@monterosa/sdk-identify-kit 2.0.0-rc.3 → 2.0.0-rc.4

package/dist/index.js

@@ -1,6 +1,6 @@
-import { getDeviceId, Sdk, getSdk, configure, getSdks } from '@monterosa/sdk-core';
-import { Emitter, createError, TaskQueue, withRetryAsync, memoizePromise, subscribe, MonterosaError, getErrorMessage } from '@monterosa/sdk-util';
+import { Emitter, createError, subscribe, TaskQueue, withRetryAsync, memoizePromise, MonterosaError, getErrorMessage } from '@monterosa/sdk-util';
 import { getParentApplication, sendSdkRequest, BridgeError, sendSdkMessage, onStateChanged, onSdkMessage, respondToSdkMessage } from '@monterosa/sdk-launcher-kit';
+import { getDeviceId, Sdk, getSdk } from '@monterosa/sdk-core';
 import { getConnect, connect, login as login$1, logout as logout$1, onConnected, onConnecting, onDisconnected } from '@monterosa/sdk-connect-kit';
 import { fetchListings } from '@monterosa/sdk-interact-interop';
 
@@ -20,10 +20,8 @@ var IdentifyEvent;
     IdentifyEvent["StateUpdated"] = "state_updated";
     IdentifyEvent["LoginRequested"] = "login_requested";
     IdentifyEvent["LogoutRequested"] = "logout_requested";
-    IdentifyEvent["SignatureUpdated"] = "signature_updated";
-    IdentifyEvent["UserdataUpdated"] = "userdata_updated";
     IdentifyEvent["CredentialsUpdated"] = "credentials_updated";
-    IdentifyEvent["EnmasseLogin"] = "enmasse_login";
+    IdentifyEvent["LoginPolicyUpdated"] = "login_policy_updated";
 })(IdentifyEvent || (IdentifyEvent = {}));
 /**
  * Defines a set of error codes that may be encountered when using the
@@ -36,8 +34,6 @@ var IdentifyEvent;
  * } catch (err) {
  *   if (err.code === IdentifyError.NoCredentials) {
  *     // handle missing credentials error
- *   } else if (err.code === IdentifyError.NotInitialised) {
- *     // handle initialization error
  *   } else {
  *     // handle other error types
  *   }
@@ -67,10 +63,6 @@ var IdentifyError;
      * or have expired.
      */
     IdentifyError["NoCredentials"] = "no_credentials";
-    /**
-     * Indicates the IdentifyKit has not been initialised properly.
-     */
-    IdentifyError["NotInitialised"] = "not_initialised";
     /**
      * Indicates an error occurred in the parent app.
      */
@@ -95,7 +87,6 @@ const IdentifyErrorMessages = {
     [IdentifyError.ExtensionApiError]: (error) => `Identify extension API returned an error: ${error}`,
     [IdentifyError.ExtensionNotSetup]: () => 'Identify extension is not set up for this project',
     [IdentifyError.NoCredentials]: () => 'Identify credentials are not set',
-    [IdentifyError.NotInitialised]: () => 'Identify instance is not initialised',
     [IdentifyError.ParentAppError]: (error) => `Parent application error: ${error}`,
     [IdentifyError.UnexpectedState]: (state) => `Unexpected LoginState: ${state}`,
     [IdentifyError.NoParentApplication]: () => 'No parent application available for delegation',
@@ -107,14 +98,9 @@ var IdentifyAction;
     IdentifyAction["Logout"] = "identifyLogout";
     IdentifyAction["RequestLogin"] = "identifyRequestLogin";
     IdentifyAction["RequestLogout"] = "identifyRequestLogout";
-    IdentifyAction["GetUserData"] = "identifyGetUserData";
-    IdentifyAction["GetSessionSignature"] = "identifyGetSessionSignature";
+    IdentifyAction["GetCredentials"] = "identifyGetCredentials";
     IdentifyAction["SetCredentials"] = "identifySetCredentials";
     IdentifyAction["ClearCredentials"] = "identifyClearCredentials";
-    IdentifyAction["OnStateUpdated"] = "identifyOnStateUpdated";
-    IdentifyAction["OnCredentialsUpdated"] = "identifyOnCredentialsUpdated";
-    IdentifyAction["OnUserDataUpdated"] = "identifyOnUserDataUpdated";
-    IdentifyAction["OnSessionSignatureUpdated"] = "identifyOnSessionSignatureUpdated";
 })(IdentifyAction || (IdentifyAction = {}));
 
 /**
@@ -141,13 +127,12 @@ class Identify extends Emitter {
         super();
         this.sdk = sdk;
         this.wasLoggedIn = false;
-        this._credentials = null;
         this._signature = null;
         this._userData = null;
         this._state = {
             state: 'logged_out',
         };
-        this._options = Object.assign({ strategy: 'email', deviceId: getDeviceId(), version: 1, loginPolicy: 'disabled' }, options);
+        this._options = Object.assign({ strategy: 'email', version: 1 }, options);
     }
     static async fetchIdentifyHost(host, projectId) {
         var _a, _b;
@@ -170,12 +155,13 @@ class Identify extends Emitter {
             case 'logged_in':
                 this.wasLoggedIn = true;
                 break;
-            case 'logged_out':
             case 'error':
                 this.wasLoggedIn = false;
                 break;
+            case 'logged_out':
             case 'pending':
-                // preserve wasLoggedIn value during transitional state
+                // preserve wasLoggedIn — these states reflect transient transport
+                // state, not a deliberate logout (credentials are the gate for that)
                 break;
             default: {
                 // Exhaustiveness check: TypeScript errors if a new state is added
@@ -203,53 +189,29 @@ class Identify extends Emitter {
                 this.signature = null;
             }, SIGNATURE_TTL);
         }
-        this.emit(IdentifyEvent.SignatureUpdated, this.signature);
