@strivacity/sdk-core 3.0.3 → 4.0.0-beta.0

package/dist/types/native.d.ts

@@ -0,0 +1,385 @@
+import { EntryResponse, ExtraRequestArgs, SDK } from './oidc';
+export declare const WidgetTypeList: readonly [
+    'layout',
+    'submit',
+    'close',
+    'static',
+    'input',
+    'checkbox',
+    'password',
+    'select',
+    'multiSelect',
+    'passcode',
+    'date',
+    'phone',
+    'passkeyLogin',
+    'passkeyEnroll',
+    'webauthnLogin',
+    'webauthnEnroll'
+];
+export type WidgetType = (typeof WidgetTypeList)[number];
+export declare const SelectOptionTypeList: readonly ['item', 'group'];
+export type SelectOptionType = (typeof SelectOptionTypeList)[number];
+export type BrandingData = {
+    logoUrl: string | null;
+    brandName: string | null;
+    copyright: string | null;
+    privacyPolicyUrl: string | null;
+    siteTermsUrl: string | null;
+};
+export type CheckboxWidget = {
+    id: string;
+    type: 'checkbox';
+    label?: string;
+    readonly?: boolean;
+    value?: boolean;
+    render?: {
+        type: 'checkboxHidden' | 'checkboxShown';
+        labelType: 'text' | 'html';
+    };
+    validator?: {
+        required?: boolean;
+    };
+};
+export type DateWidget = {
+    id: string;
+    type: 'date';
+    label?: string;
+    readonly?: boolean;
+    value?: string;
+    render?: {
+        type: 'native' | 'fieldSet';
+    };
+    validator?: {
+        notBefore?: string;
+        notAfter?: string;
+        required?: boolean;
+    };
+};
+export type InputWidget = {
+    id: string;
+    type: 'input';
+    label?: string;
+    value?: string;
+    readonly?: boolean;
+    autocomplete?: string;
+    inputmode: any;
+    render?: {
+        autocompleteHint?: string;
+    };
+    validator?: {
+        required?: boolean;
+        minLength?: number;
+        maxLength?: number;
+        regex?: string;
+    };
+};
+export type PasscodeWidget = {
+    id: string;
+    type: 'passcode';
+    label?: string;
+    validator?: {
+        length?: number;
+    };
+};
+export type PasswordWidget = {
+    id: string;
+    type: 'password';
+    label?: string;
+    qualityIndicator?: boolean;
+    validator?: {
+        minLength?: number;
+        maxLength?: number;
+        maxNumericCharacterSequences?: number;
+        maxRepeatedCharacters?: number;
+        mustContain?: Array<'UPPERCASE' | 'LOWERCASE' | 'NUMERIC' | 'SPECIAL'>;
+        restrictedCharacters?: string;
+    };
+};
+export type PhoneWidget = {
+    id: string;
+    type: 'phone';
+    label?: string;
+    readonly?: boolean;
+    value?: string;
+    validator?: {
+        required?: boolean;
+    };
+};
+export type SelectWidgetOption = {
+    type: 'item';
+    label?: string;
+    value: string;
+};
+export type SelectWidgetOptionGroup = {
+    type: 'group';
+    label?: string;
+    options: Array<SelectWidgetOption>;
+};
+export type SelectWidget = {
+    id: string;
+    type: 'select';
+    label?: string;
+    readonly?: boolean;
+    value?: string;
+    render?: {
+        type: 'dropdown' | 'radio';
+    };
+    options: Array<SelectWidgetOptionGroup | SelectWidgetOption>;
+    validator?: {
+        required?: boolean;
+    };
+};
+export type MultiSelectWidget = {
+    id: string;
+    type: 'multiSelect';
+    label?: string;
+    readonly?: boolean;
+    value?: Array<string>;
+    options: Array<SelectWidgetOptionGroup | SelectWidgetOption>;
+    validator?: {
+        minSelectable?: number;
+        maxSelectable?: number;
+    };
+};
+export type StaticWidget = {
+    id: string;
+    type: 'static';
+    value: string;
+    render?: {
+        type: 'html' | 'text';
+    };
+};
+export type SubmitWidget = {
+    id: string;
+    type: 'submit';
+    label?: string;
+    render?: {
+        type: 'button' | 'link';
+        textColor?: string;
+        bgColor?: string;
+        hint?: {
+            icon?: string;
+            variant?: string;
+        };
+    };
+};
+export type CloseWidget = {
+    id: string;
+    type: 'close';
+    label?: string;
+    render?: {
+        type: 'button' | 'link';
+        textColor?: string;
+        bgColor?: string;
+        hint?: {
+            icon?: string;
+            variant?: string;
+        };
+    };
+};
+export type PasskeyLoginWidget = {
+    id: string;
+    type: 'passkeyLogin';
+    label?: string;
+    render?: {
+        type: 'button';
+        hint?: {
+            variant?: string;
+        };
+    };
+    assertionOptions: PublicKeyCredentialRequestOptionsJSON;
+};
+export type PasskeyEnrollWidget = {
+    id: string;
+    type: 'passkeyEnroll';
+    label?: string;
+    render?: {
+        type: 'button';
+        hint?: {
+            variant?: string;
+        };
+    };
+    enrollOptions: PublicKeyCredentialCreationOptionsJSON;
+};
+export type WebauthnLoginWidget = {
+    id: string;
+    type: 'webauthnLogin';
+    label?: string;
+    authenticatorType: 'deviceBiometrics' | 'securityKey';
+    render?: {
+        type: 'button';
+        hint?: {
+            variant?: string;
+        };
+    };
+    assertionOptions: PublicKeyCredentialRequestOptionsJSON;
