@witsauth/react-native-client 0.0.0-stage → 1.0.1

package/README.md

@@ -1,3 +1,195 @@
-# Temporary Holding Version
+# @witsauth/react-native-client
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official React Native SDK for **WitsAuth** OAuth 2.0 + PKCE authentication, token lifecycle management, Axios interceptor integration, and hosted Account Management on **Android** and **iOS** (supporting both **Expo** and **Bare React Native CLI**).
+
+---
+
+## Features
+
+- **RFC 8252 System Browser OAuth 2.0 + PKCE (`S256`)**: Uses `ASWebAuthenticationSession` on iOS and Chrome Custom Tabs on Android.
+- **Hermes-Ready Pure-TS SHA-256 PKCE**: Works out-of-the-box on React Native Hermes without requiring native Web Crypto polyfills.
+- **Hardware-Backed Secure Token Storage**: Built-in adapters for `expo-secure-store` (Expo) and `react-native-keychain` (Bare React Native CLI), backed by iOS Keychain and Android Keystore.
+- **Automatic Token Refresh**: Proactively refreshes expiring tokens and refreshes automatically when the app returns to the foreground (`AppState`).
+- **Hosted Account Management (`/auth/account`)**: Allows users to change their password, update their profile, and verify their mobile phone number via OTP using a single-use handoff ticket (`navigateToAccountManagement()`).
+- **Axios Interceptor**: Automatically attaches `Authorization: Bearer <token>` and queues/retries concurrent `401 Unauthorized` requests.
+
+---
+
+## 1. WitsAuth Console Configuration
+
+1. Open the **WitsAuth Console** and create or edit a **Regular Web / Mobile Application**.
+2. Set **Framework** to **React Native (Mobile)**.
+3. Add your mobile deep-link callback URI under **Allowed Callback URLs**, for example:
+   ```text
+   myapp://auth/callback
+   ```
+
+---
+
+## 2. Installation & Setup
+
+### Option A: Expo (Managed or Prebuild Workflow)
+
+```bash
+npx expo install @witsauth/react-native-client expo-web-browser expo-secure-store
+```
+
+Configure your custom scheme in `app.json`:
+
+```json
+{
+  "expo": {
+    "name": "My App",
+    "slug": "my-app",
+    "scheme": "myapp"
+  }
+}
+```
+
+Initialize `AuthProvider` in your app root:
+
+```tsx
+import React from 'react';
+import { AppState } from 'react-native';
+import * as WebBrowser from 'expo-web-browser';
+import * as SecureStore from 'expo-secure-store';
+import {
+  AuthProvider,
+  createExpoSecureStoreAdapter,
+  createExpoWebBrowserLauncher,
+  OAuth2NativeConfig
+} from '@witsauth/react-native-client';
+
+WebBrowser.maybeCompleteAuthSession();
+
+const authConfig: OAuth2NativeConfig = {
+  clientId: 'YOUR_CLIENT_ID',
+  authorizationEndpoint: 'https://your-tenant.witsauth.com/auth/authorize',
+  tokenEndpoint: 'https://your-tenant.witsauth.com/oauth/token',
+  revokeEndpoint: 'https://your-tenant.witsauth.com/oauth/revoke',
+  redirectUri: 'myapp://auth/callback',
+  scope: 'openid profile email offline_access',
+  storage: createExpoSecureStoreAdapter(SecureStore),
+  openAuthSession: createExpoWebBrowserLauncher(WebBrowser)
+};
+
+export default function App() {
+  return (
+    <AuthProvider
+      config={authConfig}
+      subscribeAppState={(listener) => {
+        const sub = AppState.addEventListener('change', listener);
+        return () => sub.remove();
+      }}
+    >
+      {/* Your App Navigation */}
+    </AuthProvider>
+  );
+}
+```
+
+---
+
+### Option B: Bare React Native CLI (Android & iOS)
+
+```bash
+npm install @witsauth/react-native-client react-native-inappbrowser-reborn react-native-keychain
+cd ios && pod install
+```
+
+#### Android Deep-Link Configuration (`android/app/src/main/AndroidManifest.xml`)
+
+Add an `<intent-filter>` inside your main `<activity>`:
+
+```xml
+<intent-filter>
+  <action android:name="android.intent.action.VIEW" />
+  <category android:name="android.intent.category.DEFAULT" />
+  <category android:name="android.intent.category.BROWSABLE" />
+  <data android:scheme="myapp" android:host="auth" android:pathPrefix="/callback" />
+</intent-filter>
+```
+
+#### iOS Deep-Link Configuration (`ios/<YourApp>/Info.plist`)
+
+Register `CFBundleURLTypes`:
+
+```xml
+<key>CFBundleURLTypes</key>
+<array>
+  <dict>
+    <key>CFBundleTypeRole</key>
+    <string>Editor</string>
+    <key>CFBundleURLName</key>
+    <string>com.yourcompany.myapp</string>
+    <key>CFBundleURLSchemes</key>
+    <array>
+      <string>myapp</string>
+    </array>
+  </dict>
+</array>
+```
+
+Initialize `AuthProvider` with `react-native-keychain` and `react-native-inappbrowser-reborn`:
+
+```tsx
+import React from 'react';
+import { AppState } from 'react-native';
+import InAppBrowser from 'react-native-inappbrowser-reborn';
+import * as Keychain from 'react-native-keychain';
+import {
+  AuthProvider,
+  createKeychainStorageAdapter,
+  createInAppBrowserLauncher,
+  OAuth2NativeConfig
+} from '@witsauth/react-native-client';
+
+const authConfig: OAuth2NativeConfig = {
+  clientId: 'YOUR_CLIENT_ID',
+  authorizationEndpoint: 'https://your-tenant.witsauth.com/auth/authorize',
+  tokenEndpoint: 'https://your-tenant.witsauth.com/oauth/token',
+  revokeEndpoint: 'https://your-tenant.witsauth.com/oauth/revoke',
+  redirectUri: 'myapp://auth/callback',
+  scope: 'openid profile email offline_access',
+  storage: createKeychainStorageAdapter(Keychain),
+  openAuthSession: createInAppBrowserLauncher(InAppBrowser)
+};
+```
+
+---
+
+## 3. Using `useAuth()` for Login, Logout & Account Management
+
+```tsx
+import React from 'react';
+import { View, Button, Text } from 'react-native';
+import { useAuth } from '@witsauth/react-native-client';
+
+export function ProfileScreen() {
+  const {
+    isAuthenticated,
+    isLoading,
+    login,
+    logout,
+    navigateToAccountManagement
+  } = useAuth();
+
+  if (isLoading) {
+    return <Text>Loading...</Text>;
+  }
+
+  if (!isAuthenticated) {
+    return <Button title="Sign In with WitsAuth" onPress={login} />;
+  }
+
+  return (
+    <View>
+      <Button
+        title="Manage Account (Password & Phone)"
+        onPress={navigateToAccountManagement}
+      />
+      <Button title="Sign Out" onPress={logout} />
+    </View>
+  );
+}
+```

package/dist/axios/interceptor.d.ts

@@ -0,0 +1,13 @@
+import { AxiosInstance } from 'axios';
+import { AuthClient } from '../core/AuthClient';
+export interface InterceptorOptions {
+    /**
+     * Optional callback triggered when token refresh fails completely (e.g., refresh token expired).
+     */
+    onUnauthorized?: () => void;
+    /**
+     * Specify URLs that should NOT have the Authorization header injected.
+     */
+    excludeUrls?: (string | RegExp)[];
+}
+export declare function setupAxiosInterceptors(axiosInstance: AxiosInstance, authClient: AuthClient, options?: InterceptorOptions): () => void;

package/dist/core/AuthClient.d.ts

@@ -0,0 +1,48 @@
+import { AuthorizeOptions, LogoutOptions, OAuth2NativeConfig, TokenInfo, UserProfile } from '../models/types';
+import { NativeTokenStorage } from './storage';
+export declare class AuthClient {
+    private config;
+    private storage;
+    private refreshPromise;
+    constructor(config: OAuth2NativeConfig, storage?: NativeTokenStorage);
+    /**
+     * Hydrates the in-memory token cache from the underlying async secure storage.
+     * Called automatically by `AuthProvider` on mount.
+     */
+    initialize(): Promise<void>;
+    log(level: 'error' | 'warn' | 'info' | 'debug', ...args: unknown[]): void;
+    /**
+     * Builds the OAuth 2.0 + PKCE authorization URL and persists `code_verifier`, `state`, and `nonce`.
+     */
+    buildAuthorizationUrl(options?: AuthorizeOptions): Promise<string>;
+    /**
+     * Launches the system authentication browser (`ASWebAuthenticationSession` on iOS / Chrome Custom Tabs on Android),
+     * intercepts the deep-link callback (`redirectUri`), validates `state`, and exchanges `code` + `code_verifier` for tokens.
+     */
+    authorize(options?: AuthorizeOptions): Promise<TokenInfo>;
+    /**
+     * Parses a redirect callback URL (`myapp://auth/callback?code=...&state=...`) and exchanges the code for tokens.
+     */
+    handleCallbackUrl(callbackUrl: string): Promise<TokenInfo>;
+    exchangeCodeForTokens(code: string, state: string): Promise<TokenInfo>;
+    refreshAccessToken(): Promise<TokenInfo>;
+    private saveTokenInfo;
+    getAccessToken(): string | null;
+    getIdToken(): string | null;
+    getUserProfile<T extends UserProfile = UserProfile>(): T | null;
+    getRefreshToken(): string | null;
+    getExpiresAt(): number | null;
+    isAuthenticated(): boolean;
+    /**
+     * Opens the hosted WitsAuth Account Management portal (`/auth/account`) in the native secure browser
+     * using a short-lived single-use ticket (`POST /auth/account/ticket`), allowing the user to change
+     * their password, update their profile, or verify their mobile phone number via OTP.
+     */
+    navigateToAccountManagement(): Promise<void>;
+    /**
+     * Clears tokens from secure storage and revokes both refresh_token and access_token at `revokeEndpoint`.
+     * If `options.clearBrowserSession` is true and `logoutEndpoint` + `openAuthSession` are configured,
+     * launches the system browser to terminate the WitsAuth web session cookie.
+     */
+    logout(options?: LogoutOptions): Promise<void>;
+}

