@oceanum/oceanumlab 4.6.2 → 4.7.1

package/lib/Tabs.d.ts

@@ -0,0 +1,26 @@
+import * as React from 'react';
+export interface ITab {
+    /** Stable key, also used as the restored selection value. */
+    id: string;
+    label: string;
+    render: () => React.ReactElement;
+}
+export interface ITabsProps {
+    tabs: readonly ITab[];
+    /** Selected tab id. Falls back to the first tab when it names no tab. */
+    selected: string;
+    onSelect: (id: string) => void;
+}
+/**
+ * A tab strip over a single visible pane.
+ *
+ * JupyterLab users work from the keyboard, so the strip follows the WAI-ARIA tabs
+ * pattern: one tab stop for the whole strip, arrows to move between tabs, Home and End
+ * to reach the ends.
+ *
+ * Every pane stays mounted and the inactive ones are hidden. Unmounting would be
+ * cheaper, but the AI pane holds the conversation in component state and the Datamesh
+ * pane holds a workspace subscription, so switching tabs would silently discard a chat
+ * the user is in the middle of.
+ */
+export declare function Tabs({ tabs, selected, onSelect }: ITabsProps): React.ReactElement;

package/lib/Tabs.js

@@ -0,0 +1,45 @@
+import * as React from 'react';
+/**
+ * A tab strip over a single visible pane.
+ *
+ * JupyterLab users work from the keyboard, so the strip follows the WAI-ARIA tabs
+ * pattern: one tab stop for the whole strip, arrows to move between tabs, Home and End
+ * to reach the ends.
+ *
+ * Every pane stays mounted and the inactive ones are hidden. Unmounting would be
+ * cheaper, but the AI pane holds the conversation in component state and the Datamesh
+ * pane holds a workspace subscription, so switching tabs would silently discard a chat
+ * the user is in the middle of.
+ */
+export function Tabs({ tabs, selected, onSelect }) {
+    const index = Math.max(0, tabs.findIndex(tab => tab.id === selected));
+    const active = tabs[index];
+    const onKeyDown = (event) => {
+        const last = tabs.length - 1;
+        let next = null;
+        if (event.key === 'ArrowRight' || event.key === 'ArrowDown') {
+            next = index === last ? 0 : index + 1;
+        }
+        else if (event.key === 'ArrowLeft' || event.key === 'ArrowUp') {
+            next = index === 0 ? last : index - 1;
+        }
+        else if (event.key === 'Home') {
+            next = 0;
+        }
+        else if (event.key === 'End') {
+            next = last;
+        }
+        if (next === null) {
+            return;
+        }
+        // Otherwise the arrow keys also scroll the panel.
+        event.preventDefault();
+        onSelect(tabs[next].id);
+    };
+    return (React.createElement("div", { className: "oceanum-tabs" },
+        React.createElement("div", { className: "oceanum-tabs-strip", role: "tablist", "aria-label": "Oceanum.io" }, tabs.map((tab, i) => (React.createElement("button", { key: tab.id, id: `oceanum-tab-${tab.id}`, className: i === index ? 'oceanum-tab oceanum-tab-selected' : 'oceanum-tab', role: "tab", type: "button", "aria-selected": i === index, "aria-controls": `oceanum-tabpanel-${tab.id}`, 
+            // Only the selected tab is in the tab order, so Tab moves past the strip
+            // rather than through every tab in it.
+            tabIndex: i === index ? 0 : -1, onClick: () => onSelect(tab.id), onKeyDown: onKeyDown }, tab.label)))),
+        tabs.map(tab => (React.createElement("div", { key: tab.id, className: "oceanum-tabpanel", id: `oceanum-tabpanel-${tab.id}`, role: "tabpanel", "aria-labelledby": `oceanum-tab-${tab.id}`, hidden: tab.id !== active.id }, tab.render())))));
+}