     }
     get signature() {
         return this._signature;
     }
-    set credentials(credentials) {
-        if (this._credentials === credentials) {
-            return;
-        }
-        this._credentials = credentials;
-        this.emit(IdentifyEvent.CredentialsUpdated, credentials);
-    }
-    get credentials() {
-        return this._credentials;
-    }
     set userData(data) {
         if (this._userData === data) {
             return;
         }
         this._userData = data;
-        clearTimeout(this.userDataExpireTimeout);
-        this.emit(IdentifyEvent.UserdataUpdated, data);
     }
     get userData() {
         return this._userData;
     }
-    get shouldLoginOnReconnect() {
-        return (this.wasLoggedIn &&
-            this.options.loginPolicy === 'auto' &&
-            this.credentials !== null);
-    }
-    reset() {
-        this.credentials = null;
-        this.userData = null;
-        this.signature = null;
-        this.wasLoggedIn = false;
-    }
     async getUrl(path = '') {
-        const { options: { host, projectId }, } = this.sdk;
+        const { host, projectId } = this.sdk.options;
         if (this.host === undefined) {
             this.host = await Identify.fetchIdentifyHost(host, projectId);
         }
         const url = new URL(this.host);
-        const { version, deviceId, strategy, provider } = this._options;
+        const { version, strategy, provider } = this._options;
         url.pathname = `/v${version}${path}`;
         url.searchParams.set('projectId', projectId);
-        url.searchParams.set('deviceId', deviceId);
+        url.searchParams.set('deviceId', getDeviceId());
         url.searchParams.set('strategy', strategy);
         if (provider !== undefined) {
             url.searchParams.set('provider', provider);
@@ -284,6 +246,101 @@ function deleteExperience(experience) {
     }
 }
 
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+/**
+ * Locally-owned login policy.
+ *
+ * Defaults to `'disabled'`. Set via the public `setLoginPolicy`. Never
+ * propagated across the wire — each level owns its own policy.
+ *
+ * @internal
+ */
+class LoginPolicyStore extends Emitter {
+    constructor() {
+        super();
+        this._policy = 'disabled';
+    }
+    static getInstance() {
+        if (!LoginPolicyStore.instance) {
+            LoginPolicyStore.instance = new LoginPolicyStore();
+        }
+        return LoginPolicyStore.instance;
+    }
+    get policy() {
+        return this._policy;
+    }
+    set policy(next) {
+        if (this._policy === next) {
+            return;
+        }
+        this._policy = next;
+        this.emit(IdentifyEvent.LoginPolicyUpdated, next);
+    }
+    subscribe(handler) {
+        return subscribe(this, IdentifyEvent.LoginPolicyUpdated, handler);
+    }
+    reset() {
+        this._policy = 'disabled';
+        this.off(IdentifyEvent.LoginPolicyUpdated);
+    }
+}
+
+/**
+ * @license
+ * @monterosa/sdk-identify-kit
+ *
+ * Copyright © 2026 Monterosa Productions Limited. All rights reserved.
+ *
+ * More details on the license can be found at https://www.monterosa.co/sdk/license
+ */
+/**
+ * Root-owned credentials slot.
+ *
+ * Single source of truth at the root of an integration; an internal
+ * mirror at every other level, kept in sync via `Login` / `Logout`
+ * broadcasts. Not exposed publicly — public access flows through
+ * `setCredentials` / `getCredentials` / `clearCredentials` and
+ * `onCredentialsUpdated`.
+ *
+ * @internal
+ */
+class CredentialsStore extends Emitter {
+    constructor() {
+        super();
+        this._credentials = null;
+    }
+    static getInstance() {
+        if (!CredentialsStore.instance) {
+            CredentialsStore.instance = new CredentialsStore();
+        }
+        return CredentialsStore.instance;
+    }
+    get credentials() {
+        return this._credentials;
+    }
+    set credentials(next) {
+        if (this._credentials === next) {
+            return;
+        }
+        this._credentials = next;
+        this.emit(IdentifyEvent.CredentialsUpdated, next);
+    }
+    subscribe(handler) {
+        return subscribe(this, IdentifyEvent.CredentialsUpdated, handler);
+    }
+    reset() {
+        this._credentials = null;
+        this.off(IdentifyEvent.CredentialsUpdated);
+    }
+}
+
 /**
  * @license
  * identify-kit
@@ -292,8 +349,87 @@ function deleteExperience(experience) {
  *
  * More details on the license can be found at https://www.monterosa.co/sdk/license
  */
+const loginPolicyStore = LoginPolicyStore.getInstance();
+const credentialsStore = CredentialsStore.getInstance();
+/**
+ * @internal
+ */
 const identifyKits = new Map();
-const identifyHooks = [];
+/**
+ * Emitter for identify request events that are not tied to a specific
+ * identify instance (login / logout requests).
+ *
+ * @internal
+ */
+const requestsEmitter = new Emitter();
+/**
+ * Read the current locally-owned login policy.
+ *
+ * Returns `'disabled'` by default.
+ *
+ * @internal
+ */
+function getLoginPolicy() {
+    return loginPolicyStore.policy;
+}
+/**
+ * Set the locally-owned login policy.
+ *
+ * All `Identify` instances at this level honour the same policy; the
+ * value is never propagated across the wire (each level of a multi-level
+ * integration owns its own policy).
