@tidecloak/js 0.14.41 → 0.14.42-staging

package/dist/types/lib/secureFetchPolicy.d.ts

@@ -1,37 +0,0 @@
-/**
- * The decision seam of `TideCloak.secureFetch`: given the caller's `Authorization`
- * header (if any) and the access token this client currently holds, should we sign
- * the request as our own - `Authorization: DPoP <token>` plus a `DPoP:` proof?
- *
- * Kept in its own dependency-free module so it can be unit-tested directly.
- * `lib/tidecloak.js` pulls in `heimdall-tide`, which cannot be loaded under plain
- * node ESM, so the predicate is unreachable from a test if it lives there - and
- * this is precisely the seam where a mistake becomes an unexplainable `401`.
- */
-/**
- * @param {string|null|undefined} existingAuth - the caller's `Authorization` header.
- * @param {string} ourToken - the access token this client currently holds.
- * @returns {boolean} true -> attach `Authorization: DPoP <ourToken>` + a DPoP proof.
- *
- * Three cases:
- *
- *  - NO `Authorization` header: YES, attach. "I set no Authorization, use your
- *    token" is the entire point of calling `secureFetch` rather than `fetch`, and
- *    it is exactly what `secureFetch`'s own stale-token warning tells callers to do
- *    ("omit the Authorization header entirely and let secureFetch attach it").
- *
- *    This case used to be false, which sent the request as a plain, UNAUTHENTICATED
- *    fetch: no token, no proof, no credentials of any kind. A consumer that reads
- *    its token from an async state container and calls before that state has
- *    settled (React state that has not yet committed, say) would silently ship a
- *    credential-less admin request and get back a bare `401` naming none of this.
- *    That is the admin-API 401 this closes.
- *
- *  - OUR bearer token: YES, attach - upgrade `Bearer` to `DPoP` + proof. Unchanged.
- *
- *  - SOMEONE ELSE'S bearer token: NO. A third-party API call is a legitimate
- *    pass-through: it goes out verbatim and must never be handed one of our proofs.
- *    Unchanged. (A stale copy of one of ours lands here too, and is warned about
- *    once by the caller.)
- */
-export declare function shouldAttachDpopProof(existingAuth: string | null | undefined, ourToken: string): boolean;

package/dist/types/policy-react.d.ts

@@ -1,40 +0,0 @@
-/**
- * @deprecated The policy editor is no longer part of @tidecloak/js. This entry
- * point is kept so existing imports still resolve; every component throws when
- * rendered. The @tidecloak/policy package it used to re-export was never
- * published to npm.
- */
-export type Policy = any;
-export type PolicyBlock = any;
-export type Model = any;
-export type ModelField = any;
-export type Claim = any;
-/** @typedef {any} Policy */
-/** @typedef {any} PolicyBlock */
-/** @typedef {any} Model */
-/** @typedef {any} ModelField */
-/** @typedef {any} Claim */
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function PolicyBuilder(_props: any): never;
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function PolicyCanvas(_props: any): never;
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function PropertiesPanel(_props: any): never;
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function BlockPalette(_props: any): never;

package/dist/types/src/dpopRoute.d.ts

@@ -1,11 +0,0 @@
-/**
- * @param {Object} [options]
- * @param {Object} [options.config] TideCloak adapter config (tidecloak.json). Used to
- *   reject requests for another realm or client. Omitted or empty, it serves any.
- */
-export declare function createDpopRoute({ config }?: {
-    config?: Object;
-}): {
-    GET: (request: any) => Response;
-    HEAD: (request: any) => Response;
-};

package/dist/types/src/dpopServer.d.ts

@@ -1,35 +0,0 @@
-import { DPOP_AUTH_HTML, DPOP_AUTH_CSP } from './generated/dpopAuthAsset.js';
-export { DPOP_AUTH_HTML, DPOP_AUTH_CSP };
-export declare function dpopAuthHeaders(): {
-    'Content-Type': string;
-    'Content-Security-Policy': string;
-    'Allow-CSP-From': string;
-    'Cache-Control': string;
-};
-export declare function hexToUtf8(hex: any): string | null;
-export declare function dpopAuthPathFor(issuer: any, clientId: any): string;
-/**
- * Issuer and client id to accept, from a TideCloak adapter config.
- * Either is undefined when the config does not carry it (e.g. the `{}` placeholder).
- */
-export declare function expectationsFromConfig(config?: {}): {
-    issuer: string | undefined;
-    client: any;
-};
-/**
- * The response for a request path, as `{ status, headers, body }`, or null when
- * the path is not the DPoP page. Omitted expectations are not checked.
- */
-export declare function resolveDpopAuthRequest({ pathname, expectedIssuer, expectedClient, method }: {
-    expectedClient: any;
-    expectedIssuer: any;
-    method?: string | undefined;
-    pathname: any;
-}): {
-    status: any;
-    headers: {
-        'Content-Type': string;
-        'Cache-Control': string;
-    };
-    body: any;
-} | null;

