typeferry 0.10.0 → 0.12.0

package/dist/application/native.js

@@ -0,0 +1,86 @@
+import { execFile } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { fileExists, registerNativeScene, registerNativeSource, writeGeneratedFile } from './native-project.js';
+const execute = promisify(execFile);
+export async function runNative(config, action) {
+    const ios = config.client.targets.ios;
+    const identity = config.application;
+    if (!ios || !identity)
+        throw new Error('Configure application identity and client.targets.ios first');
+    const require = createRequire(path.join(config.root, 'package.json'));
+    let cli;
+    try {
+        cli = require.resolve('@capacitor/cli/bin/capacitor');
+        require.resolve('@capacitor/ios/package.json');
+    }
+    catch {
+        throw new Error('Install @capacitor/core, @capacitor/ios and @capacitor/cli in the application before using native commands');
+    }
+    for (const extension of ['ts', 'js']) {
+        if (await fileExists(path.join(config.root, `capacitor.config.${extension}`)))
+            throw new Error('Existing Capacitor configuration must be reconciled before TypeFerry can own native configuration');
+    }
+    await writeGeneratedFile(config.root, 'capacitor.config.json', `${JSON.stringify({
+        appId: identity.id,
+        appName: identity.name,
+        loggingBehavior: 'none',
+        webDir: 'dist/ios-web',
+        ios: { path: 'ios' },
+        plugins: { TypeFerryNative: { backendOrigin: ios.backend.origin, callbackScheme: identity.id } },
+    }, null, 2)}\n`);
+    const { stdout, stderr } = await execute(process.execPath, [cli, action, 'ios'], { cwd: config.root, maxBuffer: 8 * 1024 * 1024 });
+    if (stdout)
+        process.stdout.write(stdout);
+    if (stderr)
+        process.stderr.write(stderr);
+    if (action === 'open')
+        return;
+    await configureNativeProject(config);
+}
+async function configureNativeProject(config) {
+    const { IOS_NATIVE_TEMPLATES } = await import('../native/templates/index.js');
+    await writeGeneratedFile(config.root, 'ios/App/App/TypeFerryNative.swift', Object.values(IOS_NATIVE_TEMPLATES).join('\n'));
+    const projectPath = path.join(config.root, 'ios/App/App.xcodeproj/project.pbxproj');
+    const project = await readFile(projectPath, 'utf8');
+    const registered = registerNativeSource(project);
+    if (registered !== project)
+        await writeFile(projectPath, registered);
+    const scenePath = path.join(config.root, 'ios/App/App/SceneDelegate.swift');
+    if (await fileExists(scenePath)) {
+        const scene = await readFile(scenePath, 'utf8');
+        const updated = registerNativeScene(scene);
+        if (updated !== scene)
+            await writeFile(scenePath, updated);
+    }
+    const storyboardPath = path.join(config.root, 'ios/App/App/Base.lproj/Main.storyboard');
+    const storyboard = await readFile(storyboardPath, 'utf8');
+    if (storyboard.includes('customClass="CAPBridgeViewController"')) {
+        await writeFile(storyboardPath, storyboard.replace('customClass="CAPBridgeViewController" customModule="Capacitor"', 'customClass="TypeFerryBridgeViewController" customModule="App" customModuleProvider="target"'));
+    }
+    else if (!storyboard.includes('customClass="TypeFerryBridgeViewController"')) {
+        throw new Error('Custom bridge controller detected; integrate TypeFerry native registration explicitly');
+    }
+    const plist = path.join(config.root, 'ios/App/App/Info.plist');
+    const permissions = config.client.targets.ios?.permissions;
+    for (const [key, purpose] of [
+        ['NSCameraUsageDescription', permissions?.camera?.purpose],
+        ['NSMicrophoneUsageDescription', permissions?.microphone?.purpose],
+    ]) {
+        if (purpose)
+            await execute('/usr/bin/plutil', ['-replace', key, '-string', purpose, plist]);
+    }
+    const callbackScheme = config.application?.id;
+    if (callbackScheme) {
+        const existing = await execute('/usr/bin/plutil', ['-extract', 'CFBundleURLTypes', 'json', '-o', '-', plist]).catch(() => null);
+        const value = existing ? JSON.parse(existing.stdout) : [];
+        if (!Array.isArray(value))
+            throw new Error('Invalid CFBundleURLTypes in app Info.plist');
+        const includesScheme = value.some((entry) => typeof entry === 'object' && entry !== null && 'CFBundleURLSchemes' in entry && Array.isArray(entry.CFBundleURLSchemes) && entry.CFBundleURLSchemes.includes(callbackScheme));
+        if (!includesScheme)
+            await execute('/usr/bin/plutil', ['-replace', 'CFBundleURLTypes', '-json', JSON.stringify([...value, { CFBundleURLName: 'TypeFerry authentication', CFBundleURLSchemes: [callbackScheme] }]), plist]);
+    }
+}
+//# sourceMappingURL=native.js.map

