@tidecloak/js 0.14.41 → 0.14.43-staging

package/dist/types/src/index.d.ts

@@ -1,15 +1,5 @@
-export { default as IAMService } from './IAMService.js';
+export { IAMService } from './IAMService.js';
 export { default as TideCloak } from "../lib/tidecloak.js";
 export { RequestEnclave, ApprovalEnclaveNew } from "../lib/tidecloak.js";
 export { Tools, Models } from "@tideorg/js";
-export type NativeAdapter = import('./types.js').NativeAdapter;
-export type NativeTokenData = import('./types.js').NativeTokenData;
-export type NativeAuthCallbackResult = import('./types.js').NativeAuthCallbackResult;
-export type NativeEncryptionCallbackResult = import('./types.js').NativeEncryptionCallbackResult;
-export type NativeConfig = import('./types.js').NativeConfig;
-/** @typedef {import('./types.js').NativeAdapter} NativeAdapter */
-/** @typedef {import('./types.js').NativeTokenData} NativeTokenData */
-/** @typedef {import('./types.js').NativeAuthCallbackResult} NativeAuthCallbackResult */
-/** @typedef {import('./types.js').NativeEncryptionCallbackResult} NativeEncryptionCallbackResult */
-/** @typedef {import('./types.js').NativeConfig} NativeConfig */
 export { default as AdminAPI, AdminAPI as AdminAPIClass } from './AdminAPI.js';

package/docs/FRONT_CHANNEL.md

@@ -24,30 +24,15 @@ This file is required for silent session checks. It should be auto-copied when y
 <html><body><script>parent.postMessage(location.href, location.origin)</script></body></html>
 ```
 
-### 3. Create a Redirect Page
-
-Create `public/auth/redirect.html`:
-
-```html
-<!DOCTYPE html>
-<html>
-  <head><title>Redirecting...</title></head>
-  <body>
-    <p>Redirecting...</p>
-    <script>window.location.href = "/";</script>
-  </body>
-</html>
-```
-
-### 4. Initialize the SDK
+### 3. Initialize the SDK
 
 ```js
 import { IAMService } from "@tidecloak/js";
 import config from "./tidecloak.json";
 
-// Listen for events. Handlers get the event name first, then its arguments.
+// Listen for events
 IAMService
-  .on("ready", (_event, loggedIn) => {
+  .on("ready", (loggedIn) => {
     console.log("Ready! Logged in:", loggedIn);
     updateUI(loggedIn);
   })
@@ -59,39 +44,40 @@ IAMService
   });
 
 // Start the SDK
-await IAMService.initIAM(config);
+await IAMService.init(config);
 ```
 
 ### DPoP (opt-in)
 
-DPoP (sender-constrained tokens, [RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449)) binds an access token to a per-session key, so a stolen token can't be replayed. It is **opt-in**: set `useDPoP` and the SDK turns it on; omit it and the SDK requests an ordinary (unbound) token.
+DPoP (sender-constrained tokens, [RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449)) binds an access token to a per-session key, so a stolen token can't be replayed. It is **opt-in**: set `dpopConfig` and the SDK turns it on; omit it and the SDK requests an ordinary (unbound) token.
 
-> **DPoP is not a flag you can flip in isolation.** Asking for it appends `dpop_jkt` to the authorization request, and the realm then issues a token carrying `typ: "DPoP"` and `cnf.jkt`. Such a token is **invalid** if it is later presented as a plain `Authorization: Bearer …`, and the resource server answers a bare `401`. So enable DPoP only if every call that carries the token attaches a `DPoP:` proof (use `IAMService.secureFetch`, which does this for you). This is why the SDK will not turn DPoP on for you.
+> **DPoP is not a flag you can flip in isolation.** Asking for it appends `dpop_jkt` to the authorization request, and the realm then issues a token carrying `typ: "DPoP"` and `cnf.jkt`. Such a token is **invalid** if it is later presented as a plain `Authorization: Bearer …`, and the resource server answers a bare `401`. So enable DPoP only if every call that carries the token attaches a `DPoP:` proof (use `IAMService.fetch`, which does this for you). This is why the SDK will not turn DPoP on for you.
 
 ```js
 // Opt in, enforced: init fails if the realm doesn't advertise DPoP support
-await IAMService.initIAM({ ...config, useDPoP: { mode: "strict" } });
+await IAMService.init({ ...config, dpopConfig: { mode: "strict" } });
 
 // Use DPoP only when the realm supports it, otherwise fall back to bearer:
-await IAMService.initIAM({ ...config, useDPoP: { mode: "auto" } });
+await IAMService.init({ ...config, dpopConfig: { mode: "auto" } });
 
 // Pick the proof signing algorithm (default "ES256"):
-await IAMService.initIAM({ ...config, useDPoP: { mode: "strict", alg: "EdDSA" } });
+await IAMService.init({ ...config, dpopConfig: { mode: "strict", alg: "EdDSA" } });
 