package/lib/aiBackend.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Where the Oceanum AI backend is, and what a request to it is signed with.
+ *
+ * The backend accepts either a Datamesh token (`X-Datamesh-Token`) or an
+ * Oceanum.io access token (`Authorization: Bearer`). A token pasted into the
+ * settings is explicit, so it wins; otherwise a host that signs users in to
+ * Oceanum.io -- Oceanum Notebook -- lends its sign-in through its commands.
+ * Plain JupyterLab has no such commands and needs the pasted token.
+ *
+ * Whether the user is signed in, or can sign in, is read with the registry's
+ * queries (`isVisible`, `isEnabled`), never by running a command: every
+ * `execute` emits `commandExecuted`, which closes JupyterLab's command palette.
+ * The access-token command is run only when a token is actually needed.
+ */
+import type { CommandRegistry } from '@lumino/commands';
+/**
+ * The host's command answering with the current Oceanum.io access token (a
+ * JWT), or null when signed out. The token is cached and refreshed by the
+ * host, so it is asked for on every use rather than kept.
+ */
+export declare const ACCESS_TOKEN_COMMAND = "oceanum-auth:access-token";
+/**
+ * The host's command that starts signing in to Oceanum.io. Enabled only where
+ * sign-in is configured for the site.
+ */
+export declare const SIGN_IN_COMMAND = "oceanum-auth:sign-in";
+/** The host's command that signs out. Visible only while signed in. */
+export declare const SIGN_OUT_COMMAND = "oceanum-auth:sign-out";
+/** The part of the command registry the sign-in is reached through. */
+export type AuthCommands = Pick<CommandRegistry, 'hasCommand' | 'execute' | 'isEnabled' | 'isVisible'>;
+export type AiCredentialSource = 'datamesh-token' | 'sign-in';
+export interface IAiCredential {
+    /** Which credential it is: the 401 message differs. */
+    source: AiCredentialSource;
+    headers: Record<string, string>;
+}
+/**
+ * The backend address for a configured value, without a trailing
+ * slash so a path can be appended. An invalid value falls back to the default.
+ */
+export declare function aiBackendUrl(value: string | null | undefined): string;
+/** A `datameshToken` setting value, trimmed; '' when there is none. */
+export declare function pastedToken(datameshToken: unknown): string;
+/** Whether the host can sign the user in to Oceanum.io on this site. */
+export declare function canSignIn(commands: AuthCommands): boolean;
+/** Whether the host says the user is signed in to Oceanum.io. */
+export declare function isSignedIn(commands: AuthCommands): boolean;
+/**
+ * Which credential a request would carry, without fetching it: runs no
+ * command, so it is safe to ask whenever something changes.
+ */
+export declare function aiCredentialSource(datameshToken: unknown, commands: AuthCommands): AiCredentialSource | null;
+/**
+ * Asks the host for its Oceanum.io access token; null without the command.
+ * This runs a command: call it only when a token is needed for a request.
+ */
+export declare function signInToken(commands: AuthCommands): () => Promise<unknown>;
+/**
+ * The credential for a request: the pasted Datamesh token if there is one,
+ * otherwise the host's sign-in, otherwise null.
+ *
+ * @param datameshToken The `datameshToken` setting value.
+ * @param getSignInToken Asked only without a pasted token. Anything but a
+ *   non-empty string -- including a rejection -- counts as signed out.
+ */
+export declare function resolveAiCredential(datameshToken: unknown, getSignInToken: () => Promise<unknown>): Promise<IAiCredential | null>;

