+            err.code === sdkLauncherKit.BridgeError.RequestTimeoutError) {
+            const errorMessage = sdkUtil.getErrorMessage(err);
+            throw sdkUtil.createError(exports.IdentifyError.ParentTimeoutError, IdentifyErrorMessages, errorMessage);
+        }
+        throw err;
+    }
+}
+/**
+ * @internal
+ */
+async function login(identify, credentials) {
+    const signature = await getSessionSignatureMemoized(identify, credentials);
+    const conn = await sdkConnectKit.getConnect(identify.sdk.options.host);
+    await sdkConnectKit.connect(conn);
+    await sdkConnectKit.login(conn, ...signature);
+}
+const loginWithRetry = sdkUtil.withRetryAsync(login);
+/**
+ * @internal
+ */
+async function logout(identify) {
+    const conn = await sdkConnectKit.getConnect(identify.sdk.options.host);
+    await sdkConnectKit.connect(conn);
+    await sdkConnectKit.logout(conn);
+}
+const logoutWithRetry = sdkUtil.withRetryAsync(logout);
+/**
+ * @internal
+ */
+async function loginTask(identify, credentials) {
+    if (identify.state.state === 'logged_in') {
+        return;
+    }
+    try {
+        identify.state = {
+            state: 'pending',
+        };
+        await loginWithRetry(identify, credentials);
+        // Update state only if there are no pending tasks in the queue
+        if (taskQueue.isEmpty()) {
+            identify.state = {
+                state: 'logged_in',
+            };
+        }
+    }
+    catch (err) {
+        // Abandon any pending login/logout/sync tasks on failure — letting
+        // them run after an error would put the user in an inconsistent
+        // state. Note: this also drops tasks for unrelated identifies that
+        // share the queue; acceptable because the typical runtime has one
+        // identify per project.
+        taskQueue.clear();
+        identify.state = {
+            state: 'error',
+            error: err instanceof Error ? err.message : 'Unknown error',
+            errorType: 'login',
+        };
+    }
+}
+/**
+ * @internal
+ */
+async function logoutTask(identify) {
+    if (identify.state.state === 'logged_out') {
+        return;
+    }
+    try {
+        identify.state = {
+            state: 'pending',
+        };
+        await logoutWithRetry(identify);
+        // Update state only if there are no pending tasks in the queue
+        if (taskQueue.isEmpty()) {
+            identify.state = {
+                state: 'logged_out',
+            };
+        }
+    }
+    catch (err) {
+        // Abandon any pending login/logout/sync tasks on failure — see
+        // `loginTask` for the rationale.
+        taskQueue.clear();
+        identify.state = {
+            state: 'error',
+            error: err instanceof Error ? err.message : 'Unknown error',
+            errorType: 'logout',
+        };
+    }
+}
+/**
+ * Enqueue a `loginTask` for the given identify when `policy === 'auto'`.
+ * The downstream `Login` broadcast is emitted by {@link applyLogin}.
+ *
+ * @internal
+ */
+function enqueueLogin(identify, credentials, prioritise = false) {
+    if (getLoginPolicy() !== 'auto') {
+        return;
+    }
+    if (prioritise) {
+        taskQueue.enqueueFront(() => loginTask(identify, credentials));
+    }
+    else {
+        taskQueue.enqueue(() => loginTask(identify, credentials));
+    }
+}
+/**
+ * Reset the identify's identity-derived caches and enqueue a `logoutTask`
+ * when `policy === 'auto'`.
+ *
+ * @internal
+ */
+function enqueueLogout(identify) {
+    identify.userData = null;
+    identify.signature = null;
+    if (getLoginPolicy() !== 'auto') {
+        return;
+    }
+    taskQueue.enqueue(() => logoutTask(identify));
+}
+/**
+ * Apply new credentials at this level: update the slot, enqueue a
+ * `loginTask` for every existing identify on the null-to-set transition,
+ * and broadcast `Login` downstream to every embedded experience.
+ *
+ * Idempotent on token refresh: re-setting an already-set slot updates
+ * the value and broadcasts, but does not re-enqueue logins (their
+ * `loginTask` would short-circuit on `state === 'logged_in'` anyway).
