@securitydept/session-context-client 0.2.0-beta.1

package/dist/client-BcZv4X8b.mjs

@@ -0,0 +1,183 @@
+import { ClientError, ClientErrorKind, createEphemeralFlowStore, createSchema, normalizeAuthenticatedPrincipal, normalizeAuthenticatedPrincipalWire, validateWithSchemaSync } from "@securitydept/client";
+//#region src/schemas.ts
+/**
+* Schema for the canonical SessionInfo shape (camelCase principal).
+*
+* This is the preferred shape once normalized.
+*/
+const SessionInfoSchema = createSchema({ validate(input) {
+	if (typeof input === "object" && input !== null && "principal" in input && typeof input.principal === "object" && input.principal !== null) {
+		const principal = normalizeAuthenticatedPrincipal(input.principal);
+		if (principal) return { value: { principal } };
+	}
+	return { issues: [{
+		message: "Expected SessionInfo with principal.subject and principal.displayName",
+		path: ["principal", "subject"]
+	}] };
+} });
+/**
+* Schema for the Rust server session user-info response shape.
+*
+* Validates the real `/auth/session/user-info` wire payload and normalizes it
+* into SessionInfo in one step.
+*/
+const SessionUserInfoResponseSchema = createSchema({ validate(input) {
+	if (typeof input === "object" && input !== null && "subject" in input && typeof input.subject === "string") {
+		const principal = normalizeAuthenticatedPrincipalWire(input);
+		if (principal) return { value: { principal } };
+	}
+	return { issues: [{
+		message: "Expected server UserInfo response with subject (string)",
+		path: ["subject"]
+	}] };
+} });
+//#endregion
+//#region src/types.ts
+const SessionContextSource = { SessionContext: "session-context" };
+//#endregion
+//#region src/client.ts
+const DEFAULT_LOGIN_PATH = "/auth/session/login";
+const DEFAULT_LOGOUT_PATH = "/auth/session/logout";
+const DEFAULT_USER_INFO_PATH = "/auth/session/user-info";
+const DEFAULT_POST_AUTH_REDIRECT_PARAM = "post_auth_redirect_uri";
+const DEFAULT_LOGIN_REDIRECT_STATE_KEY = "securitydept.session_context.pending_login_redirect";
+/**
+* Session Context Client.
+*
+* Provides login/logout URL construction, session probing via `/user-info`, and
+* minimal session-scoped flow state for login redirect intent.
+*/
+var SessionContextClient = class {
+	_baseUrl;
+	_loginPath;
+	_logoutPath;
+	_userInfoPath;
+	_postAuthRedirectParam;
+	_pendingLoginRedirectStore;
+	_loginRedirectStateKey;
+	constructor(config, runtime = {}) {
+		this._baseUrl = config.baseUrl.replace(/\/+$/, "");
+		this._loginPath = config.loginPath ?? DEFAULT_LOGIN_PATH;
+		this._logoutPath = config.logoutPath ?? DEFAULT_LOGOUT_PATH;
+		this._userInfoPath = config.userInfoPath ?? DEFAULT_USER_INFO_PATH;
+		this._postAuthRedirectParam = config.postAuthRedirectParam ?? DEFAULT_POST_AUTH_REDIRECT_PARAM;
+		this._loginRedirectStateKey = config.loginRedirectStateKey ?? `${DEFAULT_LOGIN_REDIRECT_STATE_KEY}:${this._baseUrl || "relative"}`;
+		this._pendingLoginRedirectStore = runtime.sessionStore ? createEphemeralFlowStore({
+			store: runtime.sessionStore,
+			key: this._loginRedirectStateKey,
+			codec: {
+				encode(value) {
+					return value;
+				},
+				decode(raw) {
+					return raw;
+				}
+			}
+		}) : void 0;
+	}
+	/** Build the login URL, optionally with a post-auth redirect. */
+	loginUrl(postAuthRedirectUri) {
+		const base = this._baseUrl + this._loginPath;
+		if (postAuthRedirectUri) return `${base}?${new URLSearchParams({ [this._postAuthRedirectParam]: postAuthRedirectUri }).toString()}`;
+		return base;
+	}
+	/** Build the logout URL. */
+	logoutUrl() {
+		return this._baseUrl + this._logoutPath;
+	}
+	/** Save the pending post-auth redirect using the canonical browser-shell vocabulary. */
+	async rememberPostAuthRedirect(postAuthRedirectUri) {
+		await this.savePendingLoginRedirect(postAuthRedirectUri);
+	}
+	/** Save the pending post-auth redirect in `sessionStore` when available. */
+	async savePendingLoginRedirect(postAuthRedirectUri) {
+		if (!this._pendingLoginRedirectStore) return;
+		await this._pendingLoginRedirectStore.save(postAuthRedirectUri);
+	}
+	/** Load the pending post-auth redirect from `sessionStore`. */
+	async loadPendingLoginRedirect() {
+		if (!this._pendingLoginRedirectStore) return null;
+		return await this._pendingLoginRedirectStore.load();
+	}
+	/** Load and consume the pending post-auth redirect from `sessionStore`. */
+	async consumePendingLoginRedirect() {
+		if (!this._pendingLoginRedirectStore) return null;
+		return await this._pendingLoginRedirectStore.consume();
+	}
+	/** Clear the pending post-auth redirect from `sessionStore`. */
+	async clearPendingLoginRedirect() {
+		if (!this._pendingLoginRedirectStore) return;
+		await this._pendingLoginRedirectStore.clear();
+	}
+	/** Clear the pending post-auth redirect using the canonical browser-shell vocabulary. */
+	async clearPostAuthRedirect() {
+		await this.clearPendingLoginRedirect();
+	}
+	/** Resolve the next login URL by consuming any pending post-auth redirect intent. */
+	async resolveLoginUrl() {
+		const pendingRedirect = await this.consumePendingLoginRedirect();
+		return this.loginUrl(pendingRedirect ?? void 0);
+	}
+	/**
+	* Fetch the current session info from `/user-info`.
+	*
+	* Returns `null` only for 401/403 (unauthenticated).
+	* Throws `ClientError` for any other non-2xx response to distinguish
+	* server failures from unauthenticated state.
+	*/
+	async fetchUserInfo(transport, cancellationToken) {
+		const response = await transport.execute({
+			url: this._baseUrl + this._userInfoPath,
+			method: "GET",
+			headers: {},
+			cancellationToken
+		});
+		if (response.status === 401 || response.status === 403) return null;
+		if (response.status >= 200 && response.status < 300) return normalizeSessionInfo(response.body);
+		throw ClientError.fromHttpResponse(response.status, response.body);
+	}
+	/** Check whether a session exists on the server. */
+	async isAuthenticated(transport, cancellationToken) {
+		return await this.fetchUserInfo(transport, cancellationToken) !== null;
+	}
+	/** Execute logout against the configured session logout endpoint. */
+	async logout(transport, cancellationToken) {
+		const response = await transport.execute({
+			url: this.logoutUrl(),
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({}),
+			cancellationToken
+		});
+		if (response.status >= 200 && response.status < 300) return;
+		throw ClientError.fromHttpResponse(response.status, response.body);
+	}
+	/** Execute logout and clear any stale post-auth redirect intent in one canonical step. */
+	async logoutAndClearPendingLoginRedirect(transport, cancellationToken) {
+		await this.logout(transport, cancellationToken);
+		await this.clearPendingLoginRedirect();
+	}
+};
+/**
+* Normalize a /me response body using @standard-schema aligned schemas.
+*
+* Tries the canonical SessionInfo shape first, then falls back to the
+* server-side snake_case UserInfo shape. Throws a protocol-level ClientError
+* if neither schema matches.
+*/
+function normalizeSessionInfo(body) {
+	const infoResult = validateWithSchemaSync(SessionInfoSchema, body);
+	if (infoResult.success) return infoResult.value;
+	const userInfoResult = validateWithSchemaSync(SessionUserInfoResponseSchema, body);
+	if (userInfoResult.success) return userInfoResult.value;
+	throw new ClientError({
+		kind: ClientErrorKind.Protocol,
+		code: "session.invalid_user_info_payload",
+		message: "Session /user-info payload is invalid",
+		source: SessionContextSource.SessionContext
+	});
+}
+//#endregion
+export { SessionUserInfoResponseSchema as i, SessionContextSource as n, SessionInfoSchema as r, SessionContextClient as t };
+
+//# sourceMappingURL=client-BcZv4X8b.mjs.map

