uapp-communication-sdk 1.0.0-dev.54

package/types/sdk/runtime/auth/in-memory-key-value-storage.d.ts

@@ -0,0 +1,18 @@
+import type { KeyValueStorage } from '@features/auth';
+/**
+ * Process-lifetime {@link KeyValueStorage} backed by a plain `Map`.
+ *
+ * This is the ONLY storage the embeddable SDK ever uses. On a third-party host page we control
+ * neither the Content-Security-Policy nor the markup, so any XSS on that page could read
+ * `localStorage`/`sessionStorage` and walk away with both the access AND the refresh token —
+ * a persistent account takeover from a single injected script. Holding the session in a closure
+ * that is dropped when the widget unmounts limits the blast radius to the page's own lifetime,
+ * and costs nothing: the SDK re-handshakes with the host on every mount anyway.
+ */
+export declare class InMemoryKeyValueStorage implements KeyValueStorage {
+    private readonly entries;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+//# sourceMappingURL=in-memory-key-value-storage.d.ts.map

package/types/sdk/runtime/auth/in-memory-key-value-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-key-value-storage.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/in-memory-key-value-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAE9C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGrC"}

package/types/sdk/runtime/auth/sdk-auth-module.d.ts

@@ -0,0 +1,25 @@
+import type { Logger } from '@core/logger';
+import type { Clock } from '@core/time';
+import { type AuthStore } from '@features/auth/store';
+import type { AuthGateway } from '@features/auth/domain';
+export interface SdkAuthModuleDeps {
+    readonly clock: Clock;
+    readonly logger: Logger;
+    /**
+     * Key prefix isolating this instance's session. Two SDK instances on ONE host page (different
+     * client keys, possibly different tenants) must never observe each other's session.
+     */
+    readonly storageNamespace: string;
+    readonly authGateway: AuthGateway;
+    readonly setAccessToken: (token: string | null) => void;
+}
+/**
+ * Composition root for the SDK Auth feature.
+ *
+ * Like the main auth module, but (a) it accepts the {@link AuthGateway} directly, because the
+ * strategy is chosen at runtime from the host's `AuthConfig` (sso / signed / host-token), and
+ * (b) the session is held in memory only — see {@link InMemoryKeyValueStorage}. There is no
+ * `loginUrl`: the SDK never redirects the host page to a sign-in screen, the HOST authenticates.
+ */
+export declare const createSdkAuthModule: (deps: SdkAuthModuleDeps) => AuthStore;
+//# sourceMappingURL=sdk-auth-module.d.ts.map

package/types/sdk/runtime/auth/sdk-auth-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-auth-module.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/sdk-auth-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAQxC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,iBAAiB,KAAG,SAyC7D,CAAC"}

package/types/sdk/runtime/auth/sdk-auth-protocol.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The fixed wire contract for the embeddable SDK's token exchange, mirroring the backend's
+ * `SdkConsts`. Kept in one place so no grant type or parameter name is a magic string.
+ */
+/** Custom OpenIddict extension grant that swaps a host-signed JWS for tokens. */
+export declare const GRANT_TYPE_SDK_SIGNED = "sdk_signed";
+/** Token-request field carrying the host-signed HS256 assertion (backend `SdkConsts.AssertionParameterName`). */
+export declare const ASSERTION_PARAM = "assertion";
+/**
+ * Scopes requested by the SDK. Module scopes are NOT requested here: the backend caps them from the
+ * SDK client's entitlement and reports the effective set via `GET /api/app/sdk-capabilities`.
+ * Requesting a scope the client is not entitled to is rejected with `invalid_scope`.
+ */
+/**
+ * Base scopes every SDK token request carries, before the embed's modules are appended.
+ *
+ * Deliberately WITHOUT `offline_access`. Requesting it minted a 14-day refresh token that sat in
+ * memory on a third-party page and was never spent — `SdkSignedAuthGateway.refresh()` always fails
+ * by design, because a `sdk_signed` assertion is single-use and the host re-issues one instead.
+ * Holding a long-lived credential that nothing consumes is pure attack surface.
+ */
+export declare const SDK_OAUTH_SCOPE = "CommunicationHub";
+//# sourceMappingURL=sdk-auth-protocol.d.ts.map

package/types/sdk/runtime/auth/sdk-auth-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-auth-protocol.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/sdk-auth-protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,iHAAiH;AACjH,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C;;;;GAIG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC"}