package/lib/aiBackend.js

@@ -0,0 +1,101 @@
+import { OCEANUM_AI_BACKEND_URL } from './constants';
+import { validHttpUrl } from './httpUrl';
+/**
+ * The host's command answering with the current Oceanum.io access token (a
+ * JWT), or null when signed out. The token is cached and refreshed by the
+ * host, so it is asked for on every use rather than kept.
+ */
+export const ACCESS_TOKEN_COMMAND = 'oceanum-auth:access-token';
+/**
+ * The host's command that starts signing in to Oceanum.io. Enabled only where
+ * sign-in is configured for the site.
+ */
+export const SIGN_IN_COMMAND = 'oceanum-auth:sign-in';
+/** The host's command that signs out. Visible only while signed in. */
+export const SIGN_OUT_COMMAND = 'oceanum-auth:sign-out';
+/**
+ * The backend address for a configured value, without a trailing
+ * slash so a path can be appended. An invalid value falls back to the default.
+ */
+export function aiBackendUrl(value) {
+    const url = validHttpUrl(value, OCEANUM_AI_BACKEND_URL);
+    return `${url.origin}${url.pathname.replace(/\/+$/, '')}`;
+}
+/** A `datameshToken` setting value, trimmed; '' when there is none. */
+export function pastedToken(datameshToken) {
+    return typeof datameshToken === 'string' ? datameshToken.trim() : '';
+}
+/**
+ * Asks a query of the host's command, treating a missing command, or a query
+ * that throws, as false. Queries never emit `commandExecuted`.
+ */
+function query(commands, id, which) {
+    try {
+        return commands.hasCommand(id) && commands[which](id);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** Whether the host can sign the user in to Oceanum.io on this site. */
+export function canSignIn(commands) {
+    return query(commands, SIGN_IN_COMMAND, 'isEnabled');
+}
+/** Whether the host says the user is signed in to Oceanum.io. */
+export function isSignedIn(commands) {
+    return query(commands, SIGN_OUT_COMMAND, 'isVisible');
+}
+/**
+ * Which credential a request would carry, without fetching it: runs no
+ * command, so it is safe to ask whenever something changes.
+ */
+export function aiCredentialSource(datameshToken, commands) {
+    if (pastedToken(datameshToken)) {
+        return 'datamesh-token';
+    }
+    if (commands.hasCommand(ACCESS_TOKEN_COMMAND) && isSignedIn(commands)) {
+        return 'sign-in';
+    }
+    return null;
+}
+/**
+ * Asks the host for its Oceanum.io access token; null without the command.
+ * This runs a command: call it only when a token is needed for a request.
+ */
+export function signInToken(commands) {
+    return async () => commands.hasCommand(ACCESS_TOKEN_COMMAND)
+        ? commands.execute(ACCESS_TOKEN_COMMAND)
+        : null;
+}
+/**
+ * The credential for a request: the pasted Datamesh token if there is one,
+ * otherwise the host's sign-in, otherwise null.
+ *
+ * @param datameshToken The `datameshToken` setting value.
+ * @param getSignInToken Asked only without a pasted token. Anything but a
+ *   non-empty string -- including a rejection -- counts as signed out.
+ */
+export async function resolveAiCredential(datameshToken, getSignInToken) {
+    const pasted = pastedToken(datameshToken);
+    if (pasted) {
+        return {
+            source: 'datamesh-token',
+            headers: { 'X-Datamesh-Token': pasted }
+        };
+    }
+    let token;
+    try {
+        token = await getSignInToken();
+    }
+    catch (_a) {
+        return null;
+    }
+    const signedIn = typeof token === 'string' ? token.trim() : '';
+    if (!signedIn) {
+        return null;
+    }
+    return {
+        source: 'sign-in',
+        headers: { Authorization: `Bearer ${signedIn}` }
+    };
+}

