@thunderid/browser 0.0.3 → 0.0.5

package/dist/models/BrowserConfig.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { AuthClientConfig } from '@thunderid/javascript';
+import { BrowserStorage } from './BrowserStorage';
+/**
+ * Browser-specific SDK configuration that extends the base OIDC config.
+ */
+export interface BrowserClientConfig {
+    /**
+     * Storage backend to use for session data.
+     * @default BrowserStorage.SessionStorage
+     */
+    storage?: BrowserStorage | 'sessionStorage' | 'localStorage' | 'browserMemory';
+    /** Enable OIDC Session Management via RP Iframe. Requires same-domain or third-party cookies. */
+    syncSession?: boolean;
+    /** Interval in seconds between session-check polls. @default 3 */
+    checkSessionInterval?: number;
+    /** Interval in seconds for silent token refresh. @default 300 */
+    sessionRefreshInterval?: number;
+    /** Allowed external URL prefixes for `httpRequest` calls. */
+    allowedExternalUrls?: string[];
+    /** Additional query params to append to every authorize request. */
+    authParams?: Record<string, string>;
+    /** Automatically refresh the access token before it expires. */
+    periodicTokenRefresh?: boolean;
+    /** Sign the user out when a token refresh attempt fails. @default false */
+    autoLogoutOnTokenRefreshError?: boolean;
+}
+/** Full browser SDK configuration, combining base OIDC config with browser-specific fields. */
+export type BrowserAuthConfig = AuthClientConfig<BrowserClientConfig>;
+//# sourceMappingURL=BrowserConfig.d.ts.map

package/dist/models/BrowserConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserConfig.d.ts","sourceRoot":"","sources":["../../src/models/BrowserConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,CAAC;IAC/E,iGAAiG;IACjG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/{__legacy__/models/storage.d.ts → models/BrowserStorage.d.ts}

@@ -1,5 +1,5 @@
 /**
- * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
  *
  * WSO2 LLC. licenses this file to you under the Apache License,
  * Version 2.0 (the "License"); you may not use this file except
@@ -16,24 +16,15 @@
  * under the License.
  */
 /**
- * Enum for the different storage types.
+ * Supported browser storage backends for auth session data.
  */
 export declare enum BrowserStorage {
-    /**
-     * Stores the session information in the local storage
-     */
+    /** Store session data in `localStorage` (persists across tabs and sessions). */
     LocalStorage = "localStorage",
-    /**
-     * Store the session information in the session storage.
-     */
+    /** Store session data in `sessionStorage` (cleared when the tab is closed). */
     SessionStorage = "sessionStorage",
-    /**
-     * Store the session information in the web worker.
-     */
-    WebWorker = "webWorker",
-    /**
-     * Store the session information in the browser memory.
-     */
+    /** Store session data in in-memory (cleared on page reload). */
     BrowserMemory = "browserMemory"
 }
-//# sourceMappingURL=storage.d.ts.map
+export default BrowserStorage;
+//# sourceMappingURL=BrowserStorage.d.ts.map

package/dist/models/BrowserStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserStorage.d.ts","sourceRoot":"","sources":["../../src/models/BrowserStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;GAEG;AACH,oBAAY,cAAc;IACxB,gFAAgF;IAChF,YAAY,iBAAiB;IAC7B,+EAA+E;IAC/E,cAAc,mBAAmB;IACjC,gEAAgE;IAChE,aAAa,kBAAkB;CAChC;AAED,eAAe,cAAc,CAAC"}

package/dist/{__legacy__/models/sign-in.d.ts → models/SignInConfig.d.ts}

@@ -16,7 +16,15 @@
  * under the License.
  */
 import { ExtendedAuthorizeRequestUrlParams } from '@thunderid/javascript';
+/**
+ * Options accepted by `ThunderIDBrowserClient.signIn()`.
+ */
 export type SignInConfig = ExtendedAuthorizeRequestUrlParams & {
+    /**
+     * When `true`, the `signIn` call is a no-op unless the current URL already contains
+     * an authorization code (i.e., the page is the redirect landing page).
+     */
     callOnlyOnRedirect?: boolean;
 };
-//# sourceMappingURL=sign-in.d.ts.map
+export default SignInConfig;
+//# sourceMappingURL=SignInConfig.d.ts.map

package/dist/models/SignInConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInConfig.d.ts","sourceRoot":"","sources":["../../src/models/SignInConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,iCAAiC,EAAC,MAAM,uBAAuB,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,iCAAiC,GAAG;IAC7D;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/{__legacy__/models/sign-out-error.d.ts → models/SignOutError.d.ts}

