@strivacity/sdk-core 3.0.2 → 4.0.0-beta.0

package/dist/utils/oidc.d.ts

@@ -0,0 +1,264 @@
+import { ExtraRequestArgs, IdTokenClaims, DiscoveryDocument, SDKOptions, SessionData, EntryResponse, FlowState } from '../types/oidc';
+import { NativeFlowState } from '../types/native';
+/**
+ * Returns the default flow state for the SDK.
+ *
+ * @returns {FlowState} The default flow state object.
+ */
+export declare function getDefaultFlowState(): FlowState;
+/**
+ * Returns the default SDK options for the SDK.
+ */
+export declare const defaultOptions: Partial<SDKOptions>;
+/**
+ * Fetches the OpenID configuration discovery document from the authorization server.
+ * Caches the document for a specified duration to avoid unnecessary network requests.
+ *
+ * @param {SDKOptions} options - The SDK options containing the issuer URL and other configurations.
+ * @returns {Promise<DiscoveryDocument>} A promise that resolves to the fetched discovery document.
+ * @throws {ServerError} If the discovery document fetch fails with a server error (HTTP 429 or 5xx).
+ * @throws {ProtocolError} If the discovery document is missing required fields or has an issuer mismatch.
+ */
+export declare function getDiscoveryDocument(options: SDKOptions): Promise<DiscoveryDocument>;
+/**
+ * Returns with the SDK options merged with the provided options.
+ *
+ * @param {SDKInitConfig} options - The SDK initialization configuration.
+ * @template InitOptions - The type of the SDK initialization configuration.
+ * @template Options - The type of the SDK options.
+ * @returns {Options} The merged SDK options.
+ */
+export declare function getSDKOptions<Options extends SDKOptions = SDKOptions>(options: any): Options;
+/**
+ * Generates a code verifier for PKCE (Proof Key for Code Exchange).
+ *
+ * @returns {string} A randomly generated code verifier string.
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generates a code challenge from a code verifier using SHA-256 hashing.
+ *
+ * @param {string} codeVerifier The code verifier string.
+ * @returns {Promise<string>} A promise that resolves to the generated code challenge.
+ */
+export declare function generateCodeChallenge(codeVerifier: string): Promise<string>;
+/**
+ * Generates a random hexadecimal string of the specified byte length.
+ *
+ * @param {number} [byteLength=16] - The number of random bytes to generate (default is 16).
+ * @returns {string} A randomly generated hexadecimal string.
+ */
+export declare function generateRandomHex(byteLength?: number): string;
+/**
+ * Decodes a JWT token and returns the payload as an object.
+ *
+ * @template T The expected structure of the JWT payload.
+ * @param {string} token - The JWT token to decode.
+ * @returns {T} The decoded payload of the JWT token.
+ * @throws {ProtocolError} If the token is invalid or has the wrong format.
+ */
+export declare function decodeJwt<T = Record<string, unknown>>(token: string): T;
+/**
+ * Verifies a JWT token's signature against a JWKS endpoint.
+ * Only RS256 is supported.
+ *
+ * @param {Object} options - The options for verifying the JWT.
+ * @param {string} options.token - The JWT token to verify.
+ * @param {string} options.jwksUri - The URL of the JWKS endpoint.
+ * @param {SDKOptions} options.options - The SDK options containing client ID, storage, and other options.
+ * @template T - The expected structure of the JWT payload.
+ * @returns {Promise<T>} The verified payload.
+ * @throws {ProtocolError} If the token is invalid, the key is not found, or verification fails.
+ */
+export declare function verifyJwt<T = Record<string, unknown>>({ token, jwksUri, options }: {
+    token: string;
+    jwksUri: string;
+    options: SDKOptions;
+}): Promise<T>;
+/**
+ * Generates a signed JWT token using the provided header, payload, and private key.
+ *
+ * @param {object} header - The JWT header.
+ * @param {object} payload - The JWT payload.
+ * @param {CryptoKey} [privateKey] - The private key to sign the JWT. If not provided, an unsigned token will be generated.
+ * @returns {Promise<string>} A promise that resolves to the signed JWT token.
+ */
+export declare function generateJwt(header: object, payload: object, privateKey?: CryptoKey): Promise<string>;
+/**
+ * Verifies and validates an ID token's claims.
+ *
+ * @param {Object} options - The options for verifying the ID token
+ * @param {string} options.idToken - The ID token to verify
+ * @param {SDKOptions} options.options - The SDK options containing client ID, storage, and other options
+ * @param {string} [options.expectedSub] - Optional expected subject (`sub`) claim to validate against the ID token
+ * @param {string} [options.expectedNonce] - Optional expected nonce claim to validate against the ID token
+ * @returns {Promise<IdTokenClaims>} The verified, validated claims.
+ * @throws {ProtocolError} If the signature, `iss`, `aud`, `exp`, or `sub` fail validation.
+ */
+export declare function verifyIdToken({ idToken, options, verifySignature, expectedSub, expectedNonce, }: {