package/dist/core/browser.d.ts

@@ -0,0 +1,29 @@
+import { BrowserSessionLauncher } from '../models/types';
+/**
+ * Creates a `BrowserSessionLauncher` using Expo's `expo-web-browser` module.
+ */
+export declare function createExpoWebBrowserLauncher(webBrowserModule: {
+    openAuthSessionAsync: (url: string, redirectUrl?: string) => Promise<{
+        type: string;
+        url?: string;
+    }>;
+}): BrowserSessionLauncher;
+/**
+ * Creates a `BrowserSessionLauncher` using `react-native-inappbrowser-reborn` for Bare React Native CLI apps.
+ */
+export declare function createInAppBrowserLauncher(inAppBrowserModule: {
+    isAvailable: () => Promise<boolean>;
+    openAuth: (url: string, redirectUrl: string, options?: Record<string, unknown>) => Promise<{
+        type: string;
+        url?: string;
+    }>;
+}): BrowserSessionLauncher;
+/**
+ * Parses `code`, `state`, `error`, and `error_description` from a custom-scheme or HTTPS callback URL.
+ */
+export declare function parseCallbackUrl(callbackUrl: string): {
+    code: string | null;
+    state: string | null;
+    error: string | null;
+    errorDescription: string | null;
+};

package/dist/core/pkce.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Hermes-compatible PKCE (RFC 7636) utilities.
+ * Uses Web Crypto API when available, and falls back to a pure-TypeScript
+ * FIPS 180-4 SHA-256 implementation so S256 works out-of-the-box on React Native
+ * Hermes without requiring native crypto polyfills.
+ */
+/**
+ * Pure-TypeScript FIPS 180-4 SHA-256 digest.
+ */
+export declare function sha256Bytes(asciiOrUtf8: string): Uint8Array;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function getRandomBytes(length: number): Uint8Array;
+export declare function decodeJwtPayload<T = Record<string, unknown>>(token: string | null | undefined): T | null;
+export declare function generateRandomString(length?: number): string;
+export declare function generateCodeVerifier(): string;
+export declare function generateState(): string;
+export declare function createCodeChallenge(verifier: string): Promise<string>;

package/dist/core/storage.d.ts

@@ -0,0 +1,51 @@
+import { OAuth2AsyncStorage } from '../models/types';
+/**
+ * Wraps an asynchronous native secure store (e.g., Expo SecureStore or React Native Keychain)
+ * with a synchronous in-memory read cache. Once `hydrate()` resolves on startup,
+ * `getAccessToken()` and `isAuthenticated()` are synchronous while all mutations
+ * persist asynchronously to the native keychain/keystore.
+ */
+export declare class NativeTokenStorage {
+    private backend;
+    private cache;
+    private hydrated;
+    private hydratePromise;
+    constructor(customStorage?: OAuth2AsyncStorage);
+    hydrate(): Promise<void>;
+    getItemSync(key: string): string | null;
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+    clearTemporary(): Promise<void>;
+    clearTokens(): Promise<void>;
+}
+export declare function createMemoryStorageAdapter(): OAuth2AsyncStorage;
+/**
+ * Helper to create a storage adapter backed by `expo-secure-store`.
+ * Automatically splits values exceeding 2000 bytes across indexed chunk keys
+ * to prevent Expo SecureStore's 2048-byte limit errors on large JWTs.
+ * Pass the imported `SecureStore` module from `expo-secure-store`.
+ */
+export declare function createExpoSecureStoreAdapter(secureStoreModule: {
+    getItemAsync: (key: string) => Promise<string | null>;
+    setItemAsync: (key: string, value: string) => Promise<void>;
+    deleteItemAsync: (key: string) => Promise<void>;
+}): OAuth2AsyncStorage;
+/**
+ * Helper to create a storage adapter backed by `react-native-keychain` for Bare React Native CLI apps.
+ * Pass the imported `Keychain` module from `react-native-keychain`.
+ */
+export declare function createKeychainStorageAdapter(keychainModule: {
+    getGenericPassword: (options?: {
+        service?: string;
+    }) => Promise<false | {
+        username: string;
+        password: string;
+    }>;
+    setGenericPassword: (username: string, password: string, options?: {
+        service?: string;
+    }) => Promise<unknown>;
+    resetGenericPassword: (options?: {
+        service?: string;
+    }) => Promise<unknown>;
+}, servicePrefix?: string): OAuth2AsyncStorage;

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from './models/types';
+export { AuthClient } from './core/AuthClient';
+export { NativeTokenStorage, createMemoryStorageAdapter, createExpoSecureStoreAdapter, createKeychainStorageAdapter } from './core/storage';
+export { createExpoWebBrowserLauncher, createInAppBrowserLauncher, parseCallbackUrl } from './core/browser';
+export * from './core/pkce';
+export { AuthProvider, useAuth } from './react/AuthContext';
+export type { AuthContextType, AuthProviderProps } from './react/AuthContext';
+export { setupAxiosInterceptors } from './axios/interceptor';
+export type { InterceptorOptions } from './axios/interceptor';