package/dist/types/src/generated/dpopAuthAsset.d.ts

@@ -1,2 +0,0 @@
-export declare const DPOP_AUTH_HTML = "<html>\n\n<head>\n    <style>\n        body {\n            margin: 0;\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            height: 100vh;\n            background: #f6f6f7;\n            font-family: -apple-system, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n        }\n\n        .status {\n            text-align: center;\n            opacity: 0;\n        }\n\n        .status.visible {\n            opacity: 1;\n        }\n\n        .checkmark-circle {\n            width: 72px;\n            height: 72px;\n            margin: 0 auto 16px;\n        }\n\n        .checkmark-circle circle {\n            fill: none;\n            stroke: #039855;\n            stroke-width: 3;\n            stroke-dasharray: 201;\n            stroke-dashoffset: 201;\n        }\n\n        .checkmark-circle path {\n            fill: none;\n            stroke: #039855;\n            stroke-width: 3;\n            stroke-linecap: round;\n            stroke-linejoin: round;\n            stroke-dasharray: 50;\n            stroke-dashoffset: 50;\n        }\n\n        .status.visible .checkmark-circle circle {\n            animation: circle-draw 0.5s ease forwards;\n        }\n\n        .status.visible .checkmark-circle path {\n            animation: check-draw 0.3s 0.4s ease forwards;\n        }\n\n        .status.visible .status-text {\n            animation: fade-in 0.3s 0.6s ease forwards;\n        }\n\n        .status-text {\n            font-size: 15px;\n            color: #464647;\n            margin: 0;\n            opacity: 0;\n        }\n\n        @keyframes circle-draw {\n            to {\n                stroke-dashoffset: 0;\n            }\n        }\n\n        @keyframes check-draw {\n            to {\n                stroke-dashoffset: 0;\n            }\n        }\n\n        @keyframes fade-in {\n            to {\n                opacity: 1;\n            }\n        }\n    </style>\n</head>\n\n<body>\n    <div class=\"status\" id=\"status\">\n        <svg class=\"checkmark-circle\" viewBox=\"0 0 72 72\">\n            <circle cx=\"36\" cy=\"36\" r=\"32\" />\n            <path d=\"M22 36 l10 10 l18 -20\" />\n        </svg>\n        <p class=\"status-text\">Session verified</p>\n    </div>\n    <script>\n        const thisVersion = 1;\n\n        const hexToStr = (hex) => {\n            if (!hex || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex)) throw Error(\"Invalid hex string\");\n            const bytes = new Uint8Array(hex.length / 2);\n            for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(hex.substr(i * 2, 2), 16);\n            return new TextDecoder().decode(bytes);\n        };\n\n        const createDbName = async (issuer, clientId) => {\n            const encoder = new TextEncoder();\n            const issuerHash = Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(issuer))).slice(0, 8))\n                .map(b => b.toString(16).padStart(2, '0')).join('');\n            const clientHash = Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(clientId))).slice(0, 8))\n                .map(b => b.toString(16).padStart(2, '0')).join('');\n            return `dpop:${issuerHash}:${clientHash}`;\n        };\n\n        // Determine target window: popup has window.opener, iframe has window.parent\n        const isPopup = !!window.opener;\n        const targetWindow = window.opener || window.parent;\n\n        if (!targetWindow || targetWindow === window) {\n            document.body.textContent = \"Error: No parent or opener window found.\";\n            throw Error(\"No target window available for postMessage\");\n        }\n\n        const urlParams = new URL(window.location.href).searchParams;\n        const enclaveVersion = urlParams.get(\"version\");\n        if (!enclaveVersion) throw Error(\"No enclave version provided in url\");\n        let openerOrigin = urlParams.get(\"openerOrigin\");\n        if (!openerOrigin) throw Error(\"No opener origin provided in url\");\n        openerOrigin = new URL(decodeURIComponent(openerOrigin)).origin;\n\n        const showSuccess = () => {\n            document.getElementById('status').classList.add('visible');\n        };\n\n        const version1Flow = async () => {\n            const paths = new URL(window.location.href).pathname.split(\"/\");\n            const iss = hexToStr(paths[paths.indexOf(\"iss\") + 1]);\n            const aud = hexToStr(paths[paths.indexOf(\"aud\") + 1]);\n            const dbname = await createDbName(iss, aud);\n            let dpopKey;\n            try {\n                // Chrome 125+: requestStorageAccess({ indexedDB: true }) returns a handle\n                // whose .indexedDB factory points directly at the unpartitioned bucket.