package/dist/client-BcZv4X8b.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-BcZv4X8b.mjs","names":[],"sources":["../src/schemas.ts","../src/types.ts","../src/client.ts"],"sourcesContent":["// Session /auth/session/user-info response schemas — shared principal validation\n//\n// These schemas validate the two accepted shapes of the session user-info\n// response:\n//   1. Internal (camelCase):\n//      { principal: { subject, displayName, picture?, issuer?, claims? } }\n//   2. Rust server wire (snake_case):\n//      { subject, display_name, picture?, issuer?, claims? }\n\nimport {\n\tcreateSchema,\n\tnormalizeAuthenticatedPrincipal,\n\tnormalizeAuthenticatedPrincipalWire,\n} from \"@securitydept/client\";\nimport type { SessionInfo, SessionPrincipal } from \"./types\";\n\n/**\n * Schema for the canonical SessionInfo shape (camelCase principal).\n *\n * This is the preferred shape once normalized.\n */\nexport const SessionInfoSchema = createSchema<SessionInfo>({\n\tvalidate(input: unknown) {\n\t\tif (\n\t\t\ttypeof input === \"object\" &&\n\t\t\tinput !== null &&\n\t\t\t\"principal\" in input &&\n\t\t\ttypeof (input as Record<string, unknown>).principal === \"object\" &&\n\t\t\t(input as Record<string, unknown>).principal !== null\n\t\t) {\n\t\t\tconst principal = normalizeAuthenticatedPrincipal(\n\t\t\t\t(input as { principal: Record<string, unknown> }).principal,\n\t\t\t);\n\t\t\tif (principal) {\n\t\t\t\treturn { value: { principal } };\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\tissues: [\n\t\t\t\t{\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"Expected SessionInfo with principal.subject and principal.displayName\",\n\t\t\t\t\tpath: [\"principal\", \"subject\"],\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t},\n});\n\n/**\n * Schema for the Rust server session user-info response shape.\n *\n * Validates the real `/auth/session/user-info` wire payload and normalizes it\n * into SessionInfo in one step.\n */\nexport const SessionUserInfoResponseSchema = createSchema<SessionInfo>({\n\tvalidate(input: unknown) {\n\t\tif (\n\t\t\ttypeof input === \"object\" &&\n\t\t\tinput !== null &&\n\t\t\t\"subject\" in input &&\n\t\t\ttypeof (input as Record<string, unknown>).subject === \"string\"\n\t\t) {\n\t\t\tconst raw = input as Record<string, unknown>;\n\t\t\tconst principal = normalizeAuthenticatedPrincipalWire(raw);\n\t\t\tif (principal) {\n\t\t\t\treturn { value: { principal: principal as SessionPrincipal } };\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\tissues: [\n\t\t\t\t{\n\t\t\t\t\tmessage: \"Expected server UserInfo response with subject (string)\",\n\t\t\t\t\tpath: [\"subject\"],\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t},\n});\n","import type { AuthenticatedPrincipal } from \"@securitydept/client\";\n\n// --- Session Context Client types ---\n\nexport const SessionContextSource = {\n\tSessionContext: \"session-context\",\n} as const;\n\nexport type SessionContextSource =\n\t(typeof SessionContextSource)[keyof typeof SessionContextSource];\n\n/** Session principal — shared authenticated principal semantics via @securitydept/client. */\nexport type SessionPrincipal = AuthenticatedPrincipal;\n\n/** Session info returned from the server. */\nexport interface SessionInfo {\n\tprincipal: SessionPrincipal;\n\tattributes?: Record<string, unknown>;\n\textra?: Record<string, unknown>;\n}\n\n/** Configuration for the Session Context Client. */\nexport interface SessionContextClientConfig {\n\t/** Base URL of the SecurityDept server. */\n\tbaseUrl: string;\n\t/** Login path (default: \"/login\"). */\n\tloginPath?: string;\n\t/** Logout path (default: \"/logout\"). */\n\tlogoutPath?: string;\n\t/** User info endpoint path (default: \"/auth/session/user-info\"). */\n\tuserInfoPath?: string;\n\t/** Name of the query parameter for post-auth redirect (default: \"post_auth_redirect_uri\"). */\n\tpostAuthRedirectParam?: string;\n\t/** Optional key used with `runtime.sessionStore` for pending login redirect state. */\n\tloginRedirectStateKey?: string;\n}\n","import type {\n\tCancellationTokenTrait,\n\tClientRuntime,\n\tEphemeralFlowStore,\n\tHttpTransport,\n} from \"@securitydept/client\";\nimport {\n\tClientError,\n\tClientErrorKind,\n\tcreateEphemeralFlowStore,\n\tvalidateWithSchemaSync,\n} from \"@securitydept/client\";\nimport { SessionInfoSchema, SessionUserInfoResponseSchema } from \"./schemas\";\nimport {\n\ttype SessionContextClientConfig,\n\tSessionContextSource,\n\ttype SessionInfo,\n} from \"./types\";\n\nconst DEFAULT_LOGIN_PATH = \"/auth/session/login\";\nconst DEFAULT_LOGOUT_PATH = \"/auth/session/logout\";\nconst DEFAULT_USER_INFO_PATH = \"/auth/session/user-info\";\nconst DEFAULT_POST_AUTH_REDIRECT_PARAM = \"post_auth_redirect_uri\";\nconst DEFAULT_LOGIN_REDIRECT_STATE_KEY =\n\t\"securitydept.session_context.pending_login_redirect\";\n\n/**\n * Session Context Client.