package/types/sdk/runtime/auth/sdk-handshake-runner.d.ts

@@ -0,0 +1,56 @@
+import type { Logger } from '@core/logger';
+import type { AuthStore } from '@features/auth';
+import type { ModuleAccessModule } from '@features/module-access';
+import type { SdkEvent, SdkModuleScope } from '../../types';
+export interface SdkHandshakeDeps {
+    readonly authStore: AuthStore;
+    readonly moduleAccessModule: ModuleAccessModule;
+    /** Asks the HOST for a fresh credential (one-time secret / signed assertion / access token). */
+    readonly requestCredential: () => Promise<string>;
+    /** Scopes the embed declared it needs, used to detect a missing entitlement. */
+    readonly requestedModules: readonly SdkModuleScope[];
+    readonly emit: (event: SdkEvent) => void;
+    readonly logger: Logger;
+    /**
+     * `true` for strategies with no refresh token (`signed`, `host-token`): the widget must ask the
+     * host for a NEW credential before the current one expires, because nothing else can renew it.
+     */
+    readonly renewable: boolean;
+}
+/**
+ * Owns the SDK's authentication lifecycle for one composition: the initial handshake, renewal
+ * before expiry, recovery after a mid-session expiry, and the host-facing events.
+ *
+ * Deliberately framework-free (no React) so the awkward parts — run exactly once, back off on
+ * failure, never die permanently — are testable with fake timers instead of rendered components.
+ */
+export declare class SdkHandshakeRunner {
+    private readonly deps;
+    private timer;
+    private unwatch;
+    private started;
+    private disposed;
+    private inFlight;
+    private failures;
+    private authenticated;
+    constructor(deps: SdkHandshakeDeps);
+    /** Runs the handshake. Safe to call repeatedly — only the FIRST call does anything. */
+    start(): void;
+    private isDisposed;
+    dispose(): void;
+    private run;
+    private onAuthenticated;
+    /** The session is gone (rejected credential, or a mid-session 401 the refresh could not fix). */
+    private onExpired;
+    /**
+     * Re-arms after a failure with capped exponential backoff. Without this ONE transient network
+     * blip would leave the widget permanently signed out with the host never told why.
+     */
+    private scheduleRetry;
+    private scheduleRenewal;
+    private scheduleAt;
+    private clearTimer;
+    /** Watches for the store dropping the session mid-session (a 401 the refresh chain could not fix). */
+    private watchSession;
+}
+//# sourceMappingURL=sdk-handshake-runner.d.ts.map

package/types/sdk/runtime/auth/sdk-handshake-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-handshake-runner.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/sdk-handshake-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQ5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,gGAAgG;IAChG,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,cAAc,EAAE,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,aAAa,CAAS;gBAEX,IAAI,EAAE,gBAAgB;IAIzC,uFAAuF;IAChF,KAAK,IAAI,IAAI;IAOpB,OAAO,CAAC,UAAU;IAIX,OAAO,IAAI,IAAI;YAOR,GAAG;YAyBH,eAAe;IAyB7B,iGAAiG;IACjG,OAAO,CAAC,SAAS;IAQjB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,UAAU;IAOlB,sGAAsG;IACtG,OAAO,CAAC,YAAY;CAUrB"}

package/types/sdk/runtime/auth/sdk-host-token-auth-gateway.d.ts

@@ -0,0 +1,21 @@
+import type { Logger } from '@core/logger';
+import type { Clock } from '@core/time';
+import { type Result } from '@core/result';
+import { type AuthError, type AuthGateway, type AuthSession } from '@features/auth/domain';
+export interface SdkHostTokenAuthGatewayDeps {
+    readonly clock: Clock;
+    readonly logger: Logger;
+}
+/**
+ * AuthGateway for the `host-token` SDK strategy.
+ * Does not hit the network; simply parses the provided JWT token into a session.
+ */
+export declare class SdkHostTokenAuthGateway implements AuthGateway {
+    private readonly clock;
+    private readonly logger;
+    constructor(deps: SdkHostTokenAuthGatewayDeps);
+    exchangeSsoSecret(token: string): Promise<Result<AuthSession, AuthError>>;
+    refresh(_refreshToken: string): Promise<Result<AuthSession, AuthError>>;
+    signOut(_session: AuthSession): Promise<void>;
+}
+//# sourceMappingURL=sdk-host-token-auth-gateway.d.ts.map

package/types/sdk/runtime/auth/sdk-host-token-auth-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-host-token-auth-gateway.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/sdk-host-token-auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,WAAW;IACzD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,2BAA2B;IAK7C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAmDzE,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAUvE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAGrD"}

