@xkova/sdk 0.1.0-alpha.1

package/dist/member-bff.d.ts

@@ -0,0 +1,535 @@
+import { XKOVAMemberResources } from './member-resources.js';
+import { XKOVAMemberActionIntents, type XKOVAMemberActionIntentStore } from './member-action-intents.js';
+export { XKOVAMemberIntentError } from './member-action-intents.js';
+export type { XKOVAMemberActionIntents, XKOVAMemberActionIntentStore, StoredXKOVAMemberActionIntent, XKOVAMemberPreparedAction, XKOVAMemberIntentRequest, } from './member-action-intents.js';
+export type { XKOVAMemberResources } from './member-resources.js';
+import { type XKOVARequestSigner } from './request-signing.js';
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export type XKOVAMemberProofKind = 'xkova_hosted' | 'oidc' | 'signed_launch';
+export type XKOVAMemberProofBindingMode = 'authorization_nonce' | 'server_assertion_jti';
+export type XKOVAAccountCenterIntent = 'security' | 'sessions' | 'wallet_readiness' | 'action';
+export type XKOVAMemberActionResourceType = 'payment' | 'escrow' | 'approval_request';
+export type XKOVAMemberActionName = 'sign' | 'create' | 'cancel' | 'attest';
+export interface XKOVAMemberBffClientOptions {
+    /** API origin or versioned base URL. */
+    readonly baseUrl: string;
+    /** Confidential tenant/workspace bearer credential. */
+    readonly apiKey: string;
+    /** Non-secret member-auth application selector. */
+    readonly publishableKey: string;
+    /** Required for production mutations, optional in sandbox. */
+    readonly requestSigner?: XKOVARequestSigner;
+    /** Default request deadline. */
+    readonly timeoutMs?: number;
+    /** Override global fetch for tests or custom transport. */
+    readonly fetchImpl?: FetchLike;
+}
+export interface XKOVAMemberContext {
+    readonly sessionId: string;
+    readonly accountHolderId: string;
+    readonly providerSubject: string;
+    readonly expiresAt: number;
+}
+export interface XKOVAMemberSessionMaterial extends XKOVAMemberContext {
+    /** Confidential refresh credential, BFF storage only. */
+    readonly refreshToken: string;
+}
+export interface XKOVABrowserMemberProjection {
+    readonly signedIn: true;
+    readonly accountHolderId: string;
+    readonly expiresAt: string;
+}
+export interface StoredXKOVAMemberSession<TApplicationData = unknown> extends XKOVAMemberSessionMaterial {
+    /** Absolute expiry of the customer's first-party application session. */
+    readonly applicationExpiresAt: number;
+    /** Customer-owned data, never transmitted to XKOVA by this helper. */
+    readonly applicationData: TApplicationData;
+    /** Persisted until the exact refresh attempt is confirmed. */
+    readonly pendingRefreshAttemptId?: string;
+}
+/**
+ * `runExclusive` must serialize refresh and logout for the same reference
+ * across all BFF instances. Use a database transaction or distributed lock;
+ * a process-local mutex cannot coordinate multiple instances.
+ */
+export interface XKOVAMemberSessionStore<TApplicationData = unknown> {
+    put(reference: string, session: StoredXKOVAMemberSession<TApplicationData>): Promise<void>;
+    get(reference: string): Promise<StoredXKOVAMemberSession<TApplicationData> | null>;
+    replace(reference: string, session: StoredXKOVAMemberSession<TApplicationData>): Promise<void>;
+    delete(reference: string): Promise<void>;
+    runExclusive<T>(reference: string, work: () => Promise<T>): Promise<T>;
+}
+export type XKOVAMemberAuthorizationTransaction<TApplicationData = unknown> = {
+    readonly status: 'pending';
+    readonly completionMode: 'provider_proof';
+    /** One-way binding to the exact API origin, bearer principal, and application. */
+    readonly clientFingerprint: string;
+    readonly proofKind: XKOVAMemberProofKind;
+    readonly nonce: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+    readonly exchangeAttemptId: string;
+    /** Stable local session reference used for every callback recovery attempt. */
+    readonly sessionReference: string;
+    readonly expiresAt: number;
+    /**
+     * Confidential provider proof staged after the one-time provider callback.
