@okta/auth-foundation 0.6.0

package/dist/esm/utils/toRelativeUrl.js

@@ -0,0 +1,19 @@
+/*!
+ * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.
+ * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.")
+ *
+ * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * 
+ * See the License for the specific language governing permissions and limitations under the License.
+ */
+
+function toRelativeUrl(url) {
+    url = new URL(url);
+    return url.href.replace(url.origin, '');
+}
+
+export { toRelativeUrl };
+//# sourceMappingURL=toRelativeUrl.js.map

package/dist/esm/utils/toRelativeUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toRelativeUrl.js","sources":["../../../../src/utils/toRelativeUrl.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;AAWM,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAU,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAa,CAAE,CAAA,CAAA,CAAiB,CAAA,CAAA,CAAA;AAC9C,CAAA,CAAA,CAAA,CAAA,GAAG,CAAA,CAAA,CAAG,CAAA,CAAA,CAAA,CAAI,CAAA,CAAA,CAAG,CAAC,GAAG,CAAC,CAAA;AAClB,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA,CAAA,CAAG,CAAC,CAAA,CAAA,CAAA,CAAI,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAC,CAAA,CAAA,CAAG,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAM,CAAA,CAAE,CAAA,CAAE,CAAC,CAAA;AACzC,CAAA;;"}

package/dist/esm/utils/validators.js

@@ -0,0 +1,32 @@
+/*!
+ * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.
+ * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.")
+ *
+ * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * 
+ * See the License for the specific language governing permissions and limitations under the License.
+ */
+
+function validateString(input) {
+    return typeof input === 'string' && input.length !== 0;
+}
+function validateURL(input, allowHttp = false) {
+    if (!validateString(input)) {
+        return false;
+    }
+    try {
+        const url = new URL(input);
+        if (allowHttp) {
+            return url.protocol === 'https:' || url.protocol === 'http:';
+        }
+        return url.protocol === 'https:';
+    }
+    catch (err) { }
+    return false;
+}
+
+export { validateString, validateURL };
+//# sourceMappingURL=validators.js.map

package/dist/esm/utils/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sources":["../../../../src/utils/validators.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;;;;;;;;AAOM,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAU,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAc,CAAE,CAAA,CAAA,CAAA,CAAA,CAAc,CAAA,CAAA,CAAA;IAC5C,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA,CAAA,CAAA,CAAA,CAAK,CAAA,CAAA,CAAA,CAAA,CAAK,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAQ,IAAI,CAAA,CAAA,CAAA,CAAA,CAAK,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAM,CAAA,CAAA,CAAA,CAAA,CAAK,CAAC,CAAA;AACxD,CAAA;SAEgB,WAAW,CAAE,CAAA,CAAA,CAAA,CAAA,CAAc,EAAE,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAS,CAAA,CAAA,CAAG,KAAK,CAAA,CAAA,CAAA;AAC5D,CAAA,CAAA,CAAA,CAAA,IAAI,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAc,CAAC,CAAA,CAAA,CAAA,CAAA,CAAK,CAAC,CAAA,CAAE,CAAA;AAC1B,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,OAAO,CAAA,CAAA,CAAA,CAAA,CAAK,CAAA;IACd,CAAA;AACA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAI,CAAA;AACF,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,MAAM,CAAA,CAAA,CAAG,CAAA,CAAA,CAAG,IAAI,CAAA,CAAA,CAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAA,CAAA,CAAA,CAAI,SAAS,CAAA,CAAE,CAAA;YACb,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA,CAAA,CAAG,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAQ,CAAA,CAAA,CAAA,CAAA,CAAK,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAQ,CAAA,CAAA,CAAA,CAAI,CAAA,CAAA,CAAG,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAQ,CAAA,CAAA,CAAA,CAAA,CAAK,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA;QAC9D,CAAA;AACA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA,CAAA,CAAG,CAAC,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAQ,KAAK,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAQ,CAAA;IAClC,CAAA;AAEA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA,CAAO,CAAA,CAAA,CAAG,CAAA,CAAE,CAAA,CAAC,CAAA;AACb,CAAA,CAAA,CAAA,CAAA,OAAO,CAAA,CAAA,CAAA,CAAA,CAAK,CAAA;AACd,CAAA;;"}