package/lib/auth/accountWidget.d.ts

@@ -0,0 +1,35 @@
+import { CommandRegistry } from '@lumino/commands';
+import { Widget } from '@lumino/widgets';
+import { IPendingSignIn, ServerAuth } from './serverAuth';
+export declare const CommandIDs: {
+    readonly signIn: "oceanum-auth:sign-in";
+    readonly signOut: "oceanum-auth:sign-out";
+    readonly account: "oceanum-auth:account";
+    /**
+     * For other parts of oceanumlab and other extensions, such as the AI chat: resolves to
+     * the current access token, or `null` when signed out. Never rejects.
+     */
+    readonly accessToken: "oceanum-auth:access-token";
+};
+/**
+ * The top-bar account control: "Sign in" when signed out, the user's email with a sign-out
+ * menu when signed in.
+ */
+export declare class AccountWidget extends Widget {
+    constructor(auth: ServerAuth, commands: CommandRegistry);
+    dispose(): void;
+    private _onClick;
+    private _render;
+    private _auth;
+    private _commands;
+    private _menu;
+}
+/**
+ * What the sign-in dialog shows: the code to confirm, and a link to the page that confirms
+ * it. A real link rather than `window.open`, which a popup blocker stops once there has
+ * been an `await` between the click and the call -- and there always has, because the code
+ * comes from the server.
+ */
+export declare class SignInBody extends Widget {
+    constructor(pending: IPendingSignIn);
+}

package/lib/auth/accountWidget.js

@@ -0,0 +1,95 @@
+import { Menu, Widget } from '@lumino/widgets';
+export const CommandIDs = {
+    signIn: 'oceanum-auth:sign-in',
+    signOut: 'oceanum-auth:sign-out',
+    account: 'oceanum-auth:account',
+    /**
+     * For other parts of oceanumlab and other extensions, such as the AI chat: resolves to
+     * the current access token, or `null` when signed out. Never rejects.
+     */
+    accessToken: 'oceanum-auth:access-token'
+};
+/**
+ * The top-bar account control: "Sign in" when signed out, the user's email with a sign-out
+ * menu when signed in.
+ */
+export class AccountWidget extends Widget {
+    constructor(auth, commands) {
+        super({ node: document.createElement('button') });
+        this._onClick = () => {
+            if (!this._auth.user) {
+                void this._commands.execute(CommandIDs.signIn);
+                return;
+            }
+            const rect = this.node.getBoundingClientRect();
+            this._menu.open(rect.left, rect.bottom);
+        };
+        this._auth = auth;
+        this._commands = commands;
+        this._menu = new Menu({ commands });
+        this._menu.addItem({ command: CommandIDs.account });
+        this._menu.addItem({ type: 'separator' });
+        this._menu.addItem({ command: CommandIDs.signOut });
+        // The application shell refuses widgets without an id.
+        this.id = 'oceanum-account';
+        this.addClass('oc-Account');
+        this.node.setAttribute('type', 'button');
+        this.node.addEventListener('click', this._onClick);
+        auth.userChanged.connect(this._render, this);
+        auth.stateChanged.connect(this._render, this);
+        void auth.ready.then(() => this._render());
+        this._render();
+    }
+    dispose() {
+        if (this.isDisposed) {
+            return;
+        }
+        this.node.removeEventListener('click', this._onClick);
+        this._menu.dispose();
+        super.dispose();
+    }
+    _render() {
+        const user = this._auth.user;
+        const waiting = !user && this._auth.pending !== null;
+        this.node.textContent = user
+            ? user.email
+            : waiting
+                ? 'Signing in to Oceanum.io…'
+                : 'Sign in to Oceanum.io';
+        this.node.title = user
+            ? `Signed in to Oceanum.io as ${user.email}`
+            : 'Sign in to Oceanum.io';
+        this.toggleClass('oc-mod-signedIn', user !== null);
+    }
+}
+/**
+ * What the sign-in dialog shows: the code to confirm, and a link to the page that confirms
+ * it. A real link rather than `window.open`, which a popup blocker stops once there has
+ * been an `await` between the click and the call -- and there always has, because the code
+ * comes from the server.
+ */
+export class SignInBody extends Widget {
+    constructor(pending) {
+        super();
+        this.addClass('oc-SignIn');
+        const intro = document.createElement('p');
+        intro.textContent =
+            'Open the Oceanum.io sign-in page, and check that it shows this code:';
+        const code = document.createElement('div');
+        code.className = 'oc-SignIn-code';
+        code.textContent = pending.userCode;
+        const link = document.createElement('a');
+        link.className = 'oc-SignIn-link jp-mod-styled jp-mod-accept';
+        link.href = pending.verificationUriComplete;
+        link.target = '_blank';
+        link.rel = 'noopener noreferrer';
+        link.textContent = 'Open the sign-in page';
+        const note = document.createElement('p');
+        note.className = 'oc-SignIn-note';
+        const minutes = Math.max(1, Math.round(pending.expiresIn / 60));
+        note.textContent =
+            `This closes by itself once you have signed in. The code lasts ${minutes} ` +
+                `minute${minutes === 1 ? '' : 's'}. Only confirm a code you asked for yourself.`;
+        this.node.append(intro, code, link, note);
+    }
+}

