@oxyhq/core 5.4.3 → 6.0.0

package/dist/esm/utils/ssoReturn.js

@@ -1,263 +0,0 @@
-/**
- * Parse the SSO return fragment delivered by the central IdP.
- *
- * After a top-level redirect bounce to `auth.oxy.so/sso` (prompt=none), the
- * central IdP returns the Relying Party to its `redirect_uri` with the result
- * encoded in the URL fragment (the `#…` part). The fragment is used — not a
- * query string — so the opaque single-use code never reaches a server access
- * log, a `Referer` header, or browser history in a recoverable form.
- *
- * Three outcomes are possible:
- *   - `#oxy_sso=ok&code=<opaque>&state=<state>` — the IdP had a session; the RP
- *     exchanges `code` (via `oxy.exchangeSsoCode`) for the real session. NO
- *     token/JWT ever appears in the URL — only the opaque code.
- *   - `#oxy_sso=none&state=<state>` — the IdP had no session (prompt=none, user
- *     not signed in centrally). The RP shows its own signed-out UI.
- *   - `#oxy_sso=error&state=<state>` — the bounce failed. The RP recovers.
- *
- * This parser is pure and defensive: it never throws, and `kind` is strictly
- * one of `'ok' | 'none' | 'error'`. It returns `null` when the fragment is not
- * an oxy_sso fragment at all (i.e. `oxy_sso` is absent or an unrecognised
- * value), so the caller can ignore unrelated fragments without special-casing.
- */
-import { SSO_CALLBACK_PATH, ssoStateKey, ssoGuardKey, ssoDestKey, ssoNoSessionKey, ssoAttemptedKey, ssoCallbackBootstrapKey, } from './ssoBounce.js';
-const VALID_KINDS = new Set(['ok', 'none', 'error']);
-/**
- * Parse an SSO return fragment.
- *
- * @param hash - The URL fragment, with or without the leading `#`
- *   (e.g. `location.hash`). May be `undefined`/empty.
- * @returns The parsed result when `hash` is a recognised oxy_sso fragment,
- *   otherwise `null`. Never throws.
- */
-export function parseSsoReturnFragment(hash) {
-    if (typeof hash !== 'string' || hash.length === 0) {
-        return null;
-    }
-    // Strip a single leading '#'. A bare '#' (empty fragment) yields no params.
-    const raw = hash.startsWith('#') ? hash.slice(1) : hash;
-    if (raw.length === 0) {
-        return null;
-    }
-    let params;
-    try {
-        params = new URLSearchParams(raw);
-    }
-    catch {
-        // URLSearchParams does not throw for malformed input in practice, but guard
-        // against any environment/polyfill that might so this stays total.
-        return null;
-    }
-    const kind = params.get('oxy_sso');
-    if (kind === null || !VALID_KINDS.has(kind)) {
-        // Not an oxy_sso fragment (absent or unrecognised value) — ignore it.
-        return null;
-    }
-    const result = { kind: kind };
-    const state = params.get('state');
-    if (state !== null && state.length > 0) {
-        result.state = state;
-    }
-    // The opaque code is only meaningful on success; ignore any stray `code` on
-    // none/error so callers never attempt an exchange for a non-ok outcome.
-    if (result.kind === 'ok') {
-        const code = params.get('code');
-        if (code !== null && code.length > 0) {
-            result.code = code;
-        }
-    }
-    return result;
-}
-/**
- * Consume an SSO return: the commit-free, security-critical kernel of the
- * cross-domain SSO `sso-return` cold-boot step.
- *
- * This performs the CSRF/fragment/exchange/dest-restore/loop-breaker sequence
- * and RETURNS the exchanged session (or `null`). It deliberately does NOT
- * commit any UI/auth state — each provider commits its own way AROUND this
- * (e.g. `@oxyhq/services` `OxyContext` calls its `handleWebSSOSession`,
- * `@oxyhq/auth` `WebOxyProvider` updates its React state). Hoisting the kernel
- * here keeps the two providers byte-for-byte identical on the parts that matter
- * for security (state validation, fragment stripping order, loop prevention).