+ *
+ * Policy gates the Enmasse `loginTask` only — credentials always mirror
+ * from upstream regardless of policy. A `'disabled'` level still
+ * receives credentials via the module-load pull and the cascading
+ * `Login` / `Logout` broadcasts; it just doesn't attempt Enmasse
+ * validation against them.
+ *
+ * When the policy transitions to `'auto'`, enqueues a sync-state task
+ * for every existing identify so that any in-flight session is picked
+ * up.
+ *
+ * Idempotent: setting the same policy that's already in effect is a
+ * no-op.
+ *
+ * @param policy - `'auto'` to enable auto-login, `'disabled'` to opt out.
+ */
+function setLoginPolicy(policy) {
+    if (loginPolicyStore.policy === policy) {
+        return;
+    }
+    loginPolicyStore.policy = policy;
+    if (policy !== 'auto') {
+        return;
+    }
+    // On transition to 'auto': if the local credentials slot already
+    // has a value (typical after the non-root module-load pull, or after
+    // a setCredentials at the root, or after an upstream Login broadcast
+    // has cascaded down), enqueue a login task for each existing
+    // identify. If the slot is empty, do nothing — a future credentials
+    // arrival via `applyLogin` will trigger the login under this new
+    // policy.
+    const { credentials } = credentialsStore;
+    if (credentials === null) {
+        return;
+    }
+    for (const identify of identifyKits.values()) {
+        enqueueLogin(identify, credentials);
+    }
+}
+/**
+ * Whether the user should be auto-logged in on reconnect.
+ *
+ * True when the user was previously logged in, the policy is `'auto'`,
+ * and credentials are available on the identify instance.
+ *
+ * @internal
+ */
+function shouldLoginOnReconnect(identify) {
+    return (identify.wasLoggedIn &&
+        getLoginPolicy() === 'auto' &&
+        credentialsStore.credentials !== null);
+}
 /**
  * @internal
  */
@@ -330,17 +466,13 @@ async function api(url, token, method = 'GET') {
 /**
  * @internal
  */
-async function parentAppRequest(identify, action, payload) {
-    var _a;
+async function sendParentRequest(action, payload) {
     const parentApp = getParentApplication();
     if (parentApp === null) {
         throw createError(IdentifyError.NoParentApplication, IdentifyErrorMessages);
     }
-    const { host, projectId } = identify.sdk.options;
-    // Preserve existing origin (relay) or set from current context (source)
-    const origin = (_a = payload === null || payload === void 0 ? void 0 : payload.origin) !== null && _a !== void 0 ? _a : { host, projectId };
     try {
-        const response = await sendSdkRequest(parentApp, action, Object.assign(Object.assign({}, payload), { origin }));
+        const response = await sendSdkRequest(parentApp, action, payload);
         const { error, data } = response.payload;
         if (error !== undefined) {
             throw createError(IdentifyError.ParentAppError, IdentifyErrorMessages, error);
@@ -356,12 +488,6 @@ async function parentAppRequest(identify, action, payload) {
         throw err;
     }
 }
-/**
- * @internal
- */
-function registerIdentifyHook(hook) {
-    identifyHooks.push(hook);
-}
 /**
  * @internal
  */
@@ -385,6 +511,9 @@ const logoutWithRetry = withRetryAsync(logout);
  * @internal
  */
 async function loginTask(identify, credentials) {
+    if (identify.state.state === 'logged_in') {
+        return;
+    }
     try {
         identify.state = {
             state: 'pending',
@@ -398,6 +527,11 @@ async function loginTask(identify, credentials) {
         }
     }
     catch (err) {
+        // Abandon any pending login/logout/sync tasks on failure — letting
+        // them run after an error would put the user in an inconsistent
+        // state. Note: this also drops tasks for unrelated identifies that
+        // share the queue; acceptable because the typical runtime has one
+        // identify per project.
         taskQueue.clear();
         identify.state = {
             state: 'error',
@@ -410,6 +544,9 @@ async function loginTask(identify, credentials) {
  * @internal
  */
 async function logoutTask(identify) {
+    if (identify.state.state === 'logged_out') {
+        return;
+    }
     try {
         identify.state = {
             state: 'pending',
@@ -423,6 +560,8 @@ async function logoutTask(identify) {
         }
     }
     catch (err) {
+        // Abandon any pending login/logout/sync tasks on failure — see
+        // `loginTask` for the rationale.
         taskQueue.clear();
         identify.state = {
             state: 'error',
@@ -432,15 +571,53 @@ async function logoutTask(identify) {
     }
 }
 /**
+ * Enqueue a `loginTask` for the given identify when `policy === 'auto'`.
+ * The downstream `Login` broadcast is emitted by {@link applyLogin}.
+ *
  * @internal
  */
 function enqueueLogin(identify, credentials, prioritise = false) {
-    if (identify.options.loginPolicy === 'auto') {
-        if (prioritise) {
-            taskQueue.enqueueFront(() => loginTask(identify, credentials));
-        }
-        else {
-            taskQueue.enqueue(() => loginTask(identify, credentials));
+    if (getLoginPolicy() !== 'auto') {
+        return;
+    }
+    if (prioritise) {
+        taskQueue.enqueueFront(() => loginTask(identify, credentials));
+    }
+    else {
+        taskQueue.enqueue(() => loginTask(identify, credentials));
+    }
+}
+/**
+ * Reset the identify's identity-derived caches and enqueue a `logoutTask`
+ * when `policy === 'auto'`.