package/dist/index.es.js

@@ -0,0 +1,711 @@
+import { createContext as e, useCallback as t, useContext as n, useEffect as r, useState as i } from "react";
+import { jsx as a } from "react/jsx-runtime";
+// src/models/types.ts
+var o = {
+	ACCESS_TOKEN: "witsauth_access_token",
+	REFRESH_TOKEN: "witsauth_refresh_token",
+	TOKEN_EXPIRES_AT: "witsauth_expires_at",
+	TOKEN_TYPE: "witsauth_token_type",
+	SCOPE: "witsauth_scope",
+	ID_TOKEN: "witsauth_id_token",
+	CODE_VERIFIER: "witsauth_code_verifier",
+	STATE: "witsauth_state",
+	NONCE: "witsauth_nonce"
+}, s = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", c = new Uint32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+function l(e, t) {
+	return t >>> e | t << 32 - e;
+}
+function u(e) {
+	if (typeof TextEncoder < "u") return new TextEncoder().encode(e);
+	let t = [];
+	for (let n = 0; n < e.length; n++) {
+		let r = e.charCodeAt(n);
+		r < 128 ? t.push(r) : r < 2048 ? t.push(192 | r >> 6, 128 | r & 63) : r < 55296 || r >= 57344 ? t.push(224 | r >> 12, 128 | r >> 6 & 63, 128 | r & 63) : (n++, r = 65536 + ((r & 1023) << 10 | e.charCodeAt(n) & 1023), t.push(240 | r >> 18, 128 | r >> 12 & 63, 128 | r >> 6 & 63, 128 | r & 63));
+	}
+	return new Uint8Array(t);
+}
+function d(e) {
+	let t = u(e), n = t.length * 8, r = t.length + 9 + 63 >> 6 << 6, i = new Uint8Array(r);
+	i.set(t), i[t.length] = 128;
+	let a = new DataView(i.buffer);
+	a.setUint32(r - 8, Math.floor(n / 4294967296), !1), a.setUint32(r - 4, n >>> 0, !1);
+	let o = 1779033703, s = 3144134277, d = 1013904242, f = 2773480762, p = 1359893119, m = 2600822924, h = 528734635, g = 1541459225, _ = /* @__PURE__ */ new Uint32Array(64);
+	for (let e = 0; e < r; e += 64) {
+		for (let t = 0; t < 16; t++) _[t] = a.getUint32(e + t * 4, !1);
+		for (let e = 16; e < 64; e++) {
+			let t = l(7, _[e - 15]) ^ l(18, _[e - 15]) ^ _[e - 15] >>> 3, n = l(17, _[e - 2]) ^ l(19, _[e - 2]) ^ _[e - 2] >>> 10;
+			_[e] = _[e - 16] + t + _[e - 7] + n >>> 0;
+		}
+		let t = o, n = s, r = d, i = f, u = p, v = m, y = h, b = g;
+		for (let e = 0; e < 64; e++) {
+			let a = l(6, u) ^ l(11, u) ^ l(25, u), o = u & v ^ ~u & y, s = b + a + o + c[e] + _[e] >>> 0, d = (l(2, t) ^ l(13, t) ^ l(22, t)) + (t & n ^ t & r ^ n & r) >>> 0;
+			b = y, y = v, v = u, u = i + s >>> 0, i = r, r = n, n = t, t = s + d >>> 0;
+		}
+		o = o + t >>> 0, s = s + n >>> 0, d = d + r >>> 0, f = f + i >>> 0, p = p + u >>> 0, m = m + v >>> 0, h = h + y >>> 0, g = g + b >>> 0;
+	}
+	let v = /* @__PURE__ */ new Uint8Array(32), y = new DataView(v.buffer);
+	return y.setUint32(0, o, !1), y.setUint32(4, s, !1), y.setUint32(8, d, !1), y.setUint32(12, f, !1), y.setUint32(16, p, !1), y.setUint32(20, m, !1), y.setUint32(24, h, !1), y.setUint32(28, g, !1), v;
+}
+function f(e) {
+	let t = "", n = e.length;
+	for (let r = 0; r < n; r += 3) {
+		let i = e[r], a = r + 1 < n ? e[r + 1] : 0, o = r + 2 < n ? e[r + 2] : 0;
+		t += s[i >> 2], t += s[(i & 3) << 4 | a >> 4], r + 1 < n && (t += s[(a & 15) << 2 | o >> 6]), r + 2 < n && (t += s[o & 63]);
+	}
+	return t;
+}
+function p(e) {
+	let t = new Uint8Array(e), n = typeof globalThis < "u" ? globalThis : void 0;
+	if (n?.crypto && typeof n.crypto.getRandomValues == "function") return n.crypto.getRandomValues(t), t;
+	try {
+		let r = typeof n?.require == "function" ? n.require : void 0;
+		if (r) {
+			let n = r("expo-crypto");
+			if (n && typeof n.getRandomValues == "function") return n.getRandomValues(t), t;
+			if (n && typeof n.getRandomBytes == "function") {
+				let r = n.getRandomBytes(e);
+				return t.set(r.subarray(0, e)), t;
+			}
+		}
+	} catch {}
+	throw Error("Cryptographically secure random number generator (CSPRNG) is unavailable. Please install and import \"react-native-get-random-values\" or \"expo-crypto\".");
+}
+function m(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t + "=".repeat((4 - t.length % 4) % 4);
+	if (typeof atob == "function") {
+		let e = atob(n), t = new Uint8Array(e.length);
+		for (let n = 0; n < e.length; n++) t[n] = e.charCodeAt(n);
+		if (typeof TextDecoder < "u") return new TextDecoder().decode(t);
+		let r = "";
+		for (let e = 0; e < t.length; e++) r += String.fromCharCode(t[e]);
+		return decodeURIComponent(escape(r));
+	}
+	let r = typeof globalThis < "u" ? globalThis : void 0;
+	if (r?.Buffer) return r.Buffer.from(n, "base64").toString("utf8");
+	throw Error("Unable to decode base64url string.");
+}
+function h(e) {
+	if (!e || typeof e != "string") return null;
+	let t = e.split(".");
+	if (t.length < 2) return null;
+	try {
+		let e = m(t[1]);
+		return JSON.parse(e);
+	} catch {
+		return null;
+	}
+}
+function g(e = 64) {
+	let t = p(e), n = "";
+	for (let r = 0; r < e; r++) n += "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[t[r] % 66];
+	return n;
+}
+function _() {
+	return g(64);
+}
+function v() {
+	return g(32);
+}
+async function y(e) {
+	let t = typeof globalThis < "u" ? globalThis : void 0;
+	if (t?.crypto?.subtle && typeof t.crypto.subtle.digest == "function") try {
+		let n = u(e), r = await t.crypto.subtle.digest("SHA-256", n);
+		return f(new Uint8Array(r));
+	} catch {}
+	return f(d(e));
+}
+// src/core/storage.ts
+var b = Object.values(o), x = class {
+	backend;
+	cache = /* @__PURE__ */ new Map();
+	hydrated = !1;
+	hydratePromise = null;
+	constructor(e) {
+		this.backend = e || S();
+	}
+	async hydrate() {
+		if (!this.hydrated) return this.hydratePromise ||= (async () => {
+			await Promise.all(b.map(async (e) => {
+				try {
+					let t = await this.backend.getItem(e);
+					t != null && this.cache.set(e, t);
+				} catch {}
+			})), this.hydrated = !0;
+		})().finally(() => {
+			this.hydratePromise = null;
+		}), this.hydratePromise;
+	}
+	getItemSync(e) {
+		return this.cache.get(e) ?? null;
+	}
+	async getItem(e) {
+		if (this.cache.has(e)) return this.cache.get(e);
+		let t = await this.backend.getItem(e);
+		return t == null ? null : (this.cache.set(e, t), t);
+	}
+	async setItem(e, t) {
+		this.cache.set(e, t), await this.backend.setItem(e, t);
+	}
+	async removeItem(e) {
+		this.cache.delete(e), await this.backend.removeItem(e);
+	}
+	async clearTemporary() {
+		await Promise.all([
+			this.removeItem(o.CODE_VERIFIER),
+			this.removeItem(o.STATE),
+			this.removeItem(o.NONCE)
+		]);
+	}
+	async clearTokens() {
+		await Promise.all([
+			this.removeItem(o.ACCESS_TOKEN),
+			this.removeItem(o.REFRESH_TOKEN),
+			this.removeItem(o.TOKEN_EXPIRES_AT),
+			this.removeItem(o.TOKEN_TYPE),
+			this.removeItem(o.SCOPE),
+			this.removeItem(o.ID_TOKEN)
+		]);
+	}
+};
+function S() {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		getItem: async (t) => e.get(t) ?? null,
+		setItem: async (t, n) => {
+			e.set(t, n);
+		},
+		removeItem: async (t) => {
+			e.delete(t);
+		}
+	};
+}
+var C = 2e3, w = "__witsauth_chunked__:";
+function T(e) {
+	let t = async (t) => {
+		try {
+			let n = await e.getItemAsync(t);
+			if (n && n.startsWith(w)) {
+				let r = parseInt(n.slice(21), 10);
+				if (Number.isFinite(r) && r > 0) {
+					let n = [];
+					for (let i = 0; i < r; i++) n.push(e.deleteItemAsync(`${t}__chunk_${i}`));
+					await Promise.all(n);
+				}
+			}
+		} catch {}
+	};
+	return {
+		getItem: async (t) => {
+			let n = await e.getItemAsync(t);
+			if (!n) return null;
+			if (n.startsWith(w)) {
+				let r = parseInt(n.slice(21), 10);
+				if (!Number.isFinite(r) || r <= 0) return null;
+				let i = [];
+				for (let n = 0; n < r; n++) i.push(e.getItemAsync(`${t}__chunk_${n}`));
+				let a = await Promise.all(i);
