@smartcrab/browser 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/base64url.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Local base64url (RFC 4648 §5, no padding) helpers.
+ *
+ * Duplicated intentionally from `@smartcrab/identifiers` rather than
+ * imported: that package is not a dependency of this SDK (only
+ * `@smartcrab/contracts-public` is), and adding it just for ~40 lines of
+ * alphabet math would widen the published dependency surface for no
+ * behavioral gain. Implementations are byte-for-byte compatible.
+ */
+export declare const base64UrlEncodeBytes: (bytes: Uint8Array) => string;
+export declare const base64UrlDecodeToBytes: (encoded: string) => Uint8Array;
+export declare const bufferToBase64Url: (buffer: ArrayBuffer) => string;

package/dist/base64url.js

@@ -0,0 +1,44 @@
+/**
+ * Local base64url (RFC 4648 §5, no padding) helpers.
+ *
+ * Duplicated intentionally from `@smartcrab/identifiers` rather than
+ * imported: that package is not a dependency of this SDK (only
+ * `@smartcrab/contracts-public` is), and adding it just for ~40 lines of
+ * alphabet math would widen the published dependency surface for no
+ * behavioral gain. Implementations are byte-for-byte compatible.
+ */
+const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+export const base64UrlEncodeBytes = (bytes) => {
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const b0 = bytes[i] ?? 0;
+        const b1 = bytes[i + 1];
+        const b2 = bytes[i + 2];
+        out += BASE64URL_ALPHABET[b0 >> 2] ?? "";
+        out += BASE64URL_ALPHABET[((b0 & 0x03) << 4) | ((b1 ?? 0) >> 4)] ?? "";
+        if (b1 !== undefined)
+            out += BASE64URL_ALPHABET[((b1 & 0x0f) << 2) | ((b2 ?? 0) >> 6)] ?? "";
+        if (b2 !== undefined)
+            out += BASE64URL_ALPHABET[b2 & 0x3f] ?? "";
+    }
+    return out;
+};
+export const base64UrlDecodeToBytes = (encoded) => {
+    const out = [];
+    let buffer = 0;
+    let bits = 0;
+    for (const char of encoded) {
+        const index = BASE64URL_ALPHABET.indexOf(char);
+        if (index < 0) {
+            throw new Error(`Invalid base64url character: ${char}`);
+        }
+        buffer = (buffer << 6) | index;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out.push((buffer >>> bits) & 0xff);
+        }
+    }
+    return new Uint8Array(out);
+};
+export const bufferToBase64Url = (buffer) => base64UrlEncodeBytes(new Uint8Array(buffer));

package/dist/client.d.ts

@@ -0,0 +1,192 @@
+import type { ClientId, EmailChallengeResponse, EmailResendRequest, EmailStartRequest, EmailVerifyRequest, EmailVerifyResponse, MeDeleteResponse, MeEmailChangeStartRequest, MeEmailChangeStartResponse, MeEmailChangeVerifyNewRequest, MeEmailChangeVerifyNewResponse, MeEmailChangeVerifyOldRequest, MeEmailChangeVerifyOldResponse, MeIdentitiesListResponse, MeIdentityLinkRequest, MeIdentityLinkResponse, MeIdentityUnlinkResponse, MePasskeyRegistrationOptionsResponse, MePasskeyRegistrationVerifyRequest, MePasskeyRegistrationVerifyResponse, MePasskeyDeleteResponse, MePasskeysListResponse, MeSessionRevokeResponse, MeSessionsListResponse, MeSessionsRevokeAllResponse, MeUpdateRequest, MeUpdateResponse, MeUser, PasskeyAuthenticationOptionsRequest, PasskeyAuthenticationOptionsResponse, PasskeyAuthenticationVerifyRequest, PasskeyAuthenticationVerifyResponse, PasskeyRegistrationOptionsResponse, PasskeyRegistrationVerifyRequest, PublicConfigResponse, SocialProvider, SocialStartResponse, TransactionCancelResponse, TransactionCompleteResponse, TransactionCreateResponse, TransactionGetResponse, TransactionPasskeyRegistrationVerifyResponse } from "@smartcrab/contracts-public";
+import type { Outcome } from "@smartcrab/contracts-public";
+import type { BrowserAuthError } from "./errors.js";
+import type { FetchPort } from "./http.js";
+import type { WebAuthnBrowserPort } from "./webauthn.js";
+/**
+ * `BrowserAuthClient` — the SPA-facing client for the public authentication
+ * API (design.md §16, §22.3).