+ *
+ * @internal
+ */
+function applyLogin(credentials) {
+    const shouldLogin = credentialsStore.credentials === null;
+    credentialsStore.credentials = credentials;
+    if (shouldLogin) {
+        for (const identify of identifyKits.values()) {
+            enqueueLogin(identify, credentials);
+        }
+    }
+    for (const experience of getExperiences()) {
+        sdkLauncherKit.sendSdkMessage(experience, IdentifyAction.Login, credentials);
+    }
+}
+/**
+ * Clear credentials at this level: null out the slot, enqueue a
+ * `logoutTask` for every existing identify on the set-to-null
+ * transition, and broadcast `Logout` downstream to every embedded
+ * experience.
+ *
+ * @internal
+ */
+function applyLogout() {
+    const shouldLogout = credentialsStore.credentials !== null;
+    credentialsStore.credentials = null;
+    if (shouldLogout) {
+        for (const identify of identifyKits.values()) {
+            enqueueLogout(identify);
+        }
+    }
+    for (const experience of getExperiences()) {
+        sdkLauncherKit.sendSdkMessage(experience, IdentifyAction.Logout, {});
+    }
+}
+/**
+ * Pull state from the parent application and apply locally.
+ *
+ * Fires once at non-root bridge module load, regardless of
+ * `loginPolicy` — token presence is the customer-side sign-in state and
+ * must mirror upstream whether or not we choose to validate against
+ * Enmasse. Best-effort: a missing or non-identify-kit parent silently
+ * resolves with no slot change.
+ *
+ * Uses {@link applyLogin} so the slot update cascades downstream to
+ * this level's own embedded experiences and per-identify loginTasks
+ * are enqueued under `loginPolicy === 'auto'`.
+ *
+ * @internal
+ */
+async function pullStateFromParent() {
+    let credentials;
+    try {
+        credentials = await getCredentials();
+    }
+    catch (_a) {
+        return;
+    }
+    if (credentials !== null) {
+        applyLogin(credentials);
+    }
+}
+function getIdentify(sdkOrOptions, options) {
+    let sdk;
+    let identifyOptions;
+    if (isSdk(sdkOrOptions)) {
+        /**
+         * Interface: getIdentify(sdk, options?)
+         */
+        sdk = sdkOrOptions;
+        if (options !== undefined) {
+            identifyOptions = options;
+        }
+        else {
+            identifyOptions = {};
+        }
+    }
+    else if (sdkOrOptions !== undefined) {
+        /**
+         * Interface: getIdentify(options)
+         */
+        sdk = sdkCore.getSdk();
+        identifyOptions = sdkOrOptions;
+    }
+    else {
+        /**
+         * Interface: getIdentify()
+         */
+        sdk = sdkCore.getSdk();
+        identifyOptions = {};
+    }
+    const { projectId } = sdk.options;
+    if (identifyKits.has(projectId)) {
+        return identifyKits.get(projectId);
+    }
+    const identify = new Identify(sdk, identifyOptions);
+    watchConnectionStatus(identify);
+    identifyKits.set(projectId, identify);
+    return identify;
+}
+/**
+ * Requests a user login.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { requestLogin } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * try {
+ *   await requestLogin();
+ *
+ *   console.log('Login request successful');
+ * } catch (err) {
+ *   console.error('Error requesting login:', err.message)
+ * }
+ * ```
+ *
+ * @remarks
+ * - If the app is running within a third-party application that uses
+ *   the Monterosa SDK, the function delegates to the parent app
+ *   to handle the login process.
+ *
+ * @returns A Promise that resolves with `void` when the login request
+ *   is completed.
+ */
+async function requestLogin() {
+    if (sdkLauncherKit.getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.RequestLogin);
+        return;
+    }
+    requestsEmitter.emit(IdentifyEvent.LoginRequested);
+}
+/**
+ * Read the current credentials, pulling from the parent application when
+ * called from an embedded experience.
+ *
+ * At the root this returns the canonical slot value. At a non-root
+ * experience this dispatches a `GetCredentials` request upstream and
+ * resolves with the response, ensuring the caller always sees the
+ * authoritative value rather than a possibly-stale local mirror.
+ *
+ * @returns A Promise that resolves to the current credentials, or `null`
+ *   if none are set.
+ */
+async function getCredentials() {
+    if (sdkLauncherKit.getParentApplication() === null) {
+        return credentialsStore.credentials;
+    }
+    return sendParentRequest(IdentifyAction.GetCredentials);
+}
+/**
+ * Requests a user logout.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { requestLogout } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * try {
+ *   await requestLogout();
+ *
+ *   console.log('Logout request successful');
+ * } catch (err) {
+ *   console.error('Error requesting logout:', err.message)
+ * }
+ * ```
+ *
+ * @remarks
+ * - If the app is running within a third-party application that uses
+ *   the Monterosa SDK, the function delegates to the parent app
+ *   to handle the logout process.