 // No DPoP, a plain unbound access token (the default)
-await IAMService.initIAM({ ...config });
+await IAMService.init(config);
 ```
 
-| `useDPoP` value            | Behavior                                                                 |
-| -------------------------- | ------------------------------------------------------------------------ |
-| *(omitted)* / `false`      | **Default.** No DPoP. No `dpop_jkt`, plain unbound access token.          |
-| `{ mode: "auto" }`         | Use DPoP when the realm advertises it; otherwise fall back to bearer.    |
-| `{ mode: "strict" }`       | Enforce DPoP; init fails if the realm lacks DPoP support.                |
-| `{ mode: …, alg }`         | As above, with a specific proof algorithm (`ES256` default).            |
+| `dpopConfig` value             | Behavior                                                                  |
+| ------------------------------ | ------------------------------------------------------------------------- |
+| *(omitted)* / `false`          | **Default.** No DPoP. No `dpop_jkt`, plain unbound access token.          |
+| `{ mode: "auto" }`             | Use DPoP when the realm advertises it; otherwise fall back to bearer.     |
+| `{ mode: "strict" }`           | Enforce DPoP; init fails if the realm lacks DPoP support.                 |
+| `{ mode: …, alg }`             | As above, with a specific proof algorithm (`ES256` default).              |
+| `{ mode: …, strictStorage }`   | `true` fails init if IndexedDB is unavailable instead of using memory.    |
 
 > Your **resource server** must validate DPoP proofs for the binding to be meaningful. See [`lib/README.md`](../lib/README.md#dpop-resource-server-setup) for serving `tide_dpop_auth.html`.
 
-### 5. Add Login/Logout Buttons
+### 4. Add Login/Logout Buttons
 
 ```js
 document.getElementById("login-btn").onclick = () => IAMService.doLogin();
@@ -107,50 +93,54 @@ document.getElementById("logout-btn").onclick = () => IAMService.doLogout();
 IAMService.isLoggedIn();           // Is user logged in?
 
 // Get tokens
-await IAMService.getToken();       // Access token (for API calls)
-IAMService.getIDToken();           // ID token
+IAMService.getToken();             // Access token (for API calls)
+IAMService.getTokenExp();          // When the access token expires (Date)
 
 // Get user info
 IAMService.getName();              // Username
-IAMService.getValueFromToken("email");
-IAMService.getValueFromIDToken("name"); // getValueFromIdToken also works
+IAMService.getClaim("email");      // Any access-token claim
 
 // Check roles
 IAMService.hasRealmRole("admin");
 IAMService.hasClientRole("editor");
 
 // Auth actions
-IAMService.doLogin();
-IAMService.doLogout();
-await IAMService.updateIAMToken(); // Refresh token
+await IAMService.doLogin();
+await IAMService.doLogout();
+await IAMService.updateToken();      // Refresh if the token expires within 5s
+await IAMService.forceUpdateToken(); // Refresh now
+
+// Call an API with the access token (adds a DPoP proof when DPoP is on)
+await IAMService.fetch("/api/data", {
+  headers: { Authorization: `Bearer ${IAMService.getToken()}` },
+});
 
 // Encryption (if configured)
-await IAMService.doEncrypt([{ data: "secret", tags: ["personal"] }]);
-await IAMService.doDecrypt([{ encrypted: "...", tags: ["personal"] }]);
+await IAMService.tide.encrypt([{ data: "secret", tags: ["personal"] }]);
+await IAMService.tide.decrypt([{ encrypted: "...", tags: ["personal"] }]);
 ```
 
 ---
 
 ## Events
 
-Every handler is called with the event name first, then the event's arguments.
-
 ```js
 IAMService
-  .on("ready", (_event, loggedIn) => {
+  .on("ready", (loggedIn) => {
     // SDK is ready - loggedIn is true/false
   })
   .on("authSuccess", () => {
     // User logged in
   })
-  .on("authError", (_event, err) => {
+  .on("authError", (err) => {
     // Login failed
   })
   .on("logout", () => {
     // User logged out
   })
   .on("tokenExpired", () => {
-    // Token expired - SDK will try to refresh
+    // Token expired - refresh it
+    IAMService.updateToken();
   });
 ```
 
@@ -162,13 +152,13 @@ Protect sensitive data with tag-based encryption:
 
 ```js
 // Encrypt one or more items
-const encrypted = await IAMService.doEncrypt([
+const encrypted = await IAMService.tide.encrypt([
   { data: "10 Smith Street", tags: ["address"] },
   { data: "john@example.com", tags: ["email"] },
 ]);
 