+     * Production stores must encrypt this value and restrict it like refresh
+     * credentials. It exists only so an ambiguous XKOVA exchange can be retried
+     * without attempting to reuse the provider authorization code.
+     */
+    readonly stagedProviderExchange?: {
+        readonly providerCodeHash: string;
+        readonly proofToken: string;
+        readonly applicationExpiresAt: number;
+        /** Frozen on the first provider-code exchange and reused for every recovery. */
+        readonly applicationData: TApplicationData;
+    };
+} | {
+    readonly status: 'pending';
+    readonly completionMode: 'hosted_result_code';
+    /** Absent only while the start request is provisional; persisted before start returns. */
+    readonly authorizationUrl?: string;
+    /** One-way binding to the exact API origin, bearer principal, and application. */
+    readonly clientFingerprint: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+    readonly exchangeAttemptId: string;
+    /** Stable local session reference used for every callback recovery attempt. */
+    readonly sessionReference: string;
+    readonly expiresAt: number;
+    readonly stagedApplicationSession?: {
+        readonly authorizationCodeHash: string;
+        readonly applicationExpiresAt: number;
+        /** Frozen on first result-code exchange and reused for every recovery. */
+        readonly applicationData: TApplicationData;
+    };
+} | {
+    readonly status: 'pending';
+    readonly completionMode: 'account_center_result_code';
+    /** One-way binding to the exact API origin, bearer principal, and application. */
+    readonly clientFingerprint: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+    readonly exchangeAttemptId: string;
+    /** Exact existing customer application session that launched Account Center. */
+    readonly sessionReference: string;
+    readonly intent: XKOVAAccountCenterIntent;
+    readonly actionAuthorization?: {
+        readonly method: 'hosted_passkey';
+    } | {
+        readonly method: 'external_oidc';
+        readonly actionToken: string;
+        readonly nonce: string;
+        readonly stagedProviderExchange?: {
+            readonly providerCodeHash: string;
+            readonly proofToken: string;
+        };
+    };
+    /** Customer application return target, stored only in the BFF transaction. */
+    readonly applicationReturnUri?: string;
+    /** Review location for cancellation or expiry, never a success destination. */
+    readonly applicationReviewUri?: string;
+    readonly actionResource?: {
+        readonly type: XKOVAMemberActionResourceType;
+        readonly id: string;
+        readonly action: XKOVAMemberActionName;
+    };
+    readonly expiresAt: number;
+} | {
+    readonly status: 'completed';
+    readonly completionMode: 'provider_proof' | 'hosted_result_code';
+    /** Preserved so completed recovery cannot cross client applications. */
+    readonly clientFingerprint: string;
+    readonly redirectUri: string;
+    readonly providerCodeHash: string;
+    readonly sessionReference: string;
+    readonly expiresAt: number;
+} | {
+    readonly status: 'completed';
+    readonly completionMode: 'account_center_result_code';
+    readonly clientFingerprint: string;
+    readonly redirectUri: string;
+    readonly providerCodeHash: string;
+    readonly sessionReference: string;
+    readonly intent: XKOVAAccountCenterIntent;
+    readonly signingExchangeCode?: string;
+    readonly signingUrl?: string;
+    readonly applicationReturnUri?: string;
+    readonly applicationReviewUri?: string;
+    readonly actionResource?: {
+        readonly type: XKOVAMemberActionResourceType;
+        readonly id: string;
+        readonly action: XKOVAMemberActionName;
+    };
+    readonly expiresAt: number;
+};
+/**
+ * `runExclusive` must serialize callback completion for the same state across
+ * every BFF instance. `replace` and `delete` must target that exact state. A
+ * production store must encrypt the transaction because it can briefly hold a
+ * confidential provider proof while XKOVA session exchange is retried.