package/dist/application/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/application/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAGrC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE5G,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEnC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAiC,EAAE,MAA+B;IAChG,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAA;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IACrG,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;IACrE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAA;QACrD,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;IAC/H,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAA;IACrM,CAAC;IACD,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/E,KAAK,EAAE,QAAQ,CAAC,EAAE;QAClB,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,cAAc;QACtB,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QACpB,OAAO,EAAE,EAAE,eAAe,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE;KACjG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;IAClI,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAM;IAC7B,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAA;AACtC,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAiC;IACrE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;IAC1E,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1H,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAA;IACnF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,UAAU,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAA;IAC3E,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,IAAI,OAAO,KAAK,KAAK;YAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAA;IACvF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IACzD,IAAI,UAAU,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QACjE,MAAM,SAAS,CAAC,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,gEAAgE,EAAE,8FAA8F,CAAC,CAAC,CAAA;IACvN,CAAC;SAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAA;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAA;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI;QAC3B,CAAC,0BAA0B,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;QAC1D,CAAC,8BAA8B,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC;KAC1D,EAAE,CAAC;QACX,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7F,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7C,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/H,MAAM,KAAK,GAAY,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QACxF,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,oBAAoB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QACnO,IAAI,CAAC,cAAc;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,eAAe,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IAC5N,CAAC;AACH,CAAC"}

package/dist/application/runtime.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Public, non-secret build metadata. Browser builds retain same-origin behavior;
+ * native builds embed only the explicitly configured backend origin.
+ */
+export interface ApplicationRuntime {
+    readonly target: 'web' | 'ios';
+    readonly backendOrigin?: string;
+}
+export declare function getApplicationRuntime(): ApplicationRuntime;
+/**
+ * Resolves backend-owned paths without rewriting external provider URLs.
+ */
+export declare function resolveBackendUrl(path: string): string;

package/dist/application/runtime.js

@@ -0,0 +1,15 @@
+export function getApplicationRuntime() {
+    return typeof __TYPEFERRY_RUNTIME__ === 'undefined'
+        ? { target: 'web' }
+        : __TYPEFERRY_RUNTIME__;
+}
+/**
+ * Resolves backend-owned paths without rewriting external provider URLs.
+ */
+export function resolveBackendUrl(path) {
+    const { backendOrigin } = getApplicationRuntime();
+    if (!backendOrigin || !path.startsWith('/') || path.startsWith('//'))
+        return path;
+    return new URL(path, backendOrigin).href;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/application/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/application/runtime.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,qBAAqB,KAAK,WAAW;QACjD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACnB,CAAC,CAAC,qBAAqB,CAAA;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,EAAE,aAAa,EAAE,GAAG,qBAAqB,EAAE,CAAA;IACjD,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjF,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC"}

