@plitzi/sdk-auth 0.32.25 → 0.33.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @plitzi/sdk-auth
 
+## 0.33.1
+
+### Patch Changes
+
+- v0.33.1
+- Updated dependencies
+  - @plitzi/sdk-navigation@0.33.1
+  - @plitzi/sdk-schema@0.33.1
+  - @plitzi/sdk-shared@0.33.1
+
+## 0.33.0
+
+### Minor Changes
+
+- v0.33.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @plitzi/sdk-navigation@0.33.0
+  - @plitzi/sdk-schema@0.33.0
+  - @plitzi/sdk-shared@0.33.0
+
 ## 0.32.25
 
 ### Patch Changes

package/dist/AuthContextProvider.d.ts

@@ -1,12 +1,9 @@
-import { Environment, Server } from '@plitzi/sdk-shared';
+import { Server } from '@plitzi/sdk-shared';
 import { ReactNode } from 'react';
 export type AuthContextProviderProps = {
     children?: ReactNode;
-    isHydrating?: boolean;
-    previewMode?: boolean;
     offlineMode?: boolean;
     server: Server;
-    environment?: Environment;
 };
-declare const AuthContextProvider: ({ previewMode, isHydrating, children, server, environment }: AuthContextProviderProps) => import("react").JSX.Element;
+declare const AuthContextProvider: ({ children, server }: AuthContextProviderProps) => import("react").JSX.Element;
 export default AuthContextProvider;

package/dist/AuthContextProvider.mjs

@@ -1,98 +1,102 @@
 import e from "./hooks/useAuth/index.mjs";
 import { AuthContext as t } from "./AuthContext.mjs";
-import { useMemo as n } from "react";
-import { QueryBuilderEvaluator as r } from "@plitzi/plitzi-ui/QueryBuilder";
-import i from "@plitzi/sdk-navigation/hooks/useNavigation";
-import { processTwig as a } from "@plitzi/sdk-shared/helpers/twigWrapper";
-import { useCommonStore as o } from "@plitzi/sdk-shared/store";
-import { jsx as s } from "react/jsx-runtime";
+import { use as n, useMemo as r, useRef as i } from "react";
+import { QueryBuilderEvaluator as a } from "@plitzi/plitzi-ui/QueryBuilder";
+import o from "@plitzi/sdk-navigation/hooks/useNavigation";
+import { processTwig as s } from "@plitzi/sdk-shared/helpers/twigWrapper";
+import c from "@plitzi/sdk-shared/network/NetworkContext";
+import { useCommonStore as l, useRenderSettings as u } from "@plitzi/sdk-shared/store";
+import { jsx as d } from "react/jsx-runtime";
 //#region src/AuthContextProvider.tsx
-var c = ({ previewMode: c = !0, isHydrating: l = !1, children: u, server: d, environment: f = "production" }) => {
-	let [[{ userProvider: p, loginUrl: m, userUrl: h, refreshUrl: g, logoutUrl: _, tokenStorage: v = "localStorage", detailsPath: y = "details", tokenPath: b = "access_token", expirationTimePath: x = "expire_at" }, S]] = o(["schema.settings", "schema.variables"]), { queryParams: C, hostname: w } = i({ server: d }), T = n(() => ({
-		queryParams: C,
-		hostname: w,
-		environment: f
+var f = [
+	"loginUrl",
+	"userUrl",
+	"refreshUrl",
+	"logoutUrl",
+	"detailsPath",
+	"tokenPath",
+	"refreshTokenPath",
+	"expirationTimePath",
+	"refreshExpirationTimePath",
+	"sessionHintCookie",
+	"sessionExchangeUrl"
+], p = (e, t) => {
+	if (e === t) return !0;
+	if (!e || !t) return !1;
+	let n = e, r = t;
+	return [.../* @__PURE__ */ new Set([...Object.keys(n), ...Object.keys(r)])].every((e) => JSON.stringify(n[e]) === JSON.stringify(r[e]));
+}, m = ({ children: m, server: h }) => {