+ */
+export interface XKOVAMemberAuthorizationTransactionStore<TApplicationData = unknown> {
+    put(stateHash: string, transaction: XKOVAMemberAuthorizationTransaction<TApplicationData>): Promise<void>;
+    get(stateHash: string): Promise<XKOVAMemberAuthorizationTransaction<TApplicationData> | null>;
+    replace(stateHash: string, transaction: XKOVAMemberAuthorizationTransaction<TApplicationData>): Promise<void>;
+    delete(stateHash: string): Promise<void>;
+    runExclusive<T>(stateHash: string, work: () => Promise<T>): Promise<T>;
+}
+export type XKOVAMemberProofExchangeTransaction<TApplicationData = unknown> = {
+    readonly status: 'pending';
+    /** One-way binding to the exact API origin, bearer principal, and application. */
+    readonly clientFingerprint: string;
+    readonly attemptId: string;
+    readonly proofToken: string;
+    readonly sessionReference: string;
+    readonly applicationExpiresAt: number;
+    readonly applicationData: TApplicationData;
+    readonly expiresAt: number;
+} | {
+    readonly status: 'completed';
+    /** Preserved so completed recovery cannot cross client applications. */
+    readonly clientFingerprint: string;
+    readonly sessionReference: string;
+    readonly expiresAt: number;
+};
+/**
+ * Durable transaction store for a confidential proof exchange that does not
+ * use the browser callback helper. Pending records contain a provider proof
+ * and customer application data, so production adapters must encrypt them.
+ */
+export interface XKOVAMemberProofExchangeTransactionStore<TApplicationData = unknown> {
+    put(exchangeHash: string, transaction: XKOVAMemberProofExchangeTransaction<TApplicationData>): Promise<void>;
+    get(exchangeHash: string): Promise<XKOVAMemberProofExchangeTransaction<TApplicationData> | null>;
+    replace(exchangeHash: string, transaction: XKOVAMemberProofExchangeTransaction<TApplicationData>): Promise<void>;
+    delete(exchangeHash: string): Promise<void>;
+    runExclusive<T>(exchangeHash: string, work: () => Promise<T>): Promise<T>;
+}
+export interface XKOVAMemberAuthorizationStart {
+    readonly state: string;
+    readonly nonce: string;
+    readonly codeChallenge: string;
+    readonly codeChallengeMethod: 'S256';
+    readonly expiresAt: string;
+}
+/**
+ * Safe server-side launch projection for XKOVA Hosted Auth. The BFF stores
+ * the returned `state` in its short-lived flow cookie, then redirects the
+ * browser to `authorizationUrl`. PKCE verifier material remains only in the
+ * encrypted authorization transaction store.
+ */
+export interface XKOVAHostedMemberAuthorizationStart {
+    readonly authorizationUrl: string;
+    readonly state: string;
+    readonly expiresAt: string;
+}
+/** Safe BFF-only launch projection for the controlled Hosted Account Center. */
+export interface XKOVAAccountCenterHandoffStart {
+    readonly handoffUrl: string;
+    readonly state: string;
+    readonly expiresAt: string;
+}
+/** Safe completion projection. Account Center credentials never cross this boundary. */
+export interface XKOVAAccountCenterHandoffCompletion {
+    readonly status: 'completed';
+    readonly intent: XKOVAAccountCenterIntent;
+    readonly signingExchangeCode?: string;
+    readonly signingUrl?: string;
+    readonly applicationReturnUri?: string;
+}
+export type XKOVAMemberActionAuthorizationStart = {
+    readonly authorizationMethod: 'hosted_passkey';
+    readonly authorizationUrl: string;
+    readonly state: string;
+    readonly expiresAt: string;
+} | {
+    readonly authorizationMethod: 'external_oidc';
+    readonly actionToken: string;
+    readonly state: string;
+    readonly nonce: string;
+    readonly codeChallenge: string;
+    readonly codeChallengeMethod: 'S256';
+    readonly issuer: string;
+    readonly audience: string;
+    readonly maxAuthAgeSeconds: number;
+    readonly requiredAcrValues: readonly string[];
+    readonly requiredAmrValues: readonly string[];
+    readonly expiresAt: string;
+};
+export interface XKOVAMemberActionCompletion {
+    readonly signingExchangeCode: string;
+    readonly signingUrl: string;
+    readonly applicationReturnUri?: string;
+    readonly expiresAt?: string;
+}
+export interface XKOVAMemberProviderCodeExchangeInput {
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly nonce: string;
+    readonly redirectUri: string;
+    readonly proofKind: XKOVAMemberProofKind;
+}
+export interface XKOVAMemberProviderCodeExchangeResult {
+    /** Provider ID token or approved signed proof exchanged once with XKOVA. */
+    readonly proofToken: string;
+    /**
+     * Optional signed OIDC ID token used only to bind the provider callback to
+     * the transaction nonce. This supports providers whose XKOVA proof is a
+     * distinct access token carrying a provider-guaranteed session/JTI. Before
+     * returning a distinct nonce token, the BFF must complete full JOSE
+     * validation, including signature, issuer, audience, algorithm, expiry, and
+     * nonce. This helper only compares the already-validated nonce claim.