+};
+export type WebauthnEnrollWidget = {
+    id: string;
+    type: 'webauthnEnroll';
+    label?: string;
+    authenticatorType: 'deviceBiometrics' | 'securityKey';
+    render?: {
+        type: 'button';
+        hint?: {
+            variant?: string;
+        };
+    };
+    enrollOptions: PublicKeyCredentialCreationOptionsJSON;
+};
+export type AnyWidget = CheckboxWidget | CloseWidget | DateWidget | InputWidget | MultiSelectWidget | PasscodeWidget | PasskeyEnrollWidget | PasskeyLoginWidget | PasswordWidget | PhoneWidget | SelectWidget | StaticWidget | SubmitWidget | WebauthnEnrollWidget | WebauthnLoginWidget;
+export type FormWidget = {
+    id: string;
+    type: 'form';
+    widgets: Array<AnyWidget>;
+};
+export type Widget = {
+    type: 'widget';
+    formId: string;
+    widgetId: string;
+};
+export type LayoutWidget = {
+    type: 'vertical' | 'horizontal';
+    items: Array<Widget | LayoutWidget>;
+};
+export type NativeFlowMessage = {
+    type: string;
+    text: string;
+};
+export type NativeFlowState = {
+    /**
+     * Fallback URL to the hosted login page, if the screen cannot be rendered natively.
+     */
+    hostedUrl?: string;
+    /**
+     * Present when the journey is complete. Pass to `finalizeSession()`.
+     */
+    finalizeUrl?: string;
+    /**
+     * Identifier of the current journey step (for example, `identification`, `registration`).
+     */
+    screen?: string;
+    /**
+     * Branding information for the current login flow.
+     */
+    branding?: BrandingData;
+    /**
+     * List of Form objects, each containing a `widgets` array.
+     */
+    forms?: Array<FormWidget>;
+    /**
+     * Layout descriptor defining the visual arrangement of widgets across forms.
+     */
+    layout?: LayoutWidget;
+    /**
+     * Error and informational messages for the current step, including a `global` message.
+     */
+    messages?: Record<string, Record<string, NativeFlowMessage>> & {
+        global?: NativeFlowMessage;
+    };
+};
+export type NativeParams = ExtraRequestArgs & {
+    /**
+     * The SDK type to use for the native login flow. This is typically set to 'web-minimal' for web-based applications.
+     */
+    sdk?: string;
+    /**
+     * The session ID of the current native login flow, or `null` if no session has been started.
+     */
+    sessionId?: string | null;
+    /**
+     * The language code used for the native login flow UI.
+     */
+    language?: string | null;
+};
+export type NativeLoginFlow = {
+    /**
+     * The session ID of the current native login flow, or `null` if no session has been started.
+     *
+     * @deprecated Use `sdk.sessionId` instead of accessing this via the login flow instance.
+     */
+    sessionId: string | null;
+    /**
+     * The short application ID associated with the current native login flow, or `null` if not yet available.
+     *
+     * @deprecated Use `sdk.shortAppId` instead of accessing this via the login flow instance.
+     */
+    shortAppId: string | null;
+    /**
+     * The language code used for the native login flow UI.
+     *
+     * @deprecated Use `sdk.language` instead of accessing this via the login flow instance.
+     */
+    language: string;
+    /**
+     * Starts the native login session with the given parameters.
+     *
+     * @deprecated Use `sdk.startSession()` instead of calling this via the login flow instance.
+     *
+     * @param {NativeParams} [params] - The parameters to use when starting the session.
+     * @returns {Promise<NativeFlowState | void>} A promise that resolves to the login flow state after starting the session, or void if the session is finalized.
+     */
+    startSession(params?: NativeParams): Promise<NativeFlowState | void>;
+    /**
+     * Finalizes the native login session by processing the callback URL.
+     *
+     * @deprecated Use `sdk.finalizeSession()` instead of calling this via the login flow instance.
+     *
+     * @param {string | URL} url - The callback URL returned after authentication.
+     * @returns {Promise<void>}
+     */
+    finalizeSession(url: string | URL): Promise<void>;
+    /**
+     * Submits a login form with the given form ID and body data.
+     *
+     * @deprecated Use `sdk.submitForm()` instead of calling this via the login flow instance.
+     *
+     * @param {string} [formId] - The ID of the form to submit.
+     * @param {Record<string, unknown>} [body] - The form field values to submit.
+     * @returns {Promise<NativeFlowState>} The resulting login flow state after submission.
+     */
+    submitForm(formId?: string, body?: Record<string, unknown>): Promise<NativeFlowState>;
+};
+export type NativeFlow = Omit<SDK<NativeParams, Promise<EntryResponse>>, 'login' | 'register'> & {
+    /**
+     * Starts the native authentication session with the given parameters.
+     *
+     * @param {NativeParams} [loginParams] - The parameters to use when starting the session.
+     * @returns {Promise<NativeFlowState | void>} A promise that resolves to the login flow state after starting the session, or void if the session is finalized.