+ *
+ * @returns A Promise that resolves with `void` when the logout request
+ *   is completed.
+ */
+async function requestLogout() {
+    if (sdkLauncherKit.getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.RequestLogout);
+        return;
+    }
+    requestsEmitter.emit(IdentifyEvent.LogoutRequested);
+}
+/**
+ * @internal
+ *
+ * Returns a signature for a user session. The signature is based on the
+ * user's identifying information provided in the `IdentifyKit` instance.
+ *
+ * @remarks
+ * This function does not handle errors. Callers are responsible for catching
+ * and handling failures.
+ *
+ * @param identify - An instance of the `IdentifyKit` class used for user
+ *   identification.
+ * @param credentials - The credentials of the user.
+ *
+ * @returns A Promise that resolves to a `Signature` object.
+ */
+async function getSessionSignature(identify, credentials) {
+    if (identify.signature !== null) {
+        return identify.signature;
+    }
+    const url = await identify.getUrl('/user/check');
+    const { data } = await api(url, credentials.token);
+    const signature = [data.userId, data.timeStamp, data.signature];
+    identify.signature = signature;
+    return signature;
+}
+/**
+ * A memoized version of the `getSessionSignature` function. Memo key is
+ * the credentials token, so both leaf-side and bridge-side callers share
+ * the same cache for the same token.
+ */
+const getSessionSignatureMemoized = sdkUtil.memoizePromise(getSessionSignature, (identify, credentials) => credentials.token, {
+    clearOnResolve: true,
+    clearOnReject: true,
+});
+/**
+ * Fetches user data for the given credentials.
+ *
+ * Credentials are required explicitly so the precondition is visible at
+ * the call site — without them the function cannot be called. Obtain a
+ * `Credentials` value via {@link getCredentials} or the
+ * {@link onCredentialsUpdated} callback.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import {
+ *   getIdentify,
+ *   getUserData,
+ *   getCredentials,
+ * } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * const identify = getIdentify();
+ * const credentials = await getCredentials();
+ *
+ * if (credentials !== null) {
+ *   const userData = await getUserData(identify, credentials);
+ *   console.log('User data:', userData);
+ * }
+ * ```
+ *
+ * @remarks
+ * Cached on the identify instance after the first successful fetch.
+ * Cleared on {@link clearCredentials} via the logout path.
+ *
+ * @param identify - An instance of `IdentifyKit` that provides the user
+ *   identification functionality.
+ * @param credentials - The user's authentication credentials. The
+ *   request authorises against the value's token.
+ * @returns A Promise that resolves to a key-value object representing
+ *   user data. The structure and content of the user data object depend
+ *   on the identify service provider and may vary.
+ */
+async function getUserData(identify, credentials) {
+    if (identify.userData !== null) {
+        return identify.userData;
+    }
+    const url = await identify.getUrl('/user');
+    const { data } = await api(url, credentials.token);
+    identify.userData = data;
+    return data;
+}
+/**
+ * Sets the user's authentication credentials.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { setCredentials } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * await setCredentials({ token: 'abc123' });
+ * ```
+ *
+ * @remarks
+ * - At the root of an integration, the credentials are stored locally
+ *   and a `Login` broadcast is sent to every embedded experience.
+ * - When called from an embedded experience, the call is relayed
+ *   upstream via the `SetCredentials` wire action. The credentials are
+ *   ultimately applied at the root and propagate back down via the
+ *   cascading `Login` broadcast.
+ *
+ * @param credentials - An object representing the user's authentication
+ *   credentials.
+ * @returns A Promise that resolves to `void` once the credentials have
+ *   been written (root) or the upstream relay has completed (non-root).
+ */
+async function setCredentials(credentials) {
+    if (sdkLauncherKit.getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.SetCredentials, credentials);
+        return;
+    }
+    applyLogin(credentials);
+}
+/**
+ * Clears the user's authentication credentials.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { clearCredentials } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * await clearCredentials();
+ * ```
+ *
+ * @remarks
+ * - At the root of an integration, the credentials slot is cleared and
+ *   a `Logout` broadcast is sent to every embedded experience.