 // Decrypt
-const decrypted = await IAMService.doDecrypt([
+const decrypted = await IAMService.tide.decrypt([
   { encrypted: encrypted[0], tags: ["address"] },
   { encrypted: encrypted[1], tags: ["email"] },
 ]);
@@ -184,22 +174,32 @@ const decrypted = await IAMService.doDecrypt([
 
 ```js
 // Wrong - objects not allowed
-await IAMService.doEncrypt([{ data: { name: "John" }, tags: ["user"] }]);
+await IAMService.tide.encrypt([{ data: { name: "John" }, tags: ["user"] }]);
 
 // Right - stringify first
-await IAMService.doEncrypt([{ data: JSON.stringify({ name: "John" }), tags: ["user"] }]);
+await IAMService.tide.encrypt([{ data: JSON.stringify({ name: "John" }), tags: ["user"] }]);
 ```
 
 ---
 
 ## Custom Redirect Path
 
-By default, users go to `/auth/redirect` after login. To change this:
+By default, users come back to the page they logged in from. To send them somewhere else:
+
+```js
+await IAMService.doLogin({ redirectUri: "https://myapp.com/callback" });
+await IAMService.doLogout({ redirectUri: "https://myapp.com/" });
+```
+
+---
+
+## Silent SSO Page Location
+
+The SDK looks for `silent-check-sso.html` at your origin root. If you serve it somewhere else, pass its URL (and register it as a valid redirect URI on the client):
 
 ```js
-await IAMService.initIAM({
-  ...config,
-  redirectUri: "https://myapp.com/callback"
+await IAMService.init(config, {
+  silentCheckSsoRedirectUri: "https://myapp.com/app/silent-check-sso.html",
 });
 ```
 
@@ -209,7 +209,7 @@ await IAMService.initIAM({
 
 **Blank page after login**
 
-Make sure you have a page at `/auth/redirect` and your redirect URI is registered in TideCloak.
+Make sure the page you return to (or the `redirectUri` you pass to `doLogin`) is registered as a valid redirect URI in TideCloak.
 
 **"silent-check-sso.html not found" or silent SSO fails**
 

package/lib/README.md

@@ -55,7 +55,13 @@ const tidecloak = new TideCloak({
 const authenticated = await tidecloak.init({
   onLoad: "login-required",
   checkLoginIframe: false,
-  useDPoP: { mode: "strict", alg: "EdDSA" },
+  dpopConfig: { mode: "strict", alg: "EdDSA" },
+});
+
+// Call DPoP-protected APIs with tidecloak.fetch. It swaps the SDK's own Bearer
+// token for `Authorization: DPoP` plus a proof; any other request goes out as-is.
+const response = await tidecloak.fetch("https://api.example.com/user", {
+  headers: { Authorization: `Bearer ${tidecloak.token}` },
 });
 ```
 **Also ensure your resource server has DPoP JWT validation - this could be through using a package like Asgard or any other open sourced SDK**
@@ -64,19 +70,9 @@ const authenticated = await tidecloak.init({
 With DPoP on, TideCloak loads `tide_dpop_auth.html` from your app's origin during login to confirm the browser holds the DPoP key. The file ships in this package and is the same for every app. Your issuer and client id go in the URL, not the file.
 
 #### 1. Serve the page
-In Next.js, or anything using web `Request`/`Response`:
-
-```javascript
-// app/tide_dpop/[...path]/route.js
-import { createDpopRoute } from "@tidecloak/js/dpop-route";
-import config from "../../../tidecloak.json";
-
-export const { GET, HEAD } = createDpopRoute({ config });
-```
-
-Use a route handler, not a proxy or middleware: common matchers skip paths containing a dot.
+This package is browser-only, so serving the page is up to your app's server or host. In Next.js, use `createDpopRoute` from [`@tidecloak/nextjs/server`](https://github.com/tide-foundation/tidecloak-js/blob/main/packages/tidecloak-nextjs/docs/FRONT_CHANNEL.md#serving-the-dpop-page).
 
-Elsewhere, serve `node_modules/@tidecloak/js/tide_dpop_auth.html` for any request to
+Anywhere else, serve `node_modules/@tidecloak/js/tide_dpop_auth.html` for any request to
 `/tide_dpop/iss/{issuer as hex}/aud/{client id as hex}/tide_dpop_auth.html`
 with these response headers:
 1. `Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-utc6UrebuHOyLd/2aiMXS/p1EDy9UZBDe/XEMKDw9Mc='; style-src 'self' 'sha256-F7OJTdJYct4J+cQfuJUoDauitndqt8pAc8EbA8gwDPU='`
@@ -164,7 +160,7 @@ There are two ways to use a policy:
 
 Pass the signed policy as the second argument. When a policy is provided, the default realm-role tag checks are skipped and the policy itself controls access.
 
-`IAMService.doEncrypt` and `IAMService.doDecrypt` take the policy the same way in front-channel mode. Native mode doesn't support policies and throws if you pass one.
+`IAMService.tide.encrypt` and `IAMService.tide.decrypt` take the policy the same way.
 