+    idToken: string;
+    options: SDKOptions;
+    verifySignature?: boolean;
+    expectedSub?: string;
+    expectedNonce?: string;
+}): Promise<IdTokenClaims>;
+/**
+ * Builds the authorization URL with the provided parameters and configuration.
+ *
+ * @param {Object} options - The options for building the login URL and starting the session
+ * @param {ExtraRequestArgs} options.params - The parameters for the authorization request, including optional prompts and hints
+ * @param {SDKOptions} options.options - The SDK options containing client ID, redirect URI, storage, and other options
+ * @returns {Promise<URL>} A promise that resolves to the constructed authorization URL
+ * @throws {Error} If fetching OIDC metadata fails or writing the PKCE state to storage fails.
+ */
+export declare function buildAuthorizationUrl<URLHandlerParams extends ExtraRequestArgs = ExtraRequestArgs>({ url, includeOAuthParams, persistState, params, options, }: {
+    url?: string | null | URL;
+    includeOAuthParams?: boolean;
+    persistState?: boolean;
+    params: URLHandlerParams;
+    options: SDKOptions;
+}): Promise<URL>;
+/**
+ * Builds the end session (logout) URL with optional parameters for ID token hint and post-logout redirect URI.
+ *
+ * @param {Object} options - The options for building the end session URL
+ * @param {string | URL} options.url - The base URL for the end session endpoint
+ * @param {string} options.idToken - The ID token to include as a hint for the end session request
+ * @param {string} [options.postLogoutRedirectUri] - Optional URI to redirect to after logout
+ * @returns {URL} A promise that resolves to the constructed end session URL
+ * @throws {Error} If fetching metadata fails or the end session endpoint is not available
+ */
+export declare function buildEndSessionUrl({ url, idToken, postLogoutRedirectUri }: {
+    url: string | URL;
+    idToken: string;
+    postLogoutRedirectUri?: string;
+}): URL;
+/**
+ * Exchanges an authorization code for tokens by sending a request to the token endpoint.
+ * Validates the PKCE state and ID token claims, and returns the session data.
+ *
+ * @param {Object} options - The options for exchanging the authorization code
+ * @param {string | URL} [options.url] - The token endpoint URL (optional, will be fetched from metadata if not provided)
+ * @param {Record<string, string>} options.params - The parameters received from the authorization server, including the authorization code and state
+ * @param {SDKOptions} options.options - The SDK options containing client ID, redirect URI, storage, and other options
+ * @returns {Promise<SessionData>} A promise that resolves to the session data containing tokens and claims
+ * @throws {OidcError} If the token endpoint returns an OIDC error response
+ * @throws {ServerError} If the token endpoint request fails with a server error (HTTP 429 or 5xx)
+ * @throws {NetworkError} If the token endpoint request fails due to network issues
+ * @throws {ProtocolError} If the authorization code or state is invalid, or if the token endpoint returns an error
+ * @throws {ProtocolError} If the authorization code or state is invalid, or if the token endpoint returns an error
+ */
+export declare function exchangeCode({ url, params, options, }: {
+    url?: string | URL;
+    params: Record<string, string>;
+    options: SDKOptions;
+}): Promise<SessionData>;
+/**
+ * Refreshes the access token using the stored refresh token and persists the updated session.
+ *
+ * @param {Object} options - The options for refreshing the access token
+ * @param {string} options.url - The token endpoint URL
+ * @param {string} options.refreshToken - The refresh token to use for refreshing the access token
+ * @param {SDKOptions} options.options - The SDK options containing client ID, storage, and other options
+ * @param {string} [options.grantType='refresh_token'] - The grant type to use for the token refresh request (default is 'refresh_token')
+ * @param {string} [options.clientId] - Optional client ID to override the default client ID in the SDK options
+ * @param {string} [options.audience] - Optional audience to include in the token refresh request
+ * @param {string} [options.scope] - Optional scope to include in the token refresh request
+ * @returns {Promise<SessionData>} A promise that resolves to the updated session data with refreshed tokens
+ * @throws {ServerError} If the token refresh request fails with a server error (HTTP 429 or 5xx)
+ * @throws {NetworkError} If the token refresh request fails due to network issues
+ * @throws {OidcError} If the token refresh request returns an OIDC error response
+ * @throws {ProtocolError} If the token refresh request returns an error or the ID token claims are invalid
+ */
+export declare function refreshToken({ url, refreshToken, options, grantType, clientId, audience, scope, expectedSub, }: {
+    url?: string | URL;
+    refreshToken: string;
+    options: SDKOptions;