+ * - When called from an embedded experience, the call is relayed
+ *   upstream via the `ClearCredentials` wire action. The slot is
+ *   cleared at the root and the cascading `Logout` broadcast propagates
+ *   back down.
+ *
+ * @returns A Promise that resolves to `void` once the slot has been
+ *   cleared (root) or the upstream relay has completed (non-root).
+ */
+async function clearCredentials() {
+    if (sdkLauncherKit.getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.ClearCredentials);
+        return;
+    }
+    applyLogout();
+}
+/**
+ * Registers a callback function that will be called whenever the `LoginState`
+ * object associated with the `IdentifyKit` instance is updated.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { getIdentify, onStateUpdated } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * const identify = getIdentify();
+ *
+ * const unsubscribe = onStateUpdated(identify, (state) => {
+ *   console.log("State updated:", state);
+ * });
+ *
+ * // Call unsubscribe() to unregister the callback function
+ * // unsubscribe();
+ * ```
+ *
+ * @param identify - An instance of `IdentifyKit` that provides the user
+ *   identification functionality.
+ * @param callback - The callback function to register. This function will be
+ *   called with the updated `LoginState` object as its only argument.
+ * @returns An `Unsubscribe` function that can be called to unregister
+ *   the callback function.
+ */
+function onStateUpdated(identify, callback) {
+    return sdkUtil.subscribe(identify, IdentifyEvent.StateUpdated, callback);
+}
+/**
+ * Registers a callback function that will be called whenever the
+ * credentials slot is updated.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { onCredentialsUpdated } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * const unsubscribe = onCredentialsUpdated((credentials) => {
+ *   if (credentials !== null) {
+ *     console.log("Credentials updated:", credentials);
+ *   } else {
+ *     console.log("Credentials cleared.");
+ *   }
+ * });
+ *
+ * // Call unsubscribe() to unregister the callback function
+ * // unsubscribe();
+ * ```
+ *
+ * @param callback - The callback function to register. This function will be
+ *   called with the updated `Credentials` object as its only argument.
+ *   If the value `null` is received, it indicates that the credentials have
+ *   been cleared.
+ * @returns An `Unsubscribe` function that can be called to unregister
+ *   the callback function.
+ */
+function onCredentialsUpdated(callback) {
+    return credentialsStore.subscribe(callback);
+}
+/**
+ * Registers a callback function that will be called when a login is requested
+ * by an Experience.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { onLoginRequestedByExperience } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * const unsubscribe = onLoginRequestedByExperience(() => {
+ *   showLoginForm();
+ * });
+ *
+ * // Call unsubscribe() to unregister the callback function
+ * // unsubscribe();
+ * ```
+ *
+ * @param callback - The callback function to register. This function will
+ *   be called when a login is requested by an Experience.
+ * @returns An `Unsubscribe` function that can be called to unregister
+ *   the callback function.
+ */
+function onLoginRequestedByExperience(callback) {
+    return sdkUtil.subscribe(requestsEmitter, IdentifyEvent.LoginRequested, callback);
+}
+/**
+ * Registers a callback function that will be called when a logout is requested
+ * by an Experience.
+ *
+ * @example
+ * ```javascript
+ * import { configure } from '@monterosa/sdk-core';
+ * import { onLogoutRequestedByExperience } from '@monterosa/sdk-identify-kit';
+ *
+ * configure({ host: '...', projectId: '...' });
+ *
+ * const unsubscribe = onLogoutRequestedByExperience(() => {
+ *   // logout requested by experience
+ *   // perform logout from Auth service
+ * });
+ *
+ * // Call unsubscribe() to unregister the callback function
+ * // unsubscribe();
+ * ```
+ *
+ * @param callback - The callback function to register. This function will
+ *   be called when a logout is requested by an Experience.
+ * @returns An `Unsubscribe` function that can be called to unregister
+ *   the callback function.
+ */
+function onLogoutRequestedByExperience(callback) {
+    return sdkUtil.subscribe(requestsEmitter, IdentifyEvent.LogoutRequested, callback);
+}
+/**
+ *
+ * @internal
+ */
+async function watchConnectionStatus(identify) {
+    const conn = await sdkConnectKit.getConnect(identify.sdk.options.host);
+    sdkConnectKit.onConnected(conn, () => {
+        if (shouldLoginOnReconnect(identify)) {
+            enqueueLogin(identify, credentialsStore.credentials, true);
+        }
+        taskQueue.resume();
+    });
+    sdkConnectKit.onConnecting(conn, () => {
+        taskQueue.pause();
+        // If the user was logged in before the connection loss, set the state
+        // to pending to notify that the user is no longer logged in and a login
+        // attempt will be made when the connection is restored.
