cabalspy-id 0.0.0-stage → 0.5.1

package/dist/api.cjs

@@ -0,0 +1,72 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+var _chunkX3OFGGSEcjs = require('./chunk-X3OFGGSE.cjs');
+require('./chunk-A2ZAFAWC.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkL4RHSWOAcjs = require('./chunk-L4RHSWOA.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.AuthenticationError = _chunkL4RHSWOAcjs.AuthenticationError; exports.BadRequestError = _chunkL4RHSWOAcjs.BadRequestError; exports.CHAINS = _chunkL4RHSWOAcjs.CHAINS; exports.CURRENCY_BY_CHAIN = _chunkL4RHSWOAcjs.CURRENCY_BY_CHAIN; exports.CabalSpyID = _chunkL4RHSWOAcjs.CabalSpyID; exports.CabalSpyIDAuth = _chunkX3OFGGSEcjs.CabalSpyIDAuth; exports.CabalSpyIDError = _chunkL4RHSWOAcjs.CabalSpyIDError; exports.CabalSpyIDStream = _chunkL4RHSWOAcjs.CabalSpyIDStream; exports.ConnectionError = _chunkL4RHSWOAcjs.ConnectionError; exports.DEFAULT_BASE_URL = _chunkL4RHSWOAcjs.DEFAULT_BASE_URL; exports.DEFAULT_ISSUER = _chunkX3OFGGSEcjs.DEFAULT_ISSUER; exports.DEFAULT_STREAM_URL = _chunkL4RHSWOAcjs.DEFAULT_STREAM_URL; exports.InvalidResponseError = _chunkL4RHSWOAcjs.InvalidResponseError; exports.JwksCache = _chunkX3OFGGSEcjs.JwksCache; exports.LEADERBOARD_SORTS = _chunkL4RHSWOAcjs.LEADERBOARD_SORTS; exports.NotFoundError = _chunkL4RHSWOAcjs.NotFoundError; exports.OAuthError = _chunkL4RHSWOAcjs.OAuthError; exports.PERIODS = _chunkL4RHSWOAcjs.PERIODS; exports.PermissionError = _chunkL4RHSWOAcjs.PermissionError; exports.PlanUserLimitError = _chunkL4RHSWOAcjs.PlanUserLimitError; exports.RateLimitError = _chunkL4RHSWOAcjs.RateLimitError; exports.SDK_VERSION = _chunkL4RHSWOAcjs.SDK_VERSION; exports.ServerError = _chunkL4RHSWOAcjs.ServerError; exports.TokenVerificationError = _chunkL4RHSWOAcjs.TokenVerificationError; exports.WebhookVerificationError = _chunkL4RHSWOAcjs.WebhookVerificationError; exports.decodeJwt = _chunkX3OFGGSEcjs.decodeJwt; exports.generatePkce = _chunkX3OFGGSEcjs.generatePkce; exports.handleKind = _chunkL4RHSWOAcjs.handleKind; exports.hasX = _chunkL4RHSWOAcjs.hasX; exports.isLimited = _chunkX3OFGGSEcjs.isLimited; exports.signWebhook = _chunkL4RHSWOAcjs.signWebhook; exports.verifyWebhook = _chunkL4RHSWOAcjs.verifyWebhook;
+//# sourceMappingURL=api.cjs.map

package/dist/api.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["c:\\Users\\davis\\Desktop\\cabalspy-web\\github\\cabalspy-id-js\\dist\\api.cjs"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B,gCAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,m0DAAC","file":"C:\\Users\\davis\\Desktop\\cabalspy-web\\github\\cabalspy-id-js\\dist\\api.cjs"}

package/dist/api.d.cts

@@ -0,0 +1,193 @@
+export { A as ApiErrorBody, a as AuthenticationError, B as BadRequestError, C as CabalSpyID, b as CabalSpyIDError, c as CabalSpyIDErrorOptions, d as CabalSpyIDOptions, e as CabalSpyIDStream, f as CloseEvent, g as ConnectionError, D as DEFAULT_BASE_URL, h as DEFAULT_STREAM_URL, E as Envelope, H as HandleKind, k as HeaderSource, l as HeartbeatEvent, m as HistoryParams, I as InvalidResponseError, n as LatestTransactionsParams, o as LeaderboardParams, N as NotFoundError, O as OAuthError, P as PermissionError, q as PlanUserLimitError, s as ProfileParams, Q as Query, R as RateLimitError, t as RateLimitInfo, v as ReconnectEvent, S as SDK_VERSION, y as ScopedParams, z as ServerError, F as StreamEvent, G as StreamEventMap, J as StreamOptions, K as StreamTopic, T as SubscribedEvent, a3 as TokenVerificationError, a4 as TrackerParams, a5 as UserLike, a7 as UsersParams, a8 as VerifyWebhookOptions, a9 as WalletParams, aa as WebhookVerificationError, ab as handleKind, ac as hasX, ad as signWebhook, ae as verifyWebhook } from './users-BDLkwW1p.cjs';