\n *\n * Provides login/logout URL construction, session probing via `/user-info`, and\n * minimal session-scoped flow state for login redirect intent.\n */\nexport class SessionContextClient {\n\tprivate readonly _baseUrl: string;\n\tprivate readonly _loginPath: string;\n\tprivate readonly _logoutPath: string;\n\tprivate readonly _userInfoPath: string;\n\tprivate readonly _postAuthRedirectParam: string;\n\tprivate readonly _pendingLoginRedirectStore?: EphemeralFlowStore<string>;\n\tprivate readonly _loginRedirectStateKey: string;\n\n\tconstructor(\n\t\tconfig: SessionContextClientConfig,\n\t\truntime: Pick<ClientRuntime, \"sessionStore\"> = {},\n\t) {\n\t\tthis._baseUrl = config.baseUrl.replace(/\\/+$/, \"\");\n\t\tthis._loginPath = config.loginPath ?? DEFAULT_LOGIN_PATH;\n\t\tthis._logoutPath = config.logoutPath ?? DEFAULT_LOGOUT_PATH;\n\t\tthis._userInfoPath = config.userInfoPath ?? DEFAULT_USER_INFO_PATH;\n\t\tthis._postAuthRedirectParam =\n\t\t\tconfig.postAuthRedirectParam ?? DEFAULT_POST_AUTH_REDIRECT_PARAM;\n\t\tthis._loginRedirectStateKey =\n\t\t\tconfig.loginRedirectStateKey ??\n\t\t\t`${DEFAULT_LOGIN_REDIRECT_STATE_KEY}:${this._baseUrl || \"relative\"}`;\n\t\tthis._pendingLoginRedirectStore = runtime.sessionStore\n\t\t\t? createEphemeralFlowStore<string>({\n\t\t\t\t\tstore: runtime.sessionStore,\n\t\t\t\t\tkey: this._loginRedirectStateKey,\n\t\t\t\t\tcodec: {\n\t\t\t\t\t\tencode(value) {\n\t\t\t\t\t\t\treturn value;\n\t\t\t\t\t\t},\n\t\t\t\t\t\tdecode(raw) {\n\t\t\t\t\t\t\treturn raw;\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t: undefined;\n\t}\n\n\t/** Build the login URL, optionally with a post-auth redirect. */\n\tloginUrl(postAuthRedirectUri?: string): string {\n\t\tconst base = this._baseUrl + this._loginPath;\n\t\tif (postAuthRedirectUri) {\n\t\t\tconst params = new URLSearchParams({\n\t\t\t\t[this._postAuthRedirectParam]: postAuthRedirectUri,\n\t\t\t});\n\t\t\treturn `${base}?${params.toString()}`;\n\t\t}\n\t\treturn base;\n\t}\n\n\t/** Build the logout URL. */\n\tlogoutUrl(): string {\n\t\treturn this._baseUrl + this._logoutPath;\n\t}\n\n\t/** Save the pending post-auth redirect using the canonical browser-shell vocabulary. */\n\tasync rememberPostAuthRedirect(postAuthRedirectUri: string): Promise<void> {\n\t\tawait this.savePendingLoginRedirect(postAuthRedirectUri);\n\t}\n\n\t/** Save the pending post-auth redirect in `sessionStore` when available. */\n\tasync savePendingLoginRedirect(postAuthRedirectUri: string): Promise<void> {\n\t\tif (!this._pendingLoginRedirectStore) {\n\t\t\treturn;\n\t\t}\n\n\t\tawait this._pendingLoginRedirectStore.save(postAuthRedirectUri);\n\t}\n\n\t/** Load the pending post-auth redirect from `sessionStore`. */\n\tasync loadPendingLoginRedirect(): Promise<string | null> {\n\t\tif (!this._pendingLoginRedirectStore) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn await this._pendingLoginRedirectStore.load();\n\t}\n\n\t/** Load and consume the pending post-auth redirect from `sessionStore`. */\n\tasync consumePendingLoginRedirect(): Promise<string | null> {\n\t\tif (!this._pendingLoginRedirectStore) {\n\t\t\treturn null;\n\t\t}\n\t\treturn await this._pendingLoginRedirectStore.consume();\n\t}\n\n\t/** Clear the pending post-auth redirect from `sessionStore`. */\n\tasync clearPendingLoginRedirect(): Promise<void> {\n\t\tif (!this._pendingLoginRedirectStore) {\n\t\t\treturn;\n\t\t}\n\n\t\tawait this._pendingLoginRedirectStore.clear();\n\t}\n\n\t/** Clear the pending post-auth redirect using the canonical browser-shell vocabulary. */\n\tasync clearPostAuthRedirect(): Promise<void> {\n\t\tawait this.clearPendingLoginRedirect();\n\t}\n\n\t/** Resolve the next login URL by consuming any pending post-auth redirect intent. */\n\tasync resolveLoginUrl(): Promise<string> {\n\t\tconst pendingRedirect = await this.consumePendingLoginRedirect();\n\t\treturn this.loginUrl(pendingRedirect ?? undefined);\n\t}\n\n\t/**\n\t * Fetch the current session info from `/user-info`.\n\t *\n\t * Returns `null` only for 401/403 (unauthenticated).\n\t * Throws `ClientError` for any other non-2xx response to distinguish\n\t * server failures from unauthenticated state.\n\t */\n\tasync fetchUserInfo(\n\t\ttransport: HttpTransport,\n\t\tcancellationToken?: CancellationTokenTrait,\n\t): Promise<SessionInfo | null> {\n\t\tconst response = await transport.execute({\n\t\t\turl: this._baseUrl + this._userInfoPath,\n\t\t\tmethod: \"GET\",\n\t\t\theaders: {},\n\t\t\tcancellationToken,\n\t\t});\n\n\t\tif (response.status === 401 || response.status === 403) {\n\t\t\treturn null;\n\t\t}\n\n\t\tif (response.status >= 200 && response.status < 300) {\n\t\t\treturn normalizeSessionInfo(response.body);\n\t\t}\n\n\t\t// Non-2xx, non-401/403 — this is a server error, not \"unauthenticated\".\n\t\tthrow ClientError.fromHttpResponse(response.status, response.body);\n\t}\n\n\t/** Check whether a session exists on the server. */\n\tasync isAuthenticated(\n\t\ttransport: HttpTransport,\n\t\tcancellationToken?: CancellationTokenTrait,\n\t): Promise<boolean> {\n\t\tconst me = await this.fetchUserInfo(transport, cancellationToken);\n\t\treturn me !