+ *
+ * @internal
+ */
+function enqueueLogout(identify) {
+    identify.userData = null;
+    identify.signature = null;
+    if (getLoginPolicy() !== 'auto') {
+        return;
+    }
+    taskQueue.enqueue(() => logoutTask(identify));
+}
+/**
+ * Apply new credentials at this level: update the slot, enqueue a
+ * `loginTask` for every existing identify on the null-to-set transition,
+ * and broadcast `Login` downstream to every embedded experience.
+ *
+ * Idempotent on token refresh: re-setting an already-set slot updates
+ * the value and broadcasts, but does not re-enqueue logins (their
+ * `loginTask` would short-circuit on `state === 'logged_in'` anyway).
+ *
+ * @internal
+ */
+function applyLogin(credentials) {
+    const shouldLogin = credentialsStore.credentials === null;
+    credentialsStore.credentials = credentials;
+    if (shouldLogin) {
+        for (const identify of identifyKits.values()) {
+            enqueueLogin(identify, credentials);
         }
     }
     for (const experience of getExperiences()) {
@@ -448,14 +625,50 @@ function enqueueLogin(identify, credentials, prioritise = false) {
     }
 }
 /**
+ * Clear credentials at this level: null out the slot, enqueue a
+ * `logoutTask` for every existing identify on the set-to-null
+ * transition, and broadcast `Logout` downstream to every embedded
+ * experience.
+ *
  * @internal
  */
-function enqueueLogout(identify) {
-    if (identify.options.loginPolicy === 'auto') {
-        taskQueue.enqueue(() => logoutTask(identify));
+function applyLogout() {
+    const shouldLogout = credentialsStore.credentials !== null;
+    credentialsStore.credentials = null;
+    if (shouldLogout) {
+        for (const identify of identifyKits.values()) {
+            enqueueLogout(identify);
+        }
     }
     for (const experience of getExperiences()) {
-        sendSdkMessage(experience, IdentifyAction.Logout);
+        sendSdkMessage(experience, IdentifyAction.Logout, {});
+    }
+}
+/**
+ * Pull state from the parent application and apply locally.
+ *
+ * Fires once at non-root bridge module load, regardless of
+ * `loginPolicy` — token presence is the customer-side sign-in state and
+ * must mirror upstream whether or not we choose to validate against
+ * Enmasse. Best-effort: a missing or non-identify-kit parent silently
+ * resolves with no slot change.
+ *
+ * Uses {@link applyLogin} so the slot update cascades downstream to
+ * this level's own embedded experiences and per-identify loginTasks
+ * are enqueued under `loginPolicy === 'auto'`.
+ *
+ * @internal
+ */
+async function pullStateFromParent() {
+    let credentials;
+    try {
+        credentials = await getCredentials();
+    }
+    catch (_a) {
+        return;
+    }
+    if (credentials !== null) {
+        applyLogin(credentials);
     }
 }
 function getIdentify(sdkOrOptions, options) {
@@ -487,36 +700,31 @@ function getIdentify(sdkOrOptions, options) {
         sdk = getSdk();
         identifyOptions = {};
     }
-    const { options: { projectId }, } = sdk;
+    const { projectId } = sdk.options;
     if (identifyKits.has(projectId)) {
         return identifyKits.get(projectId);
     }
     const identify = new Identify(sdk, identifyOptions);
-    for (const hook of identifyHooks) {
-        hook(identify);
-    }
     watchConnectionStatus(identify);
     identifyKits.set(projectId, identify);
     return identify;
 }
 /**
- * A function that requests a user login via the `IdentifyKit` of the Monterosa SDK.
+ * Requests a user login.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, requestLogin } from '@monterosa/sdk-identify-kit';
+ * import { requestLogin } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
  * try {
- *   const identify = getIdentify();
- *
- *   await requestLogin(identify);
+ *   await requestLogin();
  *
  *   console.log('Login request successful');
  * } catch (err) {
- *   console.error('Error requesting login:', error.message)
+ *   console.error('Error requesting login:', err.message)
  * }
  * ```
  *
@@ -525,56 +733,67 @@ function getIdentify(sdkOrOptions, options) {
  *   the Monterosa SDK, the function delegates to the parent app
  *   to handle the login process.
  *
- * @param identify - An instance of the `IdentifyKit` class used for user
- *   identification.
  * @returns A Promise that resolves with `void` when the login request
  *   is completed.
  */
-async function requestLogin(identify) {
-    const parentApp = getParentApplication();
-    if (parentApp !== null) {
-        await parentAppRequest(identify, IdentifyAction.RequestLogin);
+async function requestLogin() {
+    if (getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.RequestLogin);
         return;
     }
-    identify.emit(IdentifyEvent.LoginRequested);
+    requestsEmitter.emit(IdentifyEvent.LoginRequested);
+}
+/**
+ * Read the current credentials, pulling from the parent application when
+ * called from an embedded experience.
+ *
+ * At the root this returns the canonical slot value. At a non-root
+ * experience this dispatches a `GetCredentials` request upstream and
+ * resolves with the response, ensuring the caller always sees the
+ * authoritative value rather than a possibly-stale local mirror.
+ *
+ * @returns A Promise that resolves to the current credentials, or `null`
+ *   if none are set.
+ */
+async function getCredentials() {
+    if (getParentApplication() === null) {
+        return credentialsStore.credentials;
+    }
+    return sendParentRequest(IdentifyAction.GetCredentials);
 }
 /**
- * A function that requests a user login via the `IdentifyKit` of the Space.
+ * Requests a user logout.
