@tidecloak/js 0.14.41 → 0.14.42-staging

package/dist/types/IAMService.d.ts

@@ -1,618 +1,67 @@
-import TideCloak, { RequestEnclave } from "../lib/tidecloak.js";
-/**
- * Singleton IAMService wrapping the TideCloak client.
- *
- * Supports three modes:
- * - **Front-channel mode**: Browser handles all token operations (standard OIDC)
- * - **Hybrid/BFF mode**: Browser handles PKCE, backend exchanges code for tokens (more secure)
- * - **Native mode**: External browser for login, app handles tokens via adapter (Electron, Tauri, React Native)
- *
- * ---
- * ## Front-channel Mode
- *
- * Handlers are called with the event name first, then the event's arguments.
- *
- * Usage A: pass an onReady callback directly
- * ```js
- * import { IAMService } from '@tidecloak/js';
- * import tidecloakConfig from './tidecloak.json';
- *
- * IAMService.initIAM(tidecloakConfig, (_event, authenticated) => {
- *   if (!authenticated) IAMService.doLogin();
- * }).catch(console.error);
- * ```
- *
- * Usage B: attach multiple listeners, then init
- * ```js
- * IAMService
- *   .on('ready', (_event, auth) => console.log('ready', auth))
- *   .on('authError', (_event, err) => console.error('Auth failed', err));
- *
- * await IAMService.initIAM(tidecloakConfig);
- * ```
- *
- * ---
- * ## Hybrid/BFF Mode (Backend-For-Frontend)
- *
- * In hybrid mode, the browser generates PKCE and redirects to the IdP, but the
- * backend exchanges the authorization code for tokens. This keeps tokens server-side
- * for improved security.
- *
- * ### Config shape:
- * ```js
- * const hybridConfig = {
- *   authMode: "hybrid",
- *   oidc: {
- *     authorizationEndpoint: "https://auth.example.com/realms/myrealm/protocol/openid-connect/auth",
- *     clientId: "my-client",
- *     redirectUri: "https://app.example.com/auth/callback",
- *     scope: "openid profile email",  // optional, defaults to "openid profile email"
- *     prompt: "login"                 // optional
- *   },
- *   tokenExchange: {
- *     endpoint: "/api/authenticate",  // Backend endpoint that exchanges code for tokens
- *     provider: "tidecloak-auth",     // optional, defaults to "tidecloak-auth"
- *     headers: () => ({               // optional, custom headers (e.g., CSRF token)
- *       "anti-csrf-token": getCSRFToken()
- *     })
- *   }
- * };
- * ```
- *
- * ### Login Page:
- * ```js
- * // Load config and trigger login
- * await IAMService.loadConfig(hybridConfig);
- * IAMService.doLogin("/dashboard");  // returnUrl after successful auth
- * ```
- *
- * ### Redirect/Callback Page:
- * ```js
- * // initIAM handles the callback automatically - exchanges code for tokens via backend
- * const authenticated = await IAMService.initIAM(hybridConfig);
- * if (authenticated) {
- *   const returnUrl = IAMService.getReturnUrl() || "/";
- *   window.location.assign(returnUrl);
- * }
- * ```
- *
- * ### Token Exchange Request Format:
- * The backend endpoint receives a POST request with:
- * ```json
- * {
- *   "accessToken": "{\"code\":\"...\",\"code_verifier\":\"...\",\"redirect_uri\":\"...\"}",
- *   "provider": "tidecloak-auth"
- * }
- * ```
- *
- * ---
- * ## Events
- * Every handler receives `(eventName, ...args)`.