package/dist/types/Credential/Credential.d.ts

@@ -0,0 +1,292 @@
+/**
+ * @module Credential
+ */
+import { type RequestAuthorizer, type RequestAuthorizerInit, type JsonRecord, type JSONSerializable, type Seconds } from '../types/index.ts';
+import type { OAuth2Client } from '../oauth2/client.ts';
+import { Token } from '../Token.ts';
+import { UserInfo } from '../oauth2/requests/UserInfo.ts';
+import { EventEmitter } from '../utils/EventEmitter.ts';
+import { type CredentialCoordinator, type CredentialCoordinatorEvents } from './CredentialCoordinator.ts';
+type CredentialEvents = {
+    'credential_added': {
+        credential: Credential;
+    };
+    'credential_removed': {
+        id: string;
+    };
+    'tags_updated': {
+        id: string;
+        tags: string[];
+    };
+} & Omit<CredentialCoordinatorEvents, 'credential_added' | 'credential_removed'>;
+/**
+ * Wrapper around a {@link Token.Token | Token}, providing methods to interact with Tokens without the hassle of managing them
+ *
+ * @public
+ */
+export declare class Credential implements RequestAuthorizer, JSONSerializable {
+    protected static readonly emitter: EventEmitter<CredentialEvents>;
+    /** @internal */
+    protected static _coordinator: CredentialCoordinator;
+    /** @internal */
+    static get coordinator(): CredentialCoordinator;
+    /** @internal */
+    static set coordinator(coordinator: CredentialCoordinator);
+    /** @internal */
+    protected _token: Token;
+    /** @internal */
+    protected _refreshPromise: Promise<void> | null;
+    /** @internal */
+    protected _oauth2: OAuth2Client;
+    /** @internal */
+    protected _metadata: Token.Metadata;
+    /** @internal */
+    protected _userInfo: UserInfo | undefined;
+    /**
+     * @remarks
+     * Do not use directly, use {@link store | Credential.store} instead
+     */
+    constructor(token: Token, client: OAuth2Client, metadata?: Token.Metadata);
+    /**
+     * @internal
+     * accesses a derived class' coordinator rather than the default Credential impl's
+     */
+    protected get coordinator(): CredentialCoordinator;
+    /**
+     * Returns instance of {@link OAuth2.OAuth2Client | OAuth2Client} used to construct {@link Credential}
+     *
+     * @public
+     */
+    get oauth2(): OAuth2Client;
+    /**
+     * Bind an event listener
+     *
+     * @param event - event name
+     * @param callback - event handler
+     *
+     * @group Events
+     *
+     * @example
+     * Credential.on(Events.CREDENTIAL_REFRESHED, credential => {
+     *   // do something with credential
+     * });
+     */
+    static on(...args: Parameters<EventEmitter<CredentialEvents>['on']>): void;
+    /**
+     * Removes active event listeners
+     *
+     * @param event - event name
+     * @param callback - the event handler previously bound via {@link on | Credential.on}
+     *
+     * @group Events
+     *
+     * @example
+     * Credential.off(Events.CREDENTIAL_REFRESHED);
+     */
+    static off(...args: Parameters<EventEmitter<CredentialEvents>['off']>): void;
+    /**
+     * @group Static Accessors
+     */
+    static getDefault(): Promise<Credential | null>;
+    /**
+     * @group Static Accessors
+     */
+    static setDefault(cred: Credential | null): Promise<void>;
+    /**
+     * Returns array of all Credential ids
+     *
+     * @group Static Accessors
+     */
+    static allIDs(): Promise<string[]>;
+    /**
+     * Returns number of Credential instances