- *
- * Security/loop invariants (preserved exactly from both former copies):
- *   - The fragment is stripped via `history.replaceState` FIRST — before the
- *     exchange — so the opaque code never lingers in the URL, browser history,
- *     or a `Referer` header even if a later step throws.
- *   - `state` must match (CSRF). A mismatch or a missing code sets the
- *     NO_SESSION flag so `sso-bounce` is disabled (no rebounce loop).
- *   - `none`/`error` outcomes set BOTH the NO_SESSION flag and the
- *     outcome-independent attempted-flag (the load2 half of the loop proof).
- *   - A throwing exchange is caught, reported via `onExchangeError`, and
- *     treated exactly like "no session" (never loops, never rethrows).
- *   - On EVERY consumed outcome (ok, none, error, state-mismatch, no-code,
- *     failed-exchange, no-sessionId) — not just ok — if the page landed on
- *     {@link SSO_CALLBACK_PATH}, the user is taken to a same-origin TARGET so
- *     they are never stranded on the internal callback path (which is an
- *     unregistered route in every consumer router → a hard 404). The target is
- *     the stored DEST when it parses as same-origin (an attacker-planted
- *     cross-origin / protocol-relative dest is rejected), ELSE the app root
- *     (`origin + '/'`). The DEST key is removed unconditionally.
- *   - For the `ok` outcome the target is applied via a SOFT
- *     `history.replaceState` + synthetic `popstate` so the freshly exchanged
- *     in-memory session the provider is about to commit is preserved (no
- *     reload). `popstate` is dispatched only on the `ok` same-origin restore.
- *   - For every NON-`ok` outcome there is no in-memory session to preserve, and
- *     the consumer router has ALREADY synchronously rendered its 404 for the
- *     unregistered callback route — a soft replaceState+popstate does not
- *     reliably make it re-resolve. So these outcomes perform a HARD
- *     full-document navigation to the target (`hardRedirect`), which is both
- *     safe (nothing to lose) and guaranteed to clear the 404 in every router.
- *
- * Total: this function NEVER throws. Off-web it is a no-op returning `null`.
- *
- * @param oxy - The exchange surface (`oxyServices.exchangeSsoCode`).
- * @param deps - Injectable web seams; see {@link ConsumeSsoReturnDeps}.
- * @returns The exchanged session on success, otherwise `null`.
- */
-export async function consumeSsoReturn(oxy, deps = {}) {
-    const isWeb = deps.isWeb ??
-        (() => typeof window !== 'undefined' &&
-            typeof window.sessionStorage !== 'undefined');
-    if (!isWeb()) {
-        return null;
-    }
-    const storage = deps.storage ?? window.sessionStorage;
-    const location = deps.location ?? window.location;
-    const history = deps.history ?? window.history;
-    const onExchangeError = deps.onExchangeError;
-    // Default: emit a synthetic `popstate` so URL-driven routers re-sync after a
-    // `history.replaceState` (which does NOT emit `popstate` on its own). Feature-
-    // detected end to end so it never throws in any environment.
-    const dispatchPopState = deps.dispatchPopState ??
-        (() => {
-            if (typeof window === 'undefined' || typeof window.dispatchEvent !== 'function') {
-                return;
-            }
-            if (typeof PopStateEvent !== 'undefined') {
-                window.dispatchEvent(new PopStateEvent('popstate'));
-            }
-            else if (typeof Event !== 'undefined') {
-                window.dispatchEvent(new Event('popstate'));
-            }
-        });
-    // Default: a hard, full-document navigation used to leave the callback path
-    // on non-`ok` outcomes. Feature-detected end to end so it never throws in any
-    // environment (SSR / native / a stubbed location without `replace`).
-    const hardRedirect = deps.hardRedirect ??
-        ((url) => {
-            if (typeof window !== 'undefined' &&
-                window.location &&
-                typeof window.location.replace === 'function') {
-                window.location.replace(url);
-            }
-        });
-    const ret = parseSsoReturnFragment(location.hash);
-    if (!ret) {
-        // Not an oxy_sso fragment — nothing to do (do NOT touch any flags).