\n                // If permission was already granted (within 30 days) this resolves\n                // automatically with no prompt.\n                //\n                // In popup mode we have first-party context so we can access IndexedDB directly.\n                let idbFactory;\n                if (isPopup) {\n                    idbFactory = window.indexedDB;\n                } else {\n                    const handle = await document.requestStorageAccess({ indexedDB: true });\n                    idbFactory = handle.indexedDB;\n                }\n\n                const db = await new Promise((resolve, reject) => {\n                    const req = idbFactory.open(dbname);\n                    req.onsuccess = () => resolve(req.result);\n                    req.onerror = () => reject(req.error);\n                });\n                dpopKey = await new Promise((resolve, reject) => {\n                    const tx = db.transaction(\"main\", \"readonly\");\n                    const store = tx.objectStore(\"main\");\n                    const req = store.get(\"dpopState\");\n                    req.onsuccess = () => resolve(req.result);\n                    req.onerror = () => reject(req.error);\n                });\n                db.close();\n                if (!dpopKey || !dpopKey.keys) throw Error(\"No DPoP key found in IndexedDB\");\n            } catch (ex) {\n                const isStorageBlocked =\n                    ex?.name === \"NotAllowedError\" ||\n                    (ex instanceof DOMException && (\n                        ex.name === \"SecurityError\" ||\n                        ex.name === \"UnknownError\" ||\n                        ex.message?.includes(\"not a known object store name\")\n                    ));\n                const detail = isStorageBlocked\n                    ? \"Browser is blocking third-party storage. Please allow storage access or disable strict tracking protection.\"\n                    : \"Failed to access DPoP key from IndexedDB.\";\n                targetWindow.postMessage({ type: \"error\", message: \"db failed\", detail }, openerOrigin);\n                document.body.textContent = detail;\n                throw ex;\n            }\n\n            const challenge = () => new Promise((resolve) => {\n                const handler = (event) => {\n                    if (event.origin !== openerOrigin) return;\n                    if (event.data.type === \"challenge\") {\n                        resolve(event.data.challenge);\n                        window.removeEventListener(\"message\", handler);\n                    }\n                };\n                window.addEventListener(\"message\", handler, false);\n            });\n\n            const pre_challenge = challenge();\n\n            targetWindow.postMessage({ type: \"pageLoaded\", message: \"yay\" }, openerOrigin);\n\n            const challengeResp = await pre_challenge;\n            if (typeof challengeResp !== \"string\" || challengeResp?.length != 64) throw Error(\"Unexpect challenge format\");\n\n            const te = new TextEncoder();\n            const signatureInput = te.encode(\"dpop-auth-challenge:\" + challengeResp);\n            const algName = dpopKey.keys.privateKey.algorithm.name;\n            const signParams = algName === \"ECDSA\"\n                ? { name: \"ECDSA\", hash: { \"P-256\": \"SHA-256\", \"P-384\": \"SHA-384\", \"P-521\": \"SHA-512\" }[dpopKey.keys.privateKey.algorithm.namedCurve] }\n                : { name: algName };\n            const signature = await crypto.subtle.sign(signParams, dpopKey.keys.privateKey, signatureInput);\n\n            const publicJwk = await crypto.subtle.exportKey(\"jwk\", dpopKey.keys.publicKey);\n\n            targetWindow.postMessage({\n                type: \"challenge response\",\n                message: {\n                    dpop_public: JSON.stringify({ crv: publicJwk.crv, kty: publicJwk.kty, x: publicJwk.x, y: publicJwk.y }),\n                    signature: btoa(String.fromCharCode(...new Uint8Array(signature)))\n                }\n            }, openerOrigin);\n\n            showSuccess();\n        };\n\n        const versionFlows = new Map([[1, version1Flow]]);\n        const latestFlow = version1Flow;\n\n        (async () => {\n            if (Number(enclaveVersion) >= thisVersion) await latestFlow();\n            else {\n                const flow = versionFlows.get(Number(enclaveVersion));\n                if (!flow) throw Error(\"Cannot find supported enclave version: \" + enclaveVersion);\n                await flow();\n            }\n        })();\n    </script>\n</body>\n\n</html>";
-export declare const DPOP_AUTH_CSP = "default-src 'self'; script-src 'self' 'sha256-utc6UrebuHOyLd/2aiMXS/p1EDy9UZBDe/XEMKDw9Mc='; style-src 'self' 'sha256-F7OJTdJYct4J+cQfuJUoDauitndqt8pAc8EbA8gwDPU='";