+     *
+     * @group Static Accessors
+     */
+    static get size(): number;
+    /**
+     * Writes `token` to storage and returns a {@link Credential} instance
+     *
+     * @param token - Object representing the token to be managed by returned Credential instance
+     * @param tags - List of strings that can be used to ease Credential retrieval
+     *
+     * @example
+     * const adminToken = await fetchAdminToken();
+     * const token = new Token(adminToken);
+     * Credential.store(token, ['admin']);
+     *
+     * @group Factory Methods
+     *
+     */
+    static store(token: Token, tags?: string[]): Promise<Credential>;
+    /**
+     * Returns {@link Credential} instance with corresponding {@link Credential.id | id}
+     *
+     * @remarks
+     * This method can be used to retreive a specific {@link Credential}, however its recommended to use
+     * {@link Credential.getDefault} or {@link Credential.find} to query by {@link Credential.tags | tags} instead
+     *
+     * @group Static Methods
+     */
+    static with(id: string): Promise<Credential | null>;
+    /**
+     * Returns all Credential instances where `matcher` function returns `true`
+     *
+     * @param matcher - Function which takes `meta` as first argument. Returns `true` if Credential should
+     * be included, `false` otherwise
+     *
+     * *Shorthand* Pass an object with any key in {@link Token.Token.Metadata:TYPE | Token.Metadata} and a string value to match on.
+     *
+     * @group Static Methods
+     *
+     * @example
+     * // find Credentials by tag 'foo'
+     * Credential.find(meta => meta?.tags?.includes('foo'));
+     *
+     * // shorthand - find Credentials by tag 'foo'
+     * Credential.find({ tags: 'foo' });
+     */
+    static find(matcher: ((meta: Token.Metadata) => boolean) | {
+        [key in keyof Token.Metadata]?: string | string[];
+    }): Promise<Credential[]>;
+    /**
+     * Removes all {@link Credential} instances and clears storage
+     *
+     * @group Static Methods
+     */
+    static clear(): Promise<void>;
+    /**
+     * Compares 2 Credential instances to determine if they represent the same token
+     *
+     * @group Static Methods
+     */
+    static isEqual(lhs: Credential, rhs: Credential): boolean;
+    /**
+     * The {@link Token.Token | Token} instance {@link Credential} is associated with
+     *
+     * @remarks
+     * This value may change, from operations like {@link Credential.refresh},
+     * however the {@link Token.Token.id | Token.id} will remain consistent
+     */
+    get token(): Token;
+    /** @internal */
+    protected set token(token: Token);
+    /**
+     * Short for `this.token.id`
+     */
+    get id(): string;
+    /**
+     * Array of tags associated with {@link Credential}. Used for retrieval
+     */
+    get tags(): string[];
+    /**
+     * Updates tags associated with {@link Credential}
+     *
+     * @remarks
+     * This is *not* merge operation
+     *
+     * @param tags - tags to be associated with {@link Credential}
+     */
+    setTags(tags?: string[]): Promise<void>;
+    /**
+     * Removes {@link Credential} from storage
+     *
+     * @remarks
+     * **NOTE:** this method *does not* revoke tokens
+     *
+     * @see {@link revoke | Credential.prototype.revoke}
+     */
+    remove(): Promise<void>;
+    /**
+     * Helper method to get a `Authorization` header, expressed as an object
+     *