+	let { previewMode: g, isHydrating: _, environment: v } = u(), { webKey: y } = n(c), [[b, x]] = l(["schema.settings", "schema.variables"]), { queryParams: S, hostname: C } = o({ server: h }), w = r(() => ({
+		queryParams: S,
+		hostname: C,
+		environment: v
 	}), [
+		S,
 		C,
-		w,
-		f
-	]), E = n(() => Array.isArray(S) ? S.reduce((e, t) => {
-		let { name: n, value: i, subValues: a } = t;
-		if (!Array.isArray(a) || a.length === 0) return {
+		v
+	]), T = r(() => Array.isArray(x) ? x.reduce((e, t) => {
+		let { name: n, value: r, subValues: i } = t;
+		if (!Array.isArray(i) || i.length === 0) return {
 			...e,
-			[n]: i
+			[n]: r
 		};
-		let o = a.find((e) => r(e.when, T));
+		let o = i.find((e) => a(e.when, w));
 		return o ? {
 			...e,
 			[n]: o.value
 		} : {
 			...e,
-			[n]: i
+			[n]: r
 		};
-	}, {}) : {}, [S, T]), D = n(() => {
+	}, {}) : {}, [x, w]), E = r(() => {
+		let e = Object.fromEntries(f.map((e) => [e, b[e]]));
 		try {
-			return JSON.parse(a(JSON.stringify({
-				loginUrl: m,
-				userUrl: h,
-				refreshUrl: g,
-				logoutUrl: _,
-				detailsPath: y,
-				tokenPath: b,
-				expirationTimePath: x
-			}), E));
+			return JSON.parse(s(JSON.stringify(e), T));
 		} catch {
-			return {
-				loginUrl: m,
-				userUrl: h,
-				refreshUrl: g,
-				logoutUrl: _,
-				detailsPath: y,
-				tokenPath: b,
-				expirationTimePath: x
-			};
+			return e;
 		}
-	}, [
-		m,
-		h,
-		g,
-		_,
-		y,
+	}, [b, T]), D = r(() => ({
+		...E,
+		spaceKey: y,
+		tokenStorage: b.tokenStorage ?? "localStorage",
+		sessionGate: b.sessionGate,
+		sessionRevalidateSeconds: b.sessionRevalidateSeconds
+	}), [
+		E,
 		b,
-		x,
-		E
-	]), { manager: O, loading: k, authenticated: A } = e({
-		server: d,
-		isHydrating: l,
-		tokenStorage: v,
-		provider: p,
-		loginUrl: D.loginUrl,
-		userUrl: D.userUrl,
-		refreshUrl: D.refreshUrl,
-		logoutUrl: D.logoutUrl,
-		detailsPath: D.detailsPath,
-		tokenPath: D.tokenPath,
-		expirationTimePath: D.expirationTimePath
-	}), j = n(() => ({
-		manager: O,
+		y
+	]), { manager: O, loading: k, authenticated: A, state: j, bootstrapUser: M, bootstrapToken: N, peekedUser: P, peekedToken: F } = e({
+		server: h,
+		isHydrating: _,
+		provider: b.userProvider ?? "",
+		settings: D
+	}), I = O.getProvider()?.user, L = I ?? M ?? P, R = I ? O.getProvider()?.token?.accessToken : M ? N : F, z = i(void 0), B = r(() => {
+		let e = L ? {
+			details: L,
+			accessToken: R
+		} : void 0, t = z.current;
+		return t?.accessToken === e?.accessToken && p(t?.details, e?.details) || (z.current = e), z.current;
+	}, [L, R]), V = r(() => ({
 		login: O.login.bind(O),
 		refresh: O.refresh.bind(O),
+		revalidate: O.revalidate.bind(O),
+		invalidate: O.invalidate.bind(O),
 		can: O.can.bind(O),
 		logout: O.logout.bind(O),
-		authenticated: A || !c,
-		user: O.getProvider() ? {
-			details: O.getProvider()?.user,
-			accessToken: O.getProvider()?.token?.accessToken
-		} : void 0
+		state: j,
+		authenticated: A || !g,
+		user: B
 	}), [
 		O,
+		j,
 		A,
-		c
+		g,
+		B
 	]);
-	return /* @__PURE__ */ s(t, {
-		value: j,
-		children: !k && u
+	return /* @__PURE__ */ d(t, {
+		value: V,
+		children: !k && m
 	});
 };
 //#endregion
-export { c as default };
+export { m as default };

package/dist/AuthManager.d.ts