+    grantType?: string;
+    clientId?: string;
+    audience?: string;
+    scope?: string;
+    expectedSub?: string;
+}): Promise<SessionData>;
+/**
+ * Revokes the best available token (refresh token preferred, then access token) and removes the session from storage.
+ *
+ * @param {Object} options - The options for revoking the token
+ * @param {string | URL} options.url - The revocation endpoint URL
+ * @param {string} options.tokenTypeHint - The type of token to revoke ('refresh_token' or 'access_token')
+ * @param {string} options.token - The token to revoke
+ * @param {SDKOptions} options.options - The SDK options containing client ID, storage, and other options
+ * @param {string} [options.clientId] - Optional client ID to override the default client ID in the SDK options
+ * @returns {Promise<void>} A promise that resolves when the token is revoked and the session is cleared from storage
+ * @throws {ServerError} If the token revocation request fails with a server error (HTTP 429 or 5xx)
+ * @throws {ProtocolError} If the token revocation request returns an error or the ID token claims are invalid
+ */
+export declare function revokeToken({ url, tokenTypeHint, token, options, clientId, }: {
+    url?: string | URL;
+    tokenTypeHint: string;
+    token: string;
+    options: SDKOptions;
+    clientId?: string;
+}): Promise<void>;
+/**
+ * Fetches the entry flow from the specified URL with the provided parameters and SDK options.
+ *
+ * @param {Object} options
+ * @param {string | URL} options.url - The URL to request the entry flow from
+ * @param {URLSearchParams} options.params - The parameters to include in the entry request
+ * @param {SDKOptions} options.options - The SDK options containing client ID, redirect URI, storage, and other options
+ * @param {string} [options.clientId] - Optional client ID to override the default client ID in the SDK options
+ * @param {string} [options.redirectUri] - Optional redirect URI to override the default redirect URI in the SDK options
+ * @param {string} [options.sdkMode='web'] - Optional SDK mode to include in the entry request (default is 'web')
+ * @returns {Promise<EntryResponse>} A promise resolving to the entry result.
+ * @throws {OidcError} If the entry request returns an OIDC error response.
+ * @throws {ServerError} If the entry request fails with a server error (HTTP 429 or 5xx).
+ * @throws {ProtocolError} If the entry request fails with a protocol error or missing required fields.
+ */
+export declare function fetchFlowEntry({ url, params, options, clientId, redirectUri, sdkMode, }: {
+    url: string | URL;
+    params: URLSearchParams;
+    options: SDKOptions;
+    clientId?: string;
+    redirectUri?: string;
+    sdkMode?: string;
+}): Promise<EntryResponse>;
+/**
+ * Finalizes the login session using the provided url.
+ *
+ * @param {Object} options - The options for finalizing the session
+ * @param {string | URL} options.url - The URL to finalize the session.
+ * @param {string} options.sessionId - The session ID to finalize the session with.
+ * @param {string} options.language - The language to use for the session.
+ * @param {SDKOptions} options.options - The SDK options containing client ID, redirect URI, storage, and other options.
+ * @returns {Promise<URL>} A promise that resolves to the redirect URL after finalizing the session.
+ * @throws {ServerError} If the request to finalize the session fails with a server error (HTTP 429 or 5xx).
+ * @throws {ProtocolError} If the response from the server is invalid or does not contain a valid redirect URI.
+ */
+export declare function finalizeLoginSession({ url, sessionId, language, options, }: {
+    url: string | URL;
+    sessionId: string;
+    language: string;
+    options: SDKOptions;
+}): Promise<URL>;
+/**
+ * Submits a login form to the authentication server.
+ *
+ * @param {Object} options - The options for submitting the form.
+ * @param {string} [options.formId] - The ID of the form to submit. If not provided, the init endpoint is used.
+ * @param {Record<string, unknown>} [options.body] - The form data to include in the request body.
+ * @param {string} options.sessionId - The session ID for the current authentication session.
+ * @param {string} options.language - The language preference sent in the `Accept-language` header.
+ * @param {SDKOptions} options.options - The SDK options.
+ * @returns {Promise<NativeFlowState>} A promise that resolves to the current login flow state.
+ * @throws {ServerError} If the server returns a non-recoverable HTTP error.
+ * @throws {FallbackError} If the server indicates the flow should fall back to the hosted UI.
+ * @throws {SessionExpiredError} If the session has expired (HTTP 403).
+ */
+export declare function submitLoginForm({ formId, body, sessionId, language, options, }: {
+    formId?: string;
+    body?: Record<string, unknown>;
+    sessionId: string;
+    language: string;
+    options: SDKOptions;
+}): Promise<NativeFlowState>;