+        if (identify.state.state === 'logged_in') {
+            identify.state = {
+                state: 'pending',
+            };
+        }
+    });
+    sdkConnectKit.onDisconnected(conn, () => {
+        taskQueue.pause();
+        taskQueue.clear();
+        // If the user was logged in before the connection loss, set the state
+        // to logged_out to notify that the user is no longer logged in.
+        if (identify.state.state === 'logged_in') {
+            identify.state = {
+                state: 'logged_out',
+            };
+        }
+    });
+}
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2023-2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+/**
+ * Process an incoming `Login` / `Logout` broadcast from the parent
+ * application. Updates the local credentials slot, enqueues login/logout
+ * for every existing identify, and forwards the broadcast downstream to
+ * this level's own embedded experiences — the mechanism that cascades a
+ * root-level `setCredentials` through every nested experience.
+ *
+ * @internal
+ */
+function handleParentMessage(message) {
+    switch (message.action) {
+        case IdentifyAction.Login: {
+            applyLogin(message.payload);
+            break;
+        }
+        case IdentifyAction.Logout: {
+            applyLogout();
+            break;
+        }
+    }
+}
+/**
+ * @internal
+ */
+function handleExperienceEmbedded(experience) {
+    const sdkMessageUnsub = sdkLauncherKit.onSdkMessage(experience, async (message) => {
+        if (!Object.values(IdentifyAction).includes(message.action)) {
+            return;
+        }
+        const respond = (payload) => sdkLauncherKit.respondToSdkMessage(experience, message, payload);
+        try {
+            switch (message.action) {
+                case IdentifyAction.RequestLogin: {
+                    await requestLogin();
+                    respond();
+                    break;
+                }
+                case IdentifyAction.RequestLogout: {
+                    await requestLogout();
+                    respond();
+                    break;
+                }
+                case IdentifyAction.GetCredentials: {
+                    const data = await getCredentials();
+                    respond({ data });
+                    break;
+                }
+                case IdentifyAction.SetCredentials: {
+                    await setCredentials(message.payload);
+                    respond();
+                    break;
+                }
+                case IdentifyAction.ClearCredentials: {
+                    await clearCredentials();
+                    respond();
+                    break;
+                }
+            }
+        }
+        catch (err) {
+            respond({
+                error: sdkUtil.getErrorMessage(err),
+            });
+        }
+    });
+    addExperience(experience, [sdkMessageUnsub]);
+}
+/**
+ * @internal
+ */
+function handleExperienceUnmounted(experience) {
+    deleteExperience(experience);
+}
+/**
+ * @internal
+ */
+function handleExperienceStateChange(experience, state) {
+    if (state === 'mounted') {
+        handleExperienceEmbedded(experience);
+        return;
+    }
+    if (state === 'unmounted') {
+        handleExperienceUnmounted(experience);
+    }
+}
+function subscribeToExperienceLifecycle() {
+    sdkLauncherKit.onStateChanged(handleExperienceStateChange);
+}
+function connectToParentApplication() {
+    const parentApp = sdkLauncherKit.getParentApplication();
+    if (parentApp === null) {
+        return;
+    }
+    sdkLauncherKit.onSdkMessage(parentApp, handleParentMessage);
+    pullStateFromParent();
+}
+subscribeToExperienceLifecycle();
+connectToParentApplication();
+
+exports.clearCredentials = clearCredentials;
+exports.getCredentials = getCredentials;
+exports.getIdentify = getIdentify;
+exports.getUserData = getUserData;
+exports.onCredentialsUpdated = onCredentialsUpdated;
+exports.onLoginRequestedByExperience = onLoginRequestedByExperience;
+exports.onLogoutRequestedByExperience = onLogoutRequestedByExperience;
+exports.onStateUpdated = onStateUpdated;
+exports.requestLogin = requestLogin;
+exports.requestLogout = requestLogout;
+exports.setCredentials = setCredentials;
+exports.setLoginPolicy = setLoginPolicy;
+//# sourceMappingURL=index.cjs.map