- * - `ready` - Emitted when initialization completes (with authenticated boolean)
- * - `initError` - Emitted when initialization fails
- * - `authSuccess` - Emitted on successful authentication
- * - `authError` - Emitted on authentication failure
- * - `authRefreshSuccess` - Emitted when token refresh succeeds (front-channel only)
- * - `authRefreshError` - Emitted when token refresh fails (front-channel only)
- * - `logout` - Emitted on logout
- * - `tokenExpired` - Emitted when token expires (front-channel only)
- */
-declare class IAMService {
-    _tc: TideCloak | null;
-    _config: {
-        constructor: Function;
-        toString(): string;
-        toLocaleString(): string;
-        valueOf(): Object;
-        hasOwnProperty(v: PropertyKey): boolean;
-        isPrototypeOf(v: Object): boolean;
-        propertyIsEnumerable(v: PropertyKey): boolean;
-    } | null;
-    _listeners: {};
-    _hybridAuthenticated: boolean;
-    _hybridReturnUrl: string | null;
-    _hybridCallbackHandled: boolean;
-    _hybridCallbackPromise: Promise<boolean> | null;
-    _cachedCallbackData: {
-        isCallback: boolean;
-        code: string;
-        verifier: string;
-        redirectUri: any;
-        returnUrl: string;
-        provider: any;
-        error: string | null;
-        errorDescription: string | null;
-    } | {
-        isCallback: boolean;
-        code: string;
-        verifier: string;
-        redirectUri: any;
-        returnUrl: string;
-        provider: any;
-        error: null;
-        errorDescription: null;
-    } | null;
-    _nativeAdapter: any;
-    _nativeAuthenticated: boolean;
-    _nativeTokens: any;
-    _nativeCallbackUnsubscribe: any;
-    _nativeCallbackHandled: boolean;
-    _nativeCallbackPromise: Promise<boolean> | null;
-    _nativeCallbackProcessing: boolean;
-    _nativeDoken: any;
-    _nativeDokenParsed: Object | null;
-    _nativeVoucher: any;
-    _nativeRequestEnclave: RequestEnclave | null;
-    _nativeEncryptionCallbackUnsubscribe: any;
-    _pendingEncryptionRequests: Map<any, any>;
-    _dpopProvider: import("../lib/tidecloak-dpop.js").DPoPSignatureProvider | null;
-    _frontchannelInitPromise: Promise<boolean> | null;
-    constructor();
-    /**
-     * Register an event listener. The handler is called as `handler(event, ...args)`,
-     * so the event name comes first, e.g. `on('ready', (_event, authenticated) => ...)`.
-     * @param {'ready'|'initError'|'authSuccess'|'authError'|'authRefreshSuccess'|'authRefreshError'|'logout'|'tokenExpired'} event
-     * @param {Function} handler
-     * @returns {this}
-     */
-    on(event: 'ready' | 'initError' | 'authSuccess' | 'authError' | 'authRefreshSuccess' | 'authRefreshError' | 'logout' | 'tokenExpired', handler: Function): this;
-    /**
-     * Unregister an event listener.
-     * @param {string} event
-     * @param {Function} handler
-     * @returns {this}
-     */
-    off(event: string, handler: Function): this;
-    /** @private */
-    private _emit;
-    /**
-     * Check if running in hybrid mode.
-     * @returns {boolean}
-     */
-    isHybridMode(): boolean;
-    /**
-     * Check if running in native mode.
-     * @returns {boolean}
-     */
-    isNativeMode(): boolean;
-    /**
-     * Load TideCloak configuration and instantiate the client once.
-     * @param {Object} config - TideCloak configuration object.
-     * @returns {Promise<Object|null>} The loaded config, or null on failure.
-     */
-    loadConfig(config: Object): Promise<Object | null>;
-    /**
-     * Initialize the TideCloak SSO client with silent SSO check.
-     * In hybrid mode, handles the redirect callback if present.
-     * @param {Object} config - TideCloak configuration object.
-     * @param {Function} [onReady] - Optional 'ready' handler, called as `(event, authenticated)`.
-     * @returns {Promise<boolean>} true if authenticated, else false.
-     */
-    initIAM(config: Object, onReady?: Function): Promise<boolean>;
-    /**
-     * Drive the one-and-only `TideCloak.init()` for front-channel mode and emit the
-     * resulting `ready` state. Split out of {@link initIAM} so the in-flight promise
-     * can be shared with concurrent callers.