+import { O as OidcScope, D as DiscoveryDocument, a8 as TokenResponse, c as CabalSpyIDClaims } from './types-UZeY9n1e.cjs';
+export { A as ActiveTokens, a as ApiResponse, C as CHAINS, b as CURRENCY_BY_CHAIN, d as Chain, e as Currency, H as HealthResponse, f as HistoryResponse, g as HistoryToken, h as HistoryTrade, i as HoldingToken, j as HoldingsResponse, L as LEADERBOARD_SORTS, k as LeaderboardEntry, l as LeaderboardResponse, m as LeaderboardSort, n as LifetimeStats, M as MeResponse, P as PERIODS, o as Pagination, p as Period, q as PeriodStats, r as PnlCalendarDay, s as PnlCalendarMonth, t as PnlCalendarResponse, u as PnlChartPoint, v as Profile, R as ResponseMeta, S as Scope, a7 as TokenOverview, a9 as TrackerResponse, aa as TrackerTrade, ab as Trade, ac as TradeOwner, ad as TraderProfile, ae as VerifiedWallet, af as WalletClaim, ag as WalletLookupResponse, ah as WebhookEvent, ai as WebhookEventType, aj as WinRateBuckets, ak as WinRateDistribution, al as XProfileClaim } from './types-UZeY9n1e.cjs';
+
+/** ES256 JWT verification against a JWKS, with WebCrypto only (no dependencies). */
+interface EcJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+}
+interface Jwks {
+    keys: EcJwk[];
+}
+interface JwtHeader {
+    alg: string;
+    kid?: string;
+    typ?: string;
+    [key: string]: unknown;
+}
+interface DecodedJwt<P = Record<string, unknown>> {
+    header: JwtHeader;
+    payload: P;
+}
+/** Decodes a JWT without verifying it. Never trust the result. */
+declare function decodeJwt<P = Record<string, unknown>>(token: string): DecodedJwt<P>;
+/**
+ * Caches the provider's public keys. An unknown `kid` triggers one refetch
+ * (key rotation), at most once per `cooldownMs`.
+ */
+declare class JwksCache {
+    private readonly load;
+    private readonly cooldownMs;
+    private keys;
+    private loaded;
+    private inflight;
+    constructor(load: () => Promise<Jwks>, cooldownMs?: number);
+    private refresh;
+    getKey(kid: string | undefined): Promise<CryptoKey>;
+}
+
+declare const DEFAULT_ISSUER = "https://id.cabalspy.xyz";
+type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
+interface CabalSpyIDAuthOptions {
+    /** Your instance's client_id (`csid_…`). */
+    clientId: string;
+    /** Client secret (`csid_sk_…`) of a server-side app. Omit for public clients. */
+    clientSecret?: string;
+    /** Default redirect URI. Must exactly match one registered in the dashboard. */
+    redirectUri?: string;
+    /** Default: https://id.cabalspy.xyz (env CABALSPY_ID_ISSUER) */
+    issuer?: string;
+    /** Default: client_secret_basic with a secret, else none. */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
+    /** Accepted clock skew in seconds when checking tokens. Default: 60 */
+    clockTolerance?: number;
+    /** Per-request timeout in milliseconds. Default: 15_000 */
+    timeout?: number;
+    fetch?: typeof globalThis.fetch;
+}
+interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** A fresh PKCE verifier (64 chars) and its S256 challenge. */
+declare function generatePkce(): Promise<PkcePair>;
+interface AuthorizationUrlParams {
+    /** Default: ['openid', 'profile']. `openid` is added when missing. */
+    scope?: OidcScope[] | string;
+    redirectUri?: string;
+    /** 'none' (silent, live apps only) or 'consent'. */
+    prompt?: 'none' | 'consent';
+    /** Your own state value; generated when omitted. */
+    state?: string;
+    /** Your own nonce; generated when omitted. */
+    nonce?: string;
+    /** Additional query parameters. */
+    extraParams?: Record<string, string>;
+}
+/**
+ * What you must keep (e.g. in a signed, http-only cookie or the server
+ * session) until the user comes back to your redirect URI.