+     */
+    readonly nonceToken?: string;
+}
+export interface EstablishedXKOVAMemberSession<TApplicationData = unknown> {
+    readonly reference: string;
+    readonly session: StoredXKOVAMemberSession<TApplicationData>;
+    readonly projection: XKOVABrowserMemberProjection;
+}
+export type XKOVAMemberAuthorizationTerminalReason = 'transaction_unavailable' | 'authorization_cancelled' | 'provider_rejected' | 'callback_missing_code' | 'proof_nonce_mismatch';
+/**
+ * Marks an authorization failure that makes the exact browser transaction
+ * unusable. BFFs may retire their short-lived flow cookie for this error.
+ * Other failures must preserve the cookie so the durable transaction can be
+ * retried with the same state and XKOVA operation attempt.
+ */
+export declare class XKOVAMemberAuthorizationTerminalError extends Error {
+    readonly reason: XKOVAMemberAuthorizationTerminalReason;
+    /** BFF-stored, validated review destination. Never copied from callback query parameters. */
+    readonly applicationReviewUri?: string;
+    constructor(reason: XKOVAMemberAuthorizationTerminalReason, message: string, applicationReviewUri?: string);
+}
+/**
+ * Keep provider proofs and XKOVA sessions on the server. Your application
+ * handles the provider's sign-in UI and passes the resulting proof here.
+ */
+export declare class XKOVAMemberBffClient {
+    private readonly options;
+    private readonly apiBaseUrl;
+    private readonly clientFingerprint;
+    private readonly fetchImpl;
+    constructor(options: XKOVAMemberBffClientOptions);
+    issueProofChallenge(input: {
+        origin: string;
+        redirectUri: string;
+    }): Promise<{
+        nonce: string;
+        expiresAt: string;
+    }>;
+    exchangeProof(proofToken: string, options: {
+        readonly attemptId: string;
+    }): Promise<XKOVAMemberSessionMaterial>;
+    refresh(refreshToken: string, options: {
+        readonly attemptId: string;
+    }): Promise<XKOVAMemberSessionMaterial>;
+    getSession(sessionId: string): Promise<XKOVAMemberContext>;
+    /** Revokes only the exact XKOVA session named by `sessionId`. */
+    signOutExactSession(sessionId: string): Promise<void>;
+    beginAuthorization<TApplicationData = unknown>(input: {
+        readonly proofKind: XKOVAMemberProofKind;
+        /**
+         * `authorization_nonce` asks XKOVA to issue and later consume the nonce.
+         * `server_assertion_jti` keeps callback state, nonce, and PKCE in the BFF,
+         * while XKOVA consumes the verified provider assertion identifier once.
+         */
+        readonly proofBindingMode?: XKOVAMemberProofBindingMode;
+        /** Exact browser Origin observed by the customer BFF. */
+        readonly browserOrigin: string;
+        readonly redirectUri: string;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+    }): Promise<XKOVAMemberAuthorizationStart>;
+    /**
+     * Persist the transaction before redirecting to Hosted Auth so the callback
+     * can validate state and PKCE and recover the same session after a retry.
+     */
+    beginHostedAuthorization<TApplicationData = unknown>(input: {
+        /** Exact browser Origin observed by the customer BFF. */
+        readonly browserOrigin: string;
+        readonly redirectUri: string;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+    }): Promise<XKOVAHostedMemberAuthorizationStart>;
+    /**
+     * Available only to sandbox applications enabled for demo sign-in. The stored
+     * Hosted transaction determines the demo account and callback. An uncertain
+     * response preserves the key so a retry recovers the same reservation.