 ```javascript
 const policy = yourSignedPolicy; // Uint8Array

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tidecloak/js",
-  "version": "0.14.41",
+  "version": "0.14.43-staging",
   "description": "Vanilla JavaScript/browser SDK for TideCloak with an IAMService singleton and low-level client.",
   "type": "module",
   "main": "dist/cjs/src/index.js",
@@ -16,26 +16,6 @@
       "require": "./dist/cjs/src/index.js",
       "default": "./dist/esm/src/index.js"
     },
-    "./dpop-server": {
-      "types": "./dist/types/src/dpopServer.d.ts",
-      "import": "./dist/esm/src/dpopServer.js",
-      "require": "./dist/cjs/src/dpopServer.js"
-    },
-    "./vite": {
-      "types": "./dist/types/src/vite.d.ts",
-      "import": "./dist/esm/src/vite.js",
-      "require": "./dist/cjs/src/vite.js"
-    },
-    "./dpop-route": {
-      "types": "./dist/types/src/dpopRoute.d.ts",
-      "import": "./dist/esm/src/dpopRoute.js",
-      "require": "./dist/cjs/src/dpopRoute.js"
-    },
-    "./policy-react": {
-      "types": "./dist/types/src/policy-react.d.ts",
-      "import": "./dist/esm/src/policy-react.js",
-      "require": "./dist/cjs/src/policy-react.js"
-    },
     "./policy.css": "./dist/esm/src/policy.css"
   },
   "scripts": {
@@ -45,8 +25,7 @@
     "build:esm": "tsc -p tsconfig.esm.json",
     "build:types": "tsc -p tsconfig.types.json",
     "build:copy-css": "node scripts/copy-css.cjs",
-    "build:dpop-asset": "node scripts/gen-dpop-asset.cjs",
-    "build": "npm run build:dpop-asset && npm run build:cjs && npm run build:esm && npm run build:types && npm run build:copy-css && cp ./silent-check-sso.html dist/ && cp ./tide_dpop_auth.html dist/ && node scripts/postbuild.cjs",
+    "build": "npm run build:cjs && npm run build:esm && npm run build:types && npm run build:copy-css && cp ./silent-check-sso.html dist/ && cp ./tide_dpop_auth.html dist/ && node scripts/postbuild.cjs",
     "prepare": "npm run build"
   },
   "files": [
@@ -76,7 +55,7 @@
     "authorization"
   ],
   "dependencies": {
-    "heimdall-tide": "^0.14.41",
-    "@tideorg/js": "^0.14.29"
+    "heimdall-tide": "0.14.43-staging",
+    "@tideorg/js": "0.14.43-staging"
   }
 }

package/dist/cjs/lib/secureFetchPolicy.js

@@ -1,45 +0,0 @@
-"use strict";
-/**
- * The decision seam of `TideCloak.secureFetch`: given the caller's `Authorization`
- * header (if any) and the access token this client currently holds, should we sign
- * the request as our own - `Authorization: DPoP <token>` plus a `DPoP:` proof?
- *
- * Kept in its own dependency-free module so it can be unit-tested directly.
- * `lib/tidecloak.js` pulls in `heimdall-tide`, which cannot be loaded under plain
- * node ESM, so the predicate is unreachable from a test if it lives there - and
- * this is precisely the seam where a mistake becomes an unexplainable `401`.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.shouldAttachDpopProof = shouldAttachDpopProof;
-/**
- * @param {string|null|undefined} existingAuth - the caller's `Authorization` header.
- * @param {string} ourToken - the access token this client currently holds.
- * @returns {boolean} true -> attach `Authorization: DPoP <ourToken>` + a DPoP proof.
- *
- * Three cases:
- *
- *  - NO `Authorization` header: YES, attach. "I set no Authorization, use your
- *    token" is the entire point of calling `secureFetch` rather than `fetch`, and
- *    it is exactly what `secureFetch`'s own stale-token warning tells callers to do
- *    ("omit the Authorization header entirely and let secureFetch attach it").
- *
- *    This case used to be false, which sent the request as a plain, UNAUTHENTICATED
- *    fetch: no token, no proof, no credentials of any kind. A consumer that reads
- *    its token from an async state container and calls before that state has
- *    settled (React state that has not yet committed, say) would silently ship a
- *    credential-less admin request and get back a bare `401` naming none of this.
- *    That is the admin-API 401 this closes.
- *
- *  - OUR bearer token: YES, attach - upgrade `Bearer` to `DPoP` + proof. Unchanged.
- *
- *  - SOMEONE ELSE'S bearer token: NO. A third-party API call is a legitimate
- *    pass-through: it goes out verbatim and must never be handed one of our proofs.
- *    Unchanged. (A stale copy of one of ours lands here too, and is warned about
- *    once by the caller.)
- */
-function shouldAttachDpopProof(existingAuth, ourToken) {
-    if (existingAuth === null || existingAuth === undefined)
-        return true;
-    return existingAuth === `Bearer ${ourToken}`;
-}
-//# sourceMappingURL=secureFetchPolicy.js.map