@@ -1,24 +1,62 @@
-import { default as Auth0Provider } from './providers/Auth0Provider';
-import { default as BasicAuthProvider } from './providers/BasicAuthProvider';
-import { default as AuthProvider, AuthEventListener, AuthProviderWithCache } from './AuthProvider';
-import { TokenResult } from '@plitzi/sdk-shared';
-declare const providers: {
-    auth0: typeof Auth0Provider;
-    basic: typeof BasicAuthProvider;
-};
-export type Providers = keyof typeof providers;
-export declare class AuthManager<U = Record<string, unknown>, T extends Providers = 'basic'> {
-    private providerType;
-    private provider?;
-    constructor(providerType: Providers | undefined, listeners: AuthEventListener | AuthEventListener[], ...args: ConstructorParameters<(typeof providers)[T]>);
-    getProviderType(): Providers;
-    getProvider(): AuthProviderWithCache<U> | undefined;
-    init(user?: U, skipAuth?: boolean): Promise<void> | undefined;
-    login(...args: Parameters<AuthProvider['login']>): Promise<TokenResult | undefined>;
-    refresh(): Promise<TokenResult | undefined>;
-    getUser(): Promise<U | undefined> | undefined;
+import { default as AuthProvider, AuthBootstrap, AuthEventListener } from './AuthProvider';
+import { AuthProviderSettings } from './types';
+import { AuthFailureReason, AuthState, TokenResult } from '@plitzi/sdk-shared';
+export type AuthProviderFactory<U = Record<string, unknown>> = (settings: AuthProviderSettings) => AuthProvider<U>;
+/**
+ * Adds an auth provider a space can then select by name in its settings. Spaces run against whichever backend their
+ * owner has — `basic` covers any HTTP+JSON API by configuration alone, and this is the way out for the ones it does
+ * not: register before the SDK mounts, and `userProvider: '<name>'` picks it up.
+ */
+export declare const registerAuthProvider: <U = Record<string, unknown>>(name: string, factory: AuthProviderFactory<U>) => void;
+export declare const getAuthProviderNames: () => string[];
+/**
+ * Holds the provider a space selected and forwards to it. Its reason for existing is that the provider is chosen at
+ * runtime from the schema: everything above this line talks to one object whether the space authenticates against
+ * Plitzi, against Auth0, or against something the customer registered.
+ */
+export declare class AuthManager<U = Record<string, unknown>> {
+    private readonly providerType;
+    private readonly provider?;
+    private readonly settings;
+    private readonly listeners;
+    constructor(providerType: string, listeners: AuthEventListener | AuthEventListener[], settings: AuthProviderSettings);
+    getProviderType(): string;
+    getProvider(): AuthProvider<U> | undefined;
+    getState(): AuthState;
+    /**
+     * What this browser can be seen to hold before anything has run.
+     *
+     * Answered even when no provider has been named yet, which is the state every page is in while its schema loads:
+     * where the credential is kept is a matter of settings — the storage key, the hint cookie — and not of which
+     * provider will end up using it, so it can be read now. Doing that read only after the schema arrived is what
+     * made a signed-in page paint its signed-out version first on every reload.