== null;\n\t}\n\n\t/** Execute logout against the configured session logout endpoint. */\n\tasync logout(\n\t\ttransport: HttpTransport,\n\t\tcancellationToken?: CancellationTokenTrait,\n\t): Promise<void> {\n\t\tconst response = await transport.execute({\n\t\t\turl: this.logoutUrl(),\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({}),\n\t\t\tcancellationToken,\n\t\t});\n\n\t\tif (response.status >= 200 && response.status < 300) {\n\t\t\treturn;\n\t\t}\n\n\t\tthrow ClientError.fromHttpResponse(response.status, response.body);\n\t}\n\n\t/** Execute logout and clear any stale post-auth redirect intent in one canonical step. */\n\tasync logoutAndClearPendingLoginRedirect(\n\t\ttransport: HttpTransport,\n\t\tcancellationToken?: CancellationTokenTrait,\n\t): Promise<void> {\n\t\tawait this.logout(transport, cancellationToken);\n\t\tawait this.clearPendingLoginRedirect();\n\t}\n}\n\n/**\n * Normalize a /me response body using @standard-schema aligned schemas.\n *\n * Tries the canonical SessionInfo shape first, then falls back to the\n * server-side snake_case UserInfo shape. Throws a protocol-level ClientError\n * if neither schema matches.\n */\nfunction normalizeSessionInfo(body: unknown): SessionInfo {\n\t// Try canonical camelCase shape first.\n\tconst infoResult = validateWithSchemaSync(SessionInfoSchema, body);\n\tif (infoResult.success) {\n\t\treturn infoResult.value;\n\t}\n\n\t// Try server-side snake_case shape.\n\tconst userInfoResult = validateWithSchemaSync(\n\t\tSessionUserInfoResponseSchema,\n\t\tbody,\n\t);\n\tif (userInfoResult.success) {\n\t\treturn userInfoResult.value;\n\t}\n\n\tthrow new ClientError({\n\t\tkind: ClientErrorKind.Protocol,\n\t\tcode: \"session.invalid_user_info_payload\",\n\t\tmessage: \"Session /user-info payload is invalid\",\n\t\tsource: SessionContextSource.SessionContext,\n\t});\n}\n"],"mappings":";;;;;;;AAqBA,MAAa,oBAAoB,aAA0B,EAC1D,SAAS,OAAgB;AACxB,KACC,OAAO,UAAU,YACjB,UAAU,QACV,eAAe,SACf,OAAQ,MAAkC,cAAc,YACvD,MAAkC,cAAc,MAChD;EACD,MAAM,YAAY,gCAChB,MAAiD,UAClD;AACD,MAAI,UACH,QAAO,EAAE,OAAO,EAAE,WAAW,EAAE;;AAGjC,QAAO,EACN,QAAQ,CACP;EACC,SACC;EACD,MAAM,CAAC,aAAa,UAAU;EAC9B,CACD,EACD;GAEF,CAAC;;;;;;;AAQF,MAAa,gCAAgC,aAA0B,EACtE,SAAS,OAAgB;AACxB,KACC,OAAO,UAAU,YACjB,UAAU,QACV,aAAa,SACb,OAAQ,MAAkC,YAAY,UACrD;EAED,MAAM,YAAY,oCADN,MAC8C;AAC1D,MAAI,UACH,QAAO,EAAE,OAAO,EAAa,WAA+B,EAAE;;AAGhE,QAAO,EACN,QAAQ,CACP;EACC,SAAS;EACT,MAAM,CAAC,UAAU;EACjB,CACD,EACD;GAEF,CAAC;;;AC1EF,MAAa,uBAAuB,EACnC,gBAAgB,mBAChB;;;ACaD,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AACzC,MAAM,mCACL;;;;;;;AAQD,IAAa,uBAAb,MAAkC;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YACC,QACA,UAA+C,EAAE,EAChD;AACD,OAAK,WAAW,OAAO,QAAQ,QAAQ,QAAQ,GAAG;AAClD,OAAK,aAAa,OAAO,aAAa;AACtC,OAAK,cAAc,OAAO,cAAc;AACxC,OAAK,gBAAgB,OAAO,gBAAgB;AAC5C,OAAK,yBACJ,OAAO,yBAAyB;AACjC,OAAK,yBACJ,OAAO,yBACP,GAAG,iCAAiC,GAAG,KAAK,YAAY;AACzD,OAAK,6BAA6B,QAAQ,eACvC,yBAAiC;GACjC,OAAO,QAAQ;GACf,KAAK,KAAK;GACV,OAAO;IACN,OAAO,OAAO;AACb,YAAO;;IAER,OAAO,KAAK;AACX,YAAO;;IAER;GACD,CAAC,GACD,KAAA;;;CAIJ,SAAS,qBAAsC;EAC9C,MAAM,OAAO,KAAK,WAAW,KAAK;AAClC,MAAI,oBAIH,QAAO,GAAG,KAAK,GAHA,IAAI,gBAAgB,GACjC,KAAK,yBAAyB,qBAC/B,CAAC,CACuB,UAAU;AAEpC,SAAO;;;CAIR,YAAoB;AACnB,SAAO,KAAK,WAAW,KAAK;;;CAI7B,MAAM,yBAAyB,qBAA4C;AAC1E,QAAM,KAAK,yBAAyB,oBAAoB;;;CAIzD,MAAM,yBAAyB,qBAA4C;AAC1E,MAAI,CAAC,KAAK,2BACT;AAGD,QAAM,KAAK,2BAA2B,KAAK,oBAAoB;;;CAIhE,MAAM,2BAAmD;AACxD,MAAI,CAAC,KAAK,2BACT,QAAO;AAGR,SAAO,MAAM,KAAK,2BAA2B,MAAM;;;CAIpD,MAAM,8BAAsD;AAC3D,MAAI,CAAC,KAAK,2BACT,QAAO;AAER,SAAO,MAAM,KAAK,2BAA2B,SAAS;;;CAIvD,MAAM,4BAA2C;AAChD,MAAI,CAAC,KAAK,2BACT;AAGD,QAAM,KAAK,2BAA2B,OAAO;;;CAI9C,MAAM,wBAAuC;AAC5C,QAAM,KAAK,2BAA2B;;;CAIvC,MAAM,kBAAmC;EACxC,MAAM,kBAAkB,MAAM,KAAK,6BAA6B;AAChE,SAAO,KAAK,SAAS,mBAAmB,KAAA,EAAU;;;;;;;;;CAUnD,MAAM,cACL,WACA,mBAC8B;EAC9B,MAAM,WAAW,MAAM,UAAU,QAAQ;GACxC,KAAK,KAAK,WAAW,KAAK;GAC1B,QAAQ;GACR,SAAS,EAAE;GACX;GACA,CAAC;AAEF,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAClD,QAAO;AAGR,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,IAC/C,QAAO,qBAAqB,SAAS,KAAK;AAI3C,QAAM,YAAY,iBAAiB,SAAS,QAAQ,SAAS,KAAK;;;CAInE,MAAM,gBACL,WACA,mBACmB;AAEnB,SADW,MAAM,KAAK,cAAc,WAAW,kBAAkB,KACnD;;;CAIf,MAAM,OACL,WACA,mBACgB;EAChB,MAAM,WAAW,MAAM,UAAU,QAAQ;GACxC,KAAK,KAAK,WAAW;GACrB,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAC/C,MAAM,KAAK,UAAU,EAAE,CAAC;GACxB;GACA,CAAC;AAEF,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,IAC/C;AAGD,QAAM,YAAY,iBAAiB,SAAS,QAAQ,SAAS,KAAK;;;CAInE,MAAM,mCACL,WACA,mBACgB;AAChB,QAAM,KAAK,OAAO,WAAW,kBAAkB;AAC/C,QAAM,KAAK,2BAA2B;;;;;;;;;;AAWxC,SAAS,qBAAqB,MAA4B;CAEzD,MAAM,aAAa,uBAAuB,mBAAmB,KAAK;AAClE,KAAI,WAAW,QACd,QAAO,WAAW;CAInB,MAAM,iBAAiB,uBACtB,+BACA,KACA;AACD,KAAI,eAAe,QAClB,QAAO,eAAe;AAGvB,OAAM,IAAI,YAAY;EACrB,MAAM,gBAAgB;EACtB,MAAM;EACN,SAAS;EACT,QAAQ,qBAAqB;EAC7B,CAAC"}