+     * @example
+     * cred.getAuthHeader();
+     * // { 'Authorization': 'Bearer ***********' }
+     *
+     * @example
+     * const data = await fetch('resource/server', { headers: { ...cred.getAuthHeader() }})
+     *
+     */
+    getAuthHeader(): {
+        Authorization: string;
+    };
+    /**
+     * A utility method which matches the signature of [fetch](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API)
+     * a [Request](https://developer.mozilla.org/en-US/docs/Web/API/Request) instance with a predefined `Authorization` header
+     */
+    authorize(input: string | URL | Request, init?: RequestAuthorizerInit): Promise<Request>;
+    toJSON(): JsonRecord;
+    /** @internal */
+    protected observeToken(): void;
+    /**
+     * Attempts to refresh the represented `token`
+     *
+     * @remarks
+     * Upon successful refresh, the `token` will be replaced with a new
+     * {@link Token.Token | Token} instance, however the `id` property will remain consistent
+     *
+     * @group OAuth2 Methods
+     *
+     * @throws {@link Core.OAuth2Error | OAuth2Error } if refresh fails
+     */
+    refresh(): Promise<void>;
+    /**
+     * Renews `token` if the will expire within the grace period
+     *
+     * @remarks
+     * Expiration calculation is performed on the browser via `TimeCoordinator`
+     *
+     * @group OAuth2 Methods
+     *
+     * @throws {@link Core.OAuth2Error | OAuth2Error} if refresh fails
+     */
+    refreshIfNeeded(gracePeriod?: Seconds): Promise<void>;
+    /**
+     * Revokes either {@link Token.Token.accessToken | token.accessToken} or
+     * {@link Token.Token.refreshToken | token.refreshToken} or both
+     *
+     * @remarks
+     * * If `RevokeType.ALL`, {@link Credential} will be removed
+     *
+     * @group OAuth2 Methods
+     *
+     * @throws {@link Core.OAuth2Error | OAuth2Error} if revocation fails
+     *
+     * @see
+     * {@link https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/CustomAS/#tag/CustomAS/operation/revokeCustomAS | Okta Docs}
+     * {@link https://oauth.net/2/token-revocation/ | OAuth2 Reference}
+     * {@link https://datatracker.ietf.org/doc/html/rfc7009 | RFC}
+     */
+    revoke(type?: Token.RevokeType): Promise<void>;
+    /**
+     * Performs introspect on a specific token
+     *
+     * @param kind - The specific token to introspect.
+     * Must be available in {@link Credential.token}
+     *
+     * @group OAuth2 Methods
+     *
+     * @throws {@link Core.OAuth2Error | OAuth2Error}
+     *
+     * @see
+     * {@link https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/CustomAS/#tag/CustomAS/operation/introspectCustomAS | Okta Docs}
+     * {@link https://oauth.net/2/token-introspection/ | OAuth2 Reference}
+     */
+    introspect(kind: Token.Kind): Promise<Token.IntrospectResponse>;
+    /**
+     * Performs OIDC UserInfo request
+     *
+     * @param ignoreCache - When `false` any previously fetched result will be returned rather than making a network request. Defaults to `false`
+     *
+     * @group OAuth2 Methods
+     *
+     * @throws {@link Core.OAuth2Error | OAuth2Error}
+     *
+     * @see
+     * {@link https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/CustomAS/#tag/CustomAS/operation/userinfoCustomAS | Okta Docs}
+     * {@link https://openid.net/specs/openid-connect-core-1_0.html#UserInfo | OIDC Spec}
+     */
+    userInfo(ignoreCache?: boolean): Promise<UserInfo>;
+}
+export {};