+				return a.some((e) => e == null) ? null : a.join("");
+			}
+			return n;
+		},
+		setItem: async (n, r) => {
+			if (r.length <= C) {
+				await t(n), await e.setItemAsync(n, r);
+				return;
+			}
+			await t(n);
+			let i = [];
+			for (let e = 0; e < r.length; e += C) i.push(r.slice(e, e + C));
+			await Promise.all(i.map((t, r) => e.setItemAsync(`${n}__chunk_${r}`, t))), await e.setItemAsync(n, `${w}${i.length}`);
+		},
+		removeItem: async (n) => {
+			await t(n), await e.deleteItemAsync(n);
+		}
+	};
+}
+function E(e, t = "com.witsauth.tokens") {
+	return {
+		getItem: async (n) => {
+			let r = await e.getGenericPassword({ service: `${t}.${n}` });
+			return r ? r.password : null;
+		},
+		setItem: async (n, r) => {
+			await e.setGenericPassword(n, r, { service: `${t}.${n}` });
+		},
+		removeItem: async (n) => {
+			await e.resetGenericPassword({ service: `${t}.${n}` });
+		}
+	};
+}
+// src/core/browser.ts
+function D(e) {
+	return async (t, n) => {
+		let r = await e.openAuthSessionAsync(t, n);
+		return r.type === "success" && r.url ? {
+			type: "success",
+			url: r.url
+		} : r.type === "cancel" ? { type: "cancel" } : { type: "dismiss" };
+	};
+}
+function O(e) {
+	return async (t, n) => {
+		if (!await e.isAvailable()) throw Error("InAppBrowser is not available on this device.");
+		let r = await e.openAuth(t, n, {
+			ephemeralWebSession: !1,
+			showTitle: !1,
+			enableUrlBarHiding: !0,
+			enableDefaultShare: !1
+		});
+		return r.type === "success" && r.url ? {
+			type: "success",
+			url: r.url
+		} : r.type === "cancel" ? { type: "cancel" } : { type: "dismiss" };
+	};
+}
+function k(e) {
+	let t = e.indexOf("?");
+	if (t === -1) return {
+		code: null,
+		state: null,
+		error: null,
+		errorDescription: null
+	};
+	let n = e.indexOf("#", t), r = n === -1 ? e.slice(t + 1) : e.slice(t + 1, n), i = new URLSearchParams(r);
+	return {
+		code: i.get("code"),
+		state: i.get("state"),
+		error: i.get("error"),
+		errorDescription: i.get("error_description")
+	};
+}
+// src/core/AuthClient.ts
+var A = class {
+	config;
+	storage;
+	refreshPromise = null;
+	constructor(e, t) {
+		this.config = e, this.storage = t || new x(e.storage);
+	}
+	async initialize() {
+		await this.storage.hydrate();
+	}
+	log(e, ...t) {
+		let n = {
+			none: 0,
+			error: 1,
+			warn: 2,
+			info: 3,
+			debug: 4
+		}, r = n[this.config.logLevel || "warn"] || 0, i = n[e] || 0;
+		i > 0 && r >= i && console[e](...t);
+	}
+	async buildAuthorizationUrl(e) {
+		await this.storage.hydrate();
+		let t = _(), n = await y(t), r = v(), i = this.config.nonce || v();
+		await this.storage.setItem(o.CODE_VERIFIER, t), await this.storage.setItem(o.STATE, r), await this.storage.setItem(o.NONCE, i);
+		let a = new URLSearchParams({
+			client_id: this.config.clientId,
+			redirect_uri: this.config.redirectUri,
+			response_type: this.config.responseType || "code",
+			code_challenge_method: this.config.codeChallengeMethod || "S256",
+			code_challenge: n,
+			state: r,
+			nonce: i
+		});
+		if (this.config.theme) {
+			let e = typeof this.config.theme == "function" ? this.config.theme() : this.config.theme;
+			e && a.append("theme", e);
+		}
+		let s = e?.scope ?? this.config.scope, c = e?.audience ?? this.config.audience;
+		return s && a.append("scope", s), c && a.append("audience", c), e?.prompt && a.append("prompt", e.prompt), `${this.config.authorizationEndpoint}?${a.toString()}`;
+	}
+	async authorize(e) {
+		if (!this.config.openAuthSession) throw Error("No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.");
+		let t = await this.buildAuthorizationUrl(e), n = await this.config.openAuthSession(t, this.config.redirectUri);
+		if (n.type !== "success" || !n.url) throw await this.storage.clearTemporary(), Error(`Authentication ${n.type}`);
+		return this.handleCallbackUrl(n.url);
+	}
+	async handleCallbackUrl(e) {
+		let { code: t, state: n, error: r, errorDescription: i } = k(e);
+		if (r) throw await this.storage.clearTemporary(), Error(i ? `${r}: ${i}` : r);
+		if (!t || !n) throw await this.storage.clearTemporary(), Error("Callback URL is missing required code or state parameters.");
+		return this.exchangeCodeForTokens(t, n);
+	}
+	async exchangeCodeForTokens(e, t) {
+		await this.storage.hydrate();
+		let n = await this.storage.getItem(o.STATE), r = await this.storage.getItem(o.CODE_VERIFIER);
+		if (!n || t !== n) throw await this.storage.clearTemporary(), Error("Invalid state parameter. Possible CSRF attack.");
+		if (!r) throw await this.storage.clearTemporary(), Error("Code verifier missing from storage.");
+		let i = new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: this.config.clientId,
+			redirect_uri: this.config.redirectUri,
+			code: e,
+			code_verifier: r
+		}), a = await fetch(this.config.tokenEndpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: i.toString()
+		});
+		if (!a.ok) throw Error("Failed to exchange code for tokens");
+		let s = await a.json(), c = {
+			accessToken: s.access_token,
+			refreshToken: s.refresh_token,
+			tokenType: s.token_type || "Bearer",
+			expiresAt: Date.now() + s.expires_in * 1e3,
+			scope: s.scope,
+			idToken: s.id_token
+		};
+		return await this.saveTokenInfo(c), await this.storage.clearTemporary(), c;
+	}
+	async refreshAccessToken() {
+		return this.refreshPromise ||= (async () => {
+			await this.storage.hydrate();
+			let e = await this.storage.getItem(o.REFRESH_TOKEN);
+			if (!e) throw Error("No refresh token available");
+			let t = new URLSearchParams({
+				grant_type: "refresh_token",
+				client_id: this.config.clientId,
+				refresh_token: e
+			}), n;
+			try {
+				n = await fetch(this.config.tokenEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: t.toString()
+				});
+			} catch (e) {
+				throw this.log("error", "Token refresh network request failed:", e), e;
+			}
+			if (!n.ok) {
+				let e = {};
+				try {
+					e = await n.json();
+				} catch {
+					try {
+						e = { error: await n.text() };
+					} catch {
+						e = {};
+					}
+				}
+				this.log("error", "Token refresh failed with status:", n.status, e), (n.status === 400 || n.status === 401) && await this.storage.clearTokens();
+				let t = e.error_description || e.error || n.statusText || "Failed to refresh token";
+				throw Error(`Failed to refresh token (${n.status}): ${t}`);
+			}
+			let r = await n.json(), i = {
+				accessToken: r.access_token,
+				refreshToken: r.refresh_token || e,
+				tokenType: r.token_type || "Bearer",
+				expiresAt: Date.now() + r.expires_in * 1e3,
+				scope: r.scope,
+				idToken: r.id_token
+			};
+			return await this.saveTokenInfo(i), i;
+		})().finally(() => {
+			this.refreshPromise = null;
+		}), this.refreshPromise;
+	}
+	async saveTokenInfo(e) {
+		await this.storage.setItem(o.ACCESS_TOKEN, e.accessToken), await this.storage.setItem(o.TOKEN_EXPIRES_AT, e.expiresAt.toString()), await this.storage.setItem(o.TOKEN_TYPE, e.tokenType), e.refreshToken && await this.storage.setItem(o.REFRESH_TOKEN, e.refreshToken), e.scope && await this.storage.setItem(o.SCOPE, e.scope), e.idToken && await this.storage.setItem(o.ID_TOKEN, e.idToken);
+	}
+	getAccessToken() {
+		return this.storage.getItemSync(o.ACCESS_TOKEN);
+	}
+	getIdToken() {
+		return this.storage.getItemSync(o.ID_TOKEN);
+	}
+	getUserProfile() {
+		return h(this.getIdToken() || this.getAccessToken());
+	}
+	getRefreshToken() {
+		return this.storage.getItemSync(o.REFRESH_TOKEN);
+	}
+	getExpiresAt() {
+		let e = this.storage.getItemSync(o.TOKEN_EXPIRES_AT);
+		if (!e) return null;