package/dist/application/vite-config.d.ts

@@ -1,3 +1,3 @@
 import type { InlineConfig } from "vite";
-import type { ResolvedApplicationConfig } from "./config.js";
-export declare function createViteConfig(config: ResolvedApplicationConfig, command: "develop" | "build"): InlineConfig;
+import type { ApplicationTarget, ResolvedApplicationConfig } from "./config.js";
+export declare function createViteConfig(config: ResolvedApplicationConfig, command: "develop" | "build", target?: ApplicationTarget): InlineConfig;

package/dist/application/vite-config.js

@@ -2,7 +2,7 @@ import path from "node:path";
 import tailwindcss from "@tailwindcss/vite";
 import react from "@vitejs/plugin-react";
 import { createTypeFerryDevProxy } from "./proxy.js";
-export function createViteConfig(config, command) {
+export function createViteConfig(config, command, target = "web") {
     const plugins = [react(), tailwindcss()];
     if (command === "develop") {
         plugins.unshift(createTypeFerryDevProxy(config.development.serverPort, config.development.proxyRoutes));
@@ -39,6 +39,20 @@ export function createViteConfig(config, command) {
             },
         },
     };
-    return config.extensions.vite?.(viteConfig, { command }) ?? viteConfig;
+    if (target === 'ios') {
+        const ios = config.client.targets.ios;
+        if (!ios)
+            throw new Error('No iOS application target configured');
+        viteConfig.build = { ...viteConfig.build, outDir: '../dist/ios-web' };
+        viteConfig.define = { __TYPEFERRY_RUNTIME__: JSON.stringify({ target, backendOrigin: ios.backend.origin }) };
+    }
+    const extended = config.extensions.vite?.(viteConfig, { command, target }) ?? viteConfig;
+    if (target === 'ios' && extended.define?.__TYPEFERRY_RUNTIME__ !== viteConfig.define?.__TYPEFERRY_RUNTIME__) {
+        throw new Error('iOS public runtime metadata must be preserved by Vite extensions');
+    }
+    if (target === 'ios' && extended.build?.outDir !== '../dist/ios-web') {
+        throw new Error('iOS output must remain isolated in dist/ios-web');
+    }
+    return extended;
 }
 //# sourceMappingURL=vite-config.js.map

package/dist/application/vite-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"vite-config.js","sourceRoot":"","sources":["../../src/application/vite-config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,sBAAsB,CAAC;AAIzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,UAAU,gBAAgB,CAC9B,MAAiC,EACjC,OAA4B;IAE5B,MAAM,OAAO,GAAmB,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,CACb,uBAAuB,CACrB,MAAM,CAAC,WAAW,CAAC,UAAU,EAC7B,MAAM,CAAC,WAAW,CAAC,WAAW,CAC/B,CACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACjD,OAAO;QACP,MAAM,EAAE;YACN,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU;YACnC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACtB,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;aAC3C;SACF;QACD,OAAO,EAAE;YACP,gBAAgB,EAAE,IAAI;YACtB,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC;gBACtD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC;gBAChE,GAAG,EAAE,MAAM,CAAC,IAAI;aACjB;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CACtD;YACD,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YAClC,aAAa,EAAE;gBACb,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC;aACjE;SACF;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,UAAU,CAAC;AACzE,CAAC"}
+{"version":3,"file":"vite-config.js","sourceRoot":"","sources":["../../src/application/vite-config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,WAAW,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,MAAM,sBAAsB,CAAC;AAIzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,UAAU,gBAAgB,CAC9B,MAAiC,EACjC,OAA4B,EAC5B,SAA4B,KAAK;IAEjC,MAAM,OAAO,GAAmB,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,CACb,uBAAuB,CACrB,MAAM,CAAC,WAAW,CAAC,UAAU,EAC7B,MAAM,CAAC,WAAW,CAAC,WAAW,CAC/B,CACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACjD,OAAO;QACP,MAAM,EAAE;YACN,YAAY,EAAE,IAAI;YAClB,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU;YACnC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACtB,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;aAC3C;SACF;QACD,OAAO,EAAE;YACP,gBAAgB,EAAE,IAAI;YACtB,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC;gBACtD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC;gBAChE,GAAG,EAAE,MAAM,CAAC,IAAI;aACjB;SACF;QACD,KAAK,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CACtD;YACD,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YAClC,aAAa,EAAE;gBACb,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC;aACjE;SACF;KACF,CAAC;IAEF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClE,UAAU,CAAC,KAAK,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACtE,UAAU,CAAC,MAAM,GAAG,EAAE,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,UAAU,CAAC;IACzF,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,qBAAqB,KAAK,UAAU,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/auth/client/index.d.ts