+ *
+ * Security posture (design.md §22.3, §32.1/§32.2):
+ * - Authorization Code + PKCE S256; `state` and `nonce` are generated when not supplied.
+ * - Access and refresh tokens stay in memory by default; access tokens never enter Web Storage.
+ * - Short-lived PKCE callback metadata is stored in `sessionStorage` (never `localStorage`) so a
+ *   top-level redirect can resume after the SPA reloads. It is consumed once and expires after
+ *   10 minutes; when storage is unavailable, the current client falls back to its memory copy.
+ * - Refresh-token persistence is a separate explicit opt-in via `refreshTokenStorage`.
+ * - No silent-iframe / third-party-cookie renewal. After reload, reauthorize top-level via
+ *   `beginHostedAuthorization()` against the existing Hosted Session, or call `restoreSession()`
+ *   when opt-in refresh-token persistence is configured.
+ *
+ * Result channel: `@praha/byethrow` does not resolve from this package (not a
+ * declared dependency), so every fallible method returns the local
+ * `Outcome<T, BrowserAuthError>` discriminated union re-exported from
+ * `@smartcrab/contracts-public` instead of `Result`.
+ */
+/** Top-level navigation port (design.md §20.6/§22.3: external, top-level redirects only). */
+export interface RedirectPort {
+    assign(url: string): void;
+}
+/**
+ * OPT-IN refresh token persistence (design.md §22.3: "refresh tokenの永続保存
+ * は既定で無効").
+ *
+ * WARNING — think before enabling: anything written here survives page
+ * reloads and is readable by every script running on your origin, including
+ * any XSS payload. Prefer the default (memory-only) and re-authorize through
+ * the Hosted Session after reload. If you enable this, use the most
+ * constrained storage available to you (e.g. an encrypted, origin-isolated
+ * store), never plain `localStorage` on a hostile-script surface, and combine
+ * it with a strict CSP (design.md §32.2). The platform rotates refresh tokens
+ * on every use and detects replay (design.md §32.1), which limits — but does
+ * not eliminate — the blast radius of a stolen token.
+ */
+export interface RefreshTokenStoragePort {
+    load(): Promise<string | null> | string | null;
+    save(refreshToken: string): Promise<void> | void;
+    clear(): Promise<void> | void;
+}
+export interface BrowserAuthClientConfig {
+    /** Public API origin, e.g. `https://id.example.com` (trailing slash tolerated). */
+    readonly baseUrl: string;
+    readonly clientId: ClientId;
+    /** Must be byte-for-byte registered on the client (design.md §15.9). */
+    readonly redirectUri: string;
+    /** Space-delimited OIDC scopes; defaults to `openid profile email`. */
+    readonly scope?: string;
+    /** RFC 8707 resource indicators to bind to the grant (design.md §15.7). */
+    readonly resource?: readonly string[];
+    /**
+     * Issuer (`https://host/e/env_xxx`). Optional: discovered and cached from
+     * `GET /v1/config` on first token/authorize call when omitted.