-     * @private
-     * @param {Object} config
+declare class IAMServiceImplementation {
+    #private;
+    get tide(): Readonly<{
+        encrypt: (toEncrypt: any, decryptionPolicy: any) => Promise<(string | Uint8Array<ArrayBufferLike>)[]>;
+        decrypt: (toDecrypt: any, decryptionPolicy: any) => Promise<(string | Uint8Array<ArrayBufferLike>)[]>;
+        draftEncryption: (toEncrypt: any) => Promise<Uint8Array<ArrayBufferLike>>;
+        commitEncryption: (request: any, decryptionPolicy: any) => Promise<Uint8Array<ArrayBufferLike>[]>;
+        draftDecryption: (toDecrypt: any) => Promise<Uint8Array<ArrayBufferLike>>;
+        commitDecryption: (request: any, decryptionPolicy: any) => Promise<Uint8Array<ArrayBufferLike>[]>;
+        createTideRequest: (encodedRequest: any) => Promise<Uint8Array<ArrayBufferLike>>;
+        requestTideOperatorApproval: (requests: any) => Promise<{
+            id: string;
+            request: Uint8Array;
+            status: 'approved' | 'denied' | 'pending';
+        }[]>;
+        executeSignRequest: (request: any, waitForAll: any) => Promise<any[]>;
+    }>;
+    /**
+     * Initialize from the TideCloak adapter config (tidecloak.json)
+     * @param {Record<string, any>} json The contents of tidecloak.json
+     * @param {import("../lib/tidecloak.js").TideCloakInitOptions | undefined} options Overrides the defaults
+     *   (check-sso, S256 PKCE, request enclave on, dpopConfig / checkLoginIframe from tidecloak.json, and
+     *   silentCheckSsoRedirectUri at `<origin>/silent-check-sso.html`). Apps that serve the silent SSO page
+     *   elsewhere pass their own `silentCheckSsoRedirectUri`.
      * @returns {Promise<boolean>}
      */
-    private _initFrontchannel;
-    /** @private */
-    private getTideCloakClient;
+    init(json: Record<string, any>, options: import("../lib/tidecloak.js").TideCloakInitOptions | undefined): Promise<boolean>;
     /**
-     * Write the access token to the `kcToken` cookie used by the server middleware.
-     * Uses `SameSite=Lax` to blunt CSRF (the cookie is not sent on cross-site
-     * subrequests) while still allowing the post-login top-level redirect, and
-     * marks it `Secure` whenever the page is served over HTTPS.
-     * @private
-     */
-    private _setTokenCookie;
-    /** @private */
-    private _clearTokenCookie;
-    /**
-     * Restrict a post-login return URL to a same-origin, root-relative path to
-     * prevent open-redirect. The OAuth `state` (and the sessionStorage fallback)
-     * round-trips this value and is then handed to `window.location.assign`, so an
-     * attacker-seeded absolute/protocol-relative URL ("https://evil", "//evil",
-     * "/\\evil", "javascript:...") must be rejected. Falls back to "/".
-     * @private
-     */
-    private _sanitizeReturnUrl;
-    /** @returns {Object} Loaded config */
-    getConfig(): Object;
-    /**
-     * Whether initialization has already run to completion for the current mode.
      *
-     * "Settled", not "started": while an init is still in flight this returns
-     * `false`, because the auth state it will produce does not exist yet and reading
-     * it would report a spurious logged-out state.
-     *
-     * Consumers that subscribe to events LATE (a React provider re-running its
-     * effect and re-subscribing, say) must use this to re-read the current auth
-     * state synchronously rather than waiting on a `ready` event that has already
-     * been emitted and is gone.
-     *
-     * @returns {boolean}
-     */
-    isInitialized(): boolean;
-    /** @returns {boolean} Whether there's a valid token (or session in hybrid/native mode) */
-    isLoggedIn(): boolean;
-    /**
-     * Get valid token (refreshing if needed). Resolves to `null` in native mode
-     * when no tokens are stored or a refresh fails.