-        return null;
-    }
-    const origin = location.origin;
-    const callbackBootstrapKey = ssoCallbackBootstrapKey(origin);
-    const wasCallbackBootstrapped = storage.getItem(callbackBootstrapKey) === '1';
-    const expectedState = storage.getItem(ssoStateKey(origin));
-    const stateOk = !!ret.state && !!expectedState && ret.state === expectedState;
-    // Strip the fragment FIRST so the opaque code never lingers in the address
-    // bar, history, or a `Referer` — even if a later step throws.
-    history.replaceState(null, '', location.pathname + location.search);
-    storage.removeItem(ssoStateKey(origin));
-    // The in-flight bounce is now resolved — drop its guard so a later cold boot
-    // (e.g. after sign-out) can bounce again.
-    storage.removeItem(ssoGuardKey(origin));
-    const markNoSession = () => {
-        storage.setItem(ssoNoSessionKey(origin), '1');
-        // A return was consumed, so the probe definitively happened. Set the
-        // outcome-independent attempted-flag too so the bounce can never re-fire
-        // even if some consumer path skipped setting it pre-bounce.
-        storage.setItem(ssoAttemptedKey(origin), '1');
-    };
-    // Compute the same-origin TARGET to leave the callback path for. Returns the
-    // stored DEST when present AND it parses as same-origin (never honour a
-    // cross-origin / protocol-relative dest that could have been planted to
-    // redirect the user), ELSE the app root (`origin + '/'`) so the user is never
-    // stranded on the internal callback path even when no dest was stored. The
-    // DEST key is removed unconditionally. Returns the relative path+search+hash
-    // (so it can be fed to either `history.replaceState` or a `hardRedirect`),
-    // or `null` when the page is not on the callback path (nothing to leave).
-    const consumeCallbackTarget = () => {
-        storage.removeItem(callbackBootstrapKey);
-        if (location.pathname !== SSO_CALLBACK_PATH && !wasCallbackBootstrapped) {
-            // Not on the callback path — still drop the dest key (consumed) but there
-            // is nothing to navigate away from.
-            storage.removeItem(ssoDestKey(origin));
-            return null;
-        }
-        const dest = storage.getItem(ssoDestKey(origin));
-        storage.removeItem(ssoDestKey(origin));
-        if (dest) {
-            try {
-                const destUrl = new URL(dest, origin);
-                if (destUrl.origin === origin) {
-                    return destUrl.pathname + destUrl.search + destUrl.hash;
-                }
-            }
-            catch {
-                // Malformed stored destination — fall through to the app-root fallback.
-            }
-        }
-        // No dest, a cross-origin/protocol-relative dest, or an unparseable dest:
-        // fall back to the app root so the router always leaves the 404.
-        return '/';
-    };
-    // Non-`ok` outcomes: there is no in-memory session to preserve, and the
-    // consumer router has already rendered its 404 for the unregistered callback
-    // route — a soft replaceState+popstate does not reliably make it re-resolve.
-    // Perform a HARD full-document navigation to the target (safe: nothing to
-    // lose; guaranteed: every router leaves the 404). Off the callback path this
-    // is a no-op (target is null).
-    const leaveCallbackHard = () => {
-        const target = consumeCallbackTarget();
-        if (target !== null) {
-            hardRedirect(origin + target);
-        }
-    };
-    if (ret.kind === 'none' || ret.kind === 'error') {
-        // The central IdP had no session (or the bounce failed). Record it so we do
-        // not bounce again this tab — the definitive loop breaker.
-        markNoSession();
-        leaveCallbackHard();
-        return null;
-    }
-    if (!stateOk || !ret.code) {
-        // Forged / replayed / stale fragment, or a malformed ok with no code. Treat
-        // exactly like "no session": never exchange, never loop.