package/dist/types/src/policy-react.d.ts

@@ -1,40 +0,0 @@
-/**
- * @deprecated The policy editor is no longer part of @tidecloak/js. This entry
- * point is kept so existing imports still resolve; every component throws when
- * rendered. The @tidecloak/policy package it used to re-export was never
- * published to npm.
- */
-export type Policy = any;
-export type PolicyBlock = any;
-export type Model = any;
-export type ModelField = any;
-export type Claim = any;
-/** @typedef {any} Policy */
-/** @typedef {any} PolicyBlock */
-/** @typedef {any} Model */
-/** @typedef {any} ModelField */
-/** @typedef {any} Claim */
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function PolicyBuilder(_props: any): never;
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function PolicyCanvas(_props: any): never;
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function PropertiesPanel(_props: any): never;
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-export declare function BlockPalette(_props: any): never;

package/dist/types/src/types.d.ts

@@ -1,114 +0,0 @@
-/**
- * Type definitions for @tidecloak/js native mode
- */
-/**
- * Token data for native mode storage.
- */
-export interface NativeTokenData {
-    accessToken: string;
-    refreshToken: string;
-    idToken?: string;
-    /** Tide doken (delegated token) for encryption/decryption operations */
-    doken?: string;
-    expiresAt: number;
-}
-/**
- * Auth callback result from native app.
- */
-export interface NativeAuthCallbackResult {
-    code?: string;
-    error?: string;
-    errorDescription?: string;
-}
-/**
- * Native adapter interface for platform-specific operations.
- *
- * This is the MINIMAL interface developers must implement for their platform.
- * The SDK handles everything else (encryption, token management, etc.).
- *
- * @example
- * ```typescript
- * // Electron example - minimal implementation
- * const adapter: NativeAdapter = {
- *   getRedirectUri: () => 'myapp://auth/callback',
- *   openExternalUrl: (url) => shell.openExternal(url),
- *   onAuthCallback: (callback) => {
- *     ipcRenderer.on('auth-callback', (_, data) => callback(data));
- *     return () => ipcRenderer.off('auth-callback');
- *   },
- *   saveTokens: (tokens) => store.set('tokens', tokens),
- *   getTokens: () => store.get('tokens'),
- *   deleteTokens: () => store.delete('tokens'),
- * };
- * ```
- */
-export interface NativeAdapter {
-    /** Get the redirect URI for this platform (can be async for dynamic URIs) */
-    getRedirectUri: () => string | Promise<string>;
-    /** Open a URL in the external browser or popup window */
-    openExternalUrl: (url: string) => Promise<void>;
-    /** Subscribe to auth callbacks - returns cleanup function */
-    onAuthCallback: (callback: (result: NativeAuthCallbackResult) => void) => () => void;
-    /** Store tokens securely on the device */
-    saveTokens: (tokens: NativeTokenData) => Promise<boolean>;
-    /** Retrieve stored tokens */
-    getTokens: () => Promise<NativeTokenData | null>;
-    /** Delete stored tokens (logout) */
-    deleteTokens: () => Promise<boolean>;
-}
-/**
- * Native mode configuration.
- * All TideCloak configuration is here - the adapter only handles platform-specific operations.
- *
- * @example
- * ```typescript
- * import adapterConfig from './adapter.json';
- *
- * const config: NativeConfig = {
- *   authMode: 'native',
- *   adapter: myAdapter,
- *   // Spread the adapter.json config - it has all the TideCloak settings
- *   ...adapterConfig,
- * };
- * ```
- */
-export interface NativeConfig {
-    /** Must be "native" for native mode */
-    authMode: "native";
-    /** Native adapter with platform-specific implementations */
-    adapter: NativeAdapter;
-    /** Auth server URL (e.g., "http://localhost:8080") */
-    "auth-server-url": string;
-    /** Realm name */
-    realm: string;
-    /** Client ID (resource in adapter.json) */
-    resource: string;
-    /** Tide vendor ID for encryption operations */
-    vendorId?: string;
-    /** Home ORK URL (e.g., "https://ork1.tideprotocol.com") */
-    homeOrkUrl?: string;
-    /**
-     * Client origin authentication signatures.
-     * These are keyed by origin (e.g., "client-origin-auth-http://localhost:5173").
-     * The SDK automatically selects the right one based on window.location.origin.
-     */
-    [key: `client-origin-auth-${string}`]: string;
-    backgroundUrl: string;
-    logoUrl: string;
-    /** Session mode: 'online' (default) validates tokens, 'offline' accepts stored tokens */
-    sessionMode?: 'online' | 'offline';
-    /** OAuth scopes (defaults to "openid profile email") */
-    scope?: string;
-    /** JWK for token verification (from adapter.json) */
-    jwk?: {
-        keys: Array<{
-            kid: string;
-            kty: string;
-            alg: string;
-            use: string;
-            crv?: string;
-            x?: string;
-            [key: string]: unknown;
-        }>;
-    };
-}