package/dist/cjs/lib/secureFetchPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secureFetchPolicy.js","sourceRoot":"","sources":["../../../lib/secureFetchPolicy.js"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,+BAAuC,YAAY,EAAE,QAAQ;IAC3D,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,YAAY,KAAK,UAAU,QAAQ,EAAE,CAAA;AAC9C,CAAC"}

package/dist/cjs/src/dpopRoute.js

@@ -1,30 +0,0 @@
-"use strict";
-// Serves tide_dpop_auth.html at /tide_dpop/iss/<hex>/aud/<hex>/tide_dpop_auth.html.
-// Uses web Request/Response, so it drops into a Next.js route handler:
-//
-//   // app/tide_dpop/[...path]/route.js
-//   export const { GET, HEAD } = createDpopRoute({ config });
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDpopRoute = createDpopRoute;
-const dpopServer_js_1 = require("./dpopServer.js");
-/**
- * @param {Object} [options]
- * @param {Object} [options.config] TideCloak adapter config (tidecloak.json). Used to
- *   reject requests for another realm or client. Omitted or empty, it serves any.
- */
-function createDpopRoute({ config = {} } = {}) {
-    const { issuer, client } = (0, dpopServer_js_1.expectationsFromConfig)(config);
-    const handle = (request) => {
-        const result = (0, dpopServer_js_1.resolveDpopAuthRequest)({
-            pathname: new URL(request.url).pathname,
-            expectedIssuer: issuer,
-            expectedClient: client,
-            method: request.method,
-        });
-        if (!result)
-            return new Response('Not Found', { status: 404, headers: { 'Content-Type': 'text/plain' } });
-        return new Response(result.body, { status: result.status, headers: result.headers });
-    };
-    return { GET: handle, HEAD: handle };
-}
-//# sourceMappingURL=dpopRoute.js.map

package/dist/cjs/src/dpopRoute.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpopRoute.js","sourceRoot":"","sources":["../../../src/dpopRoute.js"],"names":[],"mappings":";AAAA,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,wCAAwC;AACxC,8DAA8D;;;AAE9D,mDAAiF;AAEjF;;;;GAIG;AACH,yBAAgC,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,IAAA,sCAAsB,EAAC;YACpC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;YACvC,cAAc,EAAE,MAAM;YACtB,cAAc,EAAE,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/cjs/src/dpopServer.js

@@ -1,77 +0,0 @@
-"use strict";
-// Framework-neutral core for serving tide_dpop_auth.html. No fs, crypto or
-// Buffer, so it also runs on Edge. Adapters: ./dpopRoute.js and ./vite.js.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DPOP_AUTH_CSP = exports.DPOP_AUTH_HTML = void 0;
-exports.dpopAuthHeaders = dpopAuthHeaders;
-exports.hexToUtf8 = hexToUtf8;
-exports.dpopAuthPathFor = dpopAuthPathFor;
-exports.expectationsFromConfig = expectationsFromConfig;
-exports.resolveDpopAuthRequest = resolveDpopAuthRequest;
-const dpopAuthAsset_js_1 = require("./generated/dpopAuthAsset.js");
-Object.defineProperty(exports, "DPOP_AUTH_HTML", { enumerable: true, get: function () { return dpopAuthAsset_js_1.DPOP_AUTH_HTML; } });
-Object.defineProperty(exports, "DPOP_AUTH_CSP", { enumerable: true, get: function () { return dpopAuthAsset_js_1.DPOP_AUTH_CSP; } });
-const PATH_RE = /^\/tide_dpop\/iss\/([0-9a-fA-F]+)\/aud\/([0-9a-fA-F]+)\/tide_dpop_auth\.html$/;
-// X-Frame-Options or frame-ancestors would block the enclave's embed.
-function dpopAuthHeaders() {
-    return {
-        'Content-Type': 'text/html; charset=utf-8',
-        'Content-Security-Policy': dpopAuthAsset_js_1.DPOP_AUTH_CSP,
-        'Allow-CSP-From': '*',
-        'Cache-Control': 'no-store',
-    };
-}
-function hexToUtf8(hex) {
-    if (!hex || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex))
-        return null;
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < bytes.length; i++)
-        bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
-    try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-    }
-    catch {
-        return null;
-    }
-}
-function dpopAuthPathFor(issuer, clientId) {
-    const hex = (s) => [...new TextEncoder().encode(s)].map((b) => b.toString(16).padStart(2, '0')).join('');
-    return `/tide_dpop/iss/${hex(issuer)}/aud/${hex(clientId)}/tide_dpop_auth.html`;
-}
-/**
- * Issuer and client id to accept, from a TideCloak adapter config.
- * Either is undefined when the config does not carry it (e.g. the `{}` placeholder).
- */
-function expectationsFromConfig(config = {}) {
-    const url = config['auth-server-url'];
-    return {
-        issuer: url && config.realm ? `${String(url).replace(/\/+$/, '')}/realms/${config.realm}` : undefined,
-        client: config.resource || undefined,
-    };
-}
-/**
- * The response for a request path, as `{ status, headers, body }`, or null when
- * the path is not the DPoP page. Omitted expectations are not checked.
- */
-function resolveDpopAuthRequest({ pathname, expectedIssuer, expectedClient, method = 'GET' }) {
-    const match = String(pathname !== null && pathname !== void 0 ? pathname : '').split('?')[0].match(PATH_RE);
-    if (!match)
-        return null;
-    const text = (status, body, extra = {}) => ({
-        status,
-        headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', ...extra },
-        body,
-    });
-    const verb = String(method).toUpperCase();
-    if (verb !== 'GET' && verb !== 'HEAD')
-        return text(405, 'Method Not Allowed', { Allow: 'GET, HEAD' });
-    const issuer = hexToUtf8(match[1]);
-    const client = hexToUtf8(match[2]);
-    if (issuer === null || client === null)
-        return text(400, 'Invalid hex encoding in URL');
-    if ((expectedIssuer && issuer !== expectedIssuer) || (expectedClient && client !== expectedClient)) {
-        return text(403, 'Issuer or client mismatch');
-    }
-    return { status: 200, headers: dpopAuthHeaders(), body: verb === 'HEAD' ? null : dpopAuthAsset_js_1.DPOP_AUTH_HTML };
-}
-//# sourceMappingURL=dpopServer.js.map