-        markNoSession();
-        leaveCallbackHard();
-        return null;
-    }
-    let session;
-    try {
-        session = await oxy.exchangeSsoCode(ret.code, ret.state);
-    }
-    catch (error) {
-        onExchangeError?.(error);
-        markNoSession();
-        leaveCallbackHard();
-        return null;
-    }
-    if (!session?.sessionId) {
-        markNoSession();
-        leaveCallbackHard();
-        return null;
-    }
-    // `ok`: the provider is about to commit the freshly exchanged in-memory
-    // session — do NOT hard-redirect (a full navigation would discard it). Use a
-    // SOFT `history.replaceState` to the target + a synthetic `popstate` so
-    // URL-driven routers re-sync to the restored route without a reload.
-    const target = consumeCallbackTarget();
-    if (target !== null) {
-        history.replaceState(null, '', target);
-        dispatchPopState();
-    }
-    return session;
-}

package/dist/types/AuthManager.d.ts

@@ -1,380 +0,0 @@
-/**
- * AuthManager - Centralized Authentication Manager
- *
- * Provides a unified authentication interface for all platforms.
- * Handles token storage, session management, and auth state changes.
- *
- * @module core/AuthManager
- */
-import type { OxyServices } from './OxyServices';
-import type { SessionLoginResponse, MinimalUserData } from './models/session';
-import type { AuthManagerAccount, RestoreFromCookiesResult, RestoreFromCookiesOptions, SwitchAuthuserResult } from './AuthManagerTypes';
-/**
- * Storage adapter interface for platform-agnostic storage.
- */
-export interface StorageAdapter {
-    getItem: (key: string) => Promise<string | null> | string | null;
-    setItem: (key: string, value: string) => Promise<void> | void;
-    removeItem: (key: string) => Promise<void> | void;
-}
-/**
- * Auth state change callback type.
- */
-export type AuthStateChangeCallback = (user: MinimalUserData | null) => void;
-/**
- * Auth method types.
- */
-export type AuthMethod = 'fedcm' | 'redirect' | 'credentials' | 'identity';
-/**
- * Auth manager configuration.
- */
-export interface AuthManagerConfig {
-    /** Storage adapter (localStorage, AsyncStorage, etc.) */
-    storage?: StorageAdapter;
-    /** Whether to auto-refresh tokens */
-    autoRefresh?: boolean;
-    /** Token refresh interval in milliseconds (default: 5 minutes before expiry) */
-    refreshBuffer?: number;
-    /** Enable cross-tab coordination via BroadcastChannel (default: true in browsers) */
-    crossTabSync?: boolean;
-}
-/**
- * AuthManager - Centralized authentication management.
- *
- * Provides a single point of control for:
- * - Token storage and retrieval
- * - Session management
- * - Auth state change notifications
- * - Multiple auth method support
- *
- * @example
- * ```typescript
- * const authManager = new AuthManager(oxyServices);
- *
- * // Listen for auth changes
- * authManager.onAuthStateChange((user) => {
- *   console.log('Auth state changed:', user);
- * });
- *
- * // Handle successful auth
- * await authManager.handleAuthSuccess(session);
- *
- * // Sign out
- * await authManager.signOut();
- * ```
- */
-export declare class AuthManager {
-    private oxyServices;
-    private storage;
-    private listeners;
-    private currentUser;
-    private currentAuthMethod;
-    private refreshTimer;
-    private refreshPromise;
-    private config;
-    /** Tracks the access token this instance last knew about, for cross-tab adoption. */
-    private _lastKnownAccessToken;
-    /** BroadcastChannel for coordinating token refreshes across browser tabs. */
-    private _broadcastChannel;
-    /**
-     * Identifier for this AuthManager instance (≈ "this tab"). Random hex
-     * generated at construction; advertised in every outgoing broadcast and
-     * used as the lookup key in `_knownPeerNonces`.
-     */
-    private readonly _tabId;
-    /**
-     * Per-tab nonce, advertised in every outgoing broadcast. Receivers record
-     * the first (tabId, nonce) pair they see from a given peer; subsequent
-     * messages from the same tabId MUST carry the same nonce or they're
-     * ignored.