+		let t = Number(e);
+		return Number.isFinite(t) ? t : null;
+	}
+	isAuthenticated() {
+		let e = this.getExpiresAt();
+		return e !== null && Date.now() < e - 3e4 && !!this.getAccessToken();
+	}
+	async navigateToAccountManagement() {
+		await this.storage.hydrate();
+		let e = await this.storage.getItem(o.REFRESH_TOKEN);
+		if (!e) throw Error("No refresh token available to access account management.");
+		if (!this.config.openAuthSession) throw Error("No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.");
+		let t = this.config.authorizationEndpoint.replace(/\/authorize\/?$/, ""), n = await fetch(`${t}/account/ticket`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				refreshToken: e,
+				clientId: this.config.clientId,
+				redirectUri: this.config.redirectUri
+			})
+		});
+		if (!n.ok) throw Error(`Failed to request account management ticket (${n.status})`);
+		let { ticket: r } = await n.json();
+		if (!r) throw Error("Account management ticket missing from server response.");
+		let i = `${t}/account?ticket=${encodeURIComponent(r)}&return_to=${encodeURIComponent(this.config.redirectUri)}`;
+		await this.config.openAuthSession(i, this.config.redirectUri);
+	}
+	async logout(e) {
+		await this.storage.hydrate();
+		let t = this.getAccessToken(), n = await this.storage.getItem(o.REFRESH_TOKEN);
+		if (await this.storage.clearTokens(), await this.storage.clearTemporary(), this.config.revokeEndpoint) {
+			let e = [...n ? [{
+				token: n,
+				token_type_hint: "refresh_token"
+			}] : [], ...t ? [{
+				token: t,
+				token_type_hint: "access_token"
+			}] : []];
+			for (let t of e) try {
+				await fetch(this.config.revokeEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						token: t.token,
+						token_type_hint: t.token_type_hint,
+						client_id: this.config.clientId
+					}).toString()
+				});
+			} catch (e) {
+				this.log("error", "Failed to revoke token during logout", e);
+			}
+		}
+		if (e?.clearBrowserSession && this.config.logoutEndpoint && this.config.openAuthSession) {
+			let e = new URLSearchParams({
+				client_id: this.config.clientId,
+				redirect_uri: this.config.redirectUri
+			}), t = this.config.logoutEndpoint.includes("?") ? "&" : "?", n = `${this.config.logoutEndpoint}${t}${e.toString()}`;
+			try {
+				await this.config.openAuthSession(n, this.config.redirectUri);
+			} catch (e) {
+				this.log("warn", "Browser logout session dismissed or failed", e);
+			}
+		}
+	}
+}, j = e(null), M = ({ config: e, client: n, children: o, onLoginSuccess: s, onLoginError: c, subscribeAppState: l }) => {
+	let [u] = i(() => {
+		if (n) return n;
+		if (e) return new A(e);
+		throw Error("AuthProvider requires either a `client` or `config` prop.");
+	}), [d, f] = i(!1), [p, m] = i(null), [h, g] = i(null), [_, v] = i(null), [y, b] = i(!0), [x, S] = i(null), C = t(async () => {
+		if (await u.initialize(), u.isAuthenticated()) f(!0), m(u.getAccessToken()), g(u.getIdToken()), v(u.getUserProfile());
+		else {
+			if (u.getRefreshToken()) try {
+				let e = await u.refreshAccessToken();
+				f(!0), m(e.accessToken), g(u.getIdToken()), v(u.getUserProfile());
+				return;
+			} catch {
+				f(!1), m(null), g(null), v(null);
+				return;
+			}
+			f(!1), m(null), g(null), v(null);
+		}
+	}, [u]);
+	r(() => {
+		let e = !0;
+		return (async () => {
+			try {
+				await C();
+			} finally {
+				e && b(!1);
+			}
+		})(), () => {
+			e = !1;
+		};
+	}, [C]), r(() => {
+		if (!d) return;
+		let e, t = () => {
+			let n = u.getExpiresAt();
+			if (!n) return;
+			let r = n - Date.now() - 6e4;
+			e = setTimeout(async () => {
+				try {
+					let e = await u.refreshAccessToken();
+					m(e.accessToken), g(u.getIdToken()), v(u.getUserProfile()), f(!0), t();
+				} catch (n) {
+					u.log("error", "Background token refresh failed:", n), u.getAccessToken() ? e = setTimeout(t, 3e4) : (f(!1), m(null), g(null), v(null));
+				}
+			}, Math.max(0, r));
+		};
+		t();
+		let n = l ? l((e) => {
+			e === "active" && C().catch(() => {});
+		}) : void 0;
+		return () => {
+			e && clearTimeout(e), n && n();
+		};
+	}, [
+		d,
+		u,
+		l,
+		C
+	]);
+	let w = t(async (e) => {
+		b(!0), S(null);
+		try {
+			let t = await u.authorize(e);
+			m(t.accessToken), g(u.getIdToken()), v(u.getUserProfile()), f(!0), s?.();
+		} catch (e) {
+			let t = e instanceof Error ? e : /* @__PURE__ */ Error("Authentication failed");
+			S(t), c?.(t);
+		} finally {
+			b(!1);
+		}
+	}, [
+		u,
+		s,
+		c
+	]), T = t(async (e) => {
+		b(!0);
+		try {
+			await u.logout(e), f(!1), m(null), g(null), v(null);
+		} catch (e) {
+			S(e instanceof Error ? e : /* @__PURE__ */ Error("Logout failed"));
+		} finally {
+			b(!1);
+		}
+	}, [u]), E = t(async () => {
+		if (await u.initialize(), u.isAuthenticated()) return u.getAccessToken();
+		try {
+			let e = await u.refreshAccessToken();
+			return m(e.accessToken), g(u.getIdToken()), v(u.getUserProfile()), f(!0), e.accessToken;
+		} catch {
+			return f(!1), m(null), g(null), v(null), null;
+		}
+	}, [u]), D = t(async () => {
+		await u.navigateToAccountManagement(), await C();
+	}, [u, C]);
+	return /* @__PURE__ */ a(j.Provider, {
+		value: {
+			isAuthenticated: d,
+			isLoading: y,
+			accessToken: p,
+			idToken: h,
+			user: _,
+			error: x,
+			login: w,
+			logout: T,
+			getToken: E,
+			navigateToAccountManagement: D,
+			authClient: u
+		},
+		children: o
+	});
+}, N = () => {
+	let e = n(j);
+	if (!e) throw Error("useAuth must be used within an AuthProvider");
+	return e;
+};
+// src/axios/interceptor.ts
+function P(e, t, n = {}) {
+	let r = !1, i = [], a = (e, t = null) => {
+		i.forEach((n) => {
+			e ? n.reject(e) : n.resolve(t);
+		}), i = [];
+	}, o = (e) => !e || !n.excludeUrls ? !1 : n.excludeUrls.some((t) => typeof t == "string" ? e.includes(t) : t.test(e)), s = e.interceptors.request.use(async (e) => {
+		if (o(e.url)) return e;
+		await t.initialize();
+		let n = t.getAccessToken();
+		if (!t.isAuthenticated() && n) try {
+			n = (await t.refreshAccessToken()).accessToken;
+		} catch {
+			n = null;
+		}
+		return n && e.headers.set("Authorization", `Bearer ${n}`), e;
+	}, (e) => Promise.reject(e)), c = e.interceptors.response.use((e) => e, async (s) => {
+		let c = s.config;
+		if (!c || o(c.url)) return Promise.reject(s);
+		if (s.response?.status === 401 && !c._retry) {
+			if (r) return new Promise((e, t) => {
+				i.push({
+					resolve: e,
+					reject: t
+				});
+			}).then((t) => (t && c.headers.set("Authorization", `Bearer ${t}`), e(c))).catch((e) => Promise.reject(e));
+			c._retry = !0, r = !0;
+			try {
+				let n = (await t.refreshAccessToken()).accessToken;
+				return a(null, n), c.headers.set("Authorization", `Bearer ${n}`), e(c);
+			} catch (e) {
+				return a(e, null), await t.logout(), n.onUnauthorized && n.onUnauthorized(), Promise.reject(e);
+			} finally {
+				r = !1;
+			}
+		}
+		return Promise.reject(s);
+	});
+	return () => {
+		e.interceptors.request.eject(s), e.interceptors.response.eject(c);
+	};
+}
+export { A as AuthClient, M as AuthProvider, x as NativeTokenStorage, o as STORAGE_KEYS, f as base64UrlEncode, y as createCodeChallenge, T as createExpoSecureStoreAdapter, D as createExpoWebBrowserLauncher, O as createInAppBrowserLauncher, E as createKeychainStorageAdapter, S as createMemoryStorageAdapter, h as decodeJwtPayload, _ as generateCodeVerifier, g as generateRandomString, v as generateState, p as getRandomBytes, k as parseCallbackUrl, P as setupAxiosInterceptors, d as sha256Bytes, N as useAuth };