package/dist/utils/oidc.mjs

@@ -0,0 +1 @@
+import{_ as e,a as t,c as n,d as r,f as i,g as a,h as o,i as s,l as c,m as l,n as u,o as d,p as f,r as p,s as m,t as h,u as g,v as _,y as v}from"../assets/oidc.mjs";export{h as buildAuthorizationUrl,u as buildEndSessionUrl,p as decodeJwt,s as defaultOptions,t as exchangeCode,d as fetchFlowEntry,m as finalizeLoginSession,n as generateCodeChallenge,c as generateCodeVerifier,g as generateJwt,r as generateRandomHex,i as getDefaultFlowState,f as getDiscoveryDocument,l as getSDKOptions,o as refreshToken,a as revokeToken,e as submitLoginForm,_ as verifyIdToken,v as verifyJwt};

package/dist/utils/server.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../assets/server.cjs");exports.BACKCHANNEL_LOGOUT_EVENT=e.t,exports.DEFAULT_COOKIE_MAX_AGE=e.n,exports.DISALLOWED_PROXY_HEADERS=e.r,exports.RETURN_TO_COOKIE=e.i,exports.flushSetCookies=e.a,exports.getServerSDKOptions=e.o,exports.parseCookieHeader=e.s,exports.proxyResponse=e.c,exports.pushSetCookie=e.l,exports.serializeCookie=e.u,exports.toSafeRedirect=e.d;

package/dist/utils/server.d.ts

@@ -0,0 +1,72 @@
+import { HttpClientResponse, SDKStorage, ServerCookieOptions, ServerAdapter, ServerSDKOptions, ServerStorage } from '../types';
+/**
+ * Disallowed headers that should not be proxied from the SDK to the client, as they may interfere with the response handling.
+ */
+export declare const DISALLOWED_PROXY_HEADERS: Set<string>;
+/**
+ * Returns with the returnTo cookie name used for storing the returnTo URL in the server SDK.
+ */
+export declare const RETURN_TO_COOKIE = "sty.returnTo";
+/**
+ * Backchannel logout event name used for identifying backchannel logout requests in the server SDK.
+ */
+export declare const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/**
+ * Default cookie max age in seconds (30 days).
+ */
+export declare const DEFAULT_COOKIE_MAX_AGE: number;
+/**
+ * Returns with the server SDK options merged with the provided options.
+ *
+ * @param {SDKInitConfig} options - The SDK initialization configuration.
+ * @template InitOptions - The type of the SDK initialization configuration.
+ * @template Options - The type of the SDK options.
+ * @returns {Options} The merged SDK options.
+ */
+export declare function getServerSDKOptions<TEvent = unknown, Storage extends ServerStorage<TEvent> = ServerStorage<TEvent>, StateStorage extends SDKStorage = SDKStorage>(adapter: ServerAdapter<TEvent>, options: any): ServerSDKOptions<TEvent, Storage, StateStorage>;
+/**
+ * Parses a `Cookie` request header into a plain name/value map.
+ *
+ * @param {string | null | undefined} header - The raw `Cookie` header value.
+ * @returns {Record<string, string>} The parsed cookies.
+ */
+export declare function parseCookieHeader(header: string | null | undefined): Record<string, string>;
+/**
+ * Serializes a name/value pair into a `Set-Cookie` header value.
+ *
+ * @param {string} name - The cookie name.
+ * @param {string} value - The cookie value.
+ * @param {ServerCookieOptions} [options] - The cookie attributes.
+ * @returns {string} The serialized `Set-Cookie` header value.
+ */
+export declare function serializeCookie(name: string, value: string, options?: ServerCookieOptions): string;
+/**
+ * Pushes a `Set-Cookie` header value into the cookie jar for the given event.
+ *
+ * @param {unknown} event - The framework-native request event.
+ * @param {string} header - The `Set-Cookie` header value to push.
+ */
+export declare function pushSetCookie(event: unknown, header: string): void;
+/**
+ * Flushes the accumulated `Set-Cookie` headers from the cookie jar into the provided `Response`.
+ *
+ * @param {unknown} event - The framework-native request event.
+ * @param {Response} response - The `Response` object to append the `Set-Cookie` headers to.
+ * @returns {Response} The modified `Response` with the appended `Set-Cookie` headers.
+ */
+export declare function flushSetCookies(event: unknown, response: Response): Response;
+/**
+ * Proxies an `HttpClientResponse` to a Web `Response`, preserving headers and status code.
+ *
+ * @param {HttpClientResponse<T>} response - The `HttpClientResponse` to proxy.
+ * @returns {Response} A `Response` object representing the proxied response.
+ */
+export declare function proxyResponse<T = unknown>(response: HttpClientResponse<T>): Response;
+/**
+ * Returns a safe absolute redirect URL only if it shares the same origin as `safeBaseUrl`, preventing open redirects.
+ *
+ * @param {string | undefined | null} dangerousRedirect - The untrusted redirect path or URL.
+ * @param {string} safeBaseUrl - The trusted base URL whose origin is used as the allowed origin.
+ * @returns {string | null} The resolved URL string if safe, or `null`.
+ */
+export declare function toSafeRedirect(dangerousRedirect: string | undefined | null, safeBaseUrl: string): string | null;