-     *
-     * Threat model: a same-origin XSS payload can post to the channel but can
-     * NOT read this instance's private `_broadcastNonce` field (it lives in
-     * closure, not on `window`). Forged broadcasts from XSS therefore can't
-     * impersonate this tab. A new attacker-controlled tabId trips the
-     * "first message from a new peer" branch, which is by definition trusted
-     * — so the gate raises the bar but is not a complete defence (a perfect
-     * mitigation would require message signing with a server-issued key).
-     */
-    private readonly _broadcastNonce;
-    /**
-     * Bounded LRU of `(tabId → nonce)` pairs seen on inbound broadcasts. First
-     * sighting of a new tabId records its nonce; later messages from that
-     * tabId are rejected if the nonce doesn't match.
-     */
-    private readonly _knownPeerNonces;
-    private static readonly _MAX_KNOWN_PEERS;
-    /**
-     * In-flight `switchAuthuser` promise. Deduplicates concurrent calls so two
-     * near-simultaneous switches don't both fire refresh requests and rotate
-     * the slot twice. Mirrors the `refreshPromise` pattern used by
-     * `refreshToken`.
-     */
-    private _switchPromise;
-    /**
-     * Last `restoreFromCookies()` completion timestamp, keyed by the
-     * AuthManager's active authuser at the time of completion. Used to gate
-     * cross-tab cascade: a flurry of BroadcastChannel events from sibling
-     * tabs can otherwise trigger N back-to-back snapshots and rotate every
-     * slot's access token N times.
-     */
-    private readonly _lastRestoreAt;
-    private static readonly _RESTORE_DEBOUNCE_MS;
-    /**
-     * In-memory registry of every device-local account the AuthManager knows
-     * about, keyed by `authuser` slot index. Populated by:
-     *   - `restoreFromCookies()` (cold boot)
-     *   - `switchAuthuser()` (per-account rotation)
-     *   - `handleAuthSuccess()` (fresh login when the server response carries
-     *     an `authuser` field)
-     * Access tokens live ONLY here in the cookie path — they are never
-     * persisted to localStorage.
-     */
-    private accounts;
-    /**
-     * Currently-active `authuser` slot in the cookie path. `null` means either
-     * the cookie path hasn't been initialised yet, or no slots are signed in.
-     */
-    private activeAuthuser;
-    constructor(oxyServices: OxyServices, config?: AuthManagerConfig);
-    /**
-     * Initialize BroadcastChannel for cross-tab token refresh coordination.
-     * Only called in browser environments where BroadcastChannel is available.
-     */
-    private _initBroadcastChannel;
-    /**
-     * Handle messages from other tabs about token refresh activity.
-     */
-    private _handleCrossTabMessage;
-    /**
-     * Broadcast a message to other tabs. Always stamps this tab's `tabId` and
-     * `nonce` onto the message so receivers can run the cross-tab nonce gate.
-     */
-    private _broadcast;
-    /**
-     * Generate `bytes` bytes of cryptographic randomness encoded as lowercase
-     * hex. Prefers Web Crypto's `getRandomValues` when available (browser /
-     * modern Node); falls back to `Math.random` ONLY in environments without
-     * Web Crypto (the resulting nonce is still unguessable to a same-origin
-     * XSS payload — the goal is unforgeability across tabs, not cryptographic
-     * secrecy across the network).
-     */
-    private static _randomHex;
-    /**
-     * Validate an inbound broadcast against the cross-tab nonce gate.
-     *
-     * Returns `true` when the message should be honoured, `false` when it
-     * MUST be ignored:
-     *   - Message is missing `tabId` or `nonce` → ignore (forged or
-     *     mismatched-version sibling tab).
-     *   - First sighting of `tabId` → record the nonce and honour the message
-     *     (trust-on-first-use, the best we can do without a shared secret).
-     *   - Subsequent message from the same `tabId` with the SAME nonce →
-     *     honour.
-     *   - Subsequent message from the same `tabId` with a DIFFERENT nonce →
-     *     ignore (the canonical "forged broadcast" case — a same-origin XSS
-     *     payload can't read the real tab's `_broadcastNonce`).
-     *
-     * Echoes of this tab's own broadcasts (same `tabId`) are also dropped so
-     * we don't react to our own messages.
-     */
-    private _acceptBroadcast;
-    /**
-     * Get default storage based on environment.