@@ -1,2 +1,6 @@
 export { broadcastTokenRefresh, setupCrossTabSync } from './cross-tab-sync.js';
 export { refreshAccessToken, setupTokenRefreshOnExpiry } from './token-refresh.js';
+export { authenticateNativeSession } from './native-session.js';
+export type { NativeAccessSession, NativeSessionOptions } from './native-session.js';
+export { createNativeHttpFetch } from './native-http.js';
+export type { NativeHttpBridge } from './native-http.js';

package/dist/auth/client/index.js

@@ -1,3 +1,5 @@
 export { broadcastTokenRefresh, setupCrossTabSync } from './cross-tab-sync.js';
 export { refreshAccessToken, setupTokenRefreshOnExpiry } from './token-refresh.js';
+export { authenticateNativeSession } from './native-session.js';
+export { createNativeHttpFetch } from './native-http.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA"}

package/dist/auth/client/native-http.d.ts

@@ -0,0 +1,24 @@
+import type { HttpFetch } from '../../client/backend-origin.js';
+/**
+ * Text-only native transport. Its implementation must pin the backend origin,
+ * persist cookies privately, reject off-origin redirects and hide Set-Cookie.
+ */
+export interface NativeHttpBridge {
+    request(options: {
+        url: string;
+        method: string;
+        headers: Record<string, string>;
+        body?: string;
+    }): Promise<{
+        status: number;
+        statusText: string;
+        headers: Record<string, string>;
+        body: string;
+    }>;
+}
+/**
+ * Adapts native private-cookie HTTP to ClientOptions.httpFetch. This boundary is
+ * for RPC and auth JSON, not binary uploads/downloads. Cancellation is checked
+ * before and after the native operation; it does not undo server-side effects.
+ */
+export declare function createNativeHttpFetch(bridge: NativeHttpBridge): HttpFetch;

package/dist/auth/client/native-http.js

@@ -0,0 +1,19 @@
+/**
+ * Adapts native private-cookie HTTP to ClientOptions.httpFetch. This boundary is
+ * for RPC and auth JSON, not binary uploads/downloads. Cancellation is checked
+ * before and after the native operation; it does not undo server-side effects.
+ */
+export function createNativeHttpFetch(bridge) {
+    return async (url, options = {}) => {
+        options.signal?.throwIfAborted();
+        if (options.body != null && typeof options.body !== 'string') {
+            throw new Error('Native HTTP adapter supports text request bodies only');
+        }
+        const headers = Object.fromEntries(new Headers(options.headers).entries());
+        const result = await bridge.request({ url, method: options.method ?? 'GET', headers, ...(typeof options.body === 'string' ? { body: options.body } : {}) });
+        options.signal?.throwIfAborted();
+        const body = [204, 205, 304].includes(result.status) ? null : result.body;
+        return new Response(body, { status: result.status, statusText: result.statusText, headers: result.headers });
+    };
+}
+//# sourceMappingURL=native-http.js.map

package/dist/auth/client/native-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-http.js","sourceRoot":"","sources":["../../../src/auth/client/native-http.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAwB;IAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAEhC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAE3J,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAEhC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAEzE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC9G,CAAC,CAAA;AACH,CAAC"}