package/dist/client-Dzfx3BXp.d.mts

@@ -0,0 +1,83 @@
+import { AuthenticatedPrincipal, CancellationTokenTrait, ClientRuntime, HttpTransport } from "@securitydept/client";
+
+//#region src/types.d.ts
+declare const SessionContextSource: {
+  readonly SessionContext: "session-context";
+};
+type SessionContextSource = (typeof SessionContextSource)[keyof typeof SessionContextSource];
+/** Session principal — shared authenticated principal semantics via @securitydept/client. */
+type SessionPrincipal = AuthenticatedPrincipal;
+/** Session info returned from the server. */
+interface SessionInfo {
+  principal: SessionPrincipal;
+  attributes?: Record<string, unknown>;
+  extra?: Record<string, unknown>;
+}
+/** Configuration for the Session Context Client. */
+interface SessionContextClientConfig {
+  /** Base URL of the SecurityDept server. */
+  baseUrl: string;
+  /** Login path (default: "/login"). */
+  loginPath?: string;
+  /** Logout path (default: "/logout"). */
+  logoutPath?: string;
+  /** User info endpoint path (default: "/auth/session/user-info"). */
+  userInfoPath?: string;
+  /** Name of the query parameter for post-auth redirect (default: "post_auth_redirect_uri"). */
+  postAuthRedirectParam?: string;
+  /** Optional key used with `runtime.sessionStore` for pending login redirect state. */
+  loginRedirectStateKey?: string;
+}
+//#endregion
+//#region src/client.d.ts
+/**
+ * Session Context Client.
+ *
+ * Provides login/logout URL construction, session probing via `/user-info`, and
+ * minimal session-scoped flow state for login redirect intent.
+ */
+declare class SessionContextClient {
+  private readonly _baseUrl;
+  private readonly _loginPath;
+  private readonly _logoutPath;
+  private readonly _userInfoPath;
+  private readonly _postAuthRedirectParam;
+  private readonly _pendingLoginRedirectStore?;
+  private readonly _loginRedirectStateKey;
+  constructor(config: SessionContextClientConfig, runtime?: Pick<ClientRuntime, "sessionStore">);
+  /** Build the login URL, optionally with a post-auth redirect. */
+  loginUrl(postAuthRedirectUri?: string): string;
+  /** Build the logout URL. */
+  logoutUrl(): string;
+  /** Save the pending post-auth redirect using the canonical browser-shell vocabulary. */
+  rememberPostAuthRedirect(postAuthRedirectUri: string): Promise<void>;
+  /** Save the pending post-auth redirect in `sessionStore` when available. */
+  savePendingLoginRedirect(postAuthRedirectUri: string): Promise<void>;
+  /** Load the pending post-auth redirect from `sessionStore`. */
+  loadPendingLoginRedirect(): Promise<string | null>;
+  /** Load and consume the pending post-auth redirect from `sessionStore`. */
+  consumePendingLoginRedirect(): Promise<string | null>;
+  /** Clear the pending post-auth redirect from `sessionStore`. */
+  clearPendingLoginRedirect(): Promise<void>;
+  /** Clear the pending post-auth redirect using the canonical browser-shell vocabulary. */
+  clearPostAuthRedirect(): Promise<void>;
+  /** Resolve the next login URL by consuming any pending post-auth redirect intent. */
+  resolveLoginUrl(): Promise<string>;
+  /**
+   * Fetch the current session info from `/user-info`.
+   *
+   * Returns `null` only for 401/403 (unauthenticated).
+   * Throws `ClientError` for any other non-2xx response to distinguish
+   * server failures from unauthenticated state.
+   */
+  fetchUserInfo(transport: HttpTransport, cancellationToken?: CancellationTokenTrait): Promise<SessionInfo | null>;
+  /** Check whether a session exists on the server. */
+  isAuthenticated(transport: HttpTransport, cancellationToken?: CancellationTokenTrait): Promise<boolean>;
+  /** Execute logout against the configured session logout endpoint. */
+  logout(transport: HttpTransport, cancellationToken?: CancellationTokenTrait): Promise<void>;
+  /** Execute logout and clear any stale post-auth redirect intent in one canonical step. */
+  logoutAndClearPendingLoginRedirect(transport: HttpTransport, cancellationToken?: CancellationTokenTrait): Promise<void>;
+}
+//#endregion
+export { SessionPrincipal as a, SessionInfo as i, SessionContextClientConfig as n, SessionContextSource as r, SessionContextClient as t };
+//# sourceMappingURL=client-Dzfx3BXp.d.mts.map