package/dist/cjs/src/dpopServer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpopServer.js","sourceRoot":"","sources":["../../../src/dpopServer.js"],"names":[],"mappings":";AAAA,2EAA2E;AAC3E,2EAA2E;;;;;;;;AAE3E,mEAA6E;+FAApE,iCAAc;8FAAE,gCAAa;AAItC,MAAM,OAAO,GAAG,+EAA+E,CAAC;AAEhG,sEAAsE;AACtE;IACE,OAAO;QACL,cAAc,EAAE,0BAA0B;QAC1C,yBAAyB,EAAE,gCAAa;QACxC,gBAAgB,EAAE,GAAG;QACrB,eAAe,EAAE,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,mBAA0B,GAAG;IAC3B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yBAAgC,MAAM,EAAE,QAAQ;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,OAAO,kBAAkB,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,gCAAuC,MAAM,GAAG,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtC,OAAO;QACL,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;QACrG,MAAM,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,gCAAuC,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,KAAK,EAAE;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE;QAC/F,IAAI;KACL,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEtG,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACxF,IAAI,CAAC,cAAc,IAAI,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;QACnG,OAAO,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAc,EAAE,CAAC;AACpG,CAAC"}

package/dist/cjs/src/generated/dpopAuthAsset.js

@@ -1,7 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DPOP_AUTH_CSP = exports.DPOP_AUTH_HTML = void 0;
-// Generated by scripts/gen-dpop-asset.cjs. Do not edit.
-exports.DPOP_AUTH_HTML = "<html>\n\n<head>\n    <style>\n        body {\n            margin: 0;\n            display: flex;\n            align-items: center;\n            justify-content: center;\n            height: 100vh;\n            background: #f6f6f7;\n            font-family: -apple-system, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n        }\n\n        .status {\n            text-align: center;\n            opacity: 0;\n        }\n\n        .status.visible {\n            opacity: 1;\n        }\n\n        .checkmark-circle {\n            width: 72px;\n            height: 72px;\n            margin: 0 auto 16px;\n        }\n\n        .checkmark-circle circle {\n            fill: none;\n            stroke: #039855;\n            stroke-width: 3;\n            stroke-dasharray: 201;\n            stroke-dashoffset: 201;\n        }\n\n        .checkmark-circle path {\n            fill: none;\n            stroke: #039855;\n            stroke-width: 3;\n            stroke-linecap: round;\n            stroke-linejoin: round;\n            stroke-dasharray: 50;\n            stroke-dashoffset: 50;\n        }\n\n        .status.visible .checkmark-circle circle {\n            animation: circle-draw 0.5s ease forwards;\n        }\n\n        .status.visible .checkmark-circle path {\n            animation: check-draw 0.3s 0.4s ease forwards;\n        }\n\n        .status.visible .status-text {\n            animation: fade-in 0.3s 0.6s ease forwards;\n        }\n\n        .status-text {\n            font-size: 15px;\n            color: #464647;\n            margin: 0;\n            opacity: 0;\n        }\n\n        @keyframes circle-draw {\n            to {\n                stroke-dashoffset: 0;\n            }\n        }\n\n        @keyframes check-draw {\n            to {\n                stroke-dashoffset: 0;\n            }\n        }\n\n        @keyframes fade-in {\n            to {\n                opacity: 1;\n            }\n        }\n    </style>\n</head>\n\n<body>\n    <div class=\"status\" id=\"status\">\n        <svg class=\"checkmark-circle\" viewBox=\"0 0 72 72\">\n            <circle cx=\"36\" cy=\"36\" r=\"32\" />\n            <path d=\"M22 36 l10 10 l18 -20\" />\n        </svg>\n        <p class=\"status-text\">Session verified</p>\n    </div>\n    <script>\n        const thisVersion = 1;\n\n        const hexToStr = (hex) => {\n            if (!hex || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex)) throw Error(\"Invalid hex string\");\n            const bytes = new Uint8Array(hex.length / 2);\n            for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(hex.substr(i * 2, 2), 16);\n            return new TextDecoder().decode(bytes);\n        };\n\n        const createDbName = async (issuer, clientId) => {\n            const encoder = new TextEncoder();\n            const issuerHash = Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(issuer))).slice(0, 8))\n                .map(b => b.toString(16).padStart(2, '0')).join('');\n            const clientHash = Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(clientId))).slice(0, 8))\n                .map(b => b.toString(16).padStart(2, '0')).join('');\n            return `dpop:${issuerHash}:${clientHash}`;\n        };\n\n        // Determine target window: popup has window.opener, iframe has window.parent\n        const isPopup = !!window.opener;\n        const targetWindow = window.opener || window.parent;\n\n        if (!targetWindow || targetWindow === window) {\n            document.body.textContent = \"Error: No parent or opener window found.