@noy-db/in-liff 0.4.0-pre.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vLannaAi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,68 @@
+# @noy-db/in-liff
+
+[![npm](https://img.shields.io/npm/v/%40noy-db/in-liff.svg)](https://www.npmjs.com/package/@noy-db/in-liff)
+
+> LIFF (LINE Front-end Framework) shell binding for noy-db
+
+Part of [**`@noy-db/hub`**](https://www.npmjs.com/package/@noy-db/hub) — the zero-knowledge, offline-first, encrypted document store.
+
+## Install
+
+```bash
+pnpm add @noy-db/hub @noy-db/in-liff
+```
+
+## What it is
+
+The boot layer for a noy-db portal SPA opened from LINE: one `initLiffApp()` call establishes the **shell** (`'liff' | 'browser' | 'pwa'` — one SPA, three shells), enforces LINE Login, reads the ID token for the `@noy-db/on-oidc` split-key unlock, and ingests a `@noy-db/hub/share-link` deep link from the current location.
+
+The LIFF SDK is **injected, never a dependency** — every entry point takes a `LiffLike` (the six-member structural slice this package calls), so apps pass the real `liff` global and tests pass fakes.
+
+```ts
+import liff from '@line/liff'
+import { initLiffApp, getFreshIdToken, openExternal } from '@noy-db/in-liff'
+
+const ctx = await initLiffApp({ liff, liffId: import.meta.env.VITE_LIFF_ID })
+// ctx: { shell, loggedIn, idToken, inClient, deepLink }
+
+// Later, right before an on-oidc serverHalf fetch:
+const token = getFreshIdToken(liff) // re-login on expiry (navigates away), or { onExpired: 'throw' }
+```
+
+## Token lifecycle
+
+LIFF ID tokens live ~1 hour with **no silent refresh**. Expiry is detected client-side from the JWT `exp` (no network, no signature check — verification is the key-connector server's job, per `@noy-db/on-oidc`'s documented split). An unlocked noy-db session **survives token expiry**: the token is needed again only at the next serverHalf fetch — call `getFreshIdToken` exactly there.
+
+## The platform handoff matrix (escape hatch)
+
+`openExternal(liff, url)` breaks out of LINE's in-app WebView:
+
+| Platform | What happens |
+|---|---|
+| **Android** | In-scope links open the **installed PWA directly** (WebAPK link capture); the WebAPK shares Chrome's origin storage. |
+| **iOS** | Always opens Safari; the installed home-screen app cannot be targeted by URL and has its **own storage partition** — show an interstitial for the manual hop. |
+| **All** | LINE's WebView storage is always isolated: the new shell starts empty and re-enrolls via the custodian re-invite (`@noy-db/on-oidc`) — a ceremony, not a data transfer. |
+
+## In-LINE constraints
+
+- **No WebAuthn** in LINE's in-app WebView — the in-LINE offline lock options are PIN and device-trust (`@noy-db/on-pin`); biometrics become available after detaching to the external browser / PWA shells.
+- IndexedDB and `crypto.subtle` are available in all three shells (LIFF apps are HTTPS by requirement).
+
+## Scope
+
+Login + `openWindow` only — no LIFF messaging/share APIs, no server code, no UI. The PWA-side helpers (persistence, eviction guard, install prompts) live in `@noy-db/in-pwa`; the two packages share the `AppShellContext` union structurally, with no dependency between them.
+
+## Status
+
+**Pre-release** (`0.4.0-pre.x`). API may change before `1.0`.
+
+## Documentation
+
+See the [main repository](https://github.com/vLannaAi/noy-db#readme) for setup, examples, and the full subsystem catalog.
+
+- Source — [`packages/in-liff`](https://github.com/vLannaAi/noy-db/tree/main/packages/in-liff)
+- Issues — [github.com/vLannaAi/noy-db/issues](https://github.com/vLannaAi/noy-db/issues)
+
+## License
+
+[MIT](./LICENSE) © vLannaAi

package/dist/index.d.ts

@@ -0,0 +1,153 @@
+import { ShareLink } from '@noy-db/hub/share-link';
+export { ShareLink } from '@noy-db/hub/share-link';
+
+/**
+ * **@noy-db/in-liff** — LIFF (LINE Front-end Framework) shell binding for
+ * noy-db: boot + shell-context detection across the three shells one
+ * portal SPA runs in (inside LINE, external browser, installed PWA),
+ * LINE ID-token lifecycle with re-login on expiry, share-link deep-link
+ * ingestion, and the external-browser escape hatch.