+ */
+interface AuthorizationRequest {
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+interface CallbackChecks {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri?: string;
+}
+interface VerifyIdTokenOptions {
+    /** The nonce you sent; required after an authorization request. */
+    nonce?: string;
+    /** Maximum seconds since the user authenticated (checks auth_time). */
+    maxAge?: number;
+}
+interface LoginResult {
+    tokens: TokenResponse;
+    /** Verified ID token claims. Check `claims.limited` before using profile data. */
+    claims: CabalSpyIDClaims;
+}
+/** True when the platform is over its plan's user limit: anonymous sub, no profile data. */
+declare function isLimited(claims: Pick<CabalSpyIDClaims, 'limited' | 'sub'>): boolean;
+/**
+ * OpenID Connect client for "Login with CabalSpy ID".
+ *
+ *   const auth = new CabalSpyIDAuth({ clientId, clientSecret, redirectUri });
+ *   const req = await auth.createAuthorizationUrl({ scope: ['openid', 'profile', 'wallets'] });
+ *   // store req.state, req.nonce, req.codeVerifier; redirect to req.url
+ *   const { tokens, claims } = await auth.handleCallback(callbackUrl, stored);
+ */
+declare class CabalSpyIDAuth {
+    readonly clientId: string;
+    readonly issuer: string;
+    readonly redirectUri?: string;
+    readonly authMethod: TokenEndpointAuthMethod;
+    private readonly clientSecret?;
+    private readonly clockTolerance;
+    private readonly timeout;
+    private readonly fetchImpl;
+    private discovery;
+    private readonly jwks;
+    constructor(options: CabalSpyIDAuthOptions);
+    private send;
+    private fetchJson;
+    private clientAuth;
+    private postForm;
+    /** The provider's discovery document (cached for the life of this object). */
+    discover(): Promise<DiscoveryDocument>;
+    /** The provider's public signing keys. */
+    getJwks(): Promise<Jwks>;
+    /**
+     * Builds the authorization URL with PKCE (S256), state and nonce.
+     * Store `state`, `nonce` and `codeVerifier` until the callback.
+     */
+    createAuthorizationUrl(params?: AuthorizationUrlParams): Promise<AuthorizationRequest>;
+    /**
+     * Completes the login on your redirect URI: checks `error`, `state` and
+     * `iss`, exchanges the code and verifies the ID token (signature, iss, aud,
+     * exp, nonce).
+     *
+     * @param callback the full callback URL, its query string or URLSearchParams
+     */
+    handleCallback(callback: string | URL | URLSearchParams, checks: CallbackChecks): Promise<LoginResult>;
+    /** POST /oauth/token with grant_type=authorization_code. */
+    exchangeCode(params: {
+        code: string;
+        codeVerifier: string;
+        redirectUri?: string;
+    }): Promise<TokenResponse>;
+    /**
+     * POST /oauth/token with grant_type=refresh_token. Refresh tokens rotate:
+     * always store the new `refresh_token`. Reusing an old one revokes the whole
+     * chain.
+     */
+    refresh(refreshToken: string): Promise<TokenResponse>;
+    /** POST /oauth/revoke (RFC 7009). Revoking a refresh token ends its whole chain. */
+    revoke(token: string): Promise<void>;
+    /** GET /oauth/userinfo — full claims for the access token's scopes (x, wallets, onchain …). */
+    userinfo(accessToken: string): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies an ID token: ES256 signature (JWKS), iss, aud, azp, exp, nonce.
+     * Use it for tokens from your own callback and for `idToken` sent from the
+     * browser widget's `csid:login` event.
+     *
+     * When the platform is over its plan's user limit, `sub` is `anon_…` and
+     * `limited` is true; see isLimited().
+     */
+    verifyIdToken(idToken: string, options?: VerifyIdTokenOptions): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies a CabalSpy ID access token (typ at+jwt) issued to this client,
+     * e.g. one your frontend sends to your API. Returns its claims
+     * (sub, scope, client_id, exp, jti).