-     */
-    private getDefaultStorage;
-    /**
-     * Subscribe to auth state changes.
-     *
-     * @param callback - Function called when auth state changes
-     * @returns Unsubscribe function
-     */
-    onAuthStateChange(callback: AuthStateChangeCallback): () => void;
-    /**
-     * Notify all listeners of auth state change.
-     */
-    private notifyListeners;
-    /**
-     * Handle successful authentication.
-     *
-     * @param session - Session response from auth
-     * @param method - Auth method used
-     */
-    handleAuthSuccess(session: SessionLoginResponse, method?: AuthMethod): Promise<void>;
-    /**
-     * Refresh the access token. Deduplicates concurrent calls so only one
-     * refresh request is in-flight at a time. The only refresh authority is the
-     * active httpOnly refresh-cookie slot; this method never reads access tokens
-     * from storage.
-     */
-    refreshToken(): Promise<boolean>;
-    private _doRefreshToken;
-    /**
-     * Sign out and clear all auth data.
-     */
-    signOut(): Promise<void>;
-    /**
-     * Clear local cookie-path state. The only persisted AuthManager value is the
-     * active numeric slot; tokens and user objects are intentionally memory-only.
-     */
-    private clearSession;
-    /**
-     * Get current user.
-     */
-    getCurrentUser(): MinimalUserData | null;
-    /**
-     * Check if user is authenticated.
-     */
-    isAuthenticated(): boolean;
-    /**
-     * Get a valid access token, refreshing automatically if expired or expiring
-     * soon. The token is read from memory only.
-     */
-    getAccessToken(): Promise<string | null>;
-    /**
-     * Get the auth method used for current session.
-     */
-    getAuthMethod(): Promise<AuthMethod | null>;
-    /**
-     * Initialize auth state on app startup.
-     *
-     * Only the cookie path is authoritative. `restoreFromCookies()` refreshes
-     * the httpOnly `oxy_rt_${authuser}` slots through `/auth/refresh-all`,
-     * plants the active access token in memory, and returns the active user.
-     * No access token, refresh token, or session JSON is read from localStorage.
-     *
-     * Returns the active user on success, or `null` when no cookie-backed
-     * account was restored.
-     */
-    initialize(options?: RestoreFromCookiesOptions): Promise<MinimalUserData | null>;
-    /**
-     * Read the persisted active `authuser` slot index. Returns `null` when
-     * none is persisted, the value is corrupt, or the storage adapter has no
-     * record. Storage failures are non-fatal: the cookie path falls back to
-     * "lowest authuser" deterministic selection.
-     */
-    private readActiveAuthuser;
-    /**
-     * Persist the active `authuser` slot index. No-ops on storage failure
-     * (e.g. Safari private mode, native SecureStore unavailable) — this is
-     * best-effort UX persistence, not authoritative state.
-     */
-    private writeActiveAuthuser;
-    /**
-     * Clear the persisted active `authuser` so the next cold boot starts from
-     * a clean slate (used on full sign-out).
-     */
-    private clearActiveAuthuser;
-    /**
-     * Build a `MinimalUserData` from a `RefreshAllAccount`. Returns `null` when
-     * the wire entry has no user shape; the AuthManager's caller is expected to
-     * hydrate via `/users/me` in that case.
-     */
-    private static toMinimalUser;
-    /**
-     * Hydrate the user shape for a slot whose AuthManagerAccount currently has
-     * `user: null` (for example, a switch onto a previously unknown slot). Calls
-     * `/users/me` with the slot's freshly-planted access
-     * token already on the HTTP client; merges the result back into the
-     * registry entry. Network failures are non-fatal — the slot remains with
-     * `user: null` and the UI is expected to render the public-key fallback
-     * handle until a later restore picks the real user shape up.
-     */
-    private _hydrateUnknownUser;
-    /**
-     * Snapshot of the registered cookie-path accounts, sorted by `authuser`
-     * ascending (canonical order). Mutating the returned array does not
-     * affect AuthManager state.