package/dist/auth/client/native-session.d.ts

@@ -0,0 +1,34 @@
+import type { HttpFetch } from '../../client/backend-origin.js';
+/**
+ * Public access context returned by the application exchange endpoint.
+ * The refresh credential stays in the native HTTP cookie store.
+ */
+export interface NativeAccessSession {
+    token: string;
+    exp: number;
+    iat: number;
+}
+/**
+ * An external system-browser handoff and its application-owned endpoints.
+ * httpFetch must use the same private native cookie store as the RPC client.
+ */
+export interface NativeSessionOptions {
+    backendOrigin: string;
+    authorizationPath: string;
+    exchangePath: string;
+    redirectUri: string;
+    authenticate(options: {
+        url: string;
+        callbackScheme: string;
+    }): Promise<{
+        url: string;
+    }>;
+    httpFetch: HttpFetch;
+}
+/**
+ * Authenticates in an external browser with PKCE S256 and a fresh state value.
+ * Exchanges the returned code through native HTTP to establish its private
+ * refresh cookie. The caller installs the returned access context on its Client.
+ * No refresh credential or PKCE verifier is placed in a callback URL.
+ */
+export declare function authenticateNativeSession(options: NativeSessionOptions): Promise<NativeAccessSession>;

package/dist/auth/client/native-session.js

@@ -0,0 +1,65 @@
+import { resolveBackendOrigins } from '../../client/backend-origin.js';
+function base64Url(bytes) {
+    return btoa(String.fromCharCode(...bytes)).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+}
+function endpoint(path, origin) {
+    const url = new URL(path, origin);
+    if (url.origin !== origin || url.username || url.password || url.hash) {
+        throw new Error('Native authentication endpoint must use the backend origin');
+    }
+    return url;
+}
+function readCallback(value, expected, state) {
+    const callback = new URL(value);
+    const codes = callback.searchParams.getAll('code');
+    const states = callback.searchParams.getAll('state');
+    if (callback.protocol !== expected.protocol || callback.host !== expected.host || callback.pathname !== expected.pathname || callback.username || callback.password || callback.hash || codes.length !== 1 || states.length !== 1 || states[0] !== state || !/^[A-Za-z0-9_-]{43}$/.test(codes[0]) || callback.searchParams.has('error')) {
+        throw new Error('Invalid native authentication callback');
+    }
+    return codes[0];
+}
+function isAccessSession(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    return 'token' in value && typeof value.token === 'string' && value.token.length > 0
+        && 'exp' in value && typeof value.exp === 'number' && Number.isFinite(value.exp)
+        && 'iat' in value && typeof value.iat === 'number' && Number.isFinite(value.iat)
+        && value.exp > value.iat;
+}
+/**
+ * Authenticates in an external browser with PKCE S256 and a fresh state value.
+ * Exchanges the returned code through native HTTP to establish its private
+ * refresh cookie. The caller installs the returned access context on its Client.
+ * No refresh credential or PKCE verifier is placed in a callback URL.
+ */
+export async function authenticateNativeSession(options) {
+    const origin = resolveBackendOrigins({ httpOrigin: options.backendOrigin }).httpOrigin;
+    const authorization = endpoint(options.authorizationPath, origin);
+    const exchange = endpoint(options.exchangePath, origin);
+    const redirect = new URL(options.redirectUri);
+    if (!redirect.protocol.includes('.') || redirect.username || redirect.password || redirect.search || redirect.hash) {
+        throw new Error('Native redirect URI must use a reverse-domain app scheme without credentials, query or fragment');
+    }
+    const verifier = base64Url(crypto.getRandomValues(new Uint8Array(32)));
+    const state = base64Url(crypto.getRandomValues(new Uint8Array(32)));
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    authorization.searchParams.set('redirect_uri', options.redirectUri);
+    authorization.searchParams.set('code_challenge', base64Url(new Uint8Array(digest)));
+    authorization.searchParams.set('code_challenge_method', 'S256');
+    authorization.searchParams.set('state', state);
+    const callback = await options.authenticate({ url: authorization.href, callbackScheme: redirect.protocol.slice(0, -1) });
+    const code = readCallback(callback.url, redirect, state);
+    const response = await options.httpFetch(exchange.href, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: JSON.stringify({ code, codeVerifier: verifier, redirectUri: options.redirectUri }),
+    });
+    if (!response.ok)
+        throw new Error(`Native authentication exchange failed (${response.status})`);
+    const result = await response.json();
+    if (!isAccessSession(result))
+        throw new Error('Invalid native access session');
+    return { token: result.token, exp: result.exp, iat: result.iat };
+}
+//# sourceMappingURL=native-session.js.map