@@ -15,8 +15,14 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+/**
+ * Error information returned when a sign-out redirect fails.
+ */
 export interface SignOutError {
+    /** OAuth2/OIDC error code from the redirect URL. */
     error: string;
+    /** Human-readable error description from the redirect URL. */
     description: string;
 }
-//# sourceMappingURL=sign-out-error.d.ts.map
+export default SignOutError;
+//# sourceMappingURL=SignOutError.d.ts.map

package/dist/models/SignOutError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignOutError.d.ts","sourceRoot":"","sources":["../../src/models/SignOutError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAe,YAAY,CAAC"}

package/dist/{__legacy__/models/request-custom-grant.d.ts → models/TokenExchangeConfig.d.ts}

@@ -17,9 +17,14 @@
  */
 import { TokenExchangeRequestConfig } from '@thunderid/javascript';
 /**
- * SPA Custom Request Grant config model
+ * Browser-specific token exchange configuration extending the base token exchange config.
  */
-export interface SPACustomGrantConfig extends TokenExchangeRequestConfig {
+export interface SPATokenExchangeConfig extends TokenExchangeRequestConfig {
+    /**
+     * When `true`, the sign-out URL is not updated after this token exchange
+     * (preserves the original sign-out URL across org switches).
+     */
     preventSignOutURLUpdate?: boolean;
 }
-//# sourceMappingURL=request-custom-grant.d.ts.map
+export default SPATokenExchangeConfig;
+//# sourceMappingURL=TokenExchangeConfig.d.ts.map

package/dist/models/TokenExchangeConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenExchangeConfig.d.ts","sourceRoot":"","sources":["../../src/models/TokenExchangeConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,0BAA0B,EAAC,MAAM,uBAAuB,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,0BAA0B;IACxE;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,eAAe,sBAAsB,CAAC"}

package/dist/models/config.d.ts

@@ -16,5 +16,5 @@
  * under the License.
  */
 import { Config } from '@thunderid/javascript';
-export type ThunderIDBrowserConfig = Config<'sessionStorage' | 'localStorage' | 'browserMemory' | 'webWorker'>;
+export type ThunderIDBrowserConfig = Config<'sessionStorage' | 'localStorage' | 'browserMemory'>;
 //# sourceMappingURL=config.d.ts.map

package/dist/models/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAE7C,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,WAAW,CAAC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAE7C,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,gBAAgB,GAAG,cAAc,GAAG,eAAe,CAAC,CAAC"}

package/dist/{__legacy__/stores/session-store.d.ts → stores/LocalStore.d.ts}

@@ -16,9 +16,13 @@
  * under the License.
  */
 import { Storage } from '@thunderid/javascript';
-export declare class SessionStore implements Storage {
+/**
+ * `Storage` implementation backed by the browser's `localStorage`.
+ */
+declare class LocalStore implements Storage {
     setData(key: string, value: string): Promise<void>;
     getData(key: string): Promise<string>;
     removeData(key: string): Promise<void>;
 }
-//# sourceMappingURL=session-store.d.ts.map
+export default LocalStore;
+//# sourceMappingURL=LocalStore.d.ts.map

package/dist/stores/LocalStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalStore.d.ts","sourceRoot":"","sources":["../../src/stores/LocalStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAE9C;;GAEG;AACH,cAAM,UAAW,YAAW,OAAO;IACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD;AAED,eAAe,UAAU,CAAC"}