-     */
-    getAccounts(): AuthManagerAccount[];
-    /**
-     * The slot index that is currently active in the cookie path, or `null`
-     * if the cookie path hasn't been initialised or no slots are signed in.
-     */
-    getActiveAuthuser(): number | null;
-    /**
-     * Convenience: the AuthManagerAccount currently flagged active.
-     */
-    getActiveAccount(): AuthManagerAccount | null;
-    /**
-     * Restore every device-local account from the httpOnly refresh cookies.
-     *
-     * Calls `oxyServices.refreshAllSessions()` (`POST /auth/refresh-all` with
-     * `credentials: 'include'`). The server rotates every presented
-     * `oxy_rt_${authuser}` cookie in parallel and returns one entry per
-     * valid slot.
-     *
-     * Plants the active account's access token on the shared HTTP client;
-     * sibling slots' tokens stay in the in-memory registry so a later
-     * `switchAuthuser()` can hot-swap them without a network round-trip.
-     *
-     * The persisted `oxy_active_authuser` slot wins when it matches a
-     * returned account; otherwise the lowest returned `authuser` is chosen
-     * deterministically.
-     *
-     * Returns `{ accounts: [], activeAuthuser: null }` on any failure or
-     * empty snapshot — callers treat that as "no signed-in accounts" and
-     * proceed unauthenticated. State is NOT cleared on failure; existing
-     * accounts (if any) remain intact.
-     */
-    restoreFromCookies(options?: RestoreFromCookiesOptions): Promise<RestoreFromCookiesResult>;
-    /**
-     * Switch the active account to a different device-local slot.
-     *
-     * Calls `oxyServices.refreshTokenViaCookie({ authuser })` to mint a fresh
-     * access token from the slot's httpOnly cookie, updates the in-memory
-     * registry entry, plants the token on the HTTP client, persists the new
-     * active slot, and broadcasts cross-tab.
-     *
-     * Throws when the slot's refresh cookie is missing / expired / reused
-     * (the SDK returns `null` from `refreshTokenViaCookie` in that case, and
-     * we surface it as an `Error` so callers can clean up the slot from
-     * their UI).
-     */
-    switchAuthuser(authuser: number): Promise<SwitchAuthuserResult>;
-    private _doSwitchAuthuser;
-    /**
-     * Sign out a single device-local slot.
-     *
-     * Calls `oxyServices.logoutSessionByAuthuser(authuser)`: server-side
-     * revokes the slot's refresh-token family and clears the
-     * `oxy_rt_${authuser}` cookie via `Set-Cookie`. The slot is removed from
-     * the in-memory registry. If the slot was active, the next lowest
-     * remaining authuser becomes active (or `null` when none remain).
-     */
-    signOutAuthuser(authuser: number): Promise<void>;
-    /**
-     * Sign out EVERY device-local account on this device.
-     *
-     * Calls `oxyServices.logoutAllSessionsViaCookie()`: server-side revokes
-     * every presented family and `Set-Cookie`s an immediate expiry for every
-     * recognised `oxy_rt_${n}` slot. The in-memory registry is wiped, the active
-     * slot is cleared, and the persisted `oxy_active_authuser` is removed so the
-     * next cold boot starts fresh.
-     */
-    signOutAllViaCookies(): Promise<void>;
-    /**
-     * Schedule an auto-refresh for the cookie path on the active slot. The
-     * AuthManager has exactly one active slot at a time, so one timer suffices.
-     */
-    private setupCookieRefresh;
-    /**
-     * Decode the session id from an unverified JWT access token. Decode-only
-     * (no signature verification) — the server already verified the
-     * signature when minting the token. Returns `null` on malformed input.
-     */
-    private static decodeSessionIdFromAccessToken;
-    private static decodeAuthuserFromAccessToken;
-    /**
-     * Destroy the auth manager and clean up resources.
-     */
-    destroy(): void;
-}
-/**
- * Create an AuthManager instance.
- *
- * @param oxyServices - OxyServices instance
- * @param config - Optional configuration
- * @returns AuthManager instance
- */
-export declare function createAuthManager(oxyServices: OxyServices, config?: AuthManagerConfig): AuthManager;