package/dist/index.d.mts

@@ -0,0 +1,97 @@
+import { a as SessionPrincipal, i as SessionInfo, n as SessionContextClientConfig, r as SessionContextSource, t as SessionContextClient } from "./client-Dzfx3BXp.mjs";
+
+//#region ../../../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts
+/** The Standard Typed interface. This is a base type extended by other specs. */
+interface StandardTypedV1<Input = unknown, Output = Input> {
+  /** The Standard properties. */
+  readonly "~standard": StandardTypedV1.Props<Input, Output>;
+}
+declare namespace StandardTypedV1 {
+  /** The Standard Typed properties interface. */
+  interface Props<Input = unknown, Output = Input> {
+    /** The version number of the standard. */
+    readonly version: 1;
+    /** The vendor name of the schema library. */
+    readonly vendor: string;
+    /** Inferred types associated with the schema. */
+    readonly types?: Types<Input, Output> | undefined;
+  }
+  /** The Standard Typed types interface. */
+  interface Types<Input = unknown, Output = Input> {
+    /** The input type of the schema. */
+    readonly input: Input;
+    /** The output type of the schema. */
+    readonly output: Output;
+  }
+  /** Infers the input type of a Standard Typed. */
+  type InferInput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["input"];
+  /** Infers the output type of a Standard Typed. */
+  type InferOutput<Schema extends StandardTypedV1> = NonNullable<Schema["~standard"]["types"]>["output"];
+}
+/** The Standard Schema interface. */
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+  /** The Standard Schema properties. */
+  readonly "~standard": StandardSchemaV1.Props<Input, Output>;
+}
+declare namespace StandardSchemaV1 {
+  /** The Standard Schema properties interface. */
+  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
+    /** Validates unknown input values. */
+    readonly validate: (value: unknown, options?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
+  }
+  /** The result interface of the validate function. */
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  /** The result interface if validation succeeds. */
+  interface SuccessResult<Output> {
+    /** The typed output value. */
+    readonly value: Output;
+    /** A falsy value for `issues` indicates success. */
+    readonly issues?: undefined;
+  }
+  interface Options {
+    /** Explicit support for additional vendor-specific parameters, if needed. */
+    readonly libraryOptions?: Record<string, unknown> | undefined;
+  }
+  /** The result interface if validation fails. */
+  interface FailureResult {
+    /** The issues of failed validation. */
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  /** The issue interface of the failure output. */
+  interface Issue {
+    /** The error message of the issue. */
+    readonly message: string;
+    /** The path of the issue, if any. */
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  /** The path segment interface of the issue. */
+  interface PathSegment {
+    /** The key representing a path segment. */
+    readonly key: PropertyKey;
+  }
+  /** The Standard types interface. */
+  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
+  /** Infers the input type of a Standard. */
+  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
+  /** Infers the output type of a Standard. */
+  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
+}
+/** The Standard JSON Schema interface. */
+//#endregion
+//#region src/schemas.d.ts
+/**
+ * Schema for the canonical SessionInfo shape (camelCase principal).
+ *
+ * This is the preferred shape once normalized.
+ */
+declare const SessionInfoSchema: StandardSchemaV1<unknown, SessionInfo>;
+/**
+ * Schema for the Rust server session user-info response shape.
+ *
+ * Validates the real `/auth/session/user-info` wire payload and normalizes it
+ * into SessionInfo in one step.
+ */
+declare const SessionUserInfoResponseSchema: StandardSchemaV1<unknown, SessionInfo>;
+//#endregion
+export { SessionContextClient, type SessionContextClientConfig, SessionContextSource, type SessionInfo, SessionInfoSchema, type SessionPrincipal, SessionUserInfoResponseSchema };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import { i as SessionUserInfoResponseSchema, n as SessionContextSource, r as SessionInfoSchema, t as SessionContextClient } from "./client-BcZv4X8b.mjs";
+export { SessionContextClient, SessionContextSource, SessionInfoSchema, SessionUserInfoResponseSchema };

package/dist/server/index.d.mts

@@ -0,0 +1,66 @@
+import { i as SessionInfo, n as SessionContextClientConfig, t as SessionContextClient } from "../client-Dzfx3BXp.mjs";
+import { HttpTransport } from "@securitydept/client";
+
+//#region src/server/helpers.d.ts
+/** Minimal server request context — host-neutral. */
+interface ServerRequestContext {
+  /**
+   * Incoming request headers from the server host.
+   *
+   * The helper uses `cookie` (and optionally other headers) to build
+   * a forwarding transport. The host controls which headers to pass.
+   */
+  headers: Record<string, string>;
+}
+/** Options for {@link createSessionServerHelper}. */
+interface CreateSessionServerHelperOptions {
+  /** SessionContextClient config — same shape as the browser client. */
+  config: SessionContextClientConfig;
+  /**
+   * The underlying HTTP transport used for server-side requests.
+   *
+   * The helper wraps this transport to inject forwarded headers.
+   * Typically a simple `fetch`-based transport.
+   */
+  transport: HttpTransport;
+}
+/** Server-host helper for session-based auth in SSR contexts. */
+interface SessionServerHelper {
+  /** The underlying SessionContextClient instance. */
+  readonly client: SessionContextClient;
+  /**
+   * Fetch the current user session using forwarded request headers.
+   *
+   * Returns `SessionInfo` if authenticated, `null` if not.
+   * The host's cookies are forwarded via the transport.
+   */
+  fetchUserInfo(context: ServerRequestContext): Promise<SessionInfo | null>;
+  /** Build the login URL (server-host-safe, no browser globals). */
+  loginUrl(postAuthRedirectUri?: string): string;
+  /** Build the logout URL (server-host-safe, no browser globals). */
+  logoutUrl(): string;
+}
+/**
+ * Create a server-host helper for session-based auth.
+ *
+ * @example
+ * ```ts
+ * const helper = createSessionServerHelper({
+ *   config: { baseUrl: "https://auth.example.com" },
+ *   transport: fetchTransport, // your HTTP transport
+ * });
+ *
+ * // In a server request handler:
+ * const session = await helper.fetchUserInfo({
+ *   headers: { cookie: req.headers.cookie ?? "" },
+ * });
+ *
+ * if (!session) {
+ *   return Response.redirect(helper.loginUrl("/protected"), 302);
+ * }
+ * ```
+ */
+declare function createSessionServerHelper(options: CreateSessionServerHelperOptions): SessionServerHelper;
+//#endregion
+export { type CreateSessionServerHelperOptions, type ServerRequestContext, type SessionServerHelper, createSessionServerHelper };
+//# sourceMappingURL=index.d.mts.map