package/dist/utils/server.mjs

@@ -0,0 +1 @@
+import{a as e,c as t,d as n,i as r,l as i,n as a,o,r as s,s as c,t as l,u}from"../assets/server.mjs";export{l as BACKCHANNEL_LOGOUT_EVENT,a as DEFAULT_COOKIE_MAX_AGE,s as DISALLOWED_PROXY_HEADERS,r as RETURN_TO_COOKIE,e as flushSetCookies,o as getServerSDKOptions,c as parseCookieHeader,t as proxyResponse,i as pushSetCookie,u as serializeCookie,n as toSafeRedirect};

package/dist/utils/session.cjs

@@ -0,0 +1,2 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./errors.cjs"),t=require("./common.cjs");function n(n={}){let r={state:null,code:null,error:null,error_description:null,id_token:null,access_token:null,refresh_token:null,token_type:`bearer`,scope:null,expires_in:null,expires_at:null,claims:null};if(typeof n.expires_in==`number`&&!isNaN(n.expires_in)&&(r.expires_at=Math.floor(n.expires_in)+t.timestamp()),Object.assign(r,n),r.access_token&&r.token_type?.toLowerCase()!==`bearer`)throw new e.ProtocolError(`Unsupported token_type: ${r.token_type}`);return r}function r(e){if(!e)return null;let t=n();try{Object.assign(t,JSON.parse(e))}catch{t=null}return t}function i(e){return JSON.stringify(e)}function a(e){return!e?.access_token||!e.expires_at||e.expires_at<=t.timestamp()}exports.createSession=n,exports.isSessionExpired=a,exports.loadSession=r,exports.serializeSession=i;
+//# sourceMappingURL=session.cjs.map