+     */
+    peekState(): AuthState;
+    peek(): {
+        state: AuthState;
+        user?: U;
+        token?: TokenResult;
+    };
     can(permission: string): boolean;
+    /**
+     * A space that names no provider — a widget, an offline render, anything that does not sign people in — has no
+     * session to settle, and must say so. Without this it never reports a state at all, and a caller waiting for one
+     * (the SDK holds its whole tree back until auth has decided) waits forever and renders nothing.
+     *
+     * What it must not say is that nobody is signed in when the server just rendered this page for somebody. There are
+     * two ways to arrive here holding a bootstrap: a space that genuinely names no provider, and — the common one — a
+     * space whose schema has not loaded yet, because `userProvider` is read from it and is empty for the first render
+     * of every page that fetches its schema over the network. Answering `guest` there contradicted the HTML that had
+     * just been sent: the page flipped to its signed-out version, then back once the schema arrived and a real
+     * provider adopted the same identity. The server's answer stands until something that can actually check it
+     * disagrees.
+     */
+    init(bootstrap?: AuthBootstrap<U>): Promise<void>;
+    login(...args: Parameters<AuthProvider<U>['login']>): Promise<TokenResult | undefined>;
+    refresh(): Promise<TokenResult | undefined>;
+    revalidate(force?: boolean): Promise<boolean>;
+    invalidate(reason?: AuthFailureReason): void;
     logout(): Promise<void>;
+    dispose(): void;
     on(listener: AuthEventListener): (() => void) | undefined;
 }
-export {};

package/dist/AuthManager.mjs

@@ -1,14 +1,16 @@
-import e from "./providers/Auth0Provider.mjs";
-import t from "./providers/BasicAuthProvider.mjs";
+import e from "./providers/BasicAuthProvider.mjs";
 //#region src/AuthManager.ts
-var n = {
-	auth0: e,
-	basic: t
-}, r = class {
-	providerType = "basic";
-	provider = void 0;
-	constructor(e = "basic", t, ...r) {
-		this.providerType = e, n[e] && (this.provider = new n[e](...r), this.provider.on(t));
+var t = /* @__PURE__ */ new Map([["basic", (t) => new e(t)]]), n = (e, n) => {
+	t.set(e, n);
+}, r = () => [...t.keys()], i = class {
+	providerType;
+	provider;
+	settings;
+	listeners;
+	constructor(e, n, r) {
+		this.providerType = e, this.settings = r, this.listeners = Array.isArray(n) ? n : [n];
+		let i = t.get(e);
+		i && (this.provider = i(r), this.provider.on(this.listeners));
 	}
 	getProviderType() {
 		return this.providerType;
@@ -16,8 +18,28 @@ var n = {
 	getProvider() {
 		return this.provider;
 	}
-	init(e, t) {
-		return this.provider?.init(e, t);
+	getState() {
+		return this.provider?.getState() ?? "guest";
+	}
+	peekState() {
+		return this.peek().state;
+	}
+	peek() {
+		return (this.provider ?? new e(this.settings)).peek();
+	}
+	can(e) {
+		return this.provider?.can(e) ?? !1;
+	}
+	init(e) {
+		if (!this.provider) {
+			let t = this.peekState(), n = e?.user || t === "authenticated" ? "authenticated" : "guest";
+			return this.listeners.forEach((e) => e({
+				type: "state",
+				state: n,
+				reason: "no-provider"
+			})), Promise.resolve();
+		}
+		return this.provider.init(e);
 	}
 	login(...e) {
 		return this.provider?.login(...e) ?? Promise.resolve(void 0);
@@ -25,18 +47,21 @@ var n = {
 	refresh() {