package/dist/types/src/utils/dpopAuthPage.d.ts

@@ -1,22 +0,0 @@
-export declare function utf8ToHex(value: any): string;
-export declare function buildDpopAuthUrl({ origin, authServerUrl, realm, clientId }: {
-    authServerUrl: any;
-    clientId: any;
-    origin: any;
-    realm: any;
-}): string | null;
-export declare function probeDpopAuthPage({ url, fetchImpl, timeoutMs }: {
-    fetchImpl?: typeof fetch | undefined;
-    timeoutMs?: number | undefined;
-    url: any;
-}): Promise<{
-    outcome: string;
-    missing?: undefined;
-} | {
-    outcome: string;
-    missing: string[];
-}>;
-export declare function preflightDpopAuthPage({ logger, ...params }: {
-    [x: string]: any;
-    logger?: Console | undefined;
-}): Promise<string>;

package/dist/types/src/utils/fetch.d.ts

@@ -1,11 +0,0 @@
-/**
- * Fetch utilities for HTTP requests.
- */
-/**
- * Fetch JSON with credentials included.
- * @param {string} url - URL to fetch
- * @param {RequestInit} [options={}] - Fetch options
- * @returns {Promise<any>} Parsed JSON response
- * @throws {Error} If request fails (with status and body properties)
- */
-export declare function fetchJson(url: string, options?: RequestInit): Promise<any>;

package/dist/types/src/utils/index.d.ts

@@ -1,5 +0,0 @@
-export { makePkce, randomPkceVerifier, base64UrlEncode } from './pkce.js';
-export { fetchJson } from './fetch.js';
-export { resolveSilentCheckSsoRedirectUri, SILENT_CHECK_SSO_FILENAME } from './silentCheckSso.js';
-export { buildInitOptions } from './initOptions.js';
-export { preflightDpopAuthPage } from './dpopAuthPage.js';