package/dist/auth/client/native-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../../../src/auth/client/native-session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAyBnE,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AAC1G,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAEjC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAa,EAAE,KAAa;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEpD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxU,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAE7D,OAAO,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;WAC/E,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;WAC7E,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;WAC7E,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAA6B;IAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,UAAU,CAAA;IACtF,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAE7C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnH,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAA;IACpH,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAExF,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IACnE,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnF,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;IAC/D,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAE9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KACzF,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAE/F,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAE9E,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AAClE,CAAC"}

package/dist/auth/index.d.ts

@@ -5,3 +5,9 @@ export { decodeToken, signAccessToken, verifyAccessToken, } from './server/jwt-u
 export { InMemorySessionManager } from './server/session-manager.js';
 export { broadcastTokenRefresh, setupCrossTabSync, } from './client/cross-tab-sync.js';
 export { refreshAccessToken, setupTokenRefreshOnExpiry, } from './client/token-refresh.js';
+export { NativeAuthHandoff } from './server/native-handoff.js';
+export type { NativeAuthGrant, NativeAuthGrantConsume, NativeAuthGrantStore, NativeAuthHandoffOptions } from './server/native-handoff.js';
+export { authenticateNativeSession } from './client/native-session.js';
+export type { NativeAccessSession, NativeSessionOptions } from './client/native-session.js';
+export { createNativeHttpFetch } from './client/native-http.js';
+export type { NativeHttpBridge } from './client/native-http.js';

package/dist/auth/index.js

@@ -6,4 +6,7 @@ export { InMemorySessionManager } from './server/session-manager.js';
 // Client utilities
 export { broadcastTokenRefresh, setupCrossTabSync, } from './client/cross-tab-sync.js';
 export { refreshAccessToken, setupTokenRefreshOnExpiry, } from './client/token-refresh.js';
+export { NativeAuthHandoff } from './server/native-handoff.js';
+export { authenticateNativeSession } from './client/native-session.js';
+export { createNativeHttpFetch } from './client/native-http.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAcA,mBAAmB;AACnB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,mBAAmB;AACnB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAcA,mBAAmB;AACnB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,mBAAmB;AACnB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAE3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/auth/server/native-handoff.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Application-owned identity intent, bound to one native authorization attempt.
+ * Store the hash, never the plaintext authorization code or a refresh token.
+ */
+export interface NativeAuthGrant<T> {
+    codeHash: string;
+    challenge: string;
+    redirectUri: string;
+    expiresAt: number;
+    value: T;
+}
+/**
+ * Atomic consume predicate. All fields must match and expiresAt must exceed now.
+ */
+export interface NativeAuthGrantConsume {
+    codeHash: string;
+    challenge: string;
+    redirectUri: string;
+    now: number;
+}
+/**
+ * Durable shared storage contract for deployments with multiple server processes.
+ * consume must atomically delete and return only a grant matching every predicate;
+ * failed verification must leave the valid grant intact. Purge expired grants.
+ */
+export interface NativeAuthGrantStore<T> {
+    create(grant: NativeAuthGrant<T>): Promise<void>;
+    consume(request: NativeAuthGrantConsume): Promise<T | null>;
+}
+/**
+ * Server integration for an application-authenticated browser-to-native handoff.
+ */
+export interface NativeAuthHandoffOptions<T> {
+    store: NativeAuthGrantStore<T>;
+    redirectUris: readonly string[];
+    now?: () => number;
+}
+/**
+ * Issues short-lived, single-use codes protected by PKCE S256. Call authorize
+ * only after authenticating the browser user. After exchange, create a separate
+ * native session and set its refresh cookie on the exchange HTTP response.
+ * This helper does not authenticate users or register public HTTP endpoints.
+ */
+export declare class NativeAuthHandoff<T> {
+    private readonly options;
+    private readonly now;
+    private readonly redirectUris;
+    constructor(options: NativeAuthHandoffOptions<T>);
+    /**
+     * Validates a registered callback and S256 challenge, then persists an intent.
+     * Pass only application-authorized identity data as value.
+     */
+    authorize(request: {
+        value: T;
+        challenge: string;
+        redirectUri: string;
+        state: string;
+    }): Promise<string>;
+    /**
+     * Consumes exactly one matching code. The verifier must never be sent through
+     * the browser redirect; receive it only in the native exchange POST body.
+     */
+    exchange(request: {
+        code: string;
+        verifier: string;
+        redirectUri: string;
+    }): Promise<T>;
+    private validateRedirect;
+}