package/dist/{__legacy__/stores/memory-store.d.ts → stores/MemoryStore.d.ts}

@@ -16,11 +16,15 @@
  * under the License.
  */
 import { Storage } from '@thunderid/javascript';
-export declare class MemoryStore implements Storage {
+/**
+ * `Storage` implementation backed by an in-memory `Map`. Data does not survive page reloads.
+ */
+declare class MemoryStore implements Storage {
     private _data;
     constructor();
     setData(key: string, value: string): Promise<void>;
     getData(key: string): Promise<string>;
     removeData(key: string): Promise<void>;
 }
-//# sourceMappingURL=memory-store.d.ts.map
+export default MemoryStore;
+//# sourceMappingURL=MemoryStore.d.ts.map

package/dist/stores/MemoryStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MemoryStore.d.ts","sourceRoot":"","sources":["../../src/stores/MemoryStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAE9C;;GAEG;AACH,cAAM,WAAY,YAAW,OAAO;IAClC,OAAO,CAAC,KAAK,CAAsB;;IAMtB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD;AAED,eAAe,WAAW,CAAC"}

package/dist/{__legacy__/stores/local-store.d.ts → stores/SessionStore.d.ts}

@@ -16,9 +16,13 @@
  * under the License.
  */
 import { Storage } from '@thunderid/javascript';
-export declare class LocalStore implements Storage {
+/**
+ * `Storage` implementation backed by the browser's `sessionStorage`.
+ */
+declare class SessionStore implements Storage {
     setData(key: string, value: string): Promise<void>;
     getData(key: string): Promise<string>;
     removeData(key: string): Promise<void>;
 }
-//# sourceMappingURL=local-store.d.ts.map
+export default SessionStore;
+//# sourceMappingURL=SessionStore.d.ts.map

package/dist/stores/SessionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionStore.d.ts","sourceRoot":"","sources":["../../src/stores/SessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAE9C;;GAEG;AACH,cAAM,YAAa,YAAW,OAAO;IACtB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD;AAED,eAAe,YAAY,CAAC"}