  *
  * @example
  * ```javascript
- * import { getSpace } from '@monterosa/sdk-core';
- * import { getIdentify, requestLogout } from '@monterosa/sdk-identify-kit';
+ * import { configure } from '@monterosa/sdk-core';
+ * import { requestLogout } from '@monterosa/sdk-identify-kit';
  *
- * const space = getSpace('host', 'space-id');
- * const identify = getIdentify(space);
+ * configure({ host: '...', projectId: '...' });
  *
  * try {
- *   await requestLogout(identify);
+ *   await requestLogout();
  *
  *   console.log('Logout request successful');
  * } catch (err) {
- *   console.error('Error requesting logout:', error.message)
+ *   console.error('Error requesting logout:', err.message)
  * }
  * ```
  *
  * @remarks
  * - If the app is running within a third-party application that uses
- *   the Space, the function delegates to the parent app
+ *   the Monterosa SDK, the function delegates to the parent app
  *   to handle the logout process.
  *
- * @param identify - An instance of the `IdentifyKit` class used for user
- *   identification.
  * @returns A Promise that resolves with `void` when the logout request
  *   is completed.
  */
-async function requestLogout(identify) {
-    const parentApp = getParentApplication();
-    if (parentApp !== null) {
-        await parentAppRequest(identify, IdentifyAction.RequestLogout);
+async function requestLogout() {
+    if (getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.RequestLogout);
         return;
     }
-    identify.emit(IdentifyEvent.LogoutRequested);
+    requestsEmitter.emit(IdentifyEvent.LogoutRequested);
 }
 /**
  * @internal
@@ -593,11 +812,6 @@ async function requestLogout(identify) {
  * @returns A Promise that resolves to a `Signature` object.
  */
 async function getSessionSignature(identify, credentials) {
-    const parentApp = getParentApplication();
-    if (parentApp !== null) {
-        const signature = await parentAppRequest(identify, IdentifyAction.GetSessionSignature, credentials);
-        return signature;
-    }
     if (identify.signature !== null) {
         return identify.signature;
     }
@@ -608,59 +822,60 @@ async function getSessionSignature(identify, credentials) {
     return signature;
 }
 /**
- * A memoized version of the `getSessionSignature` function.
+ * A memoized version of the `getSessionSignature` function. Memo key is
+ * the credentials token, so both leaf-side and bridge-side callers share
+ * the same cache for the same token.
  */
 const getSessionSignatureMemoized = memoizePromise(getSessionSignature, (identify, credentials) => credentials.token, {
     clearOnResolve: true,
     clearOnReject: true,
 });
 /**
- * The function that takes an instance of `IdentifyKit` as its argument and
- * returns a Promise that resolves to a key-value object representing user data.
+ * Fetches user data for the given credentials.
+ *
+ * Credentials are required explicitly so the precondition is visible at
+ * the call site — without them the function cannot be called. Obtain a
+ * `Credentials` value via {@link getCredentials} or the
+ * {@link onCredentialsUpdated} callback.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, getUserData } from '@monterosa/sdk-identify-kit';
+ * import {
+ *   getIdentify,
+ *   getUserData,
+ *   getCredentials,
+ * } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
  * const identify = getIdentify();
- * const userData = await getUserData(identify);
+ * const credentials = await getCredentials();
  *
- * console.log('User data:', userData);
+ * if (credentials !== null) {
+ *   const userData = await getUserData(identify, credentials);
+ *   console.log('User data:', userData);
+ * }
  * ```
  *
  * @remarks
- * - If the app is running within a third-party application that uses
- *   the Monterosa SDK, the function delegates to the parent app
- *   to get user data.
- *
- * - If the request is successful, the function resolves with a key-value object
- *   representing user data. If not, a `MonterosaError` is thrown.
+ * Cached on the identify instance after the first successful fetch.
+ * Cleared on {@link clearCredentials} via the logout path.
  *
  * @param identify - An instance of `IdentifyKit` that provides the user
  *   identification functionality.
- * @returns A Promise that resolves to a key-value object representing user data.
- *   The structure and content of the user data object depend on the identify
- *   service provider and may vary. It typically contains information about the user,
- *   but the specific fields are determined by the Identify service provider.
+ * @param credentials - The user's authentication credentials. The
+ *   request authorises against the value's token.
+ * @returns A Promise that resolves to a key-value object representing
+ *   user data. The structure and content of the user data object depend
+ *   on the identify service provider and may vary.
  */
-async function getUserData(identify) {
-    const parentApp = getParentApplication();
-    if (parentApp !== null) {
-        const userData = await parentAppRequest(identify, IdentifyAction.GetUserData);
-        return userData;
-    }
-    // Return cached user data if available
+async function getUserData(identify, credentials) {
     if (identify.userData !== null) {
         return identify.userData;
     }
-    if (identify.credentials === null) {
-        throw createError(IdentifyError.NoCredentials, IdentifyErrorMessages);
-    }
     const url = await identify.getUrl('/user');
-    const { data } = await api(url, identify.credentials.token);
+    const { data } = await api(url, credentials.token);
     identify.userData = data;
     return data;
 }
@@ -670,41 +885,32 @@ async function getUserData(identify) {
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, setCredentials } from '@monterosa/sdk-identify-kit';
+ * import { setCredentials } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const credentials = { token: 'abc123' };
- * const identify = getIdentify();
- *
- * await setCredentials(identify, credentials)
+ * await setCredentials({ token: 'abc123' });
  * ```
  *
  * @remarks
- * - If the app is running within a third-party application that uses
- *   the Monterosa SDK, the function delegates to the parent app
- *   to set user credentials.
- *
- * - If the request is successful, the function resolves to `void`.
- *   If not, a `MonterosaError` is thrown.
+ * - At the root of an integration, the credentials are stored locally
+ *   and a `Login` broadcast is sent to every embedded experience.