package/dist/utils/session.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.cjs","names":[],"sources":["../../src/utils/session.ts"],"sourcesContent":["import type { SessionData } from '../types/oidc';\nimport { ProtocolError } from './errors';\nimport { timestamp } from './common';\n\n/**\n * Creates a new session object with default values and merges it with provided parameters.\n *\n * @param {Record<string, unknown>} params - Optional parameters to merge into the new session object.\n * @returns {SessionData} The newly created session object.\n */\nexport function createSession(params: Record<string, unknown> = {}): SessionData {\n\tconst session: SessionData = {\n\t\tstate: null,\n\t\tcode: null,\n\t\terror: null,\n\t\terror_description: null,\n\t\tid_token: null,\n\t\taccess_token: null,\n\t\trefresh_token: null,\n\t\ttoken_type: 'bearer',\n\t\tscope: null,\n\t\texpires_in: null,\n\t\texpires_at: null,\n\t\tclaims: null,\n\t};\n\n\tif (typeof params.expires_in === 'number' && !isNaN(params.expires_in)) {\n\t\tsession.expires_at = Math.floor(params.expires_in) + timestamp();\n\t}\n\n\tObject.assign(session, params);\n\n\tif (session.access_token && session.token_type?.toLowerCase() !== 'bearer') {\n\t\tthrow new ProtocolError(`Unsupported token_type: ${session.token_type}`);\n\t}\n\n\treturn session;\n}\n\n/**\n * Loads a serialized session from a JSON string.\n *\n * @param {string | null} serialized - The serialized session string to parse.\n * @returns {SessionData | null} The parsed session object, or null if parsing fails.\n */\nexport function loadSession(serialized: string | null): SessionData | null {\n\tif (!serialized) {\n\t\treturn null;\n\t}\n\n\tlet session: SessionData | null = createSession();\n\n\ttry {\n\t\tObject.assign(session, JSON.parse(serialized));\n\t} catch {\n\t\tsession = null;\n\t}\n\n\treturn session;\n}\n\n/**\n * Serializes a session object into a JSON string.\n *\n * @param {SessionData} session - The session object to serialize.\n * @returns {string} The serialized session string.\n */\nexport function serializeSession(session: SessionData): string {\n\treturn JSON.stringify(session);\n}\n\n/**\n * Checks if a session is expired based on its access token and expiration timestamp.\n *\n * @param {Partial<SessionData> | null} session - The session object to check for expiration.\n * @returns {boolean} True if the session is expired or invalid, false otherwise.\n */\nexport function isSessionExpired(session?: Partial<SessionData> | null): boolean {\n\treturn !session?.access_token || !session.expires_at || session.expires_at <= timestamp();\n}\n"],"mappings":"6HAUA,SAAgB,EAAc,EAAkC,CAAC,EAAgB,CAChF,IAAM,EAAuB,CAC5B,MAAO,KACP,KAAM,KACN,MAAO,KACP,kBAAmB,KACnB,SAAU,KACV,aAAc,KACd,cAAe,KACf,WAAY,SACZ,MAAO,KACP,WAAY,KACZ,WAAY,KACZ,OAAQ,IACT,EAQA,GANI,OAAO,EAAO,YAAe,UAAY,CAAC,MAAM,EAAO,UAAU,IACpE,EAAQ,WAAa,KAAK,MAAM,EAAO,UAAU,EAAI,EAAA,UAAU,GAGhE,OAAO,OAAO,EAAS,CAAM,EAEzB,EAAQ,cAAgB,EAAQ,YAAY,YAAY,IAAM,SACjE,MAAM,IAAI,EAAA,cAAc,2BAA2B,EAAQ,YAAY,EAGxE,OAAO,CACR,CAQA,SAAgB,EAAY,EAA+C,CAC1E,GAAI,CAAC,EACJ,OAAO,KAGR,IAAI,EAA8B,EAAc,EAEhD,GAAI,CACH,OAAO,OAAO,EAAS,KAAK,MAAM,CAAU,CAAC,CAC9C,MAAQ,CACP,EAAU,IACX,CAEA,OAAO,CACR,CAQA,SAAgB,EAAiB,EAA8B,CAC9D,OAAO,KAAK,UAAU,CAAO,CAC9B,CAQA,SAAgB,EAAiB,EAAgD,CAChF,MAAO,CAAC,GAAS,cAAgB,CAAC,EAAQ,YAAc,EAAQ,YAAc,EAAA,UAAU,CACzF"}

package/dist/utils/session.d.ts

@@ -0,0 +1,29 @@
+import { SessionData } from '../types/oidc';
+/**
+ * Creates a new session object with default values and merges it with provided parameters.
+ *
+ * @param {Record<string, unknown>} params - Optional parameters to merge into the new session object.
+ * @returns {SessionData} The newly created session object.
+ */
+export declare function createSession(params?: Record<string, unknown>): SessionData;
+/**
+ * Loads a serialized session from a JSON string.
+ *
+ * @param {string | null} serialized - The serialized session string to parse.
+ * @returns {SessionData | null} The parsed session object, or null if parsing fails.
+ */
+export declare function loadSession(serialized: string | null): SessionData | null;
+/**
+ * Serializes a session object into a JSON string.
+ *
+ * @param {SessionData} session - The session object to serialize.
+ * @returns {string} The serialized session string.
+ */
+export declare function serializeSession(session: SessionData): string;
+/**
+ * Checks if a session is expired based on its access token and expiration timestamp.
+ *
+ * @param {Partial<SessionData> | null} session - The session object to check for expiration.
+ * @returns {boolean} True if the session is expired or invalid, false otherwise.
+ */
+export declare function isSessionExpired(session?: Partial<SessionData> | null): boolean;

package/dist/utils/session.mjs

@@ -0,0 +1,2 @@
+import{ProtocolError as e}from"./errors.mjs";import{timestamp as t}from"./common.mjs";function n(n={}){let r={state:null,code:null,error:null,error_description:null,id_token:null,access_token:null,refresh_token:null,token_type:`bearer`,scope:null,expires_in:null,expires_at:null,claims:null};if(typeof n.expires_in==`number`&&!isNaN(n.expires_in)&&(r.expires_at=Math.floor(n.expires_in)+t()),Object.assign(r,n),r.access_token&&r.token_type?.toLowerCase()!==`bearer`)throw new e(`Unsupported token_type: ${r.token_type}`);return r}function r(e){if(!e)return null;let t=n();try{Object.assign(t,JSON.parse(e))}catch{t=null}return t}function i(e){return JSON.stringify(e)}function a(e){return!e?.access_token||!e.expires_at||e.expires_at<=t()}export{n as createSession,a as isSessionExpired,r as loadSession,i as serializeSession};
+//# sourceMappingURL=session.mjs.map