+ *
+ * The LIFF SDK is **injected, never depended on**: every entry point
+ * takes a {@link LiffLike} — the structural slice of the `liff` global
+ * this package actually calls — so apps pass the real `liff` object and
+ * tests pass fakes. CI runs fully mocked, per family convention.
+ *
+ * Platform truths this package encodes (the portal handoff matrix):
+ * - **Android**: an in-scope link opened via {@link openExternal} lands
+ *   in the installed PWA directly (WebAPK link capture); the WebAPK
+ *   shares Chrome's origin storage.
+ * - **iOS**: links always open Safari; an installed home-screen app
+ *   cannot be targeted by URL and has its own storage partition — the
+ *   handoff is a manual hop behind an interstitial.
+ * - **LINE's in-app WebView storage is always isolated** — moving to
+ *   another shell is a re-enroll + re-sync ceremony (see
+ *   `@noy-db/on-oidc`'s firm re-invite flow), never a data transfer.
+ * - **No WebAuthn inside LINE's WebView** — the in-LINE lock options are
+ *   PIN and device-trust (`@noy-db/on-pin`); biometric unlocks become
+ *   available only in the external-browser/PWA shells. IndexedDB and
+ *   `crypto.subtle` are available in all three shells.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Which shell the SPA is running in. Mirrors the union exported by
+ * `@noy-db/in-pwa` — kept as a structural redeclaration (identical
+ * string union) rather than an import so neither satellite depends on
+ * the other; satellites peer-depend only on the hub, per family law.
+ */
+type AppShellContext = 'liff' | 'browser' | 'pwa';
+/**
+ * The structural slice of the LIFF SDK this package calls. Pass the
+ * real `liff` global in apps; pass a fake in tests. Only these six
+ * members are ever touched — messaging/share APIs are out of scope.
+ */
+interface LiffLike {
+    init(config: {
+        liffId: string;
+    }): Promise<void>;
+    isLoggedIn(): boolean;
+    /** Navigates away to LINE Login in a real LIFF runtime. */
+    login(options?: {
+        redirectUri?: string;
+    }): void;
+    getIDToken(): string | null;
+    isInClient(): boolean;
+    openWindow(params: {
+        url: string;
+        external?: boolean;
+    }): void;
+}
+/** Thrown when `liff.init` fails — the shell cannot be established. */
+declare class LiffInitError extends Error {
+    readonly code = "LIFF_INIT_FAILED";
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown for ID-token problems this package can detect client-side:
+ * a structurally malformed JWT, or expiry when the caller opted into
+ * `onExpired: 'throw'`. Signature verification is NEVER done here —
+ * that is the key-connector server's job (see `@noy-db/on-oidc`).
+ */
+declare class LiffTokenError extends Error {
+    readonly code: 'LIFF_TOKEN_EXPIRED' | 'LIFF_TOKEN_MALFORMED';
+    constructor(code: 'LIFF_TOKEN_EXPIRED' | 'LIFF_TOKEN_MALFORMED', message: string);
+}
+/** Everything {@link initLiffApp} establishes about the running shell. */
+interface LiffAppContext {
+    /** 'liff' inside LINE; otherwise the pwa/browser split. */
+    readonly shell: AppShellContext;
+    readonly loggedIn: boolean;
+    /** LINE ID token when logged in and the SDK yields one; else null. */
+    readonly idToken: string | null;
+    /** `liff.isInClient()` — true only inside LINE's in-app WebView. */
+    readonly inClient: boolean;
+    /**
+     * The share link the app was opened with, or null when the current
+     * location is not a share link. Only `ShareLinkParseError` is
+     * swallowed into null — anything else propagates.