+     */
+    startSession(loginParams?: NativeParams): Promise<NativeFlowState | void>;
+    /**
+     * Finalizes the native authentication session by processing the callback URL.
+     *
+     * @param {string | URL} url - The callback URL returned after authentication.
+     * @returns {Promise<void>}
+     */
+    finalizeSession(url: string | URL): Promise<void>;
+    /**
+     * Submits a login form with the given form ID and body data.
+     *
+     * @param {string} [formId] - The ID of the form to submit.
+     * @param {Record<string, unknown>} [body] - The form field values to submit.
+     * @returns {Promise<NativeFlowState>} The resulting login flow state after submission.
+     */
+    submitForm(formId?: string, body?: Record<string, unknown>): Promise<NativeFlowState>;
+    /**
+     * Initiates the native login flow and returns a `NativeLoginFlow` instance to drive the process.
+     *
+     * @deprecated Use `startSession` and `finalizeSession` directly instead.
+     *
+     * @param {NativeParams} [params] - Optional parameters for the login request.
+     * @returns {NativeLoginFlow} Native login flow instance to drive the process.
+     */
+    login(params?: NativeParams): NativeLoginFlow;
+    /**
+     * Initiates the native registration flow and returns a `NativeLoginFlow` instance to drive the process.
+     *
+     * @deprecated Use `startSession` and `finalizeSession` directly instead.
+     *
+     * @param {NativeParams} [params] - Optional parameters for the registration request.
+     * @returns {NativeLoginFlow} Native login flow instance to drive the process.
+     */
+    register(params?: NativeParams): NativeLoginFlow;
+};

package/dist/types/oidc.cjs

@@ -0,0 +1,2 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=[`code`],t=[`query`,`fragment`],n=[`none`],r=[`authorization_code`,`refresh_token`],i=[`RS256`],a=[`public`];exports.AlgorithmTypeList=i,exports.GrantTypeList=r,exports.ResponseModeList=t,exports.ResponseTypeList=e,exports.SubjectTypeList=a,exports.TokenEndpointAuthMethodList=n;
+//# sourceMappingURL=oidc.cjs.map

package/dist/types/oidc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.cjs","names":[],"sources":["../../src/types/oidc.ts"],"sourcesContent":["import type { SDKHttpClient, SDKLogging, SDKStorage } from './common';\nimport type { RedirectOptions } from './redirect';\nimport type { BACKCHANNEL_LOGOUT_EVENT } from '../utils/server';\n\nexport const ResponseTypeList = ['code'] as const;\nexport type ResponseType = (typeof ResponseTypeList)[number];\n\nexport const ResponseModeList = ['query', 'fragment'] as const;\nexport type ResponseMode = (typeof ResponseModeList)[number];\n\nexport const TokenEndpointAuthMethodList = ['none'] as const;\nexport type TokenEndpointAuthMethod = (typeof TokenEndpointAuthMethodList)[number];\n\nexport const GrantTypeList = ['authorization_code', 'refresh_token'] as const;\nexport type GrantType = (typeof GrantTypeList)[number];\n\nexport const AlgorithmTypeList = ['RS256'] as const;\nexport type AlgorithmType = (typeof AlgorithmTypeList)[number];\n\nexport const SubjectTypeList = ['public'] as const;\nexport type SubjectType = (typeof SubjectTypeList)[number];\n\nexport type SigningKey = {\n\t/**\n\t * The intended use of the key. Common values include \"sig\" for signature and \"enc\" for encryption.\n\t */\n\tuse: string;\n\n\t/**\n\t * The key type. For example, \"RSA\" for RSA keys or \"EC\" for Elliptic Curve keys.\n\t */\n\tkty: string;\n\n\t/**\n\t * A unique identifier for the key. This is used to distinguish the key from others.\n\t */\n\tkid: string;\n\n\t/**\n\t * The algorithm used with the key. For example, \"RS256\" for RSA SHA-256.\n\t */\n\talg: AlgorithmType;\n\n\t/**\n\t * The modulus of the RSA key, encoded in base64url format. For RSA keys, this is a required property.\n\t */\n\tn: string;\n\n\t/**\n\t * The exponent of the RSA key, encoded in base64url format. For RSA keys, this is a required property.\n\t */\n\te: string;\n};\n\nexport type DiscoveryDocument = {\n\t/**\n\t * The issuer of the tokens. This is the authorization server or entity that issues the tokens.\n\t */\n\tissuer: string;\n\n\t/**\n\t * The URL of the authorization endpoint where authentication requests are sent.\n\t */\n\tauthorization_endpoint: string;\n\n\t/**\n\t * The URL of the token endpoint where tokens are exchanged.\n\t */\n\ttoken_endpoint: string;\n\n\t/**\n\t * The URL of the JSON Web Key Set (JWKS) endpoint where public keys are available.\n\t */\n\tjwks_uri: string;\n\n\t/**\n\t * The types of subjects that are supported by the authorization server.\n\t */\n\tsubject_types_supported: Array<SubjectType>;\n\n\t/**\n\t * The types of responses supported by the authorization server.\n\t */\n\tresponse_types_supported: Array<string>;\n\n\t/**\n\t * The claims supported by the authorization server.\n\t */\n\tclaims_supported: Array<string>;\n\n\t/**\n\t * The grant types supported by the authorization server.