package/dist/types/Credential/CredentialCoordinator.d.ts

@@ -0,0 +1,103 @@
+/**
+ * @module
+ * @mergeModuleWith Credential
+ */
+import type { OAuth2Client } from '../oauth2/client.ts';
+import type { Credential } from './Credential.ts';
+import { Token } from '../Token.ts';
+import { EventEmitter } from '../utils/EventEmitter.ts';
+import { type CredentialDataSource, type CredentialDataSourceEvents } from './CredentialDataSource.ts';
+import { TokenStorage, TokenStorageEvents } from './TokenStorage.ts';
+export type CredentialCoordinatorEvents = {
+    'credential_expired': {
+        credential: Credential;
+    };
+    'credential_refreshed': {
+        credential: Credential;
+    };
+    'cleared': void;
+} & Pick<TokenStorageEvents, 'default_changed' | 'metadata_updated' | 'token_replaced'> & CredentialDataSourceEvents;
+/**
+ * @public @interface
+ *
+ * Holds the implementation of most {@link Credential} methods. Bridges the
+ * {@link CredentialDataSource} and {@link TokenStorage} layers together
+ *
+ * @remarks
+ * Default implementation provided
+ */
+export interface CredentialCoordinator {
+    emitter: EventEmitter<CredentialCoordinatorEvents>;
+    /**
+     * Represents {@link Credential.getDefault}, backed by {@link CredentialCoordinator.tokenStorage | TokenStorage}
+     */
+    getDefault(): Promise<Credential | null>;
+    setDefault(cred: Credential | null): Promise<void>;
+    get tokenStorage(): TokenStorage;
+    /**
+     * Writes the provided {@link Token.Token | Token} (and {@link Token.Token.Metadata:TYPE | Token.Metadata}) to storage and creates a {@link Credential}
+     * instance to represent the {@link Token.Token | Token} via the {@link CredentialDataSource}
+     *
+     * @param token - the {@link Token.Token | Token} to store
+     * @param tags - an array of developer-provided tags to associate with a {@link Token.Token | Token}.
+     * Used by {@link Credential.find} queries
+     */
+    store(token: Token, tags: string[]): Promise<Credential>;
+    /**
+     * Retrieves a {@link Credential} for the provided `id` from storage
+     */
+    with(id: string): Promise<Credential | null>;
+    /**
+     * Uses stored {@link Token.Token.Metadata:TYPE | Token.Metadata} to match stored {@link Token.Token | Tokens} by certain criteria
+     */
+    find(matcher: (meta: Token.Metadata) => boolean): Promise<Credential[]>;
+    /**
+     * Removes the provided {@link Credential} from storage and {@link CredentialDataSource}
+     *
+     * @remarks
+     * **NOTE:** This does *not* {@link Credential.revoke | revoke} tokens!
+     */
+    remove(cred: Credential): Promise<void>;
+    /**
+     * Clears both {@link TokenStorage} and {@link CredentialDataSource}
+     *
+     * @remarks
+     * **NOTE:** This does *not* {@link Credential.revoke | revoke} tokens!
+     */
+    clear(): Promise<void>;
+    /**
+     * Returns all token {@link Token.Token.id | ids} in storage
+     */
+    allIDs(): Promise<string[]>;
+    /**
+     * Returns the number of recorded {@link Credential} instances in the {@link CredentialDataSource}
+     */
+    readonly size: number;
+}
+/** @internal */
+export declare class CredentialCoordinatorImpl implements CredentialCoordinator {
+    readonly emitter: EventEmitter<CredentialCoordinatorEvents>;
+    protected readonly expiryTimeouts: {
+        [key: string]: ReturnType<typeof setTimeout>;
+    };
+    protected _default: Credential | null | undefined;
+    protected _credentialDataSource: CredentialDataSource;
+    protected _tokenStorage: TokenStorage;
+    constructor(CredentialConstructor: new (token: Token, client: OAuth2Client) => Credential);
+    get credentialDataSource(): CredentialDataSource;
+    set credentialDataSource(dataSource: CredentialDataSource);
+    get tokenStorage(): TokenStorage;
+    set tokenStorage(tokenStorage: TokenStorage);
+    protected clearExpireEventTimeout(id: string): void;
+    protected addExpireEventTimeout(credential: Credential): void;
+    getDefault(): Promise<Credential | null>;
+    setDefault(cred: Credential | null): Promise<void>;
+    store(token: Token, tags?: string[]): Promise<Credential>;
+    with(id: string): Promise<Credential | null>;
+    find(matcher: (meta: Token.Metadata) => boolean): Promise<Credential[]>;
+    remove(cred: Credential): Promise<void>;
+    clear(localOnly?: boolean): Promise<void>;
+    allIDs(): Promise<string[]>;
+    get size(): number;
+    protected loadDefaultCredential(): Promise<Credential | null>;
+}