+     */
+    readonly deepLink: ShareLink | null;
+}
+interface InitLiffAppOptions {
+    liff: LiffLike;
+    liffId: string;
+    /**
+     * Require a logged-in LINE session, calling `liff.login()` when
+     * absent. Default true. NOTE: in a real LIFF runtime `login()`
+     * NAVIGATES AWAY — code after it only runs in test fakes or when the
+     * user is already logged in.
+     */
+    requireLogin?: boolean;
+    /** Current location href override (tests); default `location.href`. */
+    locationHref?: string;
+}
+/**
+ * Boot the LIFF shell: `liff.init`, optional login enforcement, shell
+ * detection, ID-token read, and deep-link ingestion — one call at app
+ * start, returning everything the portal needs to route.
+ */
+declare function initLiffApp(options: InitLiffAppOptions): Promise<LiffAppContext>;
+interface GetFreshIdTokenOptions {
+    /**
+     * What to do when the token is missing or expired: `'login'`
+     * (default) triggers `liff.login()` re-auth and returns null —
+     * remember login navigates away in a real LIFF runtime; `'throw'`
+     * raises {@link LiffTokenError} for the app to handle.
+     */
+    onExpired?: 'login' | 'throw';
+    /** Clock-skew allowance in seconds. Default 30. */
+    skewSeconds?: number;
+}
+/**
+ * Return a currently-valid LINE ID token, or handle expiry.
+ *
+ * LIFF ID tokens live ~1 hour with **no silent refresh** — expiry is
+ * detected client-side from the JWT `exp` claim (a 20-line local
+ * decode; no network, no signature check — mirrors `@noy-db/on-oidc`'s
+ * documented client/server split). An unlocked noy-db session SURVIVES
+ * token expiry: the token is only needed again at the next
+ * serverHalf fetch (see on-oidc), which is exactly when to call this.
+ */
+declare function getFreshIdToken(liff: LiffLike, options?: GetFreshIdTokenOptions): string | null;
+/**
+ * Escape hatch out of LINE's in-app WebView into the default browser
+ * (`liff.openWindow` with `external: true`).
+ *
+ * What actually happens per platform — the portal handoff matrix:
+ * - **Android**: if the installed PWA's scope covers `url`, the link
+ *   opens the installed app directly (WebAPK link capture), which
+ *   shares Chrome's origin storage.
+ * - **iOS**: always opens Safari; the installed home-screen app cannot
+ *   be targeted and has a separate storage partition — show an
+ *   interstitial for the manual hop.
+ * - In every case LINE's WebView storage stays behind: the new shell
+ *   starts empty and re-enrolls (custodian re-invite; see
+ *   `@noy-db/on-oidc`) — a ceremony, not a data transfer.
+ */
+declare function openExternal(liff: LiffLike, url: string): void;
+
+export { type AppShellContext, type GetFreshIdTokenOptions, type InitLiffAppOptions, type LiffAppContext, LiffInitError, type LiffLike, LiffTokenError, getFreshIdToken, initLiffApp, openExternal };

package/dist/index.js

@@ -0,0 +1,101 @@
+// src/index.ts
+import { parseShareLink, ShareLinkParseError } from "@noy-db/hub/share-link";
+var LiffInitError = class extends Error {
+  code = "LIFF_INIT_FAILED";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "LiffInitError";
+  }
+};
+var LiffTokenError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "LiffTokenError";
+    this.code = code;
+  }
+};
+async function initLiffApp(options) {
+  const { liff, liffId, requireLogin = true } = options;
+  try {
+    await liff.init({ liffId });
+  } catch (cause) {
+    throw new LiffInitError(
+      `initLiffApp: liff.init failed for liffId "${liffId}". Check the LIFF app configuration (endpoint URL, channel).`,
+      { cause }
+    );
+  }
+  let loggedIn = liff.isLoggedIn();
+  if (requireLogin && !loggedIn) {
+    liff.login();
+    loggedIn = liff.isLoggedIn();
+  }
+  const inClient = liff.isInClient();
+  const shell = inClient ? "liff" : detectStandalone() ? "pwa" : "browser";
+  const idToken = loggedIn ? liff.getIDToken() : null;
+  const href = options.locationHref ?? (typeof location !== "undefined" ? location.href : void 0);
+  let deepLink = null;
+  if (href !== void 0) {
+    try {
+      deepLink = parseShareLink(href);
+    } catch (err) {
+      if (!(err instanceof ShareLinkParseError)) throw err;
+      deepLink = null;
+    }
+  }
+  return { shell, loggedIn, idToken, inClient, deepLink };
+}
+function detectStandalone() {
+  try {
+    if (typeof matchMedia === "function" && matchMedia("(display-mode: standalone)").matches) {
+      return true;
+    }
+  } catch {
+  }
+  const nav = typeof navigator !== "undefined" ? navigator : void 0;
+  return nav?.standalone === true;
+}
+function getFreshIdToken(liff, options = {}) {
+  const { onExpired = "login", skewSeconds = 30 } = options;
+  const token = liff.isLoggedIn() ? liff.getIDToken() : null;
+  if (token !== null) {
+    const exp = decodeJwtExp(token);
+    if (exp === null) {
+      throw new LiffTokenError(
+        "LIFF_TOKEN_MALFORMED",
+        "getFreshIdToken: the ID token is not a decodable JWT (missing or unreadable exp claim)."