 		return this.provider?.refresh() ?? Promise.resolve(void 0);
 	}
-	getUser() {
-		return this.provider?.getUser();
+	revalidate(e) {
+		return this.provider?.revalidate(e) ?? Promise.resolve(!1);
 	}
-	can(e) {
-		return this.provider?.can(e) ?? !1;
+	invalidate(e) {
+		this.provider?.invalidate(e);
 	}
 	logout() {
 		return this.provider?.logout() ?? Promise.resolve();
 	}
+	dispose() {
+		this.provider?.dispose();
+	}
 	on(e) {
 		return this.provider?.on(e);
 	}
 };
 //#endregion
-export { r as AuthManager };
+export { i as AuthManager, r as getAuthProviderNames, n as registerAuthProvider };

package/dist/AuthProvider.d.ts

@@ -1,54 +1,191 @@
-import { Schema, TokenResult } from '@plitzi/sdk-shared';
-export type AuthProviderCache<U = Record<string, unknown>> = {
-    token?: TokenResult;
-    user?: U;
-};
-export type AuthState = 'init' | 'initLoading' | 'authenticating' | 'authenticated' | 'guest';
+import { AuthFailureReason, AuthResult, AuthState, Schema, TokenResult } from '@plitzi/sdk-shared';
+/** Why a state changed. Not control flow — it is what makes an auth trace readable, and every transition below
+ *  names one, because "it went to guest" is not a diagnosis and "the hint cookie was gone" is. */
+export type AuthStateReason = 'bootstrap' | 'restored' | 'granted' | 'renewed' | 'identity' | 'redirect' | 'exchanged' | 'no-provider' | 'skip-auth' | 'hint-missing' | 'no-evidence' | 'signed-out' | 'another-tab' | 'settled' | 'authenticating';
 export type AuthEvent = {
     type: 'state';
     state: AuthState;
+    reason?: AuthStateReason;
 } | {
     type: 'login';
-    token: TokenResult;
+    token?: TokenResult;
 } | {
     type: 'logout';
 } | {
     type: 'expired';
+    reason: AuthFailureReason;
 };
 export type AuthEventListener = (event: AuthEvent) => void;
-export type AuthProviderWithCache<U> = AuthProvider<U> & Readonly<AuthProviderCache<U>>;
+/** What the rendering server already knows about this visitor, handed over so the browser does not re-ask. */
+export type AuthBootstrap<U> = {
+    user?: U;
+    accessToken?: string;
+    expiresAt?: number;
+    skipAuth?: boolean;
+};
 export type AuthProviderProps = {
-    enableRefresh?: boolean;
+    /** The credential naming the space this SDK instance renders, forwarded on requests made on the space's behalf —
+     *  the exchange is one, since only the space can say which identity provider its credentials may come from. */
+    spaceKey?: string;
     tokenStorage?: Schema['settings']['tokenStorage'];
+    sessionHintCookie?: Schema['settings']['sessionHintCookie'];
+    sessionGate?: Schema['settings']['sessionGate'];
+    sessionRevalidateSeconds?: Schema['settings']['sessionRevalidateSeconds'];
+    storageKey?: string;
 };
+/**
+ * Everything about a session that does not depend on how a particular backend is spoken to: what is known, how long
+ * it stays true, when to renew it, and what to do when it stops being true. A subclass supplies only the four
+ * requests, so an auth backend is described rather than reimplemented.
+ *
+ * The design goal is that knowing whether someone is signed in should normally cost nothing. Three sources answer it
+ * without a request — a server-rendered page's own answer, a stored session whose token has not lapsed, and the
+ * session hint cookie — and the backend is asked only when none of them can, or when what they say has gone stale.