package/dist/types/src/utils/initOptions.d.ts

@@ -1,69 +0,0 @@
-/**
- * Builds the options object handed to `TideCloak.init()` from a caller's
- * resolved TideCloak config.
- *
- * ## Why this is an ALLOWLIST, deliberately
- *
- * `IAMService.initIAM` has always built these options as an allowlist: it reads
- * a handful of keys off the config and drops everything else on the floor. The
- * config object is NOT a `KeycloakInitOptions` bag - it is an adapter/config
- * snapshot (`tidecloak.json` + Tide fields + app-level OIDC hints), and callers
- * legitimately put keys in it that are meaningful to `IAMService` (or to their
- * own code) but that must NOT be handed to `init()`.
- *
- * PR #91 widened this allowlist to also forward `redirectUri`,
- * `silentCheckSsoFallback`, `silentCheckSsoTimeout`, `scope` and a
- * caller-supplied `pkceMethod`, on the reasoning that "each is inert unless the
- * caller sets it". That reasoning is wrong in one important direction: consumers
- * had been shipping configs with these keys set for as long as the keys were
- * being SWALLOWED, so their behaviour was pinned to the SDK's defaults, not to
- * the value in their config. Forwarding them is therefore a silent behaviour
- * change for every existing consumer - the exact opposite of inert.
- *
- * `scope` is the sharpest edge: forwarding it rewrites the authorization
- * request's scope, which changes the audience/roles on the issued access token
- * and can strip a consumer's admin-API access.
- *
- * So: forward ONLY what the SDK genuinely needs, and keep the previously
- * defaulted behaviour byte-for-byte. Any option that a consumer should be able
- * to set must be added here CONSCIOUSLY, with its prior default preserved.
- *
- * ### Forwarded
- * - `setupRequestEnclave` - passed through from the `initIAM` argument.
- * - `onLoad` - always `"check-sso"`. NOT taken from config: callers (e.g. the
- *   admin console) set `onLoad: "login-required"`, and honouring it would send
- *   `#processInit` down the full-redirect branch and never run silent check-sso
- *   at all. That is a separate product decision.
- * - `silentCheckSsoRedirectUri` - the resolved URI (see ./silentCheckSso.js).
- *   This is the ONE option PR #91 needed to make caller-supplied, and it stays.
- *   `undefined` => TideCloak skips silent check-sso and falls back to an
- *   interactive login rather than emitting a URI that would 400.
- * - `pkceMethod` - always `"S256"`, as it was before PR #91.
- * - `useDPoP` / `checkLoginIframe` - the two options `initIAM` has always
- *   forwarded. `useDPoP` is forwarded ONLY when the caller actually set it, and
- *   VERBATIM. DPoP is opt-in: nothing upstream may default it on, because
- *   enabling it appends `dpop_jkt` to the authorization request and the realm
- *   then issues a `cnf.jkt`-BOUND token, which a plain-Bearer consumer cannot
- *   use (RFC 9449) - a bare `401` with no explanation. Pinned in
- *   test/bootstrapDpop.test.js.
- *
- * ### Deliberately NOT forwarded (regression-tested in test/initOptions.test.js)
- * `scope`, `redirectUri`, `silentCheckSsoFallback`, `silentCheckSsoTimeout`.
- * Consumers depend on the SDK's defaults for these. `redirectUri` in particular
- * is still READ from config by `IAMService.doLogin` / `doLogout` and is used as
- * a derivation source for `silentCheckSsoRedirectUri`, so a sub-path-hosted app
- * still gets a correct login redirect - it just does not have `kc.redirectUri`
- * overridden at init time.
- *
- * @param {Object} args
- * @param {Object|null|undefined} args.config Resolved TideCloak config.
- * @param {boolean} args.setupRequestEnclave
- * @param {string|undefined} args.silentCheckSsoRedirectUri Resolved URI, or
- *   `undefined` when no correct URI could be derived.
- * @returns {Object} Options for `TideCloak.init()`.
- */
-export declare function buildInitOptions({ config, setupRequestEnclave, silentCheckSsoRedirectUri, }: {
-    config: Object | null | undefined;
-    setupRequestEnclave: boolean;
-    silentCheckSsoRedirectUri: string | undefined;
-}): Object;

package/dist/types/src/utils/pkce.d.ts

@@ -1,24 +0,0 @@
-/**
- * PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0 authorization code flow.
- */
-/**
- * Generate random PKCE verifier string.
- * @param {number} len - Length of the verifier (default 96)
- * @returns {string} Random verifier string
- */
-export declare function randomPkceVerifier(len?: number): string;
-/**
- * Base64 URL encode an ArrayBuffer.
- * @param {ArrayBuffer} arrayBuffer - Buffer to encode
- * @returns {string} Base64 URL encoded string
- */
-export declare function base64UrlEncode(arrayBuffer: ArrayBuffer): string;
-/**
- * Generate PKCE verifier and challenge.
- * @returns {Promise<{verifier: string, challenge: string, method: string}>}
- */
-export declare function makePkce(): Promise<{
-    verifier: string;
-    challenge: string;
-    method: string;
-}>;