+      );
+    }
+    if (exp * 1e3 > Date.now() + skewSeconds * 1e3) return token;
+  }
+  if (onExpired === "throw") {
+    throw new LiffTokenError(
+      "LIFF_TOKEN_EXPIRED",
+      "getFreshIdToken: the LINE ID token is missing or expired. Re-authenticate via liff.login()."
+    );
+  }
+  liff.login();
+  return null;
+}
+function decodeJwtExp(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const json = JSON.parse(atob(payload));
+    return typeof json.exp === "number" && Number.isFinite(json.exp) ? json.exp : null;
+  } catch {
+    return null;
+  }
+}
+function openExternal(liff, url) {
+  liff.openWindow({ url, external: true });
+}
+export {
+  LiffInitError,
+  LiffTokenError,
+  getFreshIdToken,
+  initLiffApp,
+  openExternal
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/in-liff** — LIFF (LINE Front-end Framework) shell binding for\n * noy-db: boot + shell-context detection across the three shells one\n * portal SPA runs in (inside LINE, external browser, installed PWA),\n * LINE ID-token lifecycle with re-login on expiry, share-link deep-link\n * ingestion, and the external-browser escape hatch.\n *\n * The LIFF SDK is **injected, never depended on**: every entry point\n * takes a {@link LiffLike} — the structural slice of the `liff` global\n * this package actually calls — so apps pass the real `liff` object and\n * tests pass fakes. CI runs fully mocked, per family convention.\n *\n * Platform truths this package encodes (the portal handoff matrix):\n * - **Android**: an in-scope link opened via {@link openExternal} lands\n *   in the installed PWA directly (WebAPK link capture); the WebAPK\n *   shares Chrome's origin storage.\n * - **iOS**: links always open Safari; an installed home-screen app\n *   cannot be targeted by URL and has its own storage partition — the\n *   handoff is a manual hop behind an interstitial.\n * - **LINE's in-app WebView storage is always isolated** — moving to\n *   another shell is a re-enroll + re-sync ceremony (see\n *   `@noy-db/on-oidc`'s firm re-invite flow), never a data transfer.\n * - **No WebAuthn inside LINE's WebView** — the in-LINE lock options are\n *   PIN and device-trust (`@noy-db/on-pin`); biometric unlocks become\n *   available only in the external-browser/PWA shells. IndexedDB and\n *   `crypto.subtle` are available in all three shells.\n *\n * @packageDocumentation\n */\n\nimport { parseShareLink, ShareLinkParseError } from '@noy-db/hub/share-link'\nimport type { ShareLink } from '@noy-db/hub/share-link'\n\n/**\n * Which shell the SPA is running in. Mirrors the union exported by\n * `@noy-db/in-pwa` — kept as a structural redeclaration (identical\n * string union) rather than an import so neither satellite depends on\n * the other; satellites peer-depend only on the hub, per family law.\n */\nexport type AppShellContext = 'liff' | 'browser' | 'pwa'\n\n/**\n * The structural slice of the LIFF SDK this package calls. Pass the\n * real `liff` global in apps; pass a fake in tests. Only these six\n * members are ever touched — messaging/share APIs are out of scope.