package/dist/server/index.mjs

@@ -0,0 +1,50 @@
+import { t as SessionContextClient } from "../client-BcZv4X8b.mjs";
+//#region src/server/helpers.ts
+/**
+* Create a server-host helper for session-based auth.
+*
+* @example
+* ```ts
+* const helper = createSessionServerHelper({
+*   config: { baseUrl: "https://auth.example.com" },
+*   transport: fetchTransport, // your HTTP transport
+* });
+*
+* // In a server request handler:
+* const session = await helper.fetchUserInfo({
+*   headers: { cookie: req.headers.cookie ?? "" },
+* });
+*
+* if (!session) {
+*   return Response.redirect(helper.loginUrl("/protected"), 302);
+* }
+* ```
+*/
+function createSessionServerHelper(options) {
+	const client = new SessionContextClient(options.config);
+	const baseTransport = options.transport;
+	return {
+		client,
+		async fetchUserInfo(context) {
+			return client.fetchUserInfo({ async execute(request) {
+				return baseTransport.execute({
+					...request,
+					headers: {
+						...context.headers,
+						...request.headers
+					}
+				});
+			} });
+		},
+		loginUrl(postAuthRedirectUri) {
+			return client.loginUrl(postAuthRedirectUri);
+		},
+		logoutUrl() {
+			return client.logoutUrl();
+		}
+	};
+}
+//#endregion
+export { createSessionServerHelper };
+
+//# sourceMappingURL=index.mjs.map

package/dist/server/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/server/helpers.ts"],"sourcesContent":["// Server-host helpers for session-context-client\n//\n// Provides host-neutral server helpers that wrap SessionContextClient\n// for SSR / server-render-host scenarios (Next.js, Remix, Astro,\n// plain Node request handlers, etc.).\n//\n// Key design:\n//   - The host provides incoming request headers (cookies, forwarded-for, etc.)\n//   - The helper creates a cookie-forwarding transport wrapper\n//   - fetchUserInfo, login URL, logout URL are all server-host-safe\n\nimport type { HttpTransport } from \"@securitydept/client\";\nimport { SessionContextClient } from \"../client\";\nimport type { SessionContextClientConfig, SessionInfo } from \"../types\";\n\n// ---------------------------------------------------------------------------\n// Server request context\n// ---------------------------------------------------------------------------\n\n/** Minimal server request context — host-neutral. */\nexport interface ServerRequestContext {\n\t/**\n\t * Incoming request headers from the server host.\n\t *\n\t * The helper uses `cookie` (and optionally other headers) to build\n\t * a forwarding transport. The host controls which headers to pass.\n\t */\n\theaders: Record<string, string>;\n}\n\n// ---------------------------------------------------------------------------\n// Helper options\n// ---------------------------------------------------------------------------\n\n/** Options for {@link createSessionServerHelper}. */\nexport interface CreateSessionServerHelperOptions {\n\t/** SessionContextClient config — same shape as the browser client. */\n\tconfig: SessionContextClientConfig;\n\t/**\n\t * The underlying HTTP transport used for server-side requests.\n\t *\n\t * The helper wraps this transport to inject forwarded headers.\n\t * Typically a simple `fetch`-based transport.\n\t */\n\ttransport: HttpTransport;\n}\n\n// ---------------------------------------------------------------------------\n// Helper interface\n// ---------------------------------------------------------------------------\n\n/** Server-host helper for session-based auth in SSR contexts. */\nexport interface SessionServerHelper {\n\t/** The underlying SessionContextClient instance. */\n\treadonly client: SessionContextClient;\n\n\t/**\n\t * Fetch the current user session using forwarded request headers.\n\t *\n\t * Returns `SessionInfo` if authenticated, `null` if not.\n\t * The host's cookies are forwarded via the transport.\n\t */\n\tfetchUserInfo(context: ServerRequestContext): Promise<SessionInfo | null>;\n\n\t/** Build the login URL (server-host-safe, no browser globals). */\n\tloginUrl(postAuthRedirectUri?: string): string;\n\n\t/** Build the logout URL (server-host-safe, no browser globals). */\n\tlogoutUrl(): string;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Create a server-host helper for session-based auth.\n *\n * @example\n * ```ts\n * const helper = createSessionServerHelper({\n *   config: { baseUrl: \"https://auth.example.com\" },\n *   transport: fetchTransport, // your HTTP transport\n * });\n *\n * // In a server request handler:\n * const session = await helper.fetchUserInfo({\n *   headers: { cookie: req.headers.cookie ?? \"\" },\n * });\n *\n * if (!session) {\n *   return Response.redirect(helper.loginUrl(\"/protected\"), 302);\n * }\n * ```\n */\nexport function createSessionServerHelper(\n\toptions: CreateSessionServerHelperOptions,\n): SessionServerHelper {\n\tconst client = new SessionContextClient(options.config);\n\tconst baseTransport = options.transport;\n\n\treturn {\n\t\tclient,\n\n\t\tasync fetchUserInfo(\n\t\t\tcontext: ServerRequestContext,\n\t\t): Promise<SessionInfo | null> {\n\t\t\t// Create a forwarding transport that injects the request headers.\n\t\t\tconst forwardingTransport: HttpTransport = {\n\t\t\t\tasync execute(request) {\n\t\t\t\t\treturn baseTransport.execute({\n\t\t\t\t\t\t...request,\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t...context.headers,\n\t\t\t\t\t\t\t...request.headers,\n\t\t\t\t\t\t},\n\t\t\t\t\t});\n\t\t\t\t},\n\t\t\t};\n\n\t\t\treturn client.fetchUserInfo(forwardingTransport);\n\t\t},\n\n\t\tloginUrl(postAuthRedirectUri?: string): string {\n\t\t\treturn client.loginUrl(postAuthRedirectUri);\n\t\t},\n\n\t\tlogoutUrl(): string {\n\t\t\treturn client.logoutUrl();\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+FA,SAAgB,0BACf,SACsB;CACtB,MAAM,SAAS,IAAI,qBAAqB,QAAQ,OAAO;CACvD,MAAM,gBAAgB,QAAQ;AAE9B,QAAO;EACN;EAEA,MAAM,cACL,SAC8B;AAc9B,UAAO,OAAO,cAZ6B,EAC1C,MAAM,QAAQ,SAAS;AACtB,WAAO,cAAc,QAAQ;KAC5B,GAAG;KACH,SAAS;MACR,GAAG,QAAQ;MACX,GAAG,QAAQ;MACX;KACD,CAAC;MAEH,CAE+C;;EAGjD,SAAS,qBAAsC;AAC9C,UAAO,OAAO,SAAS,oBAAoB;;EAG5C,YAAoB;AACnB,UAAO,OAAO,WAAW;;EAE1B"}