package/lib/auth/claims.d.ts

@@ -0,0 +1,3 @@
+import { IOceanumUser } from './tokens';
+/** Build the user from Auth0 ID token claims; `null` if the claims lack an identity. */
+export declare function userFromClaims(claims: Record<string, unknown> | null | undefined): IOceanumUser | null;

package/lib/auth/claims.js

@@ -0,0 +1,25 @@
+const CLAIM = 'https://oceanum.io/';
+const COLOR_SCHEMES = ['light', 'dark', 'auto'];
+/** Build the user from Auth0 ID token claims; `null` if the claims lack an identity. */
+export function userFromClaims(claims) {
+    var _a;
+    if (!claims) {
+        return null;
+    }
+    const str = (value) => typeof value === 'string' && value.length > 0 ? value : null;
+    const sub = str(claims.sub);
+    const email = (_a = str(claims.email)) !== null && _a !== void 0 ? _a : str(claims[`${CLAIM}email`]);
+    if (!sub || !email) {
+        return null;
+    }
+    const scheme = claims[`${CLAIM}color_scheme`];
+    return {
+        sub,
+        email,
+        name: str(claims.name),
+        activeOrg: str(claims[`${CLAIM}active_org`]),
+        colorScheme: COLOR_SCHEMES.includes(scheme)
+            ? scheme
+            : null
+    };
+}

package/lib/auth/plugin.d.ts

@@ -0,0 +1,9 @@
+import { JupyterFrontEndPlugin } from '@jupyterlab/application';
+import { IOceanumAuth } from './tokens';
+/**
+ * The id other deployments disable. notebook.oceanum.io provides IOceanumAuth from its own
+ * Oceanum widget extension, and Lumino lets a second provider silently replace the first
+ * rather than refusing it, so that site lists this id under `disabledExtensions`.
+ */
+export declare const DEVICE_AUTH_PLUGIN_ID = "@oceanum/oceanumlab:device-auth";
+export declare const deviceAuthPlugin: JupyterFrontEndPlugin<IOceanumAuth>;