-     * @returns {Promise<string|null>}
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getToken(): Promise<string | null>;
-    /**
-     * Seconds until token expiry.
-     * @returns {number}
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getTokenExp(): number;
-    /**
-     * Get ID token.
-     * @returns {string|null}
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getIDToken(): string | null;
-    /**
-     * Get username (preferred_username claim).
-     * @returns {string}
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getName(): string;
-    /**
-     * Get the return URL after successful hybrid authentication.
-     * Only available in hybrid mode after successful auth.
-     * @returns {string|null}
-     */
-    getReturnUrl(): string | null;
-    /**
-     * Check if user has a realm role.
-     * @param {string} role - the name of the role to check
-     * @returns {boolean} Whether the user has a given realm role
-     * @throws {Error} In hybrid mode (role checks not available client-side)
-     */
-    hasRealmRole(role: string): boolean;
-    /**
-     * Check if user has a client role.
-     * @param {string} role - the name of the role to check
-     * @param {string} [client] - optional client-ID (defaults to the configured adapter resource)
-     * @returns {boolean} - whether the user has that role
-     * @throws {Error} In hybrid mode (role checks not available client-side)
-     */
-    hasClientRole(role: string, client?: string): boolean;
-    /**
-     * Get custom claim from access token.
-     * @param {string} key - The name of the claim to retrieve from the Access token's payload.
-     * @returns {*} Custom claim from access token
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getValueFromToken(key: string): any;
-    /**
-     * Get custom claim from ID token.
-     * @param {string} key - The name of the claim to retrieve from the ID token's payload.
-     * @returns {*} Custom claim from ID token
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getValueFromIDToken(key: string): any;
-    /**
-     * Alias of {@link IAMService#getValueFromIDToken}, with the same casing as the React context.
-     * @param {string} key - The name of the claim to retrieve from the ID token's payload.
-     * @returns {*} Custom claim from ID token
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     */
-    getValueFromIdToken(key: string): any;
-    /**
-     * Refreshes token if expired or about to expire.
-     * @returns {Promise<boolean>}
-     * @throws {Error} In hybrid mode (token refresh handled server-side)
-     */
-    updateIAMToken(): Promise<boolean>;
-    /**
-     * Force immediate refresh (min validity = -1).
-     * @returns {Promise<boolean>}
-     * @throws {Error} In hybrid mode (token refresh handled server-side)
-     */
-    forceUpdateToken(): Promise<boolean>;
-    /**
-     * Start login redirect.
-     * In hybrid mode, initiates PKCE flow and redirects to IdP.
-     * In native mode, opens external browser with auth URL.
-     * @param {string} [returnUrl] - URL to redirect to after successful auth (hybrid/native mode)
-     * @returns {void|Promise<void>} Resolves once the redirect/external-browser flow is initiated (hybrid/native); returns void in front-channel mode.
-     */
-    doLogin(returnUrl?: string): void | Promise<void>;
-    /**
-     * Encrypt data via adapter.
-     * Not available in hybrid mode (encryption requires client-side doken).
-     * In native mode, passing a decryption policy throws.
-     * @param {{ data: string | Uint8Array, tags: string[] }[]} data - Array of objects to encrypt
-     * @param {Uint8Array} [decryption_policy] Optional policy to protect the encrypted data
-     * @returns {Promise<(string | Uint8Array)[]>} Array of encrypted values
-     */
-    doEncrypt(data: {
-        data: string | Uint8Array;
-        tags: string[];
-    }[], decryption_policy?: Uint8Array): Promise<(string | Uint8Array)[]>;
-    /**
-     * Decrypt data via adapter.
-     * Not available in hybrid mode (decryption requires client-side doken).
-     * In native mode, passing a decryption policy throws.
-     * @param {{ encrypted: string | Uint8Array, tags: string[] }[]} data - Array of objects to decrypt
-     * @param {Uint8Array} [decryption_policy] Optional policy the data was encrypted under
-     * @returns {Promise<(string | Uint8Array)[]>} Array of decrypted values
-     */
-    doDecrypt(data: {
-        encrypted: string | Uint8Array;
-        tags: string[];
-    }[], decryption_policy?: Uint8Array): Promise<(string | Uint8Array)[]>;
-    /**
-     * Draft an encryption request (two-step encryption flow).