\n\t */\n\tgrant_types_supported: Array<GrantType>;\n\n\t/**\n\t * The response modes supported by the authorization server.\n\t */\n\tresponse_modes_supported: Array<ResponseMode>;\n\n\t/**\n\t * The URL of the user info endpoint where user information can be retrieved.\n\t */\n\tuserinfo_endpoint: string;\n\n\t/**\n\t * The scopes supported by the authorization server.\n\t */\n\tscopes_supported: Array<string>;\n\n\t/**\n\t * The authentication methods supported for token endpoint authentication.\n\t */\n\ttoken_endpoint_auth_methods_supported: Array<TokenEndpointAuthMethod>;\n\n\t/**\n\t * The algorithms supported for signing tokens used in the user info endpoint.\n\t */\n\tuserinfo_signing_alg_values_supported: Array<AlgorithmType>;\n\n\t/**\n\t * The algorithms supported for signing ID tokens.\n\t */\n\tid_token_signing_alg_values_supported: Array<AlgorithmType>;\n\n\t/**\n\t * The algorithms used to sign ID tokens in response.\n\t */\n\tid_token_signed_response_alg: Array<AlgorithmType>;\n\n\t/**\n\t * The algorithms used to sign responses from the user info endpoint.\n\t */\n\tuserinfo_signed_response_alg: Array<AlgorithmType>;\n\n\t/**\n\t * Indicates whether the request parameter is supported in requests.\n\t */\n\trequest_parameter_supported: boolean;\n\n\t/**\n\t * Indicates whether the request URI parameter is supported in requests.\n\t */\n\trequest_uri_parameter_supported: boolean;\n\n\t/**\n\t * Indicates whether request URI registration is required.\n\t */\n\trequire_request_uri_registration: boolean;\n\n\t/**\n\t * Indicates whether the claims parameter is supported.\n\t */\n\tclaims_parameter_supported: boolean;\n\n\t/**\n\t * The URL of the revocation endpoint for revoking tokens.\n\t */\n\trevocation_endpoint: string;\n\n\t/**\n\t * Indicates whether backchannel logout is supported.\n\t */\n\tbackchannel_logout_supported: boolean;\n\n\t/**\n\t * Indicates whether backchannel logout session support is provided.\n\t */\n\tbackchannel_logout_session_supported: boolean;\n\n\t/**\n\t * Indicates whether frontchannel logout is supported.\n\t */\n\tfrontchannel_logout_supported: boolean;\n\n\t/**\n\t * Indicates whether frontchannel logout session support is provided.\n\t */\n\tfrontchannel_logout_session_supported: boolean;\n\n\t/**\n\t * The URL of the endpoint where end-session requests can be sent.\n\t */\n\tend_session_endpoint: string;\n\n\t/**\n\t * The algorithms supported for signing request objects.\n\t */\n\trequest_object_signing_alg_values_supported: Array<AlgorithmType>;\n\n\t/**\n\t * The code challenge methods supported by the authorization server.\n\t */\n\tcode_challenge_methods_supported: Array<'S256'>;\n};\n\nexport type JwtClaims = {\n\t/**\n\t * The issuer of the token. This typically represents the authorization server or entity that issued the JWT.\n\t */\n\tiss?: string;\n\n\t/**\n\t * The subject of the token. This is the identifier for the entity the token represents, such as a user ID.\n\t */\n\tsub?: string;\n\n\t/**\n\t * The audience for which the token is intended. This can be a single identifier or an array of identifiers.\n\t */\n\taud?: string | Array<string>;\n\n\t/**\n\t * The expiration time of the token, expressed as a Unix timestamp (number of seconds since January 1, 1970).\n\t */\n\texp?: number;\n\n\t/**\n\t * The not-before time of the token, expressed as a Unix timestamp. The token must not be accepted before this time.\n\t */\n\tnbf?: number;\n\n\t/**\n\t * The issued-at time of the token, expressed as a Unix timestamp (number of seconds since January 1, 1970).\n\t */\n\tiat?: number;\n\n\t/**\n\t * A unique identifier for the token. This can be used to prevent token replay attacks.\n\t */\n\tjti?: string;\n};\n\nexport type IdTokenClaims = Required<Pick<JwtClaims, 'iss' | 'sub' | 'aud' | 'exp' | 'iat' | 'jti'>> & {\n\t/**\n\t * The authentication time, indicating when the user was authenticated.\n\t */\n\tauth_time?: number;\n\n\t/**\n\t * A nonce value used to associate a client session with an ID token, preventing replay attacks.\n\t */\n\tnonce?: string;\n\n\t/**\n\t * The Authentication Context Class Reference, indicating the authentication methods used.\n\t */\n\tacr?: string;\n\n\t/**\n\t * The Authentication Methods References, providing information about the authentication methods used.\n\t */\n\tamr?: unknown;\n\n\t/**\n\t * Authorized party, the client that the ID token is intended for.\n\t */\n\tazp?: string;\n\n\t/**\n\t * Session ID for the user, which can be used to manage user sessions.\n\t */\n\tsid?: string;\n\n\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t[key: string]: any;\n};\n\nexport type LogoutTokenClaims = Pick<JwtClaims, 'iss' | 'sub' | 'aud' | 'iat' | 'jti'> & {\n\t/**\n\t * Session ID for the user, which can be used to clear a specific session.\n\t */\n\tsid?: string;\n\n\t/**\n\t * Spec-compliant event signal for OpenID Connect Back-Channel Logout.