+ * - When called from an embedded experience, the call is relayed
+ *   upstream via the `SetCredentials` wire action. The credentials are
+ *   ultimately applied at the root and propagate back down via the
+ *   cascading `Login` broadcast.
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param credentials - An object representing the user's authentication
  *   credentials.
- * @returns A Promise that resolves to `void`.
+ * @returns A Promise that resolves to `void` once the credentials have
+ *   been written (root) or the upstream relay has completed (non-root).
  */
-async function setCredentials(identify, credentials) {
-    const parentApp = getParentApplication();
-    if (parentApp !== null) {
-        await parentAppRequest(identify, IdentifyAction.SetCredentials, credentials);
+async function setCredentials(credentials) {
+    if (getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.SetCredentials, credentials);
         return;
     }
-    const shouldLogin = identify.credentials === null;
-    identify.credentials = credentials;
-    if (shouldLogin) {
-        enqueueLogin(identify, credentials);
-    }
+    applyLogin(credentials);
 }
 /**
  * Clears the user's authentication credentials.
@@ -712,40 +918,30 @@ async function setCredentials(identify, credentials) {
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, clearCredentials } from '@monterosa/sdk-identify-kit';
+ * import { clearCredentials } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const identify = getIdentify();
- *
- * await clearCredentials(identify);
+ * await clearCredentials();
  * ```
  *
  * @remarks
- * - If the app is running within a third-party application that uses
- *   the Monterosa SDK, the function delegates to the parent app
- *   to clear user credentials.
- *
- * - If the request is successful, the function resolves to `void`.
- *   If not, a `MonterosaError` is thrown.
- *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
- * @returns A Promise that resolves to `void`.
+ * - At the root of an integration, the credentials slot is cleared and
+ *   a `Logout` broadcast is sent to every embedded experience.
+ * - When called from an embedded experience, the call is relayed
+ *   upstream via the `ClearCredentials` wire action. The slot is
+ *   cleared at the root and the cascading `Logout` broadcast propagates
+ *   back down.
+ *
+ * @returns A Promise that resolves to `void` once the slot has been
+ *   cleared (root) or the upstream relay has completed (non-root).
  */
-async function clearCredentials(identify) {
-    const parentApp = getParentApplication();
-    if (parentApp !== null) {
-        await parentAppRequest(identify, IdentifyAction.ClearCredentials);
+async function clearCredentials() {
+    if (getParentApplication() !== null) {
+        await sendParentRequest(IdentifyAction.ClearCredentials);
         return;
     }
-    const shouldLogout = identify.credentials !== null;
-    identify.credentials = null;
-    identify.userData = null;
-    identify.signature = null;
-    if (shouldLogout) {
-        enqueueLogout(identify);
-    }
+    applyLogout();
 }
 /**
  * Registers a callback function that will be called whenever the `LoginState`
@@ -779,19 +975,17 @@ function onStateUpdated(identify, callback) {
     return subscribe(identify, IdentifyEvent.StateUpdated, callback);
 }
 /**
- * Registers a callback function that will be called whenever the `Credentials`
- * object associated with the `IdentifyKit` instance is updated.
+ * Registers a callback function that will be called whenever the
+ * credentials slot is updated.
  *
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onCredentialsUpdated } from '@monterosa/sdk-identify-kit';
+ * import { onCredentialsUpdated } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const identify = getIdentify();
- *
- * const unsubscribe = onCredentialsUpdated(identify, (credentials) => {
+ * const unsubscribe = onCredentialsUpdated((credentials) => {
  *   if (credentials !== null) {
  *     console.log("Credentials updated:", credentials);
  *   } else {
@@ -803,91 +997,15 @@ function onStateUpdated(identify, callback) {
  * // unsubscribe();
  * ```
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param callback - The callback function to register. This function will be
  *   called with the updated `Credentials` object as its only argument.
- *   If the value `null` is received, it indicates that the signature has
- *   been cleared
- * @returns An `Unsubscribe` function that can be called to unregister
- *   the callback function.
- */
-function onCredentialsUpdated(identify, callback) {
-    return subscribe(identify, IdentifyEvent.CredentialsUpdated, callback);
-}
-/**
- * Registers a callback function that will be called whenever the `Signature`
- * object associated with the `IdentifyKit` instance is updated.
- *
- * @example
- * ```javascript
- * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onSignatureUpdated } from '@monterosa/sdk-identify-kit';
- *
- * configure({ host: '...', projectId: '...' });
- *
- * const identify = getIdentify();
- *
- * const unsubscribe = onSignatureUpdated(identify, (signature) => {
- *   if (signature !== null) {
- *     console.log("Signature updated:", signature);
- *   } else {
- *     console.log("Signature cleared.");
- *   }
- * });
- *
- * // Call unsubscribe() to unregister the callback function
- * // unsubscribe();
- * ```
- *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
- * @param callback - The callback function to register. This function will be
- *   called with the updated `Signature` object as its only argument.
- *   If the value `null` is received, it indicates that the signature has
- *   been cleared
+ *   If the value `null` is received, it indicates that the credentials have
+ *   been cleared.
  * @returns An `Unsubscribe` function that can be called to unregister
  *   the callback function.
  */
-function onSignatureUpdated(identify, callback) {
-    return subscribe(identify, IdentifyEvent.SignatureUpdated, callback);
-}
-/**
- * Registers a callback function that will be called whenever the `UserData`
- * object associated with the `IdentifyKit` instance is updated.