package/dist/web/index.d.mts

@@ -0,0 +1,32 @@
+import { t as SessionContextClient } from "../client-Dzfx3BXp.mjs";
+
+//#region src/web/index.d.ts
+/**
+ * Options for {@link loginWithRedirect}.
+ */
+interface LoginWithRedirectOptions {
+  /**
+   * Where to redirect the user after successful authentication.
+   *
+   * When omitted, `window.location.href` is used as the return URI and
+   * persisted via the client's pending-login-redirect store for post-auth
+   * consumption.
+   */
+  postAuthRedirectUri?: string;
+}
+/**
+ * One-shot browser redirect to the session login endpoint.
+ *
+ * 1. Saves the post-auth redirect intent into the client's pending store
+ *    (when a session store is configured).
+ * 2. Navigates the current window to the login URL.
+ *
+ * This is the recommended browser entry point for initiating session-based
+ * login.  It is intentionally a standalone function (not a method on
+ * `SessionContextClient`) to keep browser-specific side-effects out of the
+ * host-neutral client contract.
+ */
+declare function loginWithRedirect(client: SessionContextClient, options?: LoginWithRedirectOptions): Promise<void>;
+//#endregion
+export { LoginWithRedirectOptions, loginWithRedirect };
+//# sourceMappingURL=index.d.mts.map

package/dist/web/index.mjs

@@ -0,0 +1,22 @@
+//#region src/web/index.ts
+/**
+* One-shot browser redirect to the session login endpoint.
+*
+* 1. Saves the post-auth redirect intent into the client's pending store
+*    (when a session store is configured).
+* 2. Navigates the current window to the login URL.
+*
+* This is the recommended browser entry point for initiating session-based
+* login.  It is intentionally a standalone function (not a method on
+* `SessionContextClient`) to keep browser-specific side-effects out of the
+* host-neutral client contract.
+*/
+async function loginWithRedirect(client, options = {}) {
+	const postAuthRedirectUri = options.postAuthRedirectUri ?? window.location.href;
+	await client.savePendingLoginRedirect(postAuthRedirectUri);
+	window.location.href = client.loginUrl(postAuthRedirectUri);
+}
+//#endregion
+export { loginWithRedirect };
+
+//# sourceMappingURL=index.mjs.map

package/dist/web/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/web/index.ts"],"sourcesContent":["// Session Context Client — Browser Adapter\n//\n// Canonical import path:\n//   import { loginWithRedirect } from \"@securitydept/session-context-client/web\"\n//\n// Provides browser-specific convenience helpers that trigger full-page\n// navigation (redirect) for session-based authentication.  The root\n// `SessionContextClient` stays host-neutral; this subpath owns the\n// browser side-effect layer.\n//\n// Stability: provisional\n\nimport type { SessionContextClient } from \"../client\";\n\n/**\n * Options for {@link loginWithRedirect}.\n */\nexport interface LoginWithRedirectOptions {\n\t/**\n\t * Where to redirect the user after successful authentication.\n\t *\n\t * When omitted, `window.location.href` is used as the return URI and\n\t * persisted via the client's pending-login-redirect store for post-auth\n\t * consumption.\n\t */\n\tpostAuthRedirectUri?: string;\n}\n\n/**\n * One-shot browser redirect to the session login endpoint.\n *\n * 1. Saves the post-auth redirect intent into the client's pending store\n *    (when a session store is configured).\n * 2. Navigates the current window to the login URL.\n *\n * This is the recommended browser entry point for initiating session-based\n * login.  It is intentionally a standalone function (not a method on\n * `SessionContextClient`) to keep browser-specific side-effects out of the\n * host-neutral client contract.\n */\nexport async function loginWithRedirect(\n\tclient: SessionContextClient,\n\toptions: LoginWithRedirectOptions = {},\n): Promise<void> {\n\tconst postAuthRedirectUri =\n\t\toptions.postAuthRedirectUri ?? window.location.href;\n\n\tawait client.savePendingLoginRedirect(postAuthRedirectUri);\n\n\twindow.location.href = client.loginUrl(postAuthRedirectUri);\n}\n"],"mappings":";;;;;;;;;;;;;AAwCA,eAAsB,kBACrB,QACA,UAAoC,EAAE,EACtB;CAChB,MAAM,sBACL,QAAQ,uBAAuB,OAAO,SAAS;AAEhD,OAAM,OAAO,yBAAyB,oBAAoB;AAE1D,QAAO,SAAS,OAAO,OAAO,SAAS,oBAAoB"}

package/package.json

@@ -0,0 +1,33 @@
+{
+	"name": "@securitydept/session-context-client",
+	"version": "0.2.0-beta.1",
+	"type": "module",
+	"sideEffects": false,
+	"exports": {
+		".": {
+			"monorepo-tsc": "./src/index.ts",
+			"types": "./dist/index.d.mts",
+			"import": "./dist/index.mjs"
+		},
+		"./web": {
+			"monorepo-tsc": "./src/web/index.ts",
+			"types": "./dist/web/index.d.mts",
+			"import": "./dist/web/index.mjs"
+		},
+		"./server": {
+			"monorepo-tsc": "./src/server/index.ts",
+			"types": "./dist/server/index.d.mts",
+			"import": "./dist/server/index.mjs"
+		}
+	},
+	"files": [
+		"dist"
+	],
+	"scripts": {
+		"build": "tsdown",
+		"typecheck": "tsc -b"
+	},
+	"dependencies": {
+		"@securitydept/client": "workspace:*"
+	}
+}