package/dist/auth/server/native-handoff.js

@@ -0,0 +1,65 @@
+import { createHash, randomBytes } from 'node:crypto';
+const CODE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+const GRANT_LIFETIME_MS = 120_000;
+/**
+ * Issues short-lived, single-use codes protected by PKCE S256. Call authorize
+ * only after authenticating the browser user. After exchange, create a separate
+ * native session and set its refresh cookie on the exchange HTTP response.
+ * This helper does not authenticate users or register public HTTP endpoints.
+ */
+export class NativeAuthHandoff {
+    options;
+    now;
+    redirectUris;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+        this.redirectUris = new Set(options.redirectUris);
+        for (const uri of this.redirectUris) {
+            const url = new URL(uri);
+            if (!url.protocol.includes('.') || url.username || url.password || url.search || url.hash) {
+                throw new Error('Native redirect URI must use a reverse-domain app scheme without credentials, query or fragment');
+            }
+        }
+    }
+    /**
+     * Validates a registered callback and S256 challenge, then persists an intent.
+     * Pass only application-authorized identity data as value.
+     */
+    async authorize(request) {
+        this.validateRedirect(request.redirectUri);
+        if (!CODE_PATTERN.test(request.challenge))
+            throw new Error('Invalid native authorization challenge');
+        if (!request.state || request.state.length > 512)
+            throw new Error('Invalid native authorization state');
+        const code = randomBytes(32).toString('base64url');
+        const codeHash = createHash('sha256').update(code).digest('hex');
+        await this.options.store.create({ codeHash, challenge: request.challenge, redirectUri: request.redirectUri, expiresAt: this.now() + GRANT_LIFETIME_MS, value: request.value });
+        const callback = new URL(request.redirectUri);
+        callback.searchParams.set('code', code);
+        callback.searchParams.set('state', request.state);
+        return callback.href;
+    }
+    /**
+     * Consumes exactly one matching code. The verifier must never be sent through
+     * the browser redirect; receive it only in the native exchange POST body.
+     */
+    async exchange(request) {
+        this.validateRedirect(request.redirectUri);
+        if (!CODE_PATTERN.test(request.code) || !VERIFIER_PATTERN.test(request.verifier)) {
+            throw new Error('Invalid or expired native authorization code');
+        }
+        const codeHash = createHash('sha256').update(request.code).digest('hex');
+        const challenge = createHash('sha256').update(request.verifier).digest('base64url');
+        const value = await this.options.store.consume({ codeHash, challenge, redirectUri: request.redirectUri, now: this.now() });
+        if (value === null)
+            throw new Error('Invalid or expired native authorization code');
+        return value;
+    }
+    validateRedirect(redirectUri) {
+        if (!this.redirectUris.has(redirectUri))
+            throw new Error('Unregistered native redirect URI');
+    }
+}
+//# sourceMappingURL=native-handoff.js.map