package/dist/types/src/utils/silentCheckSso.d.ts

@@ -1,82 +0,0 @@
-/**
- * Resolution of the silent-check-SSO redirect URI.
- *
- * ## Why this exists
- *
- * `IAMService.initIAM` used to hardcode:
- *
- * ```js
- * silentCheckSsoRedirectUri: `${window.location.origin}/silent-check-sso.html`
- * ```
- *
- * That is only correct for an app served from the ORIGIN ROOT. For any app
- * hosted under a sub-path (e.g. a console served at
- * `https://host/realms/<realm>/tide-console/`) the origin-root URI is:
- *
- *   - NOT served (there is no file at `/silent-check-sso.html`), and
- *   - NOT a registered `redirectUri` on the OIDC client,
- *
- * so the authorization request fails with `400 Invalid parameter: redirect_uri`.
- * The silent iframe then never posts back and the app hangs on its bootstrap
- * spinner. A silently-wrong URI is the worst possible outcome, so this module
- * either derives a CORRECT base-aware URI or reports that it cannot, letting
- * the caller fail loud and fall back to a redirect-based login.
- *
- * ## Resolution order
- *
- * 1. **Caller-supplied `silentCheckSsoRedirectUri`** - always wins, verbatim.
- * 2. **`<base href>`** - the standard way a sub-path-hosted SPA declares where
- *    it lives. Resolved via the browser's own `document.baseURI`.
- * 3. **The app's configured OIDC `redirectUri`** - the SDK already requires this
- *    to be base-aware and registered, so it is a sound source of truth for the
- *    app's base. The SDK's own convention is `<base>auth/redirect`, which is
- *    stripped to recover `<base>` exactly; any other redirect path is resolved
- *    relative to its own directory.
- * 4. **Origin root** - only when the app declares NEITHER a base NOR a
- *    redirectUri. Such an app is relying on the SDK's origin-root default
- *    redirectUri (`${origin}/auth/redirect`) and is therefore root-hosted by
- *    construction. This preserves the historical behaviour for every existing
- *    root-hosted consumer.
- *
- * Anything that cannot be resolved (cross-origin or malformed redirectUri)
- * returns `uri: undefined` plus a `reason`, so the caller can log an error and
- * SKIP the silent check rather than emit a URI that will 400.
- */
-/** Filename the SDK ships and that hosting providers are expected to serve. */
-export declare const SILENT_CHECK_SSO_FILENAME = "silent-check-sso.html";
-export type SilentCheckSsoResolution = {
-    /**
-     * The resolved URI, or undefined if none could be derived.
-     */
-    uri: string | undefined;
-    source: 'config' | 'base-href' | 'redirect-uri-convention' | 'redirect-uri' | 'origin-root' | 'none';
-    /**
-     * Why resolution failed (only when `uri` is undefined).
-     */
-    reason?: string;
-};
-/**
- * @typedef {object} SilentCheckSsoResolution
- * @property {string|undefined} uri    The resolved URI, or undefined if none could be derived.
- * @property {'config'|'base-href'|'redirect-uri-convention'|'redirect-uri'|'origin-root'|'none'} source
- * @property {string} [reason]         Why resolution failed (only when `uri` is undefined).
- */
-/**
- * Resolve the silent-check-SSO redirect URI.
- *
- * Pure: every environment input is passed in explicitly, so this is unit-testable
- * with no DOM. See the module docblock for the resolution order.
- *
- * @param {object} params
- * @param {string} params.origin        The app's origin (`window.location.origin`).
- * @param {string} [params.configured]  Caller-supplied `silentCheckSsoRedirectUri`.
- * @param {string} [params.baseHref]    `document.baseURI`, but ONLY when a `<base href>` element exists.
- * @param {string} [params.redirectUri] Caller-supplied OIDC `redirectUri`.
- * @returns {SilentCheckSsoResolution}
- */
-export declare function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref, redirectUri }?: {
-    origin: string;
-    configured?: string;
-    baseHref?: string;
-    redirectUri?: string;
-}): SilentCheckSsoResolution;

package/dist/types/src/vite.d.ts

@@ -1,13 +0,0 @@
-/**
- * @param {Object} [options]
- * @param {Object} [options.config] TideCloak adapter config (tidecloak.json). Used to
- *   reject requests for another realm or client.
- */
-export declare function tideDpopPlugin({ config }?: {
-    config?: Object;
-}): {
-    name: string;
-    configureServer: (server: any) => void;
-    configurePreviewServer: (server: any) => void;
-};
-export default tideDpopPlugin;