- *
- * @example
- * ```javascript
- * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onUserDataUpdated } from '@monterosa/sdk-identify-kit';
- *
- * configure({ host: '...', projectId: '...' });
- *
- * const identify = getIdentify();
- *
- * const unsubscribe = onUserDataUpdated(identify, (userData) => {
- *   if (userData !== null) {
- *     console.log("User's data updated:", userData);
- *   } else {
- *     console.log("User's data cleared.");
- *   }
- * });
- *
- * // Call unsubscribe() to unregister the callback function
- * // unsubscribe();
- * ```
- *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
- * @param callback - The callback function to register. This function will be
- *   called with the updated `UserData` object as its only argument.
- *   If the value `null` is received, it indicates that the user's data has
- *   been cleared
- * @returns An `Unsubscribe` function that can be called to unregister
- *   the callback function.
- */
-function onUserDataUpdated(identify, callback) {
-    return subscribe(identify, IdentifyEvent.UserdataUpdated, callback);
+function onCredentialsUpdated(callback) {
+    return credentialsStore.subscribe(callback);
 }
 /**
  * Registers a callback function that will be called when a login is requested
@@ -896,13 +1014,11 @@ function onUserDataUpdated(identify, callback) {
  * @example
  * ```javascript
  * import { configure } from '@monterosa/sdk-core';
- * import { getIdentify, onLoginRequestedByExperience } from '@monterosa/sdk-identify-kit';
+ * import { onLoginRequestedByExperience } from '@monterosa/sdk-identify-kit';
  *
  * configure({ host: '...', projectId: '...' });
  *
- * const identify = getIdentify();
- *
- * const unsubscribe = onLoginRequestedByExperience(identify, () => {
+ * const unsubscribe = onLoginRequestedByExperience(() => {
  *   showLoginForm();
  * });
  *
@@ -910,15 +1026,13 @@ function onUserDataUpdated(identify, callback) {
  * // unsubscribe();
  * ```
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param callback - The callback function to register. This function will
  *   be called when a login is requested by an Experience.
  * @returns An `Unsubscribe` function that can be called to unregister
  *   the callback function.
  */
-function onLoginRequestedByExperience(identify, callback) {
-    return subscribe(identify, IdentifyEvent.LoginRequested, callback);
+function onLoginRequestedByExperience(callback) {
+    return subscribe(requestsEmitter, IdentifyEvent.LoginRequested, callback);
 }
 /**
  * Registers a callback function that will be called when a logout is requested
@@ -926,13 +1040,12 @@ function onLoginRequestedByExperience(identify, callback) {
  *
  * @example
  * ```javascript
- * import { getSpace } from '@monterosa/sdk-core';
- * import { getIdentify, onLogoutRequestedByExperience } from '@monterosa/sdk-identify-kit';
+ * import { configure } from '@monterosa/sdk-core';
+ * import { onLogoutRequestedByExperience } from '@monterosa/sdk-identify-kit';
  *
- * const space = getSpace('host', 'space-id');
- * const identify = getIdentify(space);
+ * configure({ host: '...', projectId: '...' });
  *
- * const unsubscribe = onLogoutRequestedByExperience(identify, () => {
+ * const unsubscribe = onLogoutRequestedByExperience(() => {
  *   // logout requested by experience
  *   // perform logout from Auth service
  * });
@@ -941,15 +1054,13 @@ function onLoginRequestedByExperience(identify, callback) {
  * // unsubscribe();
  * ```
  *
- * @param identify - An instance of `IdentifyKit` that provides the user
- *   identification functionality.
  * @param callback - The callback function to register. This function will
  *   be called when a logout is requested by an Experience.
  * @returns An `Unsubscribe` function that can be called to unregister
  *   the callback function.
  */
-function onLogoutRequestedByExperience(identify, callback) {
-    return subscribe(identify, IdentifyEvent.LogoutRequested, callback);
+function onLogoutRequestedByExperience(callback) {
+    return subscribe(requestsEmitter, IdentifyEvent.LogoutRequested, callback);
 }
 /**
  *
@@ -958,8 +1069,8 @@ function onLogoutRequestedByExperience(identify, callback) {
 async function watchConnectionStatus(identify) {
     const conn = await getConnect(identify.sdk.options.host);
     onConnected(conn, () => {
-        if (identify.shouldLoginOnReconnect) {
-            enqueueLogin(identify, identify.credentials, true);
+        if (shouldLoginOnReconnect(identify)) {
+            enqueueLogin(identify, credentialsStore.credentials, true);
         }
         taskQueue.resume();
     });
@@ -996,115 +1107,59 @@ async function watchConnectionStatus(identify) {
  * More details on the license can be found at https://www.monterosa.co/sdk/license
  */
 /**
+ * Process an incoming `Login` / `Logout` broadcast from the parent
+ * application. Updates the local credentials slot, enqueues login/logout
+ * for every existing identify, and forwards the broadcast downstream to
+ * this level's own embedded experiences — the mechanism that cascades a
+ * root-level `setCredentials` through every nested experience.
+ *
  * @internal
  */
-function parentMessagesHook(identify) {
-    const parentApp = getParentApplication();
-    if (parentApp === null) {
-        return () => { };
-    }
-    return onSdkMessage(parentApp, async (message) => {
-        switch (message.action) {
-            case IdentifyAction.OnCredentialsUpdated: {
-                identify.credentials = message.payload.data;
-                break;
-            }
-            case IdentifyAction.OnSessionSignatureUpdated: {
-                identify.signature = message.payload.data;
-                break;
-            }
-            case IdentifyAction.OnUserDataUpdated: {
-                identify.userData = message.payload.data;
-                break;
-            }
-            case IdentifyAction.Login: {
-                enqueueLogin(identify, message.payload);
-                break;
-            }
-            case IdentifyAction.Logout: {
-                enqueueLogout(identify);
-                break;
-            }
+function handleParentMessage(message) {
+    switch (message.action) {
+        case IdentifyAction.Login: {
+            applyLogin(message.payload);
+            break;
         }
-    });
-}
-/**
- * Finds an existing SDK with matching projectId, or creates a new one.