\n */\nexport interface LiffLike {\n  init(config: { liffId: string }): Promise<void>\n  isLoggedIn(): boolean\n  /** Navigates away to LINE Login in a real LIFF runtime. */\n  login(options?: { redirectUri?: string }): void\n  getIDToken(): string | null\n  isInClient(): boolean\n  openWindow(params: { url: string; external?: boolean }): void\n}\n\n/** Thrown when `liff.init` fails — the shell cannot be established. */\nexport class LiffInitError extends Error {\n  readonly code = 'LIFF_INIT_FAILED'\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options)\n    this.name = 'LiffInitError'\n  }\n}\n\n/**\n * Thrown for ID-token problems this package can detect client-side:\n * a structurally malformed JWT, or expiry when the caller opted into\n * `onExpired: 'throw'`. Signature verification is NEVER done here —\n * that is the key-connector server's job (see `@noy-db/on-oidc`).\n */\nexport class LiffTokenError extends Error {\n  readonly code: 'LIFF_TOKEN_EXPIRED' | 'LIFF_TOKEN_MALFORMED'\n  constructor(code: 'LIFF_TOKEN_EXPIRED' | 'LIFF_TOKEN_MALFORMED', message: string) {\n    super(message)\n    this.name = 'LiffTokenError'\n    this.code = code\n  }\n}\n\n/** Everything {@link initLiffApp} establishes about the running shell. */\nexport interface LiffAppContext {\n  /** 'liff' inside LINE; otherwise the pwa/browser split. */\n  readonly shell: AppShellContext\n  readonly loggedIn: boolean\n  /** LINE ID token when logged in and the SDK yields one; else null. */\n  readonly idToken: string | null\n  /** `liff.isInClient()` — true only inside LINE's in-app WebView. */\n  readonly inClient: boolean\n  /**\n   * The share link the app was opened with, or null when the current\n   * location is not a share link. Only `ShareLinkParseError` is\n   * swallowed into null — anything else propagates.\n   */\n  readonly deepLink: ShareLink | null\n}\n\nexport interface InitLiffAppOptions {\n  liff: LiffLike\n  liffId: string\n  /**\n   * Require a logged-in LINE session, calling `liff.login()` when\n   * absent. Default true. NOTE: in a real LIFF runtime `login()`\n   * NAVIGATES AWAY — code after it only runs in test fakes or when the\n   * user is already logged in.\n   */\n  requireLogin?: boolean\n  /** Current location href override (tests); default `location.href`. */\n  locationHref?: string\n}\n\n/**\n * Boot the LIFF shell: `liff.init`, optional login enforcement, shell\n * detection, ID-token read, and deep-link ingestion — one call at app\n * start, returning everything the portal needs to route.\n */\nexport async function initLiffApp(options: InitLiffAppOptions): Promise<LiffAppContext> {\n  const { liff, liffId, requireLogin = true } = options\n  try {\n    await liff.init({ liffId })\n  } catch (cause) {\n    throw new LiffInitError(\n      `initLiffApp: liff.init failed for liffId \"${liffId}\". ` +\n        `Check the LIFF app configuration (endpoint URL, channel).`,\n      { cause },\n    )\n  }\n\n  let loggedIn = liff.isLoggedIn()\n  if (requireLogin && !loggedIn) {\n    liff.login()\n    // Real LIFF navigated away above; a fake may have flipped state.\n    loggedIn = liff.isLoggedIn()\n  }\n\n  const inClient = liff.isInClient()\n  const shell: AppShellContext = inClient ? 'liff' : detectStandalone() ? 'pwa' : 'browser'\n  const idToken = loggedIn ? liff.getIDToken() : null\n\n  const href = options.locationHref ?? (typeof location !== 'undefined' ? location.href : undefined)\n  let deepLink: ShareLink | null = null\n  if (href !== undefined) {\n    try {\n      deepLink = parseShareLink(href)\n    } catch (err) {\n      if (!