package/dist/index.umd.js

@@ -0,0 +1 @@
+(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("react"),require("react/jsx-runtime")):typeof define==`function`&&define.amd?define([`exports`,`react`,`react/jsx-runtime`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.WitsAuthReactNativeClient={},e.React,e.jsxRuntime))})(this,function(e,t,n){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var r=Object.create,i=Object.defineProperty,a=Object.getOwnPropertyDescriptor,o=Object.getOwnPropertyNames,s=Object.getPrototypeOf,c=Object.prototype.hasOwnProperty,l=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var s=o(t),l=0,u=s.length,d;l<u;l++)d=s[l],!c.call(e,d)&&d!==n&&i(e,d,{get:(e=>t[e]).bind(null,d),enumerable:!(r=a(t,d))||r.enumerable});return e};t=((e,t,n)=>(n=e==null?{}:r(s(e)),l(i(n,`default`,{value:e,enumerable:!0}),e)))(t,1);var u={ACCESS_TOKEN:`witsauth_access_token`,REFRESH_TOKEN:`witsauth_refresh_token`,TOKEN_EXPIRES_AT:`witsauth_expires_at`,TOKEN_TYPE:`witsauth_token_type`,SCOPE:`witsauth_scope`,ID_TOKEN:`witsauth_id_token`,CODE_VERIFIER:`witsauth_code_verifier`,STATE:`witsauth_state`,NONCE:`witsauth_nonce`},d=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_`,f=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]);function p(e,t){return t>>>e|t<<32-e}function m(e){if(typeof TextEncoder<`u`)return new TextEncoder().encode(e);let t=[];for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192|r>>6,128|r&63):r<55296||r>=57344?t.push(224|r>>12,128|r>>6&63,128|r&63):(n++,r=65536+((r&1023)<<10|e.charCodeAt(n)&1023),t.push(240|r>>18,128|r>>12&63,128|r>>6&63,128|r&63))}return new Uint8Array(t)}function h(e){let t=m(e),n=t.length*8,r=t.length+9+63>>6<<6,i=new Uint8Array(r);i.set(t),i[t.length]=128;let a=new DataView(i.buffer);a.setUint32(r-8,Math.floor(n/4294967296),!1),a.setUint32(r-4,n>>>0,!1);let o=1779033703,s=3144134277,c=1013904242,l=2773480762,u=1359893119,d=2600822924,h=528734635,g=1541459225,_=new Uint32Array(64);for(let e=0;e<r;e+=64){for(let t=0;t<16;t++)_[t]=a.getUint32(e+t*4,!1);for(let e=16;e<64;e++){let t=p(7,_[e-15])^p(18,_[e-15])^_[e-15]>>>3,n=p(17,_[e-2])^p(19,_[e-2])^_[e-2]>>>10;_[e]=_[e-16]+t+_[e-7]+n>>>0}let t=o,n=s,r=c,i=l,m=u,v=d,y=h,b=g;for(let e=0;e<64;e++){let a=p(6,m)^p(11,m)^p(25,m),o=m&v^~m&y,s=b+a+o+f[e]+_[e]>>>0,c=(p(2,t)^p(13,t)^p(22,t))+(t&n^t&r^n&r)>>>0;b=y,y=v,v=m,m=i+s>>>0,i=r,r=n,n=t,t=s+c>>>0}o=o+t>>>0,s=s+n>>>0,c=c+r>>>0,l=l+i>>>0,u=u+m>>>0,d=d+v>>>0,h=h+y>>>0,g=g+b>>>0}let v=new Uint8Array(32),y=new DataView(v.buffer);return y.setUint32(0,o,!1),y.setUint32(4,s,!1),y.setUint32(8,c,!1),y.setUint32(12,l,!1),y.setUint32(16,u,!1),y.setUint32(20,d,!1),y.setUint32(24,h,!1),y.setUint32(28,g,!1),v}function g(e){let t=``,n=e.length;for(let r=0;r<n;r+=3){let i=e[r],a=r+1<n?e[r+1]:0,o=r+2<n?e[r+2]:0;t+=d[i>>2],t+=d[(i&3)<<4|a>>4],r+1<n&&(t+=d[(a&15)<<2|o>>6]),r+2<n&&(t+=d[o&63])}return t}function _(e){let t=new Uint8Array(e),n=typeof globalThis<`u`?globalThis:void 0;if(n?.crypto&&typeof n.crypto.getRandomValues==`function`)return n.crypto.getRandomValues(t),t;try{let r=typeof n?.require==`function`?n.require:void 0;if(r){let n=r(`expo-crypto`);if(n&&typeof n.getRandomValues==`function`)return n.getRandomValues(t),t;if(n&&typeof n.getRandomBytes==`function`){let r=n.getRandomBytes(e);return t.set(r.subarray(0,e)),t}}}catch{}throw Error(`Cryptographically secure random number generator (CSPRNG) is unavailable. Please install and import "react-native-get-random-values" or "expo-crypto".`)}function v(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4);if(typeof atob==`function`){let e=atob(n),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);if(typeof TextDecoder<`u`)return new TextDecoder().decode(t);let r=``;for(let e=0;e<t.length;e++)r+=String.fromCharCode(t[e]);return decodeURIComponent(escape(r))}let r=typeof globalThis<`u`?globalThis:void 0;if(r?.Buffer)return r.Buffer.from(n,`base64`).toString(`utf8`);throw Error(`Unable to decode base64url string.`)}function y(e){if(!e||typeof e!=`string`)return null;let t=e.split(`.`);if(t.length<2)return null;try{let e=v(t[1]);return JSON.parse(e)}catch{return null}}function b(e=64){let t=_(e),n=``;for(let r=0;r<e;r++)n+=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`[t[r]%66];return n}function x(){return b(64)}function S(){return b(32)}async function C(e){let t=typeof globalThis<`u`?globalThis:void 0;if(t?.crypto?.subtle&&typeof t.crypto.subtle.digest==`function`)try{let n=m(e),r=await t.crypto.subtle.digest(`SHA-256`,n);return g(new Uint8Array(r))}catch{}return g(h(e))}var w=Object.values(u),T=class{backend;cache=new Map;hydrated=!1;hydratePromise=null;constructor(e){this.backend=e||E()}async hydrate(){if(!this.hydrated)return this.hydratePromise||=(async()=>{await Promise.all(w.map(async e=>{try{let t=await this.backend.getItem(e);t!=null&&this.cache.set(e,t)}catch{}})),this.hydrated=!0})().finally(()=>{this.hydratePromise=null}),this.hydratePromise}getItemSync(e){return this.cache.get(e)??null}async getItem(e){if(this.cache.has(e))return this.cache.get(e);let t=await this.backend.getItem(e);return t==null?null:(this.cache.set(e,t),t)}async setItem(e,t){this.cache.set(e,t),await this.backend.setItem(e,t)}async removeItem(e){this.cache.delete(e),await this.backend.removeItem(e)}async clearTemporary(){await Promise.all([this.removeItem(u.CODE_VERIFIER),this.removeItem(u.STATE),this.removeItem(u.NONCE)])}async clearTokens(){await Promise.all([this.removeItem(u.ACCESS_TOKEN),this.removeItem(u.REFRESH_TOKEN),this.removeItem(u.TOKEN_EXPIRES_AT),this.removeItem(u.TOKEN_TYPE),this.removeItem(u.SCOPE),this.removeItem(u.ID_TOKEN)])}};function E(){let e=new Map;return{getItem:async t=>e.get(t)??null,setItem:async(t,n)=>{e.set(t,n)},removeItem:async t=>{e.delete(t)}}}var D=2e3,O=`__witsauth_chunked__:`;function k(e){let t=async t=>{try{let n=await e.getItemAsync(t);if(n&&n.startsWith(O)){let r=parseInt(n.slice(21),10);if(Number.isFinite(r)&&r>0){let n=[];for(let i=0;i<r;i++)n.push(e.deleteItemAsync(`${t}__chunk_${i}`));await Promise.all(n)}}}catch{}};return{getItem:async t=>{let n=await e.getItemAsync(t);if(!n)return null;if(n.startsWith(O)){let r=parseInt(n.slice(21),10);if(!Number.isFinite(r)||r<=0)return null;let i=[];for(let n=0;n<r;n++)i.push(e.getItemAsync(`${t}__chunk_${n}`));let a=await Promise.all(i);return a.some(e=>e==null)?null:a.join(``)}return n},setItem:async(n,r)=>{if(r.length<=D){await t(n),await e.setItemAsync(n,r);return}await t(n);let i=[];for(let e=0;e<r.length;e+=D)i.push(r.slice(e,e+D));await Promise.all(i.map((t,r)=>e.setItemAsync(`${n}__chunk_${r}`,t))),await e.setItemAsync(n,`${O}${i.length}`)},removeItem:async n=>{await t(n),await e.deleteItemAsync(n)}}}function A(e,t=`com.witsauth.tokens`){return{getItem:async n=>{let r=await e.getGenericPassword({service:`${t}.${n}`});return r?r.password:null},setItem:async(n,r)=>{await e.setGenericPassword(n,r,{service:`${t}.${n}`})},removeItem:async n=>{await e.resetGenericPassword({service:`${t}.${n}`})}}}function j(e){return async(t,n)=>{let r=await e.openAuthSessionAsync(t,n);return r.type===`success`&&r.url?{type:`success`,url:r.url}:r.type===`cancel`?{type:`cancel`}:{type:`dismiss`}}}function M(e){return async(t,n)=>{if(!await e.isAvailable())throw Error(`InAppBrowser is not available on this device.`);let r=await e.openAuth(t,n,{ephemeralWebSession:!1,showTitle:!1,enableUrlBarHiding:!0,enableDefaultShare:!1});return r.type===`success`&&r.url?{type:`success`,url:r.url}:r.type===`cancel`?{type:`cancel`}:{type:`dismiss`}}}function N(e){let t=e.indexOf(`?`);if(t===-1)return{code:null,state:null,error:null,errorDescription:null};let n=e.indexOf(`#`,t),r=n===-1?e.slice(t+1):e.slice(t+1,n),i=new URLSearchParams(r);return{code:i.get(`code`),state:i.get(`state`),error:i.get(`error`),errorDescription:i.get(`error_description`)}}var P=class{config;storage;refreshPromise=null;constructor(e,t){this.config=e,this.storage=t||new T(e.storage)}async initialize(){await this.storage.hydrate()}log(e,...t){let n={none:0,error:1,warn:2,info:3,debug:4},r=n[this.config.logLevel||`warn`]||0,i=n[e]||0;i>0&&r>=i&&console[e](...t)}async buildAuthorizationUrl(e){await this.storage.hydrate();let t=x(),n=await C(t),r=S(),i=this.config.nonce||S();await this.storage.setItem(u.CODE_VERIFIER,t),await this.storage.setItem(u.STATE,r),await this.storage.setItem(u.NONCE,i);let a=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri,response_type:this.config.responseType||`code`,code_challenge_method:this.config.codeChallengeMethod||`S256`,code_challenge:n,state:r,nonce:i});if(this.config.theme){let e=typeof this.config.theme==`function`?this.config.theme():this.config.theme;e&&a.append(`theme`,e)}let o=e?.scope??this.config.scope,s=e?.audience??this.config.audience;return o&&a.append(`scope`,o),s&&a.append(`audience`,s),e?.prompt&&a.append(`prompt`,e.prompt),`${this.config.authorizationEndpoint}?${a.toString()}`}async authorize(e){if(!this.config.openAuthSession)throw Error(`No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.`);let t=await this.buildAuthorizationUrl(e),n=await this.config.openAuthSession(t,this.config.redirectUri);if(n.type!