-     * Not available in hybrid or native mode.
-     * @param {{ data: Uint8Array, tags: string[] }[]} data - Array of objects to draft encryption for
-     * @returns {Promise<Uint8Array>} Draft encryption request
-     */
-    doDraftEncryption(data: {
-        data: Uint8Array;
-        tags: string[];
-    }[]): Promise<Uint8Array>;
-    /**
-     * Commit a drafted encryption request with a specified policy.
-     * Not available in hybrid or native mode.
-     * @param {Uint8Array} request - Draft request from doDraftEncryption
-     * @param {Uint8Array} decryption_policy - Policy to protect the encrypted data
-     * @returns {Promise<Uint8Array[]>} Encrypted data
-     */
-    doCommitEncryption(request: Uint8Array, decryption_policy: Uint8Array): Promise<Uint8Array[]>;
-    /**
-     * Draft a decryption request (two-step decryption flow).
-     * Not available in hybrid or native mode.
-     * @param {{ encrypted: Uint8Array, tags: string[] }[]} data - Array of objects to draft decryption for
-     * @returns {Promise<Uint8Array>} Draft decryption request
-     */
-    doDraftDecryption(data: {
-        encrypted: Uint8Array;
-        tags: string[];
-    }[]): Promise<Uint8Array>;
-    /**
-     * Commit a drafted decryption request.
-     * Not available in hybrid or native mode.
-     * @param {Uint8Array} request - Draft request from doDraftDecryption
-     * @param {Uint8Array} decryption_policy - Policy to decrypt the data
-     * @returns {Promise<Uint8Array[]>} Decrypted data
+     * @param {import("../lib/tidecloak.js").TideCloakLoginOptions?} loginOpts
      */
-    doCommitDecryption(request: Uint8Array, decryption_policy: Uint8Array): Promise<Uint8Array[]>;
+    doLogin(loginOpts: import("../lib/tidecloak.js").TideCloakLoginOptions | null): Promise<void>;
     /**
-     * Drop-in replacement for fetch that automatically handles DPoP authentication.
-     * If the request includes a Bearer token matching the TideCloak-managed token,
-     * it's replaced with DPoP authorization and proof. Also manages resource server
-     * nonces automatically. Otherwise, behaves like regular fetch.
      *
-     * @param {string|URL|RequestInfo} url - The resource URL to fetch
-     * @param {RequestInit} [init] - Optional fetch init options (same as standard fetch)
-     * @returns {Promise<Response>} A promise that resolves to the fetch Response
-     * @throws {Error} In hybrid mode (tokens are server-side)
-     *
-     * @example
-     * ```js
-     * const token = await IAMService.getToken();
-     * const response = await IAMService.secureFetch('https://api.example.com/data', {
-     *   method: 'POST',
-     *   headers: {
-     *     'Authorization': `Bearer ${token}`,
-     *     'Content-Type': 'application/json',
-     *   },
-     *   body: JSON.stringify({ key: 'value' }),
-     * });
-     * ```
-     */
-    secureFetch(url: string | URL | RequestInfo, init?: RequestInit): Promise<Response>;
-    /**
-     * Native mode secure fetch with DPoP support.
-     * @private
-     */
-    private _nativeSecureFetch;
-    /**
-     * Logout, clear cookie/session, then redirect.
-     * In hybrid mode, clears local state and emits logout event.
-     * In native mode, deletes tokens via adapter and emits logout event.
-     */
-    doLogout(): Promise<void>;
-    /**
-     * Base URL for Tidecloak realm (no trailing slash).
-     * In hybrid mode returns empty string.
+     * @param {import("../lib/tidecloak.js").TideCloakLogoutOptions?} logoutOpts
      */
-    getBaseUrl(): any;
+    doLogout(logoutOpts: import("../lib/tidecloak.js").TideCloakLogoutOptions | null): Promise<void>;
+    getToken(): string | undefined;
     /**
-     * Start hybrid login flow: generate PKCE, store verifier, redirect to IdP.