package/dist/auth/server/native-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-handoff.js","sourceRoot":"","sources":["../../../src/auth/server/native-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,YAAY,GAAG,qBAAqB,CAAA;AAC1C,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AACpD,MAAM,iBAAiB,GAAG,OAAO,CAAA;AA2CjC;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAIC;IAHZ,GAAG,CAAc;IACjB,YAAY,CAAqB;IAElD,YAA6B,OAAoC;QAApC,YAAO,GAAP,OAAO,CAA6B;QAC/D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAClC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAEjD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAExB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAA;YACpH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAA4E;QAC1F,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAE1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QACpG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAEvG,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAEhE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAE9K,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAE7C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACvC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAEjD,OAAO,QAAQ,CAAC,IAAI,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAgE;QAC7E,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAE1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACnF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAE1H,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QAEnF,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,gBAAgB,CAAC,WAAmB;QAC1C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC9F,CAAC;CACF"}

package/dist/cli/index.js

@@ -1,7 +1,12 @@
 #!/usr/bin/env node
 import { CLI_USAGE, } from '../application/cli-arguments.js';
 import { runCli } from './run.js';
+import { NativeCommandInterruptedError } from '../application/native-command.js';
 runCli(process.argv.slice(2)).catch((error) => {
+    if (error instanceof NativeCommandInterruptedError) {
+        process.exitCode = error.exitCode;
+        return;
+    }
     const message = error instanceof Error ? error.message : String(error);
     console.error(message);
     console.error(CLI_USAGE);

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,SAAS,GACV,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAA;AAE9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACrD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACtB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACxB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,SAAS,GACV,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAA;AAE7E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACrD,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;QACnD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QACjC,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACtB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACxB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC,CAAC,CAAA"}

package/dist/cli/run.js

@@ -1,3 +1,5 @@
+import { runNative } from '../application/native.js';
+import { runNativeSimulator } from '../application/native-simulator.js';
 import { runBuild } from '../application/build.js';
 import { parseCliArguments } from '../application/cli-arguments.js';
 import { loadApplicationConfig } from '../application/config.js';
@@ -9,7 +11,22 @@ export async function runCli(arguments_) {
     const root = await findApplicationRoot(process.cwd());
     const config = await loadApplicationConfig(root);
     if (parsed.command === 'build') {
-        await runBuild(config);
+        await runBuild(config, parsed.target);
+        return;
+    }
+    if (parsed.command === 'native') {
+        switch (parsed.action) {
+            case 'devices':
+            case 'doctor':
+            case 'run':
+            case 'logs':
+            case 'screenshot':
+                if (!await runNativeSimulator(config, parsed))
+                    process.exitCode = 1;
+                break;
+            default:
+                await runNative(config, parsed.action);
+        }
         return;
     }
     if (parsed.command === 'develop') {

package/dist/cli/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAA6B;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEnD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAA6B;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,SAAS,CAAC;YACf,KAAK,QAAQ,CAAC;YACd,KAAK,KAAK,CAAC;YACX,KAAK,MAAM,CAAC;YACZ,KAAK,YAAY;gBACf,IAAI,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC;oBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;gBACnE,MAAK;YACP;gBACE,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QAC1C,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;AAC5E,CAAC"}

package/dist/client/backend-origin.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Explicit backend locations for clients running outside their server origin.
+ * Paths remain owned by the protocol and application, not by these origins.
+ */
+export interface BackendOrigins {
+    httpOrigin: string;
+    webSocketOrigin?: string;
+}
+/**
+ * Validates explicit origins without including potentially secret input in errors.
+ * The WebSocket origin defaults to the HTTP host with the corresponding scheme.
+ */
+export declare function resolveBackendOrigins(backend: BackendOrigins): Required<BackendOrigins>;
+/**
+ * Fetch-compatible request boundary that native hosts can implement privately.
+ */
+export type HttpFetch = (url: string, options?: RequestInit) => Promise<Response>;