==`success`||!n.url)throw await this.storage.clearTemporary(),Error(`Authentication ${n.type}`);return this.handleCallbackUrl(n.url)}async handleCallbackUrl(e){let{code:t,state:n,error:r,errorDescription:i}=N(e);if(r)throw await this.storage.clearTemporary(),Error(i?`${r}: ${i}`:r);if(!t||!n)throw await this.storage.clearTemporary(),Error(`Callback URL is missing required code or state parameters.`);return this.exchangeCodeForTokens(t,n)}async exchangeCodeForTokens(e,t){await this.storage.hydrate();let n=await this.storage.getItem(u.STATE),r=await this.storage.getItem(u.CODE_VERIFIER);if(!n||t!==n)throw await this.storage.clearTemporary(),Error(`Invalid state parameter. Possible CSRF attack.`);if(!r)throw await this.storage.clearTemporary(),Error(`Code verifier missing from storage.`);let i=new URLSearchParams({grant_type:`authorization_code`,client_id:this.config.clientId,redirect_uri:this.config.redirectUri,code:e,code_verifier:r}),a=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i.toString()});if(!a.ok)throw Error(`Failed to exchange code for tokens`);let o=await a.json(),s={accessToken:o.access_token,refreshToken:o.refresh_token,tokenType:o.token_type||`Bearer`,expiresAt:Date.now()+o.expires_in*1e3,scope:o.scope,idToken:o.id_token};return await this.saveTokenInfo(s),await this.storage.clearTemporary(),s}async refreshAccessToken(){return this.refreshPromise||=(async()=>{await this.storage.hydrate();let e=await this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available`);let t=new URLSearchParams({grant_type:`refresh_token`,client_id:this.config.clientId,refresh_token:e}),n;try{n=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t.toString()})}catch(e){throw this.log(`error`,`Token refresh network request failed:`,e),e}if(!n.ok){let e={};try{e=await n.json()}catch{try{e={error:await n.text()}}catch{e={}}}this.log(`error`,`Token refresh failed with status:`,n.status,e),(n.status===400||n.status===401)&&await this.storage.clearTokens();let t=e.error_description||e.error||n.statusText||`Failed to refresh token`;throw Error(`Failed to refresh token (${n.status}): ${t}`)}let r=await n.json(),i={accessToken:r.access_token,refreshToken:r.refresh_token||e,tokenType:r.token_type||`Bearer`,expiresAt:Date.now()+r.expires_in*1e3,scope:r.scope,idToken:r.id_token};return await this.saveTokenInfo(i),i})().finally(()=>{this.refreshPromise=null}),this.refreshPromise}async saveTokenInfo(e){await this.storage.setItem(u.ACCESS_TOKEN,e.accessToken),await this.storage.setItem(u.TOKEN_EXPIRES_AT,e.expiresAt.toString()),await this.storage.setItem(u.TOKEN_TYPE,e.tokenType),e.refreshToken&&await this.storage.setItem(u.REFRESH_TOKEN,e.refreshToken),e.scope&&await this.storage.setItem(u.SCOPE,e.scope),e.idToken&&await this.storage.setItem(u.ID_TOKEN,e.idToken)}getAccessToken(){return this.storage.getItemSync(u.ACCESS_TOKEN)}getIdToken(){return this.storage.getItemSync(u.ID_TOKEN)}getUserProfile(){return y(this.getIdToken()||this.getAccessToken())}getRefreshToken(){return this.storage.getItemSync(u.REFRESH_TOKEN)}getExpiresAt(){let e=this.storage.getItemSync(u.TOKEN_EXPIRES_AT);if(!e)return null;let t=Number(e);return Number.isFinite(t)?t:null}isAuthenticated(){let e=this.getExpiresAt();return e!==null&&Date.now()<e-3e4&&!!this.getAccessToken()}async navigateToAccountManagement(){await this.storage.hydrate();let e=await this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available to access account management.`);if(!this.config.openAuthSession)throw Error(`No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.`);let t=this.config.authorizationEndpoint.replace(/\/authorize\/?$/,``),n=await fetch(`${t}/account/ticket`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({refreshToken:e,clientId:this.config.clientId,redirectUri:this.config.redirectUri})});if(!n.ok)throw Error(`Failed to request account management ticket (${n.status})`);let{ticket:r}=await n.json();if(!r)throw Error(`Account management ticket missing from server response.`);let i=`${t}/account?ticket=${encodeURIComponent(r)}&return_to=${encodeURIComponent(this.config.redirectUri)}`;await this.config.openAuthSession(i,this.config.redirectUri)}async logout(e){await this.storage.hydrate();let t=this.getAccessToken(),n=await this.storage.getItem(u.REFRESH_TOKEN);if(await this.storage.clearTokens(),await this.storage.clearTemporary(),this.config.revokeEndpoint){let e=[...n?[{token:n,token_type_hint:`refresh_token`}]:[],...t?[{token:t,token_type_hint:`access_token`}]:[]];for(let t of e)try{await fetch(this.config.revokeEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:t.token,token_type_hint:t.token_type_hint,client_id:this.config.clientId}).toString()})}catch(e){this.log(`error`,`Failed to revoke token during logout`,e)}}if(e?.clearBrowserSession&&this.config.logoutEndpoint&&this.config.openAuthSession){let e=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri}),t=this.config.logoutEndpoint.includes(`?`)?`&`:`?`,n=`${this.config.logoutEndpoint}${t}${e.toString()}`;try{await this.config.openAuthSession(n,this.config.redirectUri)}catch(e){this.log(`warn`,`Browser logout session dismissed or failed`,e)}}}},F=(0,t.createContext)(null),I=({config:e,client:r,children:i,onLoginSuccess:a,onLoginError:o,subscribeAppState:s})=>{let[c]=(0,t.useState)(()=>{if(r)return r;if(e)return new P(e);throw Error("AuthProvider requires either a `client` or `config` prop.")}),[l,u]=(0,t.useState)(!1),[d,f]=(0,t.useState)(null),[p,m]=(0,t.useState)(null),[h,g]=(0,t.useState)(null),[_,v]=(0,t.useState)(!0),[y,b]=(0,t.useState)(null),x=(0,t.useCallback)(async()=>{if(await c.initialize(),c.isAuthenticated())u(!0),f(c.getAccessToken()),m(c.getIdToken()),g(c.getUserProfile());else{if(c.getRefreshToken())try{let e=await c.refreshAccessToken();u(!0),f(e.accessToken),m(c.getIdToken()),g(c.getUserProfile());return}catch{u(!1),f(null),m(null),g(null);return}u(!1),f(null),m(null),g(null)}},[c]);(0,t.useEffect)(()=>{let e=!0;return(async()=>{try{await x()}finally{e&&v(!1)}})(),()=>{e=!1}},[x]),(0,t.useEffect)(()=>{if(!l)return;let e,t=()=>{let n=c.getExpiresAt();if(!n)return;let r=n-Date.now()-6e4;e=setTimeout(async()=>{try{let e=await c.refreshAccessToken();f(e.accessToken),m(c.getIdToken()),g(c.getUserProfile()),u(!0),t()}catch(n){c.log(`error`,`Background token refresh failed:`,n),c.getAccessToken()?e=setTimeout(t,3e4):(u(!1),f(null),m(null),g(null))}},Math.max(0,r))};t();let n=s?s(e=>{e===`active`&&x().catch(()=>{})}):void 0;return()=>{e&&clearTimeout(e),n&&n()}},[l,c,s,x]);let S=(0,t.useCallback)(async e=>{v(!0),b(null);try{let t=await c.authorize(e);f(t.accessToken),m(c.getIdToken()),g(c.getUserProfile()),u(!0),a?.()}catch(e){let t=e instanceof Error?e:Error(`Authentication failed`);b(t),o?.(t)}finally{v(!1)}},[c,a,o]),C=(0,t.useCallback)(async e=>{v(!0);try{await c.logout(e),u(!1),f(null),m(null),g(null)}catch(e){b(e instanceof Error?e:Error(`Logout failed`))}finally{v(!1)}},[c]),w=(0,t.useCallback)(async()=>{if(await c.initialize(),c.isAuthenticated())return c.getAccessToken();try{let e=await c.refreshAccessToken();return f(e.accessToken),m(c.getIdToken()),g(c.getUserProfile()),u(!0),e.accessToken}catch{return u(!1),f(null),m(null),g(null),null}},[c]),T=(0,t.useCallback)(async()=>{await c.navigateToAccountManagement(),await x()},[c,x]);return(0,n.jsx)(F.Provider,{value:{isAuthenticated:l,isLoading:_,accessToken:d,idToken:p,user:h,error:y,login:S,logout:C,getToken:w,navigateToAccountManagement:T,authClient:c},children:i})},L=()=>{let e=(0,t.useContext)(F);if(!e)throw Error(`useAuth must be used within an AuthProvider`);return e};function R(e,t,n={}){let r=!1,i=[],a=(e,t=null)=>{i.forEach(n=>{e?n.reject(e):n.resolve(t)}),i=[]},o=e=>!e||!n.excludeUrls?!1:n.excludeUrls.some(t=>typeof t==`string`?e.includes(t):t.test(e)),s=e.interceptors.request.use(async e=>{if(o(e.url))return e;await t.initialize();let n=t.getAccessToken();if(!t.isAuthenticated()&&n)try{n=(await t.refreshAccessToken()).accessToken}catch{n=null}return n&&e.headers.set(`Authorization`,`Bearer ${n}`),e},e=>Promise.reject(e)),c=e.interceptors.response.use(e=>e,async s=>{let c=s.config;if(!c||o(c.url))return Promise.reject(s);if(s.response?.status===401&&!c._retry){if(r)return new Promise((e,t)=>{i.push({resolve:e,reject:t})}).then(t=>(t&&c.headers.set(`Authorization`,`Bearer ${t}`),e(c))).catch(e=>Promise.reject(e));c._retry=!0,r=!0;try{let n=(await t.refreshAccessToken()).accessToken;return a(null,n),c.headers.set(`Authorization`,`Bearer ${n}`),e(c)}catch(e){return a(e,null),await t.logout(),n.onUnauthorized&&n.onUnauthorized(),Promise.reject(e)}finally{r=!1}}return Promise.reject(s)});return()=>{e.interceptors.request.eject(s),e.interceptors.response.eject(c)}}e.AuthClient=P,e.AuthProvider=I,e.NativeTokenStorage=T,e.STORAGE_KEYS=u,e.base64UrlEncode=g,e.createCodeChallenge=C,e.createExpoSecureStoreAdapter=k,e.createExpoWebBrowserLauncher=j,e.createInAppBrowserLauncher=M,e.createKeychainStorageAdapter=A,e.createMemoryStorageAdapter=E,e.decodeJwtPayload=y,e.generateCodeVerifier=x,e.generateRandomString=b,e.generateState=S,e.getRandomBytes=_,e.parseCallbackUrl=N,e.setupAxiosInterceptors=R,e.sha256Bytes=h,e.useAuth=L});