+     * Complete the returned callback using
+     * completeHostedAuthorization and the original browser flow cookie.
+     */
+    completeSandboxDemoAuthorization<TApplicationData>(input: {
+        readonly state: string;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+    }): Promise<{
+        readonly callbackUrl: string;
+        readonly expiresAt: string;
+    }>;
+    /**
+     * Completes the one-time Hosted Auth result-code exchange and persists the
+     * provider-neutral XKOVA member session. The returned projection is safe for
+     * a browser, but `session` and `reference` remain BFF-only material.
+     */
+    completeHostedAuthorization<TApplicationData>(input: {
+        readonly callbackUrl: string;
+        /** Exact state recovered from the initiating browser's flow cookie. */
+        readonly expectedState: string;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly applicationData: TApplicationData;
+        readonly applicationSessionSeconds?: number;
+    }): Promise<EstablishedXKOVAMemberSession<TApplicationData>>;
+    /**
+     * Launches the narrow, Hosted-only XKOVA Account Center from an existing
+     * customer application session. The browser receives only a one-time
+     * handoff URL and state. The member session, PKCE verifier, and exchange
+     * attempt remain in the customer BFF stores.
+     */
+    beginAccountCenterHandoff<TApplicationData>(input: {
+        readonly intent: XKOVAAccountCenterIntent;
+        readonly browserOrigin: string;
+        readonly returnUri: string;
+        /** Exact-origin application screen to restore, persisted only by the BFF. */
+        readonly applicationReturnUri?: string;
+        readonly sessionReference: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+    }): Promise<XKOVAAccountCenterHandoffStart>;
+    /**
+     * Completes a one-time Account Center return. The same existing application
+     * session must still exist and XKOVA binds the result to its exact member
+     * session, application, tenant, workspace, account holder, state, PKCE, and
+     * durable exchange attempt.
+     */
+    completeAccountCenterHandoff<TApplicationData>(input: {
+        readonly callbackUrl: string;
+        readonly expectedState: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+    }): Promise<XKOVAAccountCenterHandoffCompletion>;
+    /**
+     * Binds fresh authorization to one existing resource. Hosted applications
+     * use Account Center passkeys. OIDC applications receive the assurance
+     * requirements their BFF must request from the registered provider.
+     */
+    beginMemberAction<TApplicationData>(input: {
+        readonly resourceType: XKOVAMemberActionResourceType;
+        readonly resourceId: string;
+        readonly action: XKOVAMemberActionName;
+        readonly browserOrigin: string;
+        readonly returnUri: string;
+        /** Same-origin destination after the wallet signature completes. */
+        readonly applicationReturnUri?: string;
+        /** Same-origin originating review screen, not the success screen. */
+        readonly applicationReviewUri?: string;
+        readonly sessionReference: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+    }): Promise<XKOVAMemberActionAuthorizationStart>;
+    /** Completes the exact Hosted-passkey or FI-OIDC action ceremony. */
+    completeMemberAction<TApplicationData>(input: {
+        readonly callbackUrl: string;
+        readonly expectedState: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+        readonly exchangeProviderCode?: (input: XKOVAMemberProviderCodeExchangeInput) => XKOVAMemberProviderCodeExchangeResult | Promise<XKOVAMemberProviderCodeExchangeResult>;
+    }): Promise<XKOVAMemberActionCompletion>;
+    completeAuthorizationCallback<TApplicationData>(input: {
+        readonly callbackUrl: string;
+        /** Exact state recovered from the initiating browser's flow cookie. */
+        readonly expectedState: string;
+        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly exchangeProviderCode: (input: XKOVAMemberProviderCodeExchangeInput) => XKOVAMemberProviderCodeExchangeResult | Promise<XKOVAMemberProviderCodeExchangeResult>;
+        readonly applicationData: TApplicationData;
+        readonly applicationSessionSeconds?: number;
+    }): Promise<EstablishedXKOVAMemberSession<TApplicationData>>;
+    establishSession<TApplicationData>(input: {
+        /** Stable ID generated and persisted before the first exchange attempt. */
+        readonly exchangeId: string;
+        /** Required on first use, optional when recovering a staged exchange. */
+        readonly proofToken?: string;
+        readonly exchangeStore: XKOVAMemberProofExchangeTransactionStore<TApplicationData>;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly applicationData: TApplicationData;
+        readonly applicationSessionSeconds?: number;
+    }): Promise<EstablishedXKOVAMemberSession<TApplicationData>>;
+    resolveSession<TApplicationData>(input: {
+        readonly reference: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly refreshSkewSeconds?: number;
+        /** Defaults true, which checks revocation, idle expiry, and policy changes. */
+        readonly validateWithXkova?: boolean;
+    }): Promise<StoredXKOVAMemberSession<TApplicationData> | null>;
+    /**
+     * Resolve, refresh and validate a confidential session, then bind typed
+     * business operations to it. Call once per incoming BFF request, after the
+     * application has checked its browser Origin and mutation CSRF proof.