package/dist/utils/session.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.mjs","names":[],"sources":["../../src/utils/session.ts"],"sourcesContent":["import type { SessionData } from '../types/oidc';\nimport { ProtocolError } from './errors';\nimport { timestamp } from './common';\n\n/**\n * Creates a new session object with default values and merges it with provided parameters.\n *\n * @param {Record<string, unknown>} params - Optional parameters to merge into the new session object.\n * @returns {SessionData} The newly created session object.\n */\nexport function createSession(params: Record<string, unknown> = {}): SessionData {\n\tconst session: SessionData = {\n\t\tstate: null,\n\t\tcode: null,\n\t\terror: null,\n\t\terror_description: null,\n\t\tid_token: null,\n\t\taccess_token: null,\n\t\trefresh_token: null,\n\t\ttoken_type: 'bearer',\n\t\tscope: null,\n\t\texpires_in: null,\n\t\texpires_at: null,\n\t\tclaims: null,\n\t};\n\n\tif (typeof params.expires_in === 'number' && !isNaN(params.expires_in)) {\n\t\tsession.expires_at = Math.floor(params.expires_in) + timestamp();\n\t}\n\n\tObject.assign(session, params);\n\n\tif (session.access_token && session.token_type?.toLowerCase() !== 'bearer') {\n\t\tthrow new ProtocolError(`Unsupported token_type: ${session.token_type}`);\n\t}\n\n\treturn session;\n}\n\n/**\n * Loads a serialized session from a JSON string.\n *\n * @param {string | null} serialized - The serialized session string to parse.\n * @returns {SessionData | null} The parsed session object, or null if parsing fails.\n */\nexport function loadSession(serialized: string | null): SessionData | null {\n\tif (!serialized) {\n\t\treturn null;\n\t}\n\n\tlet session: SessionData | null = createSession();\n\n\ttry {\n\t\tObject.assign(session, JSON.parse(serialized));\n\t} catch {\n\t\tsession = null;\n\t}\n\n\treturn session;\n}\n\n/**\n * Serializes a session object into a JSON string.\n *\n * @param {SessionData} session - The session object to serialize.\n * @returns {string} The serialized session string.\n */\nexport function serializeSession(session: SessionData): string {\n\treturn JSON.stringify(session);\n}\n\n/**\n * Checks if a session is expired based on its access token and expiration timestamp.\n *\n * @param {Partial<SessionData> | null} session - The session object to check for expiration.\n * @returns {boolean} True if the session is expired or invalid, false otherwise.\n */\nexport function isSessionExpired(session?: Partial<SessionData> | null): boolean {\n\treturn !session?.access_token || !session.expires_at || session.expires_at <= timestamp();\n}\n"],"mappings":"sFAUA,SAAgB,EAAc,EAAkC,CAAC,EAAgB,CAChF,IAAM,EAAuB,CAC5B,MAAO,KACP,KAAM,KACN,MAAO,KACP,kBAAmB,KACnB,SAAU,KACV,aAAc,KACd,cAAe,KACf,WAAY,SACZ,MAAO,KACP,WAAY,KACZ,WAAY,KACZ,OAAQ,IACT,EAQA,GANI,OAAO,EAAO,YAAe,UAAY,CAAC,MAAM,EAAO,UAAU,IACpE,EAAQ,WAAa,KAAK,MAAM,EAAO,UAAU,EAAI,EAAU,GAGhE,OAAO,OAAO,EAAS,CAAM,EAEzB,EAAQ,cAAgB,EAAQ,YAAY,YAAY,IAAM,SACjE,MAAM,IAAI,EAAc,2BAA2B,EAAQ,YAAY,EAGxE,OAAO,CACR,CAQA,SAAgB,EAAY,EAA+C,CAC1E,GAAI,CAAC,EACJ,OAAO,KAGR,IAAI,EAA8B,EAAc,EAEhD,GAAI,CACH,OAAO,OAAO,EAAS,KAAK,MAAM,CAAU,CAAC,CAC9C,MAAQ,CACP,EAAU,IACX,CAEA,OAAO,CACR,CAQA,SAAgB,EAAiB,EAA8B,CAC9D,OAAO,KAAK,UAAU,CAAO,CAC9B,CAQA,SAAgB,EAAiB,EAAgD,CAChF,MAAO,CAAC,GAAS,cAAgB,CAAC,EAAQ,YAAc,EAAQ,YAAc,EAAU,CACzF"}

package/dist/utils/state.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../assets/oidc.cjs");exports.createState=e.b,exports.parseState=e.x,exports.serializeState=e.S;