\n\t */\n\tevents: Record<typeof BACKCHANNEL_LOGOUT_EVENT, Record<string, never>>;\n\n\t/**\n\t * MUST NOT contain a nonce claim according to the OIDC Back-Channel Logout spec.\n\t */\n\tnonce?: never;\n\n\t// eslint-disable-next-line @typescript-eslint/no-explicit-any\n\t[key: string]: any;\n};\n\nexport type SessionData = {\n\t/**\n\t * The state parameter used in the authentication request.\n\t */\n\tstate?: string | null;\n\n\t/**\n\t * The authorization code returned by the authorization server.\n\t */\n\tcode?: string | null;\n\n\t/**\n\t * The error returned during the authentication process, if any.\n\t */\n\terror?: string | null;\n\n\t/**\n\t * A description of the error returned during authentication.\n\t */\n\terror_description?: string | null;\n\n\t/**\n\t * A URI identifying a human-readable web page with information about the error (RFC 6749).\n\t */\n\terror_uri?: string | null;\n\n\t/**\n\t * Opaque value representing the session state at the authorization server (OIDC Session Management).\n\t */\n\tsession_state?: string | null;\n\n\t/**\n\t * The ID token issued by the authorization server.\n\t */\n\tid_token?: string | null;\n\n\t/**\n\t * The access token issued by the authorization server.\n\t */\n\taccess_token?: string | null;\n\n\t/**\n\t * The refresh token issued by the authorization server.\n\t */\n\trefresh_token?: string | null;\n\n\t/**\n\t * The type of token issued, defaulting to 'bearer'.\n\t */\n\ttoken_type?: string;\n\n\t/**\n\t * The scope of the issued token.\n\t */\n\tscope?: string | null;\n\n\t/**\n\t * The lifetime of the access token in seconds, as returned by the token endpoint.\n\t */\n\texpires_in?: number | null;\n\n\t/**\n\t * The absolute expiration time of the access token, represented as a Unix timestamp (seconds since epoch).\n\t */\n\texpires_at?: number | null;\n\n\t/**\n\t * The claims associated with the ID token.\n\t */\n\tclaims?: IdTokenClaims | null;\n};\n\nexport type LoginSessionParams = {\n\t/**\n\t * The unique identifier of the login session.\n\t */\n\tsession_id?: string;\n\n\t/**\n\t * The short application identifier associated with the login session.\n\t */\n\tshort_app_id?: string;\n\n\t/**\n\t * BCP 47 language tag representing the language preference for the login session.\n\t */\n\tlanguage?: string;\n};\n\nexport type StateData = {\n\t/**\n\t * A unique identifier for the state.\n\t */\n\tid: string;\n\n\t/**\n\t * The timestamp when the state was created, represented as a Unix timestamp (seconds since epoch).\n\t */\n\tcreatedAt: number;\n\n\t/**\n\t * The code verifier used in the PKCE flow.\n\t */\n\tcodeVerifier: string;\n\n\t/**\n\t * The code challenge derived from the code verifier, used in the PKCE flow.\n\t */\n\tcodeChallenge: string;\n\n\t/**\n\t * A unique nonce value used to associate a client session with an ID token, preventing replay attacks.\n\t */\n\tnonce: string;\n\n\t/**\n\t * Optional metadata associated with the state, which can be used to store additional information relevant to the authentication flow.\n\t */\n\tmetadata?: Record<string, unknown>;\n};\n\nexport type LogoutParams = {\n\t/**\n\t * The URL to which the user should be redirected after logging out.\n\t */\n\tpostLogoutRedirectUri?: string;\n};\n\nexport type ExtraRequestArgs = {\n\t/**\n\t * Specifies the type of prompt to display to the user during authentication or authorization.\n\t *\n\t * @example 'none' | 'login' | 'create'\n\t */\n\tprompt?: string | null;\n\n\t/**\n\t * Specifies the display mode for the authentication or authorization request.\n\t *\n\t * @example 'page' | 'popup'\n\t */\n\tdisplay?: string | null;\n\n\t/**\n\t * Provides a hint to the authorization server about the user's email or username.\n\t *\n\t * @example 'user@example.com'\n\t */\n\tloginHint?: string | null;\n\n\t/**\n\t * A list of values used to request specific authentication contexts or levels of assurance.\n\t * This parameter allows requesting specific authentication contexts (e.g., multi-factor authentication)\n\t * or other criteria that the authorization server should consider when authenticating the user.\n\t *\n\t * @example ['urn:mace:incommon:iap:bronze', 'urn:mace:incommon:iap:silver']\n\t */\n\tacrValues?: Array<string> | null;\n\n\t/**\n\t * A list of BCP 47 language tags specifying the preferred display language for the customer-facing UI.\n\t * We uses this as a fallback when determining the display language.\n\t * It is only applied if no higher-priority signal is present.\n\t *\n\t * @see https://docs.strivacity.com/docs/translations\n\t * @example ['en-US', 'fr-FR', 'de-DE']\n\t */\n\tuiLocales?: Array<string> | null;\n\n\t/**\n\t * A list of audience values to specify the intended recipients of the token.\n\t * This parameter allows requesting that the issued token is intended for specific audiences.\n\t *\n\t * @example ['https://api.example.com', 'https://service.example.com']\n\t */\n\taudiences?: Array<string> | null;\n};\n\nexport type EntryResponse = {\n\t/**\n\t * The session ID associated with the entry flow. This is a unique identifier for the session and can be used to track or manage the session.