+     * Do not cache the returned request-scoped resources across requests.
+     */
+    resolveResources<TApplicationData>(input: {
+        readonly reference: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+    }): Promise<{
+        readonly session: StoredXKOVAMemberSession<TApplicationData>;
+        readonly resources: XKOVAMemberResources;
+    } | null>;
+    /** Bind durable action reviews to the same exact session and public resources as normal reads. */
+    resolveActionIntents<TApplicationData>(input: {
+        readonly reference: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        readonly intentStore: XKOVAMemberActionIntentStore;
+    }): Promise<XKOVAMemberActionIntents | null>;
+    logoutSession<TApplicationData>(input: {
+        readonly reference: string;
+        readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+    }): Promise<void>;
+    private persistSessionWithAttempt;
+    private persistSessionMaterial;
+    private postJson;
+    private recoverablePostJson;
+    private getJson;
+    private requestJson;
+    private readSessionMaterial;
+    private requestSignal;
+}
+/** Only confirmed admission rejections may release a customer's pending demo reservation. */
+export declare function isDefinitiveXKOVASandboxDemoAdmissionFailure(error: unknown): boolean;
+export declare function projectXKOVAMemberSession(session: XKOVAMemberContext): XKOVABrowserMemberProjection;
+export declare function serializeXKOVAMemberSessionCookie(input: {
+    readonly cookieName: string;
+    readonly reference: string;
+    readonly maxAgeSeconds: number;
+}): string;
+/** Short-lived Lax cookie for cross-site OAuth/OIDC callback state only. */
+export declare function serializeXKOVAMemberFlowCookie(input: {
+    readonly cookieName: string;
+    readonly reference: string;
+    readonly maxAgeSeconds?: number;
+}): string;
+export declare function serializeClearedXKOVAMemberCookie(cookieName: string): string;
+/** One short-lived cookie per ceremony, so another tab cannot replace its browser binding. */
+export declare function xkovaMemberFlowCookieName(cookiePrefix: string, state: string): string;
+/** State must match a real HttpOnly cookie. A callback query alone is never authority. */
+export declare function readXKOVAMemberCallbackFlow(input: {
+    cookieHeader: string | null;
+    cookiePrefix: string;
+    callbackUrl: string;
+}): {
+    state: string;
+    cookieName: string;
+} | null;
+export declare function readXKOVAMemberCookie(cookieHeader: string | null, cookieName: string): string | null;
+export declare function createXKOVAMemberCsrfToken(input: {
+    readonly sessionReference: string;
+    readonly secret: string | Uint8Array;
+    readonly ttlSeconds?: number;
+    readonly now?: number;
+}): string;
+export declare function verifyXKOVAMemberCsrfToken(input: {
+    readonly token: string;
+    readonly sessionReference: string;
+    readonly secret: string | Uint8Array;
+    readonly now?: number;
+}): boolean;
+export declare function assertXKOVAMemberRequestOrigin(origin: string | null, allowedOrigins: readonly string[]): void;
+export declare function generateXKOVAMemberOperationAttemptId(): string;