+ */
 declare abstract class AuthProvider<U = Record<string, unknown>> {
     abstract readonly name: string;
-    protected cache?: AuthProviderCache<U>;
-    protected enableRefresh: boolean;
-    protected tokenStorage: Schema['settings']['tokenStorage'];
     protected state: AuthState;
-    private listeners;
-    constructor({ enableRefresh, tokenStorage }?: AuthProviderProps);
-    abstract init(user?: U, skipAuth?: boolean): Promise<void>;
-    abstract login(...args: unknown[]): Promise<TokenResult | undefined>;
-    abstract getUser(): Promise<U | undefined>;
-    abstract refresh(): Promise<TokenResult | undefined>;
-    abstract can(permission: string): boolean;
-    abstract logout(): Promise<void>;
-    protected internalRefresh(token?: TokenResult): void;
-    protected internalGetUser(user?: U): void;
-    protected internalLogin(user?: U, token?: TokenResult): void;
-    protected internalLogout(): void;
-    protected isExpired(): boolean;
-    protected setCache<T extends keyof AuthProviderCache>(cacheKey: T | undefined, cache: AuthProviderCache<U>[T]): void;
-    protected clearCache(cacheKey?: keyof AuthProviderCache<U>): void;
+    private session;
+    private readonly store;
+    private readonly gate;
+    private readonly hintCookie?;
+    private readonly revalidateSeconds;
+    private readonly listeners;
+    private renewal?;
+    private renewalTimer?;
+    private detachListeners?;
+    /** Set when a request failed to reach the backend, so the next `online` event retries instead of waiting. */
+    private offline;
+    protected readonly spaceKey: string;
+    constructor({ spaceKey, tokenStorage, sessionHintCookie, sessionGate, sessionRevalidateSeconds, storageKey }?: AuthProviderProps);
+    protected abstract get capabilities(): {
+        renew: boolean;
+        identity: boolean;
+    };
+    /** The backend's endpoints. Refusals reported from elsewhere are matched against these, so a session only reacts
+     *  to the API that issued it. Empty means "unknown", and then every refusal is taken as ours. */
+    protected get endpoints(): string[];
+    protected abstract requestLogin(params: Record<string, unknown>): Promise<AuthResult<U>>;
+    protected abstract requestRenewal(refreshToken?: string): Promise<AuthResult<U>>;
+    protected abstract requestIdentity(): Promise<AuthResult<U>>;
+    protected abstract requestLogout(): Promise<void>;
+    /**
+     * Hands the credential this browser just obtained to the rendering server, so it can establish a session of its
+     * own — see `handOffToServer`. Returning undefined, the default, means this provider's grants already come from
+     * the server and there is nothing to hand over.
+     */
+    protected requestExchange(): Promise<AuthResult<U> | undefined>;
+    /**
+     * A grant waiting in the current URL, for providers whose sign-in is a redirect rather than a request: OAuth and
+     * OIDC (Auth0 among them) send the browser away and bring it back with a code to exchange. That is the freshest
+     * evidence a page can have, so it is consulted before anything stored — and it is the provider's job to clean the
+     * code out of the URL once taken.
+     *
+     * Returning undefined, the default, means this provider does not sign in by redirect.
+     */
+    protected consumeRedirect(): Promise<AuthResult<U> | undefined>;
+    get user(): U | undefined;
+    get token(): TokenResult | undefined;
+    getState(): AuthState;
+    can(permission: string): boolean;
+    /**
+     * What this browser can be seen to hold, right now, without asking anyone or changing anything.
+     *
+     * `init()` reaches the same conclusion, but it runs in an effect — so the first paint of a client-rendered page
+     * happens before it, and a visitor whose session was sitting in storage the whole time saw the signed-out page
+     * flash past. There is nothing to wait for: the credential is in `localStorage` and the hint is a cookie, both
+     * synchronous. This is the same evidence `decide()` acts on, read a few milliseconds earlier.
+     *
+     * `init` means "cannot say yet" — there is evidence, but confirming it needs a request. Only `authenticated` and
+     * `guest` are claims, and both are ones the browser can make on its own.
+     */
+    peekState(): AuthState;
+    /** The same read, with the identity it found — so a page can render the visitor, not just know there is one. */
+    peek(): {
+        state: AuthState;
+        user?: U;
+        token?: TokenResult;
+    };
+    /**
+     * Decides what this page already knows and what, if anything, it has to ask. Resolves once the answer is good
+     * enough to render with — which under the default gate means as soon as a stored session says so, with the
+     * confirmation happening behind the render rather than in front of it.