package/dist/utils/AuthenticationHelper.d.ts

@@ -0,0 +1,192 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { User, IsomorphicCrypto, StorageManager, IdToken, ExtendedAuthorizeRequestUrlParams, OIDCEndpoints, TokenResponse, HttpClient, HttpError, HttpRequestConfig, HttpResponse } from '@thunderid/javascript';
+import { SPATokenExchangeConfig } from '../models/TokenExchangeConfig';
+import SPAHelper from './SPAHelper';
+interface SessionManagementHelperInterface {
+    initialize(clientId: string, checkSessionEndpoint: string, getSessionState: () => Promise<string>, interval: number, sessionRefreshInterval: number, redirectURL: string, getSignInUrl: (params?: ExtendedAuthorizeRequestUrlParams) => Promise<string>): void;
+    receivePromptNoneResponse(setSessionState?: (sessionState: string | null) => Promise<void>): Promise<boolean>;
+    reset(): void;
+}
+/**
+ * Browser-level authentication helper that orchestrates HTTP requests with token attachment,
+ * automatic token refresh, session management, and the silent sign-in flow.
+ *
+ * @typeParam T - The browser client config extension type.
+ */
+declare class AuthenticationHelper<T> {
+    private _storageManager;
+    private _spaHelper;
+    private _instanceId;
+    private _isTokenRefreshing;
+    private _getUser;
+    private _refreshAccessToken;
+    private _getAccessToken;
+    private _getIDPAccessToken;
+    private _isSignedIn;
+    private _getDecodedIdToken;
+    private _getCrypto;
+    private _getIdToken;
+    private _getOpenIDProviderEndpoints;
+    private _exchangeToken;
+    private _setPKCECode;
+    /**
+     * @param storageManager - Storage manager for reading config and session data.
+     * @param spaHelper - Helper for managing token refresh timers.
+     * @param instanceId - The instance ID used for signing out URL storage.
+     * @param operations - Client operation callbacks to avoid circular dependency.
+     */
+    constructor(storageManager: StorageManager<T>, spaHelper: SPAHelper<T>, instanceId: number, operations: {
+        getUser: () => Promise<User>;
+        refreshAccessToken: () => Promise<TokenResponse | User>;
+        getAccessToken: (sessionId?: string) => Promise<string>;
+        getIDPAccessToken: () => Promise<string>;
+        isSignedIn: () => Promise<boolean>;
+        getDecodedIdToken: (sessionId?: string) => Promise<IdToken>;
+        getCrypto: () => Promise<IsomorphicCrypto>;
+        getIdToken: () => Promise<string>;
+        getOpenIDProviderEndpoints: () => Promise<OIDCEndpoints>;
+        exchangeToken: (config: SPATokenExchangeConfig) => Promise<Response | TokenResponse | User>;
+        setPKCECode: (pkceKey: string, state: string) => Promise<void>;
+    });
+    /**
+     * Enables request interception on the HTTP client.
+     *
+     * @param httpClient - The HTTP client to enable.
+     */
+    enableHttpHandler(httpClient: HttpClient): void;
+    /**
+     * Disables request interception on the HTTP client.
+     *
+     * @param httpClient - The HTTP client to disable.
+     */
+    disableHttpHandler(httpClient: HttpClient): void;
+    /**
+     * Initializes OIDC Session Management via an RP iframe.
+     *
+     * @param config - The current auth config.
+     * @param oidcEndpoints - Resolved OIDC provider endpoints.
+     * @param getSessionState - Returns the current session state from storage.
+     * @param getAuthzURL - Builds an authorization URL with optional params.
+     * @param sessionManagementHelper - The session management helper instance.
+     */
+    initializeSessionManger(config: any, oidcEndpoints: OIDCEndpoints, getSessionState: () => Promise<string>, getAuthzURL: (params?: ExtendedAuthorizeRequestUrlParams) => Promise<string>, sessionManagementHelper: SessionManagementHelperInterface): void;
+    /**
+     * Executes a custom token exchange grant, enforcing `allowedExternalUrls` rules when applicable.
+     *
+     * @param config - The token exchange configuration.
+     * @param enableRetrievingSignOutURLFromSession - Callback invoked when `preventSignOutURLUpdate` is set.
+     * @returns The user session or raw response.
+     */
+    exchangeToken(config: SPATokenExchangeConfig, enableRetrievingSignOutURLFromSession?: (config: SPATokenExchangeConfig) => void): Promise<User | Response>;
+    /**
+     * Returns the stored custom grant config if a replay-after-refresh was scheduled, or `null`.
+     */
+    getCustomGrantConfigData(): Promise<SPATokenExchangeConfig | null>;
+    /**
+     * Refreshes the access token, replays any scheduled custom grant, and reschedules auto-refresh.
+     *
+     * @param enableRetrievingSignOutURLFromSession - Callback for custom grant sign-out URL handling.
+     * @returns The updated user session.
+     */
+    refreshAccessToken(enableRetrievingSignOutURLFromSession?: (config: SPATokenExchangeConfig) => void): Promise<User>;
+    private retryFailedRequests;
+    /**
+     * Sends an HTTP request via the provided client, automatically attaching the token,
+     * and retries once after a token refresh on a 401 response.
+     *
+     * @param httpClient - The HTTP client to use.
+     * @param requestConfig - The request configuration.
+     * @param isHttpHandlerEnabled - Whether request callbacks are active.
+     * @param httpErrorCallback - Called when a request fails.
+     * @param httpFinishCallback - Called when a request finishes.
+     * @param enableRetrievingSignOutURLFromSession - Callback for custom grant sign-out handling.
+     * @returns The HTTP response.
+     */
+    httpRequest(httpClient: HttpClient, requestConfig: HttpRequestConfig, isHttpHandlerEnabled?: boolean, httpErrorCallback?: (error: HttpError) => void | Promise<void>, httpFinishCallback?: () => void, enableRetrievingSignOutURLFromSession?: (config: SPATokenExchangeConfig) => void): Promise<HttpResponse>;
+    /**
+     * Sends multiple HTTP requests in parallel via the provided client,
+     * retrying all on a 401 after a token refresh.
+     *
+     * @param requestConfigs - Array of request configurations.
+     * @param httpClient - The HTTP client to use.
+     * @param isHttpHandlerEnabled - Whether request callbacks are active.
+     * @param httpErrorCallback - Called when a batch fails.
+     * @param httpFinishCallback - Called when the batch finishes.
+     * @returns Array of responses.
+     */
+    httpRequestAll(requestConfigs: HttpRequestConfig[], httpClient: HttpClient, isHttpHandlerEnabled?: boolean, httpErrorCallback?: (error: HttpError) => void | Promise<void>, httpFinishCallback?: () => void): Promise<HttpResponse[] | undefined>;
+    /**
+     * Executes the silent sign-in flow using a prompt-none request via an iFrame.
+     *
+     * @param constructSilentSignInUrl - Builds the prompt-none authorize URL.
+     * @param requestAccessToken - Exchanges the returned code for tokens.
+     * @param sessionManagementHelper - Handles the iFrame prompt-none response.
+     * @param additionalParams - Extra authorize request params.
+     * @param tokenRequestConfig - Additional params for the token request.
+     * @returns The user session, or `false` if the user is not signed in.
+     */
+    signInSilently(constructSilentSignInUrl: (additionalParams?: Record<string, string | boolean>) => Promise<string>, requestAccessToken: (authzCode: string, sessionState: string, state: string, tokenRequestConfig?: {
+        params: Record<string, unknown>;
+    }) => Promise<User>, sessionManagementHelper: SessionManagementHelperInterface, additionalParams?: Record<string, string | boolean>, tokenRequestConfig?: {
+        params: Record<string, unknown>;
+    }): Promise<User | boolean>;
+    /**
+     * Handles the early-return path of `signIn()` when a session already exists
+     * or the page is handling a prompt-none response.
+     *
+     * @param shouldStopAuthn - Returns `true` if we should short-circuit and return early.
+     * @param checkSession - Callback to initialize OIDC session management.
+     * @returns The current user if already signed in, or `undefined` to continue normal sign-in.
+     */
+    handleSignIn(shouldStopAuthn: () => Promise<boolean>, checkSession: () => Promise<void>): Promise<User | undefined>;
+    /**
+     * Attaches the access token (or IDP token) to an HTTP request config's `Authorization` header.
+     *
+     * @param request - The request config to mutate.
+     */
+    attachTokenToRequestConfig(request: HttpRequestConfig): Promise<void>;
+    /** Returns the current authenticated user from the ID token. */
+    getUser(): Promise<User>;
+    /**
+     * Returns the decoded ID token payload.
+     *
+     * @param sessionId - Optional session ID.
+     */
+    getDecodedIdToken(sessionId?: string): Promise<IdToken>;
+    /** Returns the IsomorphicCrypto instance used by the client. */
+    getCrypto(): Promise<IsomorphicCrypto>;
+    /** Returns the raw ID token string. */
+    getIdToken(): Promise<string>;
+    /** Returns the resolved OIDC provider endpoints. */
+    getOpenIDProviderEndpoints(): Promise<OIDCEndpoints>;
+    /**
+     * Returns the current access token.
+     *
+     * @param sessionId - Optional session ID.
+     */
+    getAccessToken(sessionId?: string): Promise<string>;
+    /** Returns the IDP access token from the session. */
+    getIDPAccessToken(): Promise<string>;
+    /** Returns the storage manager. */
+    getStorageManager(): StorageManager<T>;
+    /** Returns whether the user is currently signed in. */
+    isSignedIn(): Promise<boolean>;
+}
+export default AuthenticationHelper;
+//# sourceMappingURL=AuthenticationHelper.d.ts.map