package/dist/types/Credential/CredentialDataSource.d.ts

@@ -0,0 +1,75 @@
+/**
+ * @module
+ * @mergeModuleWith Credential
+ */
+import type { Token } from '../Token.ts';
+import type { Credential } from './Credential.ts';
+import { EventEmitter } from '../utils/EventEmitter.ts';
+import { OAuth2Client } from '../oauth2/client.ts';
+import { ConfigurationParams } from '../types/index.ts';
+export type CredentialDataSourceEvents = {
+    credential_added: {
+        dataSource: CredentialDataSource;
+        credential: Credential;
+    };
+    credential_removed: {
+        dataSource: CredentialDataSource;
+        id: string;
+    };
+};
+/**
+ * @public @interface
+ *
+ * Prevents multiple instances of {@link Credential} from existing for the same {@link Token.Token | Token}
+ *
+ * @remarks
+ * Default implementation provided
+ */
+export interface CredentialDataSource {
+    readonly emitter: EventEmitter<CredentialDataSourceEvents>;
+    /**
+     * Returns the number of {@link Credential}s recorded in the {@link CredentialDataSource}
+     */
+    readonly size: number;
+    /**
+     * Checks {@link CredentialDataSource} for an existing {@link Credential} instance which
+     * represents the provided {@link Token.Token | Token}.
+     */
+    hasCredential(token: Token): boolean;
+    /**
+     * Checks {@link CredentialDataSource} for an existing {@link Credential} instance which
+     * represents the provided {@link Token.Token | Token}. If one does not exist, a new {@link Credential}
+     * instance is created (and recorded within the {@link CredentialDataSource})
+     */
+    credentialFor(token: Token, metadata?: Token.Metadata): Credential;
+    /**
+     * Removes provided {@link Credential} instance from the {@link CredentialDataSource}
+     *
+     * @remarks
+     * **NOTE:** This does *not* {@link Credential.revoke | revoke} the represented token.
+     * They are only removed from the {@link CredentialDataSource}!
+     */
+    remove(cred: Credential | string): void;
+    /**
+     * Clears all {@link Credential} instances from the {@link CredentialDataSource}
+     *
+     * @remarks
+     * **NOTE:** This does *not* {@link Credential.revoke | revoke} tokens.
+     * They are only removed from the {@link CredentialDataSource}!
+     */
+    clear(): void;
+}
+/** @internal */
+export declare class DefaultCredentialDataSource implements CredentialDataSource {
+    protected readonly CredentialConstructor: new (...args: ConstructorParameters<typeof Credential>) => Credential;
+    protected readonly credentials: Map<string, Credential>;
+    readonly emitter: EventEmitter<CredentialDataSourceEvents>;
+    constructor(CredentialConstructor: new (...args: ConstructorParameters<typeof Credential>) => Credential);
+    protected createOAuth2Client(params: ConfigurationParams): OAuth2Client;
+    protected createCredential(token: Token, metadata?: Token.Metadata): Credential;
+    hasCredential(token: Token): boolean;
+    credentialFor(token: Token, metadata?: Token.Metadata): Credential;
+    remove(cred: Credential | string): void;
+    clear(): void;
+    get size(): number;
+}