+     */
+    init(bootstrap?: AuthBootstrap<U>): Promise<void>;
+    /**
+     * No path may leave a page waiting. Every branch below either settles the state itself or comes back through here,
+     * so a backend that answers something nobody anticipated costs a visitor a wrong guess about their session — never
+     * a page that renders nothing at all.
+     */
+    private settle;
+    private decide;
+    /** Drops timers and window listeners. Called when the provider is replaced, so a re-configured space leaves none behind. */
+    dispose(): void;
+    login(params: Record<string, unknown>): Promise<TokenResult | undefined>;
+    /**
+     * A credential obtained in the browser — by a client-side identity provider, or by a redirect coming back from
+     * one — is unknown to the server that renders the pages. It therefore renders every one of them as a guest while
+     * the browser knows perfectly well who this is, and the page changes under the visitor the moment it hydrates.
+     *
+     * Handing the credential over closes that gap: the server verifies it with the provider and establishes its own
+     * session, cookie and all, so the next server-rendered page already knows. Providers whose grants came from that
+     * same server return undefined here and nothing happens.
+     */
+    private handOffToServer;
+    refresh(): Promise<TokenResult | undefined>;
+    /**
+     * Confirms the session against the backend. Skipped when the last confirmation is recent enough and the token has
+     * not lapsed, unless forced — which is what a caller does before an action it cannot take back.
+     */
+    revalidate(force?: boolean): Promise<boolean>;
+    /**
+     * What an app calls when the backend refused a credential it just used. `expired` is renewable and silently is;
+     * anything terminal ends the session here and now, without waiting for a timer to notice.
+     */
+    invalidate(reason?: AuthFailureReason): void;
+    logout(): Promise<void>;
     on(listeners: AuthEventListener | AuthEventListener[]): () => void;
     protected emit(event: AuthEvent): void;
-    protected setState(state: AuthState): void;
-    getState(): AuthState;
-    protected request<T>(input: RequestInfo, init?: RequestInit): Promise<{
-        data?: T;
-        status: number;
-    }>;
+    protected setState(state: AuthState, reason?: AuthStateReason): void;
+    /** Single-flight: a timer firing while a 401 is being handled must not rotate the refresh token twice. */
+    private renew;
+    private performRenewal;
+    private loadIdentity;
+    private handleFailure;
+    /** Takes on what a grant or an identity call returned, and records that the backend confirmed it just now. */
+    private adopt;
+    /**
+     * Ends the session locally. `reason` distinguishes an expiry the client discovered from a sign-out the person
+     * asked for; both clear the same state, but only the first is something the app may want to react to.
+     *
+     * The cleared entry is written back rather than removed, because "nobody is signed in, confirmed just now" is
+     * worth remembering: it is what keeps a signed-out visitor from paying for the same refused request on every load.
+     */
+    private endSession;
+    /** Unix seconds this session's access token dies at, from what the backend said or, failing that, from the token. */
+    private expiresAt;
+    private hasLiveToken;
+    private isFresh;
+    /**
+     * Whether this browser shows any sign of holding a session: a stored credential, or the hint cookie the backend
+     * publishes beside its httpOnly one.
+     *
+     * **Nothing is ever asked without it.** A page that calls an API "just in case" gets a 401 for every signed-out
+     * visitor on every load and every tab focus — noise in the logs that says nothing, and a request that could never
+     * have succeeded. Evidence is cheap to produce and the backend decides whether it is any good.
+     *
+     * The hint is read live rather than at boot, so a sign-in that happened in another app on this domain is picked
+     * up by the next revalidation instead of waiting for a reload.
+     */
+    private hasEvidence;
+    private scheduleRenewal;
+    private onRenewalDue;
+    private attach;
+    /**
+     * Another tab changed the session. Adopting it rather than re-checking is the point: two tabs that each renewed on
+     * their own would rotate the refresh token out from under each other, and the one that lost would sign its user
+     * out over nothing.
+     */
+    private adoptFromStorage;
 }
 export default AuthProvider;