\n\t */\n\tsession_id: string;\n\n\t/**\n\t * The short application ID associated with the entry flow. This is a unique identifier for the application and can be used to identify the application in various contexts.\n\t */\n\tshort_app_id: string;\n\n\t/**\n\t * The language code associated with the entry flow. This indicates the preferred language for the user interface and can be used to provide localized content.\n\t */\n\tlanguage: string;\n\n\t[key: string]: string;\n};\n\nexport type SDKOptions<Storage extends SDKStorage = SDKStorage, StateStorage extends SDKStorage = SDKStorage> = {\n\t/**\n\t * A factory function that creates an instance of the SDK based on the provided initialization options.\n\t *\n\t * @param options - The initialization options for the SDK.\n\t * @returns The instance created by the factory function.\n\t */\n\tfactory?: (options: SDKInitConfig) => unknown;\n\n\t/**\n\t * The mode of operation for the SDK, which determines how authentication flows are handled.\n\t *\n\t * @default 'redirect'\n\t */\n\tmode: 'popup' | 'redirect' | 'native' | 'embedded';\n\n\t/**\n\t * The issuer of the tokens, typically the URL of the authorization server.\n\t */\n\tissuer: string;\n\n\t/**\n\t * The client ID issued by the authorization server, used to identify the application.\n\t */\n\tclientId: string;\n\n\t/**\n\t * The URI to which the user will be redirected after authentication or authorization.\n\t */\n\tredirectUri: string;\n\n\t/**\n\t * A list of scopes requested by the application, defining the access levels for the tokens.\n\t *\n\t * @default ['openid']\n\t */\n\tscopes: Array<string>;\n\n\t/**\n\t * The type of response expected from the authorization server.\n\t *\n\t * @default 'code'\n\t */\n\tresponseType: ResponseType;\n\n\t/**\n\t * The mode in which the response is returned from the authorization server.\n\t *\n\t * @default 'query'\n\t */\n\tresponseMode: ResponseMode;\n\n\t/**\n\t * The storage mechanism used to save and retrieve authentication information.\n\t *\n\t * @default Storage\n\t */\n\tstorage: Storage;\n\n\t/**\n\t * The storage mechanism used to save and retrieve state information, such as the state parameter in OAuth flows.\n\t *\n\t * @default StateStorage\n\t */\n\tstateStorage: StateStorage;\n\n\t/**\n\t * The name of the storage token used to store session data.\n\t *\n\t * @default 'sty.session'\n\t */\n\tstorageTokenName: string;\n\n\t/**\n\t * The HTTP client used for making requests to the authorization server and other endpoints.\n\t */\n\thttpClient: SDKHttpClient;\n\n\t/**\n\t * The logging mechanism used for logging messages and errors.\n\t */\n\tlogging?: SDKLogging;\n\n\t/**\n\t * Indicates whether the SDK should be lazily loaded, meaning that it will be initialized only when needed.\n\t *\n\t * @default false\n\t */\n\tlazyLoad: boolean;\n\n\t/**\n\t * Indicates whether the SDK should automatically refresh tokens when they are about to expire.\n\t *\n\t * @default true\n\t */\n\tautoRefresh: boolean;\n\n\t/**\n\t * The URL of your backend-for-frontend (BFF) endpoint that the SDK will route login/registration/start-session requests to instead of building the authorization URL itself.\n\t * Setting this also switches the SDK into server-managed session mode: tokens are never read from or written to client-side storage, and successful authorization responses redirect the browser instead of being exchanged for tokens client-side.\n\t * If not set, the SDK talks to the IDP directly and manages the session client-side.\n\t *\n\t * @default '/auth/login'\n\t */\n\tserverSessionUri?: boolean | string | null;\n\n\t/**\n\t * Discovery document metadata is cached for this amount of time (in seconds) before being refreshed from the authorization server.\n\t *\n\t * @default 3600 (1 hour)\n\t */\n\tdiscoveryDocumentCacheTTL: number;\n\n\t/**\n\t * JWKS (JSON Web Key Set) is cached for this amount of time (in seconds) before being refreshed from the authorization server.\n\t *\n\t * @default 600 (10 minutes)\n\t */\n\tjwksCacheTTL: number;\n\n\t/**\n\t * Handles the URL redirection to the specified target.\n\t * You can use this method to implement custom URL handling logic, such as opening a new window or navigating to a different page.\n\t *\n\t * @param {string | URL} url - The URL to handle.\n\t * @param {Record<string, unknown>} params - Optional parameters for redirection.\n\t * @returns - A promise that resolves when the redirection is handled.\n\t */\n\turlHandler: (url: string | URL, params?: Record<string, unknown>) => Promise<unknown>;\n\n\t/**\n\t * Handles the callback from the authorization server after a successful authentication or authorization.\n\t * You can use this method to implement custom logic for processing the response from the authorization server.