-     * @private
-     * @param {string} returnUrl - URL to redirect to after successful auth
+     * When the access token expires, in browser time (adjusted for server clock skew).
+     * @returns {Date | undefined}
      */
-    private _startHybridLogin;
+    getTokenExp(): Date | undefined;
+    getClaim(name: any): any;
+    getName(): any;
+    hasRealmRole(role: any): boolean;
+    hasClientRole(role: any): boolean;
+    updateToken(): Promise<boolean>;
+    forceUpdateToken(): Promise<boolean>;
     /**
-     * Get hybrid callback data for custom token exchange.
-     * Use this when you need to handle token exchange with your own auth system
-     * (e.g., using a custom useLogin hook) instead of IAMService's built-in fetchJson.
-     *
-     * @param {Object} [opts] - Options
-     * @param {boolean} [opts.clearStorage=true] - Whether to clear sessionStorage after reading
-     * @param {string} [opts.redirectUri] - Override redirect URI (use when config isn't loaded)
-     * @param {string} [opts.provider] - Override provider (defaults to "tidecloak-auth")
-     * @returns {{
-     *   isCallback: boolean,
-     *   code: string,
-     *   verifier: string,
-     *   redirectUri: string,
-     *   returnUrl: string,
-     *   provider: string,
-     *   error: string|null,
-     *   errorDescription: string|null
-     * }}
      *
-     * @example
-     * // With redirectUri override (recommended for callback pages after full navigation)
-     * const data = IAMService.getHybridCallbackData({
-     *   redirectUri: process.env.KEYCLOAK_REDIRECTURI,
-     * });
-     * if (data.isCallback && data.code && data.verifier) {
-     *   login.execute({
-     *     accessToken: JSON.stringify({
-     *       code: data.code,
-     *       code_verifier: data.verifier,
-     *       redirect_uri: data.redirectUri,
-     *     }),
-     *     provider: data.provider,
-     *   });
-     * }
-     */
-    getHybridCallbackData(opts?: {
-        clearStorage?: boolean;
-        redirectUri?: string;
-        provider?: string;
-    }): {
-        isCallback: boolean;
-        code: string;
-        verifier: string;
-        redirectUri: string;
-        returnUrl: string;
-        provider: string;
-        error: string | null;
-        errorDescription: string | null;
-    };
-    /**
-     * Handle hybrid redirect callback: exchange code for tokens via backend endpoint.
-     * @private
-     * @param {Object} opts - Options
-     * @param {string} [opts.onMissingVerifierRedirectTo] - URL to redirect if verifier is missing
-     * @returns {Promise<{handled: boolean, authenticated: boolean, returnUrl: string}>}
-     */
-    private _handleHybridRedirectCallback;
-    /**
-     * Get OIDC configuration from the native config.
-     * @private
-     * @returns {{ authServerUrl: string, realm: string, clientId: string, scope: string }}
-     */
-    private _getNativeOIDCConfig;
-    /**
-     * Get encryption configuration from the native config.
-     * Automatically selects clientOriginAuth based on window.location.origin.
-     * @private
-     * @returns {{ vendorId: string, homeOrkUrl: string, clientOriginAuth: string } | null}
-     */
-    private _getNativeEncryptionConfig;
-    /**
-     * Start native login flow: generate PKCE, open external browser with auth URL.
-     * @private
-     * @param {string} returnUrl - URL to redirect to after successful auth
-     */
-    private _startNativeLogin;
-    /**
-     * Handle native auth callback: exchange code for tokens.
-     * @private
-     * @param {string} code - Authorization code from IdP
-     * @param {string} [voucher] - Optional voucher fetched during login (for encryption)
-     */
-    private _handleNativeCallback;
-    /**
-     * Refresh native token using refresh token.