package/dist/utils/AuthenticationHelper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationHelper.d.ts","sourceRoot":"","sources":["../../src/utils/AuthenticationHelper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEL,IAAI,EACJ,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,iCAAiC,EACjC,aAAa,EACb,aAAa,EAEb,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACb,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAAC,sBAAsB,EAAC,MAAM,+BAA+B,CAAC;AACrE,OAAO,SAAS,MAAM,aAAa,CAAC;AAyBpC,UAAU,gCAAgC;IACxC,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE,MAAM,EAC5B,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,sBAAsB,EAAE,MAAM,EAC9B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,iCAAiC,KAAK,OAAO,CAAC,MAAM,CAAC,GAC5E,IAAI,CAAC;IACR,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;GAKG;AACH,cAAM,oBAAoB,CAAC,CAAC;IAC1B,OAAO,CAAC,eAAe,CAAoB;IAC3C,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,kBAAkB,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,mBAAmB,CAAsC;IACjE,OAAO,CAAC,eAAe,CAA0C;IACjE,OAAO,CAAC,kBAAkB,CAAwB;IAClD,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,kBAAkB,CAA2C;IACrE,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,cAAc,CAA+E;IACrG,OAAO,CAAC,YAAY,CAAoD;IAExE;;;;;OAKG;gBAED,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE;QACV,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,kBAAkB,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QACxD,cAAc,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,SAAS,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3C,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,0BAA0B,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;QACzD,aAAa,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC;QAC5F,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAChE;IAmBH;;;;OAIG;IACI,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAItD;;;;OAIG;IACI,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IAIvD;;;;;;;;OAQG;IACI,uBAAuB,CAC5B,MAAM,EAAE,GAAG,EACX,aAAa,EAAE,aAAa,EAC5B,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EACtC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,iCAAiC,KAAK,OAAO,CAAC,MAAM,CAAC,EAC5E,uBAAuB,EAAE,gCAAgC,GACxD,IAAI;IAYP;;;;;;OAMG;IACU,aAAa,CACxB,MAAM,EAAE,sBAAsB,EAC9B,qCAAqC,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,GAC/E,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;IA4C3B;;OAEG;IACU,wBAAwB,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAU/E;;;;;OAKG;IACU,kBAAkB,CAC7B,qCAAqC,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,GAC/E,OAAO,CAAC,IAAI,CAAC;YAoBF,mBAAmB;IAqBjC;;;;;;;;;;;OAWG;IACU,WAAW,CACtB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,iBAAiB,EAChC,oBAAoB,CAAC,EAAE,OAAO,EAC9B,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC9D,kBAAkB,CAAC,EAAE,MAAM,IAAI,EAC/B,qCAAqC,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI,GAC/E,OAAO,CAAC,YAAY,CAAC;IAyExB;;;;;;;;;;OAUG;IACU,cAAc,CACzB,cAAc,EAAE,iBAAiB,EAAE,EACnC,UAAU,EAAE,UAAU,EACtB,oBAAoB,CAAC,EAAE,OAAO,EAC9B,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAC9D,kBAAkB,CAAC,EAAE,MAAM,IAAI,GAC9B,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC;IAgEtC;;;;;;;;;OASG;IACU,cAAc,CACzB,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAClG,kBAAkB,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,KACnD,OAAO,CAAC,IAAI,CAAC,EAClB,uBAAuB,EAAE,gCAAgC,EACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACnD,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IA8D1B;;;;;;;OAOG;IACU,YAAY,CACvB,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IA2C5B;;;;OAIG;IACU,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBlF,gEAAgE;IACnD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrC;;;;OAIG;IACU,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpE,gEAAgE;IACnD,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAInD,uCAAuC;IAC1B,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI1C,oDAAoD;IACvC,0BAA0B,IAAI,OAAO,CAAC,aAAa,CAAC;IAIjE;;;;OAIG;IACU,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhE,qDAAqD;IACxC,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIjD,mCAAmC;IAC5B,iBAAiB,IAAI,cAAc,CAAC,CAAC,CAAC;IAI7C,uDAAuD;IAC1C,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;CAG5C;AAED,eAAe,oBAAoB,CAAC"}