\n\t *\n\t * @param {string | URL} url - The URL containing the response from the authorization server.\n\t * @param {ResponseMode} [responseMode] - Optional parameter specifying the response mode (query or fragment).\n\t * @returns - A promise that resolves when the callback is handled.\n\t */\n\tcallbackHandler: (url: string | URL, responseMode?: ResponseMode) => Promise<unknown>;\n};\n\nexport type SDKInitConfig = Partial<SDKOptions> & Required<Pick<SDKOptions, 'mode' | 'issuer' | 'clientId' | 'redirectUri'>>;\n\nexport type FlowState = {\n\t/**\n\t * Indicates whether the SDK has been initialized and is ready for use.\n\t */\n\tinitialized: boolean;\n\n\t/**\n\t * The current session data, which may include tokens and related information.\n\t */\n\tsession: SessionData | null;\n\n\t/**\n\t * The unique identifier for the current session, which may be used for tracking and correlation.\n\t */\n\tsessionId: string | null;\n\n\t/**\n\t * The short application identifier, which may be used for tracking and correlation.\n\t */\n\tshortAppId: string | null;\n\n\t/**\n\t * The language preference for the authentication flow, which may be used for localization.\n\t *\n\t * @default navigator.language\n\t */\n\tlanguage: string;\n};\n\nexport type EventFunctions = {\n\taccessTokenExpired: (params?: { accessToken?: string | null; refreshToken?: string | null }) => Promise<void> | void;\n\tinit: () => Promise<void> | void;\n\tloggedIn: (params?: {\n\t\tidToken?: string | null;\n\t\taccessToken?: string | null;\n\t\trefreshToken?: string | null;\n\t\tclaims?: IdTokenClaims | null;\n\t}) => Promise<void> | void;\n\tsessionUpdated: (params?: {\n\t\tidToken?: string | null;\n\t\taccessToken?: string | null;\n\t\trefreshToken?: string | null;\n\t\tclaims?: IdTokenClaims | null;\n\t}) => Promise<void> | void;\n\tsessionCleared: () => Promise<void> | void;\n\tloginInitiated: () => Promise<void> | void;\n\tflowInitiated: () => Promise<void> | void;\n\tlogoutInitiated: (params?: { idToken?: string | null; claims?: IdTokenClaims | null }) => Promise<void> | void;\n\tsessionLoaded: (params?: {\n\t\tidToken?: string | null;\n\t\taccessToken?: string | null;\n\t\trefreshToken?: string | null;\n\t\tclaims?: IdTokenClaims | null;\n\t}) => Promise<void> | void;\n\ttokenRefreshed: (params?: {\n\t\tidToken?: string | null;\n\t\taccessToken?: string | null;\n\t\trefreshToken?: string | null;\n\t\tclaims?: IdTokenClaims | null;\n\t}) => Promise<void> | void;\n\ttokenRefreshFailed: (params?: { refreshToken?: string | null }) => Promise<void> | void;\n\ttokenRevoked: (params?: { token?: string | null; tokenTypeHint?: 'refresh_token' | 'access_token' }) => Promise<void> | void;\n\ttokenRevokeFailed: (params?: { token?: string | null; tokenTypeHint?: 'refresh_token' | 'access_token' }) => Promise<void> | void;\n};\n\nexport type SDK<URLHandlerParams extends ExtraRequestArgs = ExtraRequestArgs, EntryReturnType = Promise<void>> = {\n\t/**\n\t * The resolved SDK configuration options in use.\n\t */\n\treadonly options: SDKOptions;\n\n\t/**\n\t * Whether the SDK has been fully initialized.\n\t */\n\treadonly initialized: boolean;\n\n\t/**\n\t * The storage adapter used to persist session and state data.\n\t */\n\treadonly storage: SDKStorage;\n\n\t/**\n\t * The HTTP client adapter used for making requests.\n\t */\n\treadonly httpClient: SDKHttpClient;\n\n\t/**\n\t * The optional logging adapter for SDK diagnostic output.\n\t */\n\treadonly logging?: SDKLogging;\n\n\t/**\n\t * The current session data, or `null` if no session is active.\n\t */\n\tsession: SessionData | null;\n\n\t/**\n\t * The short application ID associated with the current session, or `null` if not yet available.\n\t */\n\tshortAppId: string | null;\n\n\t/**\n\t * The unique identifier for the current session, or `null` if no session is active.\n\t */\n\tsessionId: string | null;\n\n\t/**\n\t * The language code used for the authentication UI.\n\t */\n\tlanguage: string;\n\n\t/**\n\t * A promise that resolves to `true` if the user is currently authenticated, `false` otherwise.\n\t */\n\treadonly isAuthenticated: Promise<boolean>;\n\n\t/**\n\t * A synchronous boolean indicating whether the user is currently authenticated.\n\t * This value may not reflect the most recent authentication state if the SDK has not been initialized or if a token refresh is pending.\n\t */\n\treadonly isAuthenticatedSync: boolean;\n\n\t/**\n\t * The current access token, or `null` if the user is not authenticated.\n\t */\n\treadonly accessToken: string | null;\n\n\t/**\n\t * Indicates whether the current access token has expired.\n\t */\n\treadonly accessTokenExpired: boolean;\n\n\t/**\n\t * The expiration time of the current access token, represented as a Unix timestamp (seconds since epoch), or `null` if no access token is present.\n\t */\n\treadonly accessTokenExpirationDate: number | null;\n\n\t/**\n\t * The current refresh token, or `null` if the user is not authenticated.