+     */
+    readonly issuer?: string;
+    /** fetch override (tests, custom instrumentation). Defaults to global `fetch`. */
+    readonly fetch?: FetchPort;
+    /** WebAuthn ceremony port. Defaults to `navigator.credentials`. */
+    readonly webAuthn?: WebAuthnBrowserPort;
+    /** Top-level navigation port. Defaults to `window.location.assign`. */
+    readonly redirect?: RedirectPort;
+    /** OPT-IN refresh token persistence — read the security warning on the type. */
+    readonly refreshTokenStorage?: RefreshTokenStoragePort;
+    /** Clock override for tests (epoch ms). */
+    readonly now?: () => number;
+}
+/** A live auth transaction plus the client-generated `state` that correlates its completion. */
+export interface BrowserTransaction {
+    readonly transactionId: string;
+    readonly state: string;
+    readonly expiresAt: string;
+    readonly availableMethods: TransactionCreateResponse["available_methods"];
+}
+export interface CreateTransactionInput {
+    readonly scope?: string;
+    readonly resource?: readonly string[];
+    /** App-supplied correlation value; the SDK generates one when omitted. */
+    readonly state?: string;
+    readonly nonce?: string;
+}
+/** Session metadata. Note: the access token itself is only ever handed out by `getAccessToken()`. */
+export interface AuthenticatedSession {
+    /** Epoch ms when the in-memory access token expires. */
+    readonly accessTokenExpiresAt: number;
+    readonly scope: string;
+    readonly hasRefreshToken: boolean;
+}
+/** Auth state snapshot for `subscribe`/`getSnapshot` (React bindings consume this). */
+export interface BrowserAuthSnapshot {
+    readonly status: "signed_out" | "signed_in";
+    readonly accessTokenExpiresAt?: number;
+    readonly scope?: string;
+    readonly hasRefreshToken: boolean;
+}
+export type BrowserAuthListener = (snapshot: BrowserAuthSnapshot) => void;
+export interface HostedAuthorization {
+    readonly url: string;
+    readonly state: string;
+}
+export interface BrowserAuthClient {
+    /** `GET /v1/config` (design.md §16.2), schema-validated. */
+    getPublicConfig(): Promise<Outcome<PublicConfigResponse, BrowserAuthError>>;
+    createTransaction(input?: CreateTransactionInput): Promise<Outcome<BrowserTransaction, BrowserAuthError>>;
+    getTransaction(transactionId: string): Promise<Outcome<TransactionGetResponse, BrowserAuthError>>;
+    cancelTransaction(transactionId: string): Promise<Outcome<TransactionCancelResponse, BrowserAuthError>>;
+    startEmailOtp(transactionId: string, input: EmailStartRequest): Promise<Outcome<EmailChallengeResponse, BrowserAuthError>>;
+    resendEmailOtp(transactionId: string, input: EmailResendRequest): Promise<Outcome<EmailChallengeResponse, BrowserAuthError>>;
+    verifyEmailOtp(transactionId: string, input: EmailVerifyRequest): Promise<Outcome<EmailVerifyResponse, BrowserAuthError>>;
+    getPasskeyRegistrationOptions(transactionId: string): Promise<Outcome<PasskeyRegistrationOptionsResponse, BrowserAuthError>>;
+    verifyPasskeyRegistration(transactionId: string, input: PasskeyRegistrationVerifyRequest): Promise<Outcome<TransactionPasskeyRegistrationVerifyResponse, BrowserAuthError>>;
+    /** Full registration ceremony: options → authenticator → verify. */
+    startPasskeyRegistration(transactionId: string, input?: {
+        readonly name?: string;
+    }): Promise<Outcome<TransactionPasskeyRegistrationVerifyResponse, BrowserAuthError>>;
+    getPasskeyAuthenticationOptions(transactionId: string, input?: PasskeyAuthenticationOptionsRequest): Promise<Outcome<PasskeyAuthenticationOptionsResponse, BrowserAuthError>>;
+    verifyPasskeyAuthentication(transactionId: string, input: PasskeyAuthenticationVerifyRequest): Promise<Outcome<PasskeyAuthenticationVerifyResponse, BrowserAuthError>>;
+    /** Full authentication ceremony (discoverable-credential default, design.md §17.2). */
+    startPasskeyAuthentication(transactionId: string, input?: PasskeyAuthenticationOptionsRequest): Promise<Outcome<PasskeyAuthenticationVerifyResponse, BrowserAuthError>>;
+    /**
+     * Starts social sign-in and performs a TOP-LEVEL redirect to the returned
+     * `authorization_url` (embedded iframes/WebViews are never used). The
+     * provider callback eventually lands on `redirectUri`; resume with
+     * `handleHostedAuthorizationCallback`.
+     */
+    startSocialSignIn(transactionId: string, provider: SocialProvider): Promise<Outcome<SocialStartResponse, BrowserAuthError>>;
+    completeTransaction(transactionId: string): Promise<Outcome<TransactionCompleteResponse, BrowserAuthError>>;
+    /**
+     * Exchanges a one-time authorization code at the token endpoint using the
+     * PKCE verifier registered under `state`. Fails with `state_mismatch` when
+     * the state is unknown or expired.