package/dist/utils/SPACryptoUtils.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { Buffer } from 'buffer';
+import { Crypto, JWKInterface } from '@thunderid/javascript';
+/**
+ * Browser-side `Crypto` implementation using native Web Crypto APIs and `jose` for JWT verification.
+ */
+declare class SPACryptoUtils implements Crypto<Buffer | string> {
+    /**
+     * Base64URL-encodes a buffer or string value.
+     *
+     * @param value - The value to encode.
+     * @returns The base64url-encoded string with padding stripped.
+     */
+    base64URLEncode(value: Buffer | string): string;
+    /**
+     * Decodes a base64url-encoded string.
+     *
+     * @param value - The base64url string to decode.
+     * @returns The decoded UTF-8 string.
+     */
+    base64URLDecode(value: string): string;
+    /**
+     * Computes the SHA-256 hash of a string.
+     *
+     * @param data - The input string to hash.
+     * @returns A `Buffer` containing the raw hash bytes.
+     */
+    hashSha256(data: string): string | Buffer;
+    /**
+     * Generates a buffer of cryptographically random bytes.
+     *
+     * @param length - Number of bytes to generate.
+     * @returns A `Buffer` of random bytes.
+     */
+    generateRandomBytes(length: number): string | Buffer;
+    /**
+     * Verifies a JWT against a JWK using `jose`.
+     *
+     * @param idToken - The raw JWT string.
+     * @param jwk - The JSON Web Key to verify against.
+     * @param algorithms - Allowed signature algorithms (e.g., `['RS256']`).
+     * @param clientId - Expected audience claim value.
+     * @param issuer - Expected issuer claim value.
+     * @param subject - Expected subject claim value.
+     * @param clockTolerance - Allowed clock skew in seconds.
+     * @param validateJwtIssuer - Whether to validate the issuer claim.
+     * @returns `true` if the token is valid.
+     */
+    verifyJwt(idToken: string, jwk: Partial<JWKInterface>, algorithms: string[], clientId: string, issuer: string, subject: string, clockTolerance?: number, validateJwtIssuer?: boolean): Promise<boolean>;
+}
+export default SPACryptoUtils;
+//# sourceMappingURL=SPACryptoUtils.d.ts.map