+     */
+    verifyAccessToken(accessToken: string): Promise<{
+        sub: string;
+        scope: string;
+        client_id: string;
+        exp: number;
+        jti: string;
+    } & Record<string, unknown>>;
+}
+
+export { type AuthorizationRequest, type AuthorizationUrlParams, CabalSpyIDAuth, type CabalSpyIDAuthOptions, CabalSpyIDClaims, type CallbackChecks, DEFAULT_ISSUER, type DecodedJwt, DiscoveryDocument, type EcJwk, type Jwks, JwksCache, type JwtHeader, type LoginResult, OidcScope, type PkcePair, type TokenEndpointAuthMethod, TokenResponse, type VerifyIdTokenOptions, decodeJwt, generatePkce, isLimited };

package/dist/api.d.ts

@@ -0,0 +1,193 @@
+export { A as ApiErrorBody, a as AuthenticationError, B as BadRequestError, C as CabalSpyID, b as CabalSpyIDError, c as CabalSpyIDErrorOptions, d as CabalSpyIDOptions, e as CabalSpyIDStream, f as CloseEvent, g as ConnectionError, D as DEFAULT_BASE_URL, h as DEFAULT_STREAM_URL, E as Envelope, H as HandleKind, k as HeaderSource, l as HeartbeatEvent, m as HistoryParams, I as InvalidResponseError, n as LatestTransactionsParams, o as LeaderboardParams, N as NotFoundError, O as OAuthError, P as PermissionError, q as PlanUserLimitError, s as ProfileParams, Q as Query, R as RateLimitError, t as RateLimitInfo, v as ReconnectEvent, S as SDK_VERSION, y as ScopedParams, z as ServerError, F as StreamEvent, G as StreamEventMap, J as StreamOptions, K as StreamTopic, T as SubscribedEvent, a3 as TokenVerificationError, a4 as TrackerParams, a5 as UserLike, a7 as UsersParams, a8 as VerifyWebhookOptions, a9 as WalletParams, aa as WebhookVerificationError, ab as handleKind, ac as hasX, ad as signWebhook, ae as verifyWebhook } from './users-CDlDRuyv.js';
+import { O as OidcScope, D as DiscoveryDocument, a8 as TokenResponse, c as CabalSpyIDClaims } from './types-UZeY9n1e.js';
+export { A as ActiveTokens, a as ApiResponse, C as CHAINS, b as CURRENCY_BY_CHAIN, d as Chain, e as Currency, H as HealthResponse, f as HistoryResponse, g as HistoryToken, h as HistoryTrade, i as HoldingToken, j as HoldingsResponse, L as LEADERBOARD_SORTS, k as LeaderboardEntry, l as LeaderboardResponse, m as LeaderboardSort, n as LifetimeStats, M as MeResponse, P as PERIODS, o as Pagination, p as Period, q as PeriodStats, r as PnlCalendarDay, s as PnlCalendarMonth, t as PnlCalendarResponse, u as PnlChartPoint, v as Profile, R as ResponseMeta, S as Scope, a7 as TokenOverview, a9 as TrackerResponse, aa as TrackerTrade, ab as Trade, ac as TradeOwner, ad as TraderProfile, ae as VerifiedWallet, af as WalletClaim, ag as WalletLookupResponse, ah as WebhookEvent, ai as WebhookEventType, aj as WinRateBuckets, ak as WinRateDistribution, al as XProfileClaim } from './types-UZeY9n1e.js';
+
+/** ES256 JWT verification against a JWKS, with WebCrypto only (no dependencies). */
+interface EcJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+}
+interface Jwks {
+    keys: EcJwk[];
+}
+interface JwtHeader {
+    alg: string;
+    kid?: string;
+    typ?: string;
+    [key: string]: unknown;
+}
+interface DecodedJwt<P = Record<string, unknown>> {
+    header: JwtHeader;
+    payload: P;
+}
+/** Decodes a JWT without verifying it. Never trust the result. */
+declare function decodeJwt<P = Record<string, unknown>>(token: string): DecodedJwt<P>;
+/**
+ * Caches the provider's public keys. An unknown `kid` triggers one refetch
+ * (key rotation), at most once per `cooldownMs`.