package/dist/types/types.d.ts

@@ -1,114 +0,0 @@
-/**
- * Type definitions for @tidecloak/js native mode
- */
-/**
- * Token data for native mode storage.
- */
-export interface NativeTokenData {
-    accessToken: string;
-    refreshToken: string;
-    idToken?: string;
-    /** Tide doken (delegated token) for encryption/decryption operations */
-    doken?: string;
-    expiresAt: number;
-}
-/**
- * Auth callback result from native app.
- */
-export interface NativeAuthCallbackResult {
-    code?: string;
-    error?: string;
-    errorDescription?: string;
-}
-/**
- * Native adapter interface for platform-specific operations.
- *
- * This is the MINIMAL interface developers must implement for their platform.
- * The SDK handles everything else (encryption, token management, etc.).
- *
- * @example
- * ```typescript
- * // Electron example - minimal implementation
- * const adapter: NativeAdapter = {
- *   getRedirectUri: () => 'myapp://auth/callback',
- *   openExternalUrl: (url) => shell.openExternal(url),
- *   onAuthCallback: (callback) => {
- *     ipcRenderer.on('auth-callback', (_, data) => callback(data));
- *     return () => ipcRenderer.off('auth-callback');
- *   },
- *   saveTokens: (tokens) => store.set('tokens', tokens),
- *   getTokens: () => store.get('tokens'),
- *   deleteTokens: () => store.delete('tokens'),
- * };
- * ```
- */
-export interface NativeAdapter {
-    /** Get the redirect URI for this platform (can be async for dynamic URIs) */
-    getRedirectUri: () => string | Promise<string>;
-    /** Open a URL in the external browser or popup window */
-    openExternalUrl: (url: string) => Promise<void>;
-    /** Subscribe to auth callbacks - returns cleanup function */
-    onAuthCallback: (callback: (result: NativeAuthCallbackResult) => void) => () => void;
-    /** Store tokens securely on the device */
-    saveTokens: (tokens: NativeTokenData) => Promise<boolean>;
-    /** Retrieve stored tokens */
-    getTokens: () => Promise<NativeTokenData | null>;
-    /** Delete stored tokens (logout) */
-    deleteTokens: () => Promise<boolean>;
-}
-/**
- * Native mode configuration.
- * All TideCloak configuration is here - the adapter only handles platform-specific operations.
- *
- * @example
- * ```typescript
- * import adapterConfig from './adapter.json';
- *
- * const config: NativeConfig = {
- *   authMode: 'native',
- *   adapter: myAdapter,
- *   // Spread the adapter.json config - it has all the TideCloak settings
- *   ...adapterConfig,
- * };
- * ```
- */
-export interface NativeConfig {
-    /** Must be "native" for native mode */
-    authMode: "native";
-    /** Native adapter with platform-specific implementations */
-    adapter: NativeAdapter;
-    /** Auth server URL (e.g., "http://localhost:8080") */
-    "auth-server-url": string;
-    /** Realm name */
-    realm: string;
-    /** Client ID (resource in adapter.json) */
-    resource: string;
-    /** Tide vendor ID for encryption operations */
-    vendorId?: string;
-    /** Home ORK URL (e.g., "https://ork1.tideprotocol.com") */
-    homeOrkUrl?: string;
-    /**
-     * Client origin authentication signatures.
-     * These are keyed by origin (e.g., "client-origin-auth-http://localhost:5173").
-     * The SDK automatically selects the right one based on window.location.origin.
-     */
-    [key: `client-origin-auth-${string}`]: string;
-    backgroundUrl: string;
-    logoUrl: string;
-    /** Session mode: 'online' (default) validates tokens, 'offline' accepts stored tokens */
-    sessionMode?: 'online' | 'offline';
-    /** OAuth scopes (defaults to "openid profile email") */
-    scope?: string;
-    /** JWK for token verification (from adapter.json) */
-    jwk?: {
-        keys: Array<{
-            kid: string;
-            kty: string;
-            alg: string;
-            use: string;
-            crv?: string;
-            x?: string;
-            [key: string]: unknown;
-        }>;
-    };
-}