package/dist/types/Credential/TokenStorage.d.ts

@@ -0,0 +1,116 @@
+/**
+ * @module
+ * @mergeModuleWith Credential
+ */
+import { Token } from '../Token.ts';
+import { EventEmitter } from '../utils/EventEmitter.ts';
+type TokenStorageEvent = {
+    storage: TokenStorage;
+    id: string;
+};
+export type TokenStorageEvents = {
+    'token_added': TokenStorageEvent & {
+        token: Token;
+    };
+    'token_removed': TokenStorageEvent;
+    'token_replaced': TokenStorageEvent & {
+        token: Token;
+    };
+    'default_changed': Omit<TokenStorageEvent, 'id'> & {
+        id: string | null;
+    };
+    'metadata_updated': TokenStorageEvent & {
+        metadata: Token.Metadata;
+    };
+};
+/**
+ * @public @interface
+ *
+ * Defines interface for token storage. {@link Token.Token | Token} and {@link Token.Token.Metadata:TYPE | Token.Metadata} are treated as independent entities,
+ * which enables them to be stored in different locations. This may be more relevant in mobile environments, where {@link Token.Token | Token} data can be
+ * written to a secure location (which requires biometrics to access) and {@link Token.Token.Metadata:TYPE | Token.Metadata}, containing only non-sensitive info
+ * can be stored in a more accessible location and used to query which tokens are available (without prompting biometrics)
+ *
+ * @remarks
+ * Default implementation provided based on {@link https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage | localStorage}
+ */
+export interface TokenStorage {
+    readonly emitter: EventEmitter<TokenStorageEvents>;
+    /**
+     * In memory cached value of the {@link Credential.getDefault | default Credential}'s id
+     */
+    readonly defaultTokenId: string | null;
+    /**
+     * Updates the stored {@link Credential.getDefault | default Credential} id
+     */
+    setDefaultTokenId(id: string | null): Promise<void>;
+    /**
+     * Returns all token {@link Token.Token.id | ids} in storage
+     */
+    allIDs(): Promise<string[]>;
+    /**
+     * Writes a {@link Token.Token | Token} to storage
+     *
+     * @param token - raw JSON representation of {@link Token.Token | Token}
+     * @param metadata - non-sensitive data regarding the stored {@link Token.Token | Token} which will be used in storage queries
+     */
+    add(token: Token, metadata?: Token.Metadata): Promise<void>;
+    /**
+     * Updates the {@link Token.Token | Token} value in storage for a given {@link Token.Token.id | id}.
+     * Used by operations like {@link Credential.refresh}
+     */
+    replace(id: string, token: Token): Promise<void>;
+    /**
+     * Removes the {@link Token.Token | Token} value for a given {@link Token.Token.id | id} from storage
+     *
+     * @remarks
+     * **NOTE:** This does *not* {@link Credential.revoke | revoke} tokens. They are only removed from storage!
+     */
+    remove(id: string): Promise<void>;
+    /**
+     * Retrieves a {@link Token.Token | Token} from storage
+     *
+     * @remarks
+     * This may prompt user for biometrics in certain mobile environments
+     */
+    get(id: string): Promise<Token | null>;
+    /**
+     * Retieves {@link Token.Token.Metadata:TYPE | Token.Metadata} for a given {@link Token.Token.id | id}
+     *
+     * @remarks
+     * {@link Token.Token.Metadata:TYPE | Token.Metadata} will be written to less-protected location and therefore will not prompt biometrics
+     */
+    getMetadata(id: string): Promise<Token.Metadata | null>;
+    /**
+     * Writes {@link Token.Token.Metadata:TYPE | Token.Metadata} for a given {@link Token.Token | Token} to storage
+     */
+    setMetadata(metadata: Token.Metadata): Promise<void>;
+    /**
+     * Clears all {@link Token.Token | Token} instances from storage
+     *
+     * @remarks
+     * **NOTE:** This does *not* {@link Credential.revoke | revoke} tokens. They are only removed from storage!
+     */
+    clear(): Promise<void>;
+}
+/**
+ * A simple Map-based TokenStorage implementation. Not necessarily intended for production use!
+ *
+ * @internal
+ */
+export declare class DefaultTokenStorage implements TokenStorage {
+    #private;
+    readonly emitter: EventEmitter<TokenStorageEvents>;
+    get defaultTokenId(): string | null;
+    setDefaultTokenId(id: string | null): Promise<void>;
+    protected saveDefault(id: string | null): void;
+    allIDs(): Promise<string[]>;
+    add(token: Token, metadata?: Token.Metadata | undefined): Promise<void>;
+    replace(id: string, token: Token): Promise<void>;
+    remove(id: string): Promise<void>;
+    get(id: string): Promise<Token | null>;
+    getMetadata(id: string): Promise<Token.Metadata | null>;
+    setMetadata(metadata: Token.Metadata): Promise<void>;
+    clear(): Promise<void>;
+}
+export {};

package/dist/types/Credential/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @packageDocumentation
+ * @internal
+ */
+export * from './Credential.ts';
+export * from './CredentialCoordinator.ts';
+export * from './CredentialDataSource.ts';
+export * from './TokenStorage.ts';