package/lib/auth/plugin.js

@@ -0,0 +1,126 @@
+import { Dialog, ICommandPalette, Notification } from '@jupyterlab/apputils';
+import { PageConfig, URLExt } from '@jupyterlab/coreutils';
+import { ServerConnection } from '@jupyterlab/services';
+import { AccountWidget, CommandIDs, SignInBody } from './accountWidget';
+import { readServerAuthOption, SERVER_AUTH_OPTION, ServerAuth } from './serverAuth';
+import { IOceanumAuth } from './tokens';
+/**
+ * The id other deployments disable. notebook.oceanum.io provides IOceanumAuth from its own
+ * Oceanum widget extension, and Lumino lets a second provider silently replace the first
+ * rather than refusing it, so that site lists this id under `disabledExtensions`.
+ */
+export const DEVICE_AUTH_PLUGIN_ID = '@oceanum/oceanumlab:device-auth';
+function serverRequest(settings) {
+    return async (action, method) => {
+        const url = URLExt.join(settings.baseUrl, 'oceanum', 'auth', action);
+        const response = await ServerConnection.makeRequest(url, { method }, settings);
+        if (!response.ok) {
+            throw new ServerConnection.ResponseError(response);
+        }
+        return response.json();
+    };
+}
+/** Show the code and the link until the sign-in completes, fails, or is cancelled. */
+async function showSignIn(auth) {
+    const pending = auth.pending;
+    if (!pending) {
+        return;
+    }
+    const dialog = new Dialog({
+        title: 'Sign in to Oceanum.io',
+        body: new SignInBody(pending),
+        buttons: [Dialog.cancelButton()]
+    });
+    const closeWhenSettled = () => {
+        if (auth.pending === null) {
+            dialog.reject();
+        }
+    };
+    auth.stateChanged.connect(closeWhenSettled);
+    auth.userChanged.connect(closeWhenSettled);
+    try {
+        await dialog.launch();
+    }
+    finally {
+        auth.stateChanged.disconnect(closeWhenSettled);
+        auth.userChanged.disconnect(closeWhenSettled);
+    }
+    if (auth.pending) {
+        // Still waiting, so it was the user who closed it.
+        await auth.cancelSignIn();
+    }
+    else if (!auth.user && auth.error) {
+        Notification.warning(`Oceanum.io sign-in did not complete: ${auth.error}`, {
+            autoClose: false
+        });
+    }
+}
+export const deviceAuthPlugin = {
+    id: DEVICE_AUTH_PLUGIN_ID,
+    description: 'Oceanum.io sign-in by device code, run by the Jupyter server extension.',
+    autoStart: true,
+    provides: IOceanumAuth,
+    optional: [ICommandPalette],
+    activate: (app, palette) => {
+        const environment = readServerAuthOption(PageConfig.getOption(SERVER_AUTH_OPTION), window.location.hostname);
+        const auth = new ServerAuth({
+            environment,
+            request: serverRequest(app.serviceManager.serverSettings),
+            onSessionEnded: message => Notification.warning(message, { autoClose: false })
+        });
+        if (!environment) {
+            // The server offers no sign-in (`c.OceanumLab.sign_in = "off"`), or there is no
+            // oceanumlab server extension at all. Consumers see an auth with no environment and
+            // say sign-in is not configured; nothing is added to the top bar.
+            return auth;
+        }
+        document.addEventListener('visibilitychange', () => {
+            if (document.visibilityState === 'visible') {
+                void auth.refresh();
+            }
+        });
+        const { commands } = app;
+        let dialogOpen = false;
+        commands.addCommand(CommandIDs.signIn, {
+            label: 'Sign in to Oceanum.io',
+            isVisible: () => !auth.user,
+            execute: async () => {
+                await auth.signIn();
+                if (auth.pending && !dialogOpen) {
+                    dialogOpen = true;
+                    try {
+                        await showSignIn(auth);
+                    }
+                    finally {
+                        dialogOpen = false;
+                    }
+                }
+                else if (!auth.user && !auth.pending && auth.error) {
+                    Notification.warning(`Oceanum.io sign-in could not start: ${auth.error}`, { autoClose: false });
+                }
+            }
+        });
+        commands.addCommand(CommandIDs.signOut, {
+            label: 'Sign out of Oceanum.io',
+            isVisible: () => auth.user !== null,
+            execute: () => auth.signOut()
+        });
+        commands.addCommand(CommandIDs.account, {
+            label: () => auth.user ? `Signed in as ${auth.user.email}` : 'Not signed in',
+            isEnabled: () => false,
+            execute: () => undefined
+        });
+        commands.addCommand(CommandIDs.accessToken, {
+            label: 'Oceanum.io access token',
+            isVisible: () => false,
+            execute: () => auth.getAccessToken().catch(() => null)
+        });
+        auth.userChanged.connect(() => commands.notifyCommandChanged());
+        if (palette) {
+            palette.addItem({ command: CommandIDs.signIn, category: 'Oceanum' });
+            palette.addItem({ command: CommandIDs.signOut, category: 'Oceanum' });
+        }
+        app.shell.add(new AccountWidget(auth, commands), 'top', { rank: 1000 });
+        return auth;
+    }
+};