+     */
+    exchangeAuthorizationCode(input: {
+        readonly code: string;
+        readonly state: string;
+    }): Promise<Outcome<AuthenticatedSession, BrowserAuthError>>;
+    /** Builds `{issuer}/oauth2/authorize` with fresh PKCE/state/nonce (design.md §15.1). */
+    createHostedAuthorizationUrl(): Promise<Outcome<HostedAuthorization, BrowserAuthError>>;
+    /** Same as `createHostedAuthorizationUrl` plus a top-level navigation. */
+    beginHostedAuthorization(): Promise<Outcome<{
+        readonly state: string;
+    }, BrowserAuthError>>;
+    /** Parses the authorize/social callback URL and exchanges the code it carries. */
+    handleHostedAuthorizationCallback(callbackUrl: string): Promise<Outcome<AuthenticatedSession, BrowserAuthError>>;
+    getSnapshot(): BrowserAuthSnapshot;
+    subscribe(listener: BrowserAuthListener): () => void;
+    /** Runtime WebAuthn capability (design.md §21.2: UI must hide passkeys when false). */
+    isPasskeySupported(): boolean;
+    /** Current access token; silently refreshes first when expired and a refresh token exists. */
+    getAccessToken(): Promise<Outcome<string, BrowserAuthError>>;
+    /** Explicit refresh. Concurrent calls share one in-flight request (design.md §21.7). */
+    refreshSession(): Promise<Outcome<AuthenticatedSession, BrowserAuthError>>;
+    /**
+     * Reload recovery for the OPT-IN persistence path: loads the persisted
+     * refresh token and immediately rotates it into a fresh in-memory session.
+     * Without `refreshTokenStorage` (or an empty store) this resolves to
+     * `not_authenticated` and the app should start a fresh authorization.
+     */
+    restoreSession(): Promise<Outcome<AuthenticatedSession, BrowserAuthError>>;
+    /** Best-effort refresh-token revocation, then full local cleanup. */
+    signOut(): Promise<Outcome<{
+        readonly signedOut: true;
+    }, BrowserAuthError>>;
+    getMe(): Promise<Outcome<MeUser, BrowserAuthError>>;
+    updateMe(input: MeUpdateRequest): Promise<Outcome<MeUpdateResponse, BrowserAuthError>>;
+    listMyPasskeys(): Promise<Outcome<MePasskeysListResponse, BrowserAuthError>>;
+    getMyPasskeyRegistrationOptions(): Promise<Outcome<MePasskeyRegistrationOptionsResponse, BrowserAuthError>>;
+    verifyMyPasskeyRegistration(input: MePasskeyRegistrationVerifyRequest): Promise<Outcome<MePasskeyRegistrationVerifyResponse, BrowserAuthError>>;
+    /** Full me-scoped registration ceremony: options → authenticator → verify. */
+    registerMyPasskey(input?: {
+        readonly name?: string;
+    }): Promise<Outcome<MePasskeyRegistrationVerifyResponse, BrowserAuthError>>;
+    deleteMyPasskey(passkeyId: string): Promise<Outcome<MePasskeyDeleteResponse, BrowserAuthError>>;
+    listMyIdentities(): Promise<Outcome<MeIdentitiesListResponse, BrowserAuthError>>;
+    linkMyIdentity(provider: SocialProvider, input: MeIdentityLinkRequest): Promise<Outcome<MeIdentityLinkResponse, BrowserAuthError>>;
+    unlinkMyIdentity(identityId: string): Promise<Outcome<MeIdentityUnlinkResponse, BrowserAuthError>>;
+    listMySessions(): Promise<Outcome<MeSessionsListResponse, BrowserAuthError>>;
+    revokeMySession(sessionId: string): Promise<Outcome<MeSessionRevokeResponse, BrowserAuthError>>;
+    revokeAllMySessions(): Promise<Outcome<MeSessionsRevokeAllResponse, BrowserAuthError>>;
+    startMyEmailChange(input: MeEmailChangeStartRequest): Promise<Outcome<MeEmailChangeStartResponse, BrowserAuthError>>;
+    verifyMyEmailChangeOld(input: MeEmailChangeVerifyOldRequest): Promise<Outcome<MeEmailChangeVerifyOldResponse, BrowserAuthError>>;
+    verifyMyEmailChangeNew(input: MeEmailChangeVerifyNewRequest): Promise<Outcome<MeEmailChangeVerifyNewResponse, BrowserAuthError>>;
+    deleteMyAccount(): Promise<Outcome<MeDeleteResponse, BrowserAuthError>>;
+}
+export declare const createBrowserAuthClient: (config: BrowserAuthClientConfig) => BrowserAuthClient;