\n\t */\n\treadonly refreshToken: string | null;\n\n\t/**\n\t * The current ID token, or `null` if the user is not authenticated.\n\t */\n\treadonly idToken: string | null;\n\n\t/**\n\t * The claims extracted from the current ID token, or `null` if no ID token is present.\n\t */\n\treadonly idTokenClaims: IdTokenClaims | null;\n\n\t/**\n\t * Subscribes to a specific SDK event by name.\n\t *\n\t * @template T - The name of the event to subscribe to.\n\t * @param {T} eventName - The name of the event.\n\t * @param {Function} callbackFn - The callback to invoke when the event fires.\n\t * @returns {{ dispose: () => void }} An object with a `dispose` method to remove the subscription.\n\t */\n\tsubscribeToEvent<T extends keyof EventFunctions>(\n\t\teventName: T,\n\t\tcallbackFn: (...params: Parameters<EventFunctions[T]>) => Promise<void> | void,\n\t): { dispose: () => void };\n\n\t/**\n\t * Subscribes to all SDK events.\n\t *\n\t * @param {Function} callbackFn - The callback to invoke whenever any event fires.\n\t * @returns {{ dispose: () => void }} An object with a `dispose` method to remove the subscription.\n\t */\n\tsubscribeToAllEvents(callbackFn: (...params: Array<unknown>) => Promise<void> | void): { dispose: () => void };\n\n\t/**\n\t * Clears the current session data from storage.\n\t *\n\t * @returns {Promise<void>}\n\t */\n\tcleanupSession(): Promise<void>;\n\n\t/**\n\t * Replaces the current session data with the provided data.\n\t *\n\t * @param {SessionData} newData - The new session data to persist.\n\t * @returns {Promise<void>}\n\t */\n\tupdateSession(newData: SessionData): Promise<void>;\n\n\t/**\n\t * Checks whether the user is currently authenticated, optionally triggering a token refresh.\n\t *\n\t * @param {{ autoRefresh: boolean }} [params] - Options for the check.\n\t * @returns {Promise<boolean>} Resolves to `true` if authenticated, `false` otherwise.\n\t */\n\tcheckAuthentication(params?: { autoRefresh: boolean }): Promise<boolean>;\n\n\t/**\n\t * Initializes the SDK, loading metadata and restoring any persisted session.\n\t *\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the stored session cannot be loaded.\n\t */\n\tinit(): Promise<void>;\n\n\t/**\n\t * Performs a token exchange using the provided parameters.\n\t *\n\t * @param {Record<string, string>} [params] - Additional parameters for the token exchange request.\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the token exchange fails or if the provided parameters are invalid.\n\t */\n\ttokenExchange(params?: Record<string, string>): Promise<void>;\n\n\t/**\n\t * Handles the authentication callback by parsing the response from the given URL.\n\t *\n\t * @param {string | URL} [url] - The callback URL to process. Defaults to the current page URL if omitted.\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the callback handling fails or if the URL is invalid.\n\t */\n\thandleCallback(url?: string | URL): Promise<void>;\n\n\t/**\n\t * Refreshes the current access token using the refresh token.\n\t *\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the refresh process fails or if no refresh token is available.\n\t */\n\trefresh(): Promise<void>;\n\n\t/**\n\t * Revokes the current tokens.\n\t *\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the revocation process fails or if no tokens are available to revoke.\n\t */\n\trevoke(): Promise<void>;\n\n\t/**\n\t * Logs the user out and optionally redirects to a post-logout URI.\n\t *\n\t * @param {LogoutParams} [params] - Optional logout and URL handler parameters.\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the logout url handling fails or if the provided parameters are invalid.\n\t */\n\tlogout(params?: LogoutParams): Promise<void>;\n\n\t/**\n\t * Initiates the login flow.\n\t *\n\t * @param {URLHandlerParams} [params] - Optional parameters for the login request.\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the login process fails or if the provided parameters are invalid.\n\t */\n\tlogin(params?: URLHandlerParams): Promise<void>;\n\n\t/**\n\t * Initiates the registration flow.\n\t *\n\t * @param {URLHandlerParams} [params] - Optional parameters for the registration request.\n\t * @returns {Promise<void>}\n\t * @throws {Error} Throws an error if the registration process fails or if the provided parameters are invalid.\n\t */\n\tregister(params?: URLHandlerParams): Promise<void>;\n\n\t/**\n\t * Handles the entry point URL of the authentication flow, typically used for embedded or native modes.\n\t *\n\t * @param {string | URL} [url] - The entry URL to process.\n\t * @param {RedirectOptions} [params] - Optional redirect options.\n\t * @returns {EntryReturnType}\n\t * @throws {Error} Throws an error if the entry URL is invalid or if the entry process fails.\n\t */\n\tentry(url?: string | URL, params?: RedirectOptions): EntryReturnType;\n};\n"],"mappings":"mEAIA,IAAa,EAAmB,CAAC,MAAM,EAG1B,EAAmB,CAAC,QAAS,UAAU,EAGvC,EAA8B,CAAC,MAAM,EAGrC,EAAgB,CAAC,qBAAsB,eAAe,EAGtD,EAAoB,CAAC,OAAO,EAG5B,EAAkB,CAAC,QAAQ"}