+ */
+declare class JwksCache {
+    private readonly load;
+    private readonly cooldownMs;
+    private keys;
+    private loaded;
+    private inflight;
+    constructor(load: () => Promise<Jwks>, cooldownMs?: number);
+    private refresh;
+    getKey(kid: string | undefined): Promise<CryptoKey>;
+}
+
+declare const DEFAULT_ISSUER = "https://id.cabalspy.xyz";
+type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
+interface CabalSpyIDAuthOptions {
+    /** Your instance's client_id (`csid_…`). */
+    clientId: string;
+    /** Client secret (`csid_sk_…`) of a server-side app. Omit for public clients. */
+    clientSecret?: string;
+    /** Default redirect URI. Must exactly match one registered in the dashboard. */
+    redirectUri?: string;
+    /** Default: https://id.cabalspy.xyz (env CABALSPY_ID_ISSUER) */
+    issuer?: string;
+    /** Default: client_secret_basic with a secret, else none. */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
+    /** Accepted clock skew in seconds when checking tokens. Default: 60 */
+    clockTolerance?: number;
+    /** Per-request timeout in milliseconds. Default: 15_000 */
+    timeout?: number;
+    fetch?: typeof globalThis.fetch;
+}
+interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/** A fresh PKCE verifier (64 chars) and its S256 challenge. */
+declare function generatePkce(): Promise<PkcePair>;
+interface AuthorizationUrlParams {
+    /** Default: ['openid', 'profile']. `openid` is added when missing. */
+    scope?: OidcScope[] | string;
+    redirectUri?: string;
+    /** 'none' (silent, live apps only) or 'consent'. */
+    prompt?: 'none' | 'consent';
+    /** Your own state value; generated when omitted. */
+    state?: string;
+    /** Your own nonce; generated when omitted. */
+    nonce?: string;
+    /** Additional query parameters. */
+    extraParams?: Record<string, string>;
+}
+/**
+ * What you must keep (e.g. in a signed, http-only cookie or the server
+ * session) until the user comes back to your redirect URI.
+ */
+interface AuthorizationRequest {
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+interface CallbackChecks {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    redirectUri?: string;
+}
+interface VerifyIdTokenOptions {
+    /** The nonce you sent; required after an authorization request. */
+    nonce?: string;
+    /** Maximum seconds since the user authenticated (checks auth_time). */
+    maxAge?: number;
+}
+interface LoginResult {
+    tokens: TokenResponse;
+    /** Verified ID token claims. Check `claims.limited` before using profile data. */
+    claims: CabalSpyIDClaims;
+}
+/** True when the platform is over its plan's user limit: anonymous sub, no profile data. */
+declare function isLimited(claims: Pick<CabalSpyIDClaims, 'limited' | 'sub'>): boolean;
+/**
+ * OpenID Connect client for "Login with CabalSpy ID".
+ *
+ *   const auth = new CabalSpyIDAuth({ clientId, clientSecret, redirectUri });
+ *   const req = await auth.createAuthorizationUrl({ scope: ['openid', 'profile', 'wallets'] });
+ *   // store req.state, req.nonce, req.codeVerifier; redirect to req.url
+ *   const { tokens, claims } = await auth.handleCallback(callbackUrl, stored);
+ */
+declare class CabalSpyIDAuth {
+    readonly clientId: string;
+    readonly issuer: string;
+    readonly redirectUri?: string;
+    readonly authMethod: TokenEndpointAuthMethod;
+    private readonly clientSecret?;
+    private readonly clockTolerance;
+    private readonly timeout;
+    private readonly fetchImpl;
+    private discovery;
+    private readonly jwks;
+    constructor(options: CabalSpyIDAuthOptions);
+    private send;
+    private fetchJson;
+    private clientAuth;
+    private postForm;
+    /** The provider's discovery document (cached for the life of this object). */
+    discover(): Promise<DiscoveryDocument>;
+    /** The provider's public signing keys. */
+    getJwks(): Promise<Jwks>;
+    /**
+     * Builds the authorization URL with PKCE (S256), state and nonce.
+     * Store `state`, `nonce` and `codeVerifier` until the callback.
+     */
+    createAuthorizationUrl(params?: AuthorizationUrlParams): Promise<AuthorizationRequest>;
+    /**
+     * Completes the login on your redirect URI: checks `error`, `state` and
+     * `iss`, exchanges the code and verifies the ID token (signature, iss, aud,
+     * exp, nonce).