package/lib/auth/serverAuth.d.ts

@@ -0,0 +1,79 @@
+import { IDisposable } from '@lumino/disposable';
+import { ISignal } from '@lumino/signaling';
+import { IOceanumAuth, IOceanumEnvironment, IOceanumServiceUrls, IOceanumUser } from './tokens';
+/**
+ * The page option the server extension publishes when it runs the device sign-in. Must
+ * match SERVER_AUTH_OPTION in oceanumlab/__init__.py.
+ */
+export declare const SERVER_AUTH_OPTION = "oceanumServerAuth";
+/** A sign-in waiting on the user: the code to confirm, and where to confirm it. */
+export interface IPendingSignIn {
+    readonly userCode: string;
+    readonly verificationUri: string;
+    /** The verification page with the code already filled in. */
+    readonly verificationUriComplete: string;
+    /** Seconds until the code lapses. */
+    readonly expiresIn: number;
+}
+/** One exchange with the server extension's `/oceanum/auth/<action>` handler. */
+export type AuthRequest = (action: 'status' | 'token' | 'start' | 'cancel' | 'signout', method: 'GET' | 'POST') => Promise<unknown>;
+/**
+ * The Oceanum deployment the server signs in to, from the page option, or `null` when the
+ * server offers no device sign-in (or the option is malformed, which is treated the same).
+ */
+export declare function readServerAuthOption(option: string | undefined, hostname: string): IOceanumEnvironment | null;
+export interface IServerAuthOptions {
+    /** The deployment the server signs in to, or `null` when it offers no sign-in. */
+    environment: IOceanumEnvironment | null;
+    request: AuthRequest;
+    /** Called when a session ends other than by `signOut()`. */
+    onSessionEnded?: (message: string) => void;
+    /** How often to ask the server whether a pending sign-in has completed. */
+    pendingPollMs?: number;
+    /** How often to pick up a refreshed access token while signed in. */
+    tokenPollMs?: number;
+}
+export declare class ServerAuth implements IOceanumAuth, IDisposable {
+    constructor(options: IServerAuthOptions);
+    readonly environment: IOceanumEnvironment | null;
+    get urls(): IOceanumServiceUrls | null;
+    get ready(): Promise<void>;
+    get user(): IOceanumUser | null;
+    get userChanged(): ISignal<IOceanumAuth, IOceanumUser | null>;
+    get tokenChanged(): ISignal<IOceanumAuth, string | null>;
+    /** The sign-in waiting on the user, if any. */
+    get pending(): IPendingSignIn | null;
+    /** Why the last sign-in attempt ended, if it failed. */
+    get error(): string | null;
+    /** Emits when `pending` or `error` changes. */
+    get stateChanged(): ISignal<ServerAuth, void>;
+    signIn(): Promise<void>;
+    /** Abandon a sign-in that is waiting on the user. */
+    cancelSignIn(): Promise<void>;
+    signOut(): Promise<void>;
+    getAccessToken(): Promise<string | null>;
+    /** Re-read the server's state, e.g. when the tab becomes visible again. */
+    refresh(): Promise<void>;
+    get isDisposed(): boolean;
+    dispose(): void;
+    private _sync;
+    private _apply;
+    /** Poll quickly while a sign-in is pending, slowly while signed in, not at all otherwise. */
+    private _schedule;
+    private _clearTimer;
+    private _request;
+    private _onSessionEnded;
+    private _pendingPollMs;
+    private _tokenPollMs;
+    private _ready;
+    private _user;
+    private _token;
+    private _pending;
+    private _error;
+    private _signingOut;
+    private _disposed;
+    private _timer;
+    private _userChanged;
+    private _tokenChanged;
+    private _stateChanged;
+}