package/dist/utils/state.d.ts

@@ -0,0 +1,23 @@
+import { StateData } from '../types/oidc';
+/**
+ * Creates a new state object for OAuth 2.0 authorization requests, including a code verifier and challenge for PKCE.
+ *
+ * @param {Record<string, unknown>} [metadata={}] Optional metadata to associate with the state.
+ * @returns {Promise<StateData>} A promise that resolves to the newly created state object.
+ */
+export declare function createState(metadata?: Record<string, unknown>): Promise<StateData>;
+/**
+ * Parses a serialized state string into a StateData object.
+ *
+ * @param {string} serialized - The serialized state string to parse.
+ * @returns {StateData} The parsed StateData object.
+ * @throws {Error} If the serialized string is invalid or cannot be parsed.
+ */
+export declare function parseState(serialized: string): StateData;
+/**
+ * Serializes a StateData object into a string for storage or transmission.
+ *
+ * @param {StateData} state - The StateData object to serialize.
+ * @returns {string} The serialized state string.
+ */
+export declare function serializeState(state: StateData): string;

package/dist/utils/state.mjs

@@ -0,0 +1 @@
+import{S as e,b as t,x as n}from"../assets/oidc.mjs";export{t as createState,n as parseState,e as serializeState};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strivacity/sdk-core",
-  "version": "3.0.2",
+  "version": "4.0.0-beta.0",
   "license": "MIT",
   "description": "Strivacity JavaScript SDK client",
   "author": "strivacity <opensource@strivacity.com>",
@@ -8,6 +8,7 @@
     "type": "git",
     "url": "https://github.com/Strivacity/sdk-js"
   },
+  "sideEffects": false,
   "main": "./dist/index.cjs",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -17,29 +18,77 @@
       "require": "./dist/index.cjs",
       "default": "./dist/index.mjs"
     },
+    "./flows": {
+      "types": "./dist/flows/index.d.ts",
+      "import": "./dist/flows/index.mjs",
+      "require": "./dist/flows/index.cjs",
+      "default": "./dist/flows/index.mjs"
+    },
     "./flows/*": {
       "types": "./dist/flows/*.d.ts",
       "import": "./dist/flows/*.mjs",
       "require": "./dist/flows/*.cjs",
       "default": "./dist/flows/*.mjs"
     },
+    "./handlers": {
+      "types": "./dist/handlers/index.d.ts",
+      "import": "./dist/handlers/index.mjs",
+      "require": "./dist/handlers/index.cjs",
+      "default": "./dist/handlers/index.mjs"
+    },
     "./handlers/*": {
       "types": "./dist/handlers/*.d.ts",
       "import": "./dist/handlers/*.mjs",
       "require": "./dist/handlers/*.cjs",
       "default": "./dist/handlers/*.mjs"
     },
+    "./storages": {
+      "types": "./dist/storages/index.d.ts",
+      "import": "./dist/storages/index.mjs",
+      "require": "./dist/storages/index.cjs",
+      "default": "./dist/storages/index.mjs"
+    },
     "./storages/*": {
       "types": "./dist/storages/*.d.ts",
       "import": "./dist/storages/*.mjs",
       "require": "./dist/storages/*.cjs",
       "default": "./dist/storages/*.mjs"
     },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.mjs",
+      "require": "./dist/server/index.cjs",
+      "default": "./dist/server/index.mjs"
+    },
+    "./server/*": {
+      "types": "./dist/server/*.d.ts",
+      "import": "./dist/server/*.mjs",
+      "require": "./dist/server/*.cjs",
+      "default": "./dist/server/*.mjs"
+    },
+    "./utils": {
+      "types": "./dist/utils/index.d.ts",
+      "import": "./dist/utils/index.mjs",
+      "require": "./dist/utils/index.cjs",
+      "default": "./dist/utils/index.mjs"
+    },
     "./utils/*": {
       "types": "./dist/utils/*.d.ts",
       "import": "./dist/utils/*.mjs",
       "require": "./dist/utils/*.cjs",
       "default": "./dist/utils/*.mjs"
+    },
+    "./types": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/types/index.mjs",
+      "require": "./dist/types/index.cjs",
+      "default": "./dist/types/index.mjs"
+    },
+    "./types/*": {
+      "types": "./dist/types/*.d.ts",
+      "import": "./dist/types/*.mjs",
+      "require": "./dist/types/*.cjs",
+      "default": "./dist/types/*.mjs"
     }
   },
   "typesVersions": {
@@ -50,6 +99,9 @@
       "storages/*": [
         "./dist/storages/*"
       ],
+      "server/*": [
+        "./dist/server/*"
+      ],
       "utils/*": [
         "./dist/utils/*"
       ]