(err instanceof ShareLinkParseError)) throw err\n      deepLink = null\n    }\n  }\n\n  return { shell, loggedIn, idToken, inClient, deepLink }\n}\n\n/**\n * The pwa/browser split OUTSIDE LINE. Same rule as\n * `@noy-db/in-pwa`'s `getDisplayContext` (kept in sync by comment, not\n * import): standalone display-mode media query, plus iOS Safari's\n * legacy `navigator.standalone`.\n */\nfunction detectStandalone(): boolean {\n  try {\n    if (typeof matchMedia === 'function' && matchMedia('(display-mode: standalone)').matches) {\n      return true\n    }\n  } catch {\n    // matchMedia hostile/absent — fall through to the iOS flag.\n  }\n  const nav = typeof navigator !== 'undefined'\n    ? (navigator as Navigator & { standalone?: boolean })\n    : undefined\n  return nav?.standalone === true\n}\n\nexport interface GetFreshIdTokenOptions {\n  /**\n   * What to do when the token is missing or expired: `'login'`\n   * (default) triggers `liff.login()` re-auth and returns null —\n   * remember login navigates away in a real LIFF runtime; `'throw'`\n   * raises {@link LiffTokenError} for the app to handle.\n   */\n  onExpired?: 'login' | 'throw'\n  /** Clock-skew allowance in seconds. Default 30. */\n  skewSeconds?: number\n}\n\n/**\n * Return a currently-valid LINE ID token, or handle expiry.\n *\n * LIFF ID tokens live ~1 hour with **no silent refresh** — expiry is\n * detected client-side from the JWT `exp` claim (a 20-line local\n * decode; no network, no signature check — mirrors `@noy-db/on-oidc`'s\n * documented client/server split). An unlocked noy-db session SURVIVES\n * token expiry: the token is only needed again at the next\n * serverHalf fetch (see on-oidc), which is exactly when to call this.\n */\nexport function getFreshIdToken(\n  liff: LiffLike,\n  options: GetFreshIdTokenOptions = {},\n): string | null {\n  const { onExpired = 'login', skewSeconds = 30 } = options\n  const token = liff.isLoggedIn() ? liff.getIDToken() : null\n\n  if (token !== null) {\n    const exp = decodeJwtExp(token)\n    if (exp === null) {\n      throw new LiffTokenError(\n        'LIFF_TOKEN_MALFORMED',\n        'getFreshIdToken: the ID token is not a decodable JWT (missing or unreadable exp claim).',\n      )\n    }\n    if (exp * 1000 > Date.now() + skewSeconds * 1000) return token\n  }\n\n  if (onExpired === 'throw') {\n    throw new LiffTokenError(\n      'LIFF_TOKEN_EXPIRED',\n      'getFreshIdToken: the LINE ID token is missing or expired. Re-authenticate via liff.login().',\n    )\n  }\n  liff.login()\n  return null\n}\n\n/** Decode the `exp` claim (seconds) from a JWT, or null if malformed. */\nfunction decodeJwtExp(token: string): number | null {\n  const parts = token.split('.')\n  if (parts.length !== 3) return null\n  try {\n    const payload = parts[1]!.replace(/-/g, '+').replace(/_/g, '/')\n    const json = JSON.parse(atob(payload)) as { exp?: unknown }\n    return typeof json.exp === 'number' && Number.isFinite(json.exp) ? json.exp : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Escape hatch out of LINE's in-app WebView into the default browser\n * (`liff.openWindow` with `external: true`).\n *\n * What actually happens per platform — the portal handoff matrix:\n * - **Android**: if the installed PWA's scope covers `url`, the link\n *   opens the installed app directly (WebAPK link capture), which\n *   shares Chrome's origin storage.\n * - **iOS**: always opens Safari; the installed home-screen app cannot\n *   be targeted and has a separate storage partition — show an\n *   interstitial for the manual hop.