+     *
+     * @param callback the full callback URL, its query string or URLSearchParams
+     */
+    handleCallback(callback: string | URL | URLSearchParams, checks: CallbackChecks): Promise<LoginResult>;
+    /** POST /oauth/token with grant_type=authorization_code. */
+    exchangeCode(params: {
+        code: string;
+        codeVerifier: string;
+        redirectUri?: string;
+    }): Promise<TokenResponse>;
+    /**
+     * POST /oauth/token with grant_type=refresh_token. Refresh tokens rotate:
+     * always store the new `refresh_token`. Reusing an old one revokes the whole
+     * chain.
+     */
+    refresh(refreshToken: string): Promise<TokenResponse>;
+    /** POST /oauth/revoke (RFC 7009). Revoking a refresh token ends its whole chain. */
+    revoke(token: string): Promise<void>;
+    /** GET /oauth/userinfo — full claims for the access token's scopes (x, wallets, onchain …). */
+    userinfo(accessToken: string): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies an ID token: ES256 signature (JWKS), iss, aud, azp, exp, nonce.
+     * Use it for tokens from your own callback and for `idToken` sent from the
+     * browser widget's `csid:login` event.
+     *
+     * When the platform is over its plan's user limit, `sub` is `anon_…` and
+     * `limited` is true; see isLimited().
+     */
+    verifyIdToken(idToken: string, options?: VerifyIdTokenOptions): Promise<CabalSpyIDClaims>;
+    /**
+     * Verifies a CabalSpy ID access token (typ at+jwt) issued to this client,
+     * e.g. one your frontend sends to your API. Returns its claims
+     * (sub, scope, client_id, exp, jti).
+     */
+    verifyAccessToken(accessToken: string): Promise<{
+        sub: string;
+        scope: string;
+        client_id: string;
+        exp: number;
+        jti: string;
+    } & Record<string, unknown>>;
+}
+
+export { type AuthorizationRequest, type AuthorizationUrlParams, CabalSpyIDAuth, type CabalSpyIDAuthOptions, CabalSpyIDClaims, type CallbackChecks, DEFAULT_ISSUER, type DecodedJwt, DiscoveryDocument, type EcJwk, type Jwks, JwksCache, type JwtHeader, type LoginResult, OidcScope, type PkcePair, type TokenEndpointAuthMethod, TokenResponse, type VerifyIdTokenOptions, decodeJwt, generatePkce, isLimited };

package/dist/api.js

@@ -0,0 +1,72 @@
+import {
+  CabalSpyIDAuth,
+  DEFAULT_ISSUER,
+  JwksCache,
+  decodeJwt,
+  generatePkce,
+  isLimited
+} from "./chunk-Z3UPDOBY.js";
+import "./chunk-CJFIOVBA.js";
+import {
+  AuthenticationError,
+  BadRequestError,
+  CHAINS,
+  CURRENCY_BY_CHAIN,
+  CabalSpyID,
+  CabalSpyIDError,
+  CabalSpyIDStream,
+  ConnectionError,
+  DEFAULT_BASE_URL,
+  DEFAULT_STREAM_URL,
+  InvalidResponseError,
+  LEADERBOARD_SORTS,
+  NotFoundError,
+  OAuthError,
+  PERIODS,
+  PermissionError,
+  PlanUserLimitError,
+  RateLimitError,
+  SDK_VERSION,
+  ServerError,
+  TokenVerificationError,
+  WebhookVerificationError,
+  handleKind,
+  hasX,
+  signWebhook,
+  verifyWebhook
+} from "./chunk-3LKLY5WQ.js";
+export {
+  AuthenticationError,
+  BadRequestError,
+  CHAINS,
+  CURRENCY_BY_CHAIN,
+  CabalSpyID,
+  CabalSpyIDAuth,
+  CabalSpyIDError,
+  CabalSpyIDStream,
+  ConnectionError,
+  DEFAULT_BASE_URL,
+  DEFAULT_ISSUER,
+  DEFAULT_STREAM_URL,
+  InvalidResponseError,
+  JwksCache,
+  LEADERBOARD_SORTS,
+  NotFoundError,
+  OAuthError,
+  PERIODS,
+  PermissionError,
+  PlanUserLimitError,
+  RateLimitError,
+  SDK_VERSION,
+  ServerError,
+  TokenVerificationError,
+  WebhookVerificationError,
+  decodeJwt,
+  generatePkce,
+  handleKind,
+  hasX,
+  isLimited,
+  signWebhook,
+  verifyWebhook
+};
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}