\";\n            throw Error(\"No target window available for postMessage\");\n        }\n\n        const urlParams = new URL(window.location.href).searchParams;\n        const enclaveVersion = urlParams.get(\"version\");\n        if (!enclaveVersion) throw Error(\"No enclave version provided in url\");\n        let openerOrigin = urlParams.get(\"openerOrigin\");\n        if (!openerOrigin) throw Error(\"No opener origin provided in url\");\n        openerOrigin = new URL(decodeURIComponent(openerOrigin)).origin;\n\n        const showSuccess = () => {\n            document.getElementById('status').classList.add('visible');\n        };\n\n        const version1Flow = async () => {\n            const paths = new URL(window.location.href).pathname.split(\"/\");\n            const iss = hexToStr(paths[paths.indexOf(\"iss\") + 1]);\n            const aud = hexToStr(paths[paths.indexOf(\"aud\") + 1]);\n            const dbname = await createDbName(iss, aud);\n            let dpopKey;\n            try {\n                // Chrome 125+: requestStorageAccess({ indexedDB: true }) returns a handle\n                // whose .indexedDB factory points directly at the unpartitioned bucket.\n                // If permission was already granted (within 30 days) this resolves\n                // automatically with no prompt.\n                //\n                // In popup mode we have first-party context so we can access IndexedDB directly.\n                let idbFactory;\n                if (isPopup) {\n                    idbFactory = window.indexedDB;\n                } else {\n                    const handle = await document.requestStorageAccess({ indexedDB: true });\n                    idbFactory = handle.indexedDB;\n                }\n\n                const db = await new Promise((resolve, reject) => {\n                    const req = idbFactory.open(dbname);\n                    req.onsuccess = () => resolve(req.result);\n                    req.onerror = () => reject(req.error);\n                });\n                dpopKey = await new Promise((resolve, reject) => {\n                    const tx = db.transaction(\"main\", \"readonly\");\n                    const store = tx.objectStore(\"main\");\n                    const req = store.get(\"dpopState\");\n                    req.onsuccess = () => resolve(req.result);\n                    req.onerror = () => reject(req.error);\n                });\n                db.close();\n                if (!dpopKey || !dpopKey.keys) throw Error(\"No DPoP key found in IndexedDB\");\n            } catch (ex) {\n                const isStorageBlocked =\n                    ex?.name === \"NotAllowedError\" ||\n                    (ex instanceof DOMException && (\n                        ex.name === \"SecurityError\" ||\n                        ex.name === \"UnknownError\" ||\n                        ex.message?.includes(\"not a known object store name\")\n                    ));\n                const detail = isStorageBlocked\n                    ? \"Browser is blocking third-party storage. Please allow storage access or disable strict tracking protection.\"\n                    : \"Failed to access DPoP key from IndexedDB.\";\n                targetWindow.postMessage({ type: \"error\", message: \"db failed\", detail }, openerOrigin);\n                document.body.textContent = detail;\n                throw ex;\n            }\n\n            const challenge = () => new Promise((resolve) => {\n                const handler = (event) => {\n                    if (event.origin !== openerOrigin) return;\n                    if (event.data.type === \"challenge\") {\n                        resolve(event.data.challenge);\n                        window.removeEventListener(\"message\", handler);\n                    }\n                };\n                window.addEventListener(\"message\", handler, false);\n            });\n\n            const pre_challenge = challenge();\n\n            targetWindow.postMessage({ type: \"pageLoaded\", message: \"yay\" }, openerOrigin);\n\n            const challengeResp = await pre_challenge;\n            if (typeof challengeResp !== \"string\" || challengeResp?.length != 64) throw Error(\"Unexpect challenge format\");\n\n            const te = new TextEncoder();\n            const signatureInput = te.encode(\"dpop-auth-challenge:\" + challengeResp);\n            const algName = dpopKey.keys.privateKey.algorithm.name;\n            const signParams = algName === \"ECDSA\"\n                ? { name: \"ECDSA\", hash: { \"P-256\": \"SHA-256\", \"P-384\": \"SHA-384\", \"P-521\": \"SHA-512\" }[dpopKey.keys.privateKey.algorithm.namedCurve] }\n                : { name: algName };\n            const signature = await crypto.subtle.sign(signParams, dpopKey.keys.privateKey, signatureInput);\n\n            const publicJwk = await crypto.subtle.exportKey(\"jwk\", dpopKey.keys.publicKey);\n\n            targetWindow.postMessage({\n                type: \"challenge response\",\n                message: {\n                    dpop_public: JSON.stringify({ crv: publicJwk.crv, kty: publicJwk.kty, x: publicJwk.x, y: publicJwk.y }),\n                    signature: btoa(String.fromCharCode(...new Uint8Array(signature)))\n                }\n            }, openerOrigin);\n\n            showSuccess();\n        };\n\n        const versionFlows = new Map([[1, version1Flow]]);\n        const latestFlow = version1Flow;\n\n        (async () => {\n            if (Number(enclaveVersion) >= thisVersion) await latestFlow();\n            else {\n                const flow = versionFlows.get(Number(enclaveVersion));\n                if (!flow) throw Error(\"Cannot find supported enclave version: \" + enclaveVersion);\n                await flow();\n            }\n        })();\n    </script>\n</body>\n\n</html>";
-exports.DPOP_AUTH_CSP = "default-src 'self'; script-src 'self' 'sha256-utc6UrebuHOyLd/2aiMXS/p1EDy9UZBDe/XEMKDw9Mc='; style-src 'self' 'sha256-F7OJTdJYct4J+cQfuJUoDauitndqt8pAc8EbA8gwDPU='";
-//# sourceMappingURL=dpopAuthAsset.js.map