\n * - In every case LINE's WebView storage stays behind: the new shell\n *   starts empty and re-enrolls (custodian re-invite; see\n *   `@noy-db/on-oidc`) — a ceremony, not a data transfer.\n */\nexport function openExternal(liff: LiffLike, url: string): void {\n  liff.openWindow({ url, external: true })\n}\n\nexport type { ShareLink } from '@noy-db/hub/share-link'\n"],"mappings":";AA8BA,SAAS,gBAAgB,2BAA2B;AA2B7C,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B,OAAO;AAAA,EAChB,YAAY,SAAiB,SAA+B;AAC1D,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;AAQO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EAC/B;AAAA,EACT,YAAY,MAAqD,SAAiB;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAsCA,eAAsB,YAAY,SAAsD;AACtF,QAAM,EAAE,MAAM,QAAQ,eAAe,KAAK,IAAI;AAC9C,MAAI;AACF,UAAM,KAAK,KAAK,EAAE,OAAO,CAAC;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,6CAA6C,MAAM;AAAA,MAEnD,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AAEA,MAAI,WAAW,KAAK,WAAW;AAC/B,MAAI,gBAAgB,CAAC,UAAU;AAC7B,SAAK,MAAM;AAEX,eAAW,KAAK,WAAW;AAAA,EAC7B;AAEA,QAAM,WAAW,KAAK,WAAW;AACjC,QAAM,QAAyB,WAAW,SAAS,iBAAiB,IAAI,QAAQ;AAChF,QAAM,UAAU,WAAW,KAAK,WAAW,IAAI;AAE/C,QAAM,OAAO,QAAQ,iBAAiB,OAAO,aAAa,cAAc,SAAS,OAAO;AACxF,MAAI,WAA6B;AACjC,MAAI,SAAS,QAAW;AACtB,QAAI;AACF,iBAAW,eAAe,IAAI;AAAA,IAChC,SAAS,KAAK;AACZ,UAAI,EAAE,eAAe,qBAAsB,OAAM;AACjD,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,UAAU,SAAS,UAAU,SAAS;AACxD;AAQA,SAAS,mBAA4B;AACnC,MAAI;AACF,QAAI,OAAO,eAAe,cAAc,WAAW,4BAA4B,EAAE,SAAS;AACxF,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,QAAM,MAAM,OAAO,cAAc,cAC5B,YACD;AACJ,SAAO,KAAK,eAAe;AAC7B;AAwBO,SAAS,gBACd,MACA,UAAkC,CAAC,GACpB;AACf,QAAM,EAAE,YAAY,SAAS,cAAc,GAAG,IAAI;AAClD,QAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,WAAW,IAAI;AAEtD,MAAI,UAAU,MAAM;AAClB,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,MAAM;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,MAAO,KAAK,IAAI,IAAI,cAAc,IAAM,QAAO;AAAA,EAC3D;AAEA,MAAI,cAAc,SAAS;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,OAAK,MAAM;AACX,SAAO;AACT;AAGA,SAAS,aAAa,OAA8B;AAClD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,UAAU,MAAM,CAAC,EAAG,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC9D,UAAM,OAAO,KAAK,MAAM,KAAK,OAAO,CAAC;AACrC,WAAO,OAAO,KAAK,QAAQ,YAAY,OAAO,SAAS,KAAK,GAAG,IAAI,KAAK,MAAM;AAAA,EAChF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBO,SAAS,aAAa,MAAgB,KAAmB;AAC9D,OAAK,WAAW,EAAE,KAAK,UAAU,KAAK,CAAC;AACzC;","names":[]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@noy-db/in-liff",
+  "version": "0.4.0-pre.2",
+  "description": "LIFF (LINE Front-end Framework) shell binding for noy-db — boot + shell context detection across LIFF/browser/PWA, LINE ID-token lifecycle with re-login on expiry, share-link deep-link ingestion, and the external-browser escape hatch with the platform handoff matrix.",
+  "license": "MIT",
+  "author": "vLannaAi <vicio@lanna.ai>",
+  "homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/in-liff#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vLannaAi/noy-db.git",
+    "directory": "packages/in-liff"
+  },
+  "bugs": {
+    "url": "https://github.com/vLannaAi/noy-db/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "peerDependencies": {
+    "@noy-db/hub": "0.4.0-pre.2"
+  },
+  "devDependencies": {
+    "@noy-db/hub": "0.4.0-pre.2"
+  },
+  "keywords": [
+    "noy-db",
+    "in-liff",
+    "liff",
+    "line",
+    "line-login",
+    "deep-link"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit"
+  }
+}