package/dist/utils/SPACryptoUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SPACryptoUtils.d.ts","sourceRoot":"","sources":["../../src/utils/SPACryptoUtils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,MAAM,EAAC,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAyB,MAAM,EAAE,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAMnF;;GAEG;AACH,cAAM,cAAe,YAAW,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACrD;;;;;OAKG;IACI,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAItD;;;;;OAKG;IACI,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI7C;;;;;OAKG;IACI,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAIhD;;;;;OAKG;IACI,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAI3D;;;;;;;;;;;;OAYG;IACI,SAAS,CACd,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,EAC1B,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,OAAO,CAAC;CAgCpB;AAED,eAAe,cAAc,CAAC"}

package/dist/utils/SPAHelper.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { StorageManager } from '@thunderid/javascript';
+/**
+ * Helper that manages automatic access-token refresh scheduling via `setTimeout`.
+ *
+ * @typeParam T - Browser client config type.
+ */
+declare class SPAHelper<T> {
+    private _storageManager;
+    private _isTokenRefreshLoading;
+    /**
+     * @param storageManager - The storage manager instance used to read config and session data.
+     */
+    constructor(storageManager: StorageManager<T>);
+    /**
+     * Schedules an automatic access-token refresh if `periodicTokenRefresh` is enabled in config.
+     * No-op if the feature is disabled or there is no refresh token.
+     *
+     * @param refreshAccessToken - Async callback that performs the refresh.
+     */
+    refreshAccessTokenAutomatically(refreshAccessToken: () => Promise<any>): Promise<void>;
+    /**
+     * Returns the current refresh timer ID from storage, or `-1` if none is set.
+     */
+    getRefreshTimeoutTimer(): Promise<number>;
+    /**
+     * Clears the automatic-refresh timer.
+     *
+     * @param timer - Timer ID to clear. If omitted, the stored timer ID is used.
+     */
+    clearRefreshTokenTimeout(timer?: number): Promise<void>;
+}
+export default SPAHelper;
+//# sourceMappingURL=SPAHelper.d.ts.map

package/dist/utils/SPAHelper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SPAHelper.d.ts","sourceRoot":"","sources":["../../src/utils/SPAHelper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAC,cAAc,EAAiB,MAAM,uBAAuB,CAAC;AAErE;;;;GAIG;AACH,cAAM,SAAS,CAAC,CAAC;IACf,OAAO,CAAC,eAAe,CAAoB;IAC3C,OAAO,CAAC,sBAAsB,CAAS;IAEvC;;OAEG;gBACgB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAIpD;;;;;OAKG;IACU,+BAA+B,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAkDnG;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAYtD;;;;OAIG;IACU,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAarE;AAED,eAAe,SAAS,CAAC"}