package/dist/models/types.d.ts

@@ -0,0 +1,131 @@
+export interface OAuth2AsyncStorage {
+    getItem(key: string): Promise<string | null> | string | null;
+    setItem(key: string, value: string): Promise<void> | void;
+    removeItem(key: string): Promise<void> | void;
+}
+export interface BrowserSessionResult {
+    type: 'success' | 'cancel' | 'dismiss';
+    url?: string;
+}
+export type BrowserSessionLauncher = (authUrl: string, redirectUri: string) => Promise<BrowserSessionResult>;
+export interface OAuth2NativeConfig {
+    /**
+     * The Client ID obtained from the WitsAuth console.
+     */
+    clientId: string;
+    /**
+     * The authorization endpoint URL.
+     * E.g., https://auth.example.com/auth/authorize
+     */
+    authorizationEndpoint: string;
+    /**
+     * The token endpoint URL.
+     * E.g., https://auth.example.com/oauth/token
+     */
+    tokenEndpoint: string;
+    /**
+     * The callback URI configured for your mobile application.
+     * Supports custom schemes (e.g., myapp://auth/callback) and Universal/App Links.
+     */
+    redirectUri: string;
+    /**
+     * Optional userInfo endpoint URL.
+     * E.g., https://auth.example.com/oauth/userinfo
+     */
+    userInfoEndpoint?: string;
+    /**
+     * Optional token revocation endpoint URL.
+     * E.g., https://auth.example.com/oauth/revoke
+     */
+    revokeEndpoint?: string;
+    /**
+     * Optional logout endpoint URL.
+     * E.g., https://auth.example.com/auth/logout
+     */
+    logoutEndpoint?: string;
+    /**
+     * Scopes to request, separated by spaces.
+     * E.g., "openid profile email offline_access"
+     */
+    scope?: string;
+    /**
+     * Audience parameter to request (if required by WitsAuth).
+     */
+    audience?: string;
+    /**
+     * Optional static nonce value. If omitted, a random cryptographic nonce is generated per authorization request.
+     */
+    nonce?: string;
+    /**
+     * Optional theme hint ("light" | "dark") or a callback returning the current theme.
+     */
+    theme?: 'light' | 'dark' | (() => 'light' | 'dark' | undefined);
+    /**
+     * Response type. Defaults to "code".
+     */
+    responseType?: string;
+    /**
+     * PKCE code challenge method. Defaults to "S256".
+     */
+    codeChallengeMethod?: 'S256' | 'plain';
+    /**
+     * Secure async storage adapter (e.g., Expo SecureStore or React Native Keychain).
+     * If omitted, falls back to an in-memory store.
+     */
+    storage?: OAuth2AsyncStorage;
+    /**
+     * Custom system browser session launcher (ASWebAuthenticationSession on iOS / Chrome Custom Tabs on Android).
+     * If omitted, auto-detects `expo-web-browser` or `react-native-inappbrowser-reborn`.
+     */
+    openAuthSession?: BrowserSessionLauncher;
+    /**
+     * Log level for internal client messages. Defaults to 'warn'.
+     */
+    logLevel?: 'none' | 'error' | 'warn' | 'info' | 'debug';
+}
+export interface TokenInfo {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    tokenType: string;
+    scope?: string;
+    idToken?: string;
+}
+export interface UserProfile {
+    sub?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    roles?: string[];
+    permissions?: string[];
+    amr?: string[];
+    act?: {
+        sub: string;
+        ticket_ref?: string;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface AuthorizeOptions {
+    prompt?: 'login' | 'consent' | 'select_account';
+    scope?: string;
+    audience?: string;
+}
+export interface LogoutOptions {
+    clearBrowserSession?: boolean;
+}
+export declare const STORAGE_KEYS: {
+    readonly ACCESS_TOKEN: 'witsauth_access_token';
+    readonly REFRESH_TOKEN: 'witsauth_refresh_token';
+    readonly TOKEN_EXPIRES_AT: 'witsauth_expires_at';
+    readonly TOKEN_TYPE: 'witsauth_token_type';
+    readonly SCOPE: 'witsauth_scope';
+    readonly ID_TOKEN: 'witsauth_id_token';
+    readonly CODE_VERIFIER: 'witsauth_code_verifier';
+    readonly STATE: 'witsauth_state';
+    readonly NONCE: 'witsauth_nonce';
+};

package/dist/react/AuthContext.d.ts

@@ -0,0 +1,30 @@
+import React from 'react';
+import { AuthClient } from '../core/AuthClient';
+import { AuthorizeOptions, LogoutOptions, OAuth2NativeConfig, UserProfile } from '../models/types';
+export interface AuthContextType {
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    accessToken: string | null;
+    idToken: string | null;
+    user: UserProfile | null;
+    error: Error | null;
+    login: (options?: AuthorizeOptions) => Promise<void>;
+    logout: (options?: LogoutOptions) => Promise<void>;
+    getToken: () => Promise<string | null>;
+    navigateToAccountManagement: () => Promise<void>;
+    authClient: AuthClient;
+}
+export interface AuthProviderProps {
+    config?: OAuth2NativeConfig;
+    client?: AuthClient;
+    children: React.ReactNode;
+    onLoginSuccess?: () => void;
+    onLoginError?: (error: Error) => void;
+    /**
+     * Optional subscription to React Native's `AppState.addEventListener('change', listener)`
+     * so tokens automatically refresh when the app returns to the foreground (`active`).
+     */
+    subscribeAppState?: (listener: (state: string) => void) => () => void;
+}
+export declare const AuthProvider: React.FC<AuthProviderProps>;
+export declare const useAuth: () => AuthContextType;

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@witsauth/react-native-client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.1",
+  "description": "Official React Native client library (Expo and Bare React Native CLI) for integrating WitsAuth OAuth 2.0 + PKCE authentication on Android and iOS.",
+  "main": "./dist/index.umd.js",
+  "module": "./dist/index.es.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.es.js",
+      "require": "./dist/index.umd.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "react-native",
+    "expo",
+    "android",
+    "ios",
+    "witsauth",
+    "auth",
+    "oauth2",
+    "pkce"
+  ],
+  "author": "",
+  "license": "ISC",
+  "type": "module",
+  "peerDependencies": {
+    "axios": "^1.0.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-native": ">=0.72.0"
+  },
+  "peerDependenciesMeta": {
+    "axios": {
+      "optional": true
+    },
+    "react-native": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@types/node": "^24.13.2",
+    "@types/react": "^19.2.17",
+    "axios": "^1.18.1",
+    "jsdom": "^29.1.1",
+    "react": "^19.2.7",
+    "typescript": "^7.0.2",
+    "vite": "^8.1.5",
+    "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build && tsc -p tsconfig.build.json",
+    "test": "vitest run"
+  }
 }