-     * @private
-     * @param {string} refreshToken - The refresh token
-     * @returns {Promise<Object>} New token data
+     * @param {'ready'|'authSuccess'|'authError'|'authRefreshSuccess'|'authRefreshError'|'logout'|'tokenExpired'} event
+     * @param {*Function} callback
      */
-    private _refreshNativeToken;
+    on(event: 'ready' | 'authSuccess' | 'authError' | 'authRefreshSuccess' | 'authRefreshError' | 'logout' | 'tokenExpired', callback: any): this;
     /**
-     * Initialize the native RequestEnclave for encryption/decryption.
-     * @private
-     * @param {string} voucherDataUrl - Pre-fetched voucher as data URL
-     */
-    private _initNativeRequestEnclave;
-    /**
-     * Build the encryption page URL for external browser.
-     * This page is hosted on the TideCloak server and has session cookies.
-     * @private
-     * @param {string} operation - 'encrypt' or 'decrypt'
-     * @param {string} requestId - Unique request ID
-     * @param {string} dataBase64 - Base64-encoded data to process
-     * @param {string} tagsJson - JSON-encoded tags array
-     * @param {string} callbackUrl - URL to redirect with result
-     * @returns {string} URL to open in external browser
-     */
-    private _buildEncryptionPageUrl;
-    /**
-     * Perform an encryption operation via external browser.
-     * @private
-     * @param {'encrypt' | 'decrypt'} operation - The operation to perform
-     * @param {string} dataBase64 - Base64-encoded data to process
-     * @param {string[]} tags - Tags for the operation
-     * @returns {Promise<string>} Base64-encoded result
-     */
-    private _doExternalBrowserOperation;
-    /**
-     * Get the voucher URL for native mode.
-     * @private
-     * @returns {string} Voucher URL
-     */
-    private _getNativeVoucherUrl;
-    /**
-     * Check if user has a realm role (native mode helper).
-     * @private
-     * @param {string} role - Role to check
-     * @returns {boolean}
-     */
-    private _nativeHasRealmRole;
-    /**
-     * Native mode encryption using RequestEnclave.
-     * Uses either a pre-fetched voucher (as data URL) or the live voucherURL
-     * that the ORK iframe will fetch with session cookies.
-     * @private
-     * @param {{ data: string | Uint8Array, tags: string[] }[]} toEncrypt
-     * @returns {Promise<(string | Uint8Array)[]>}
-     */
-    private _nativeEncrypt;
-    /**
-     * Native mode decryption using RequestEnclave.
-     * Uses either a pre-fetched voucher (as data URL) or the live voucherURL
-     * that the ORK iframe will fetch with session cookies.
-     * @private
-     * @param {{ encrypted: string | Uint8Array, tags: string[] }[]} toDecrypt
-     * @returns {Promise<(string | Uint8Array)[]>}
-     */
-    private _nativeDecrypt;
-    /**
-     * Convert string to Uint8Array.
-     * @private
-     */
-    private _stringToUint8Array;
-    /**
-     * Convert Uint8Array to string.
-     * @private
-     */
-    private _stringFromUint8Array;
-    /**
-     * Convert bytes to base64.
-     * @private
-     */
-    private _bytesToBase64;
-    /**
-     * Convert base64 to bytes.
-     * @private
-     */
-    private _base64ToBytes;
-    /**
-     * Parse a JWT token and return its payload.
-     * @private
-     * @param {string} token - JWT token string
-     * @returns {Object|null} Parsed token payload or null on error
-     */
-    private _parseToken;
-    /**
-     * Cleanup native mode resources.
-     */
-    destroy(): void;
+    * Unregister an event listener.
+    * @param {string} event
+    * @param {Function} handler
+    * @returns {this}
+    */
+    off(event: string, handler: Function): this;
+    fetch(url: any, init?: {}): Promise<Response>;
+    isLoggedIn(): boolean;
 }
-declare const IAMServiceInstance: IAMService;
-export { IAMServiceInstance as IAMService };
-export default IAMServiceInstance;
+export declare const IAMService: IAMServiceImplementation;
+export {};