package/dist/cjs/src/generated/dpopAuthAsset.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpopAuthAsset.js","sourceRoot":"","sources":["../../../../src/generated/dpopAuthAsset.js"],"names":[],"mappings":";;;AAAA,wDAAwD;AAC3C,QAAA,cAAc,GAAG,uvSAAuvS,CAAC;AACzwS,QAAA,aAAa,GAAG,qKAAqK,CAAC"}

package/dist/cjs/src/policy-react.js

@@ -1,51 +0,0 @@
-"use strict";
-/**
- * @deprecated The policy editor is no longer part of @tidecloak/js. This entry
- * point is kept so existing imports still resolve; every component throws when
- * rendered. The @tidecloak/policy package it used to re-export was never
- * published to npm.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyBuilder = PolicyBuilder;
-exports.PolicyCanvas = PolicyCanvas;
-exports.PropertiesPanel = PropertiesPanel;
-exports.BlockPalette = BlockPalette;
-const moved = (name) => new Error(`${name} from "@tidecloak/js/policy-react" is no longer available: the policy editor has moved out of @tidecloak/js.`);
-/** @typedef {any} Policy */
-/** @typedef {any} PolicyBlock */
-/** @typedef {any} Model */
-/** @typedef {any} ModelField */
-/** @typedef {any} Claim */
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-function PolicyBuilder(_props) {
-    throw moved("PolicyBuilder");
-}
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-function PolicyCanvas(_props) {
-    throw moved("PolicyCanvas");
-}
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-function PropertiesPanel(_props) {
-    throw moved("PropertiesPanel");
-}
-/**
- * @deprecated The policy editor has moved out of @tidecloak/js.
- * @param {any} _props
- * @returns {never}
- */
-function BlockPalette(_props) {
-    throw moved("BlockPalette");
-}
-//# sourceMappingURL=policy-react.js.map

package/dist/cjs/src/policy-react.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-react.js","sourceRoot":"","sources":["../../../src/policy-react.js"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,CACrB,IAAI,KAAK,CACP,GAAG,IAAI,8GAA8G,CACtH,CAAC;AAEJ,4BAA4B;AAC5B,iCAAiC;AACjC,2BAA2B;AAC3B,gCAAgC;AAChC,2BAA2B;AAE3B;;;;GAIG;AACH,uBAA8B,MAAM;IAClC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,sBAA6B,MAAM;IACjC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,yBAAgC,MAAM;IACpC,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,sBAA6B,MAAM;IACjC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;AAC9B,CAAC"}

package/dist/cjs/src/types.js

@@ -1,6 +0,0 @@
-"use strict";
-/**
- * Type definitions for @tidecloak/js native mode
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/dist/cjs/src/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":";AAAA;;GAEG"}