- */
-function getOrConfigureSdk(host, projectId) {
-    const existingSdk = getSdks().find((sdk) => sdk.options.projectId === projectId);
-    return existingSdk !== null && existingSdk !== void 0 ? existingSdk : configure({ host, projectId }, projectId);
+        case IdentifyAction.Logout: {
+            applyLogout();
+            break;
+        }
+    }
 }
 /**
  * @internal
  */
 function handleExperienceEmbedded(experience) {
-    const identify = getIdentify(experience.sdk);
-    // Send login action with current credentials to the new experience if available.
-    // The bridge queues this message until the experience is initialised.
-    if (identify.credentials) {
-        sendSdkMessage(experience, IdentifyAction.Login, identify.credentials);
-    }
-    const credentialsUpdatedUnsub = onCredentialsUpdated(identify, (data) => {
-        sendSdkMessage(experience, IdentifyAction.OnCredentialsUpdated, {
-            data,
-        });
-    });
-    const signatureUpdatedUnsub = onSignatureUpdated(identify, (data) => {
-        sendSdkMessage(experience, IdentifyAction.OnSessionSignatureUpdated, {
-            data,
-        });
-    });
-    const userDataUpdatedUnsub = onUserDataUpdated(identify, (data) => {
-        sendSdkMessage(experience, IdentifyAction.OnUserDataUpdated, {
-            data,
-        });
-    });
     const sdkMessageUnsub = onSdkMessage(experience, async (message) => {
         if (!Object.values(IdentifyAction).includes(message.action)) {
             return;
         }
-        // Extract origin context from payload if available.
-        // New clients include origin (host, projectId) to ensure correct project context
-        // in multilevel integrations. Old clients don't send origin, so we fall back
-        // to the experience's SDK to maintain backward compatibility.
-        const { origin } = message.payload;
-        const originSdk = origin
-            ? getOrConfigureSdk(origin.host, origin.projectId)
-            : experience.sdk;
-        const originIdentify = getIdentify(originSdk);
         const respond = (payload) => respondToSdkMessage(experience, message, payload);
         try {
             switch (message.action) {
                 case IdentifyAction.RequestLogin: {
-                    await requestLogin(originIdentify);
+                    await requestLogin();
                     respond();
                     break;
                 }
                 case IdentifyAction.RequestLogout: {
-                    await requestLogout(identify);
+                    await requestLogout();
                     respond();
                     break;
                 }
-                case IdentifyAction.GetUserData: {
-                    const data = await getUserData(identify);
+                case IdentifyAction.GetCredentials: {
+                    const data = await getCredentials();
                     respond({ data });
                     break;
                 }
-                case IdentifyAction.GetSessionSignature: {
-                    const signature = await getSessionSignatureMemoized(identify, message.payload);
-                    respond({ data: signature });
-                    break;
-                }
                 case IdentifyAction.SetCredentials: {
-                    await setCredentials(originIdentify, {
-                        token: message.payload.token,
-                    });
+                    await setCredentials(message.payload);
                     respond();
                     break;
                 }
                 case IdentifyAction.ClearCredentials: {
-                    await clearCredentials(identify);
+                    await clearCredentials();
                     respond();
                     break;
                 }
@@ -1116,12 +1171,7 @@ function handleExperienceEmbedded(experience) {
             });
         }
     });
-    addExperience(experience, [
-        credentialsUpdatedUnsub,
-        signatureUpdatedUnsub,
-        userDataUpdatedUnsub,
-        sdkMessageUnsub,
-    ]);
+    addExperience(experience, [sdkMessageUnsub]);
 }
 /**
  * @internal
@@ -1129,15 +1179,31 @@ function handleExperienceEmbedded(experience) {
 function handleExperienceUnmounted(experience) {
     deleteExperience(experience);
 }
-onStateChanged((experience, state) => {
+/**
+ * @internal
+ */
+function handleExperienceStateChange(experience, state) {
     if (state === 'mounted') {
         handleExperienceEmbedded(experience);
+        return;
     }
-    else if (state === 'unmounted') {
+    if (state === 'unmounted') {
         handleExperienceUnmounted(experience);
     }
-});
-registerIdentifyHook(parentMessagesHook);
+}
+function subscribeToExperienceLifecycle() {
+    onStateChanged(handleExperienceStateChange);
+}
+function connectToParentApplication() {
+    const parentApp = getParentApplication();
+    if (parentApp === null) {
+        return;
+    }
+    onSdkMessage(parentApp, handleParentMessage);
+    pullStateFromParent();
+}
+subscribeToExperienceLifecycle();
+connectToParentApplication();
 
-export { IdentifyError, clearCredentials, getIdentify, getUserData, onCredentialsUpdated, onLoginRequestedByExperience, onLogoutRequestedByExperience, onSignatureUpdated, onStateUpdated, onUserDataUpdated, requestLogin, requestLogout, setCredentials };
+export { IdentifyError, clearCredentials, getCredentials, getIdentify, getUserData, onCredentialsUpdated, onLoginRequestedByExperience, onLogoutRequestedByExperience, onStateUpdated, requestLogin, requestLogout, setCredentials, setLoginPolicy };
 //# sourceMappingURL=index.js.map