package/types/sdk/runtime/auth/sdk-signed-auth-gateway.d.ts

@@ -0,0 +1,44 @@
+import { type HttpClient } from '@core/http';
+import type { Logger } from '@core/logger';
+import type { Clock } from '@core/time';
+import { type Result } from '@core/result';
+import { type AuthError, type AuthGateway, type AuthSession } from '@features/auth/domain';
+import type { SdkModuleScope } from '../../types';
+export interface SdkSignedAuthGatewayDeps {
+    readonly httpClient: HttpClient;
+    readonly clock: Clock;
+    readonly logger: Logger;
+    /** The SDK client key (`sk_…`). It IS the OAuth `client_id` and resolves the tenant server-side. */
+    readonly clientKey: string;
+    /**
+     * Module scopes to request. These MUST be sent: the backend gates every module endpoint on the
+     * scope claim, so a token minted without them authenticates the user but can call nothing.
+     * The server rejects any scope outside the client's registered entitlement, so ask only for
+     * what this embed actually needs.
+     */
+    readonly modules: readonly SdkModuleScope[];
+}
+/**
+ * {@link AuthGateway} for the `signed` SDK strategy: exchanges a host-signed JWS assertion for
+ * tokens via the backend's `sdk_signed` extension grant.
+ *
+ * Credential model — the assertion IS the credential. The paired OpenIddict application is a
+ * PUBLIC client with no secret, so this request deliberately carries NO `client_secret`: an
+ * embeddable browser SDK cannot keep one, and sending it would only teach integrators to ship a
+ * shared secret to every visitor. The backend also ignores any body `origin` parameter and reads
+ * the `Origin` REQUEST HEADER instead (which the browser sets and page script cannot forge), so
+ * we do not send one.
+ */
+export declare class SdkSignedAuthGateway implements AuthGateway {
+    private readonly httpClient;
+    private readonly clock;
+    private readonly logger;
+    private readonly clientKey;
+    private readonly scope;
+    constructor(deps: SdkSignedAuthGatewayDeps);
+    exchangeSsoSecret(assertion: string): Promise<Result<AuthSession, AuthError>>;
+    refresh(_refreshToken: string): Promise<Result<AuthSession, AuthError>>;
+    signOut(_session: AuthSession): Promise<void>;
+    private requestToken;
+}
+//# sourceMappingURL=sdk-signed-auth-gateway.d.ts.map

package/types/sdk/runtime/auth/sdk-signed-auth-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-signed-auth-gateway.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/sdk-signed-auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAa,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,KAAK,MAAM,EAAO,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,YAAW,WAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEZ,IAAI,EAAE,wBAAwB;IAU1C,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAa7E,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAYvE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;YAKtC,YAAY;CAwB3B"}

package/types/sdk/runtime/auth/shared-handshake.d.ts

@@ -0,0 +1,36 @@
+import type { SdkEvent } from '../../types';
+import type { SdkHandshakeRunner } from './sdk-handshake-runner';
+/** `pending` until a token exists; `ready` once authenticated; `failed` if the handshake gave up. */
+export type SdkHandshakeStatus = 'pending' | 'ready' | 'failed';
+/**
+ * One authentication flow per shared runtime, fanned out to every widget attached to it.
+ *
+ * Sharing the dependency graph is not enough on its own: each widget still ran its own
+ * `SdkHandshakeRunner`, whose in-flight and started guards are per instance. Four widgets
+ * therefore still asked the host for four assertions, exchanged four tokens, and raced to
+ * provision the same new user. This collapses that to one.
+ *
+ * The runner is created lazily on first attach so a runtime that is acquired but never rendered
+ * performs no network work, and is disposed on last detach so a page that removes every widget
+ * leaves no renewal timer behind.
+ */
+export declare class SharedHandshake {
+    private readonly createRunner;
+    private readonly eventListeners;
+    private readonly statusListeners;
+    private runner;
+    private currentStatus;
+    constructor(createRunner: (emit: (event: SdkEvent) => void) => SdkHandshakeRunner);
+    get status(): SdkHandshakeStatus;
+    /**
+     * Registers a widget's event callback and guarantees the handshake is running. Returns a detach
+     * function; the last detach tears the runner down.
+     */
+    attach(onEvent: ((event: SdkEvent) => void) | undefined): () => void;
+    /** React subscription for status changes; pairs with {@link status} as the snapshot. */
+    subscribeStatus(listener: () => void): () => void;
+    dispose(): void;
+    private emit;
+    private setStatus;
+}
+//# sourceMappingURL=shared-handshake.d.ts.map

package/types/sdk/runtime/auth/shared-handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-handshake.d.ts","sourceRoot":"","sources":["../../../../../../src/sdk/runtime/auth/shared-handshake.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0D;IACvF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IAEzD,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,aAAa,CAAiC;gBAGpD,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,KAAK,kBAAkB;IAKvE,IAAW,MAAM,IAAI,kBAAkB,CAEtC;IAED;;;OAGG;IACI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,MAAM,IAAI;IAkC3E,wFAAwF;IACjF,eAAe,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAOjD,OAAO,IAAI,IAAI;IAQtB,OAAO,CAAC,IAAI;IAgBZ,OAAO,CAAC,SAAS;CAUlB"}

package/types/sdk/runtime/module-scopes.d.ts

@@ -0,0 +1,16 @@
+import { type SdkModuleScope } from '../types';
+/**
+ * Anti-corruption map between the backend's SDK module SCOPES (`commhub.*`, what the host page and
+ * the token endpoint speak) and this app's module-access permission ids (what the UI gates on).
+ * One place, so a rename can never drift between the gateway and the event payloads.
+ */
+export declare const SCOPE_TO_MODULE_ACCESS: Readonly<Record<SdkModuleScope, string>>;
+export declare const isSdkModuleScope: (value: string) => value is SdkModuleScope;
+/** The scopes represented by a set of granted module-access permission ids. */
+export declare const scopesFromModuleAccess: (grantedModules: ReadonlySet<string>) => SdkModuleScope[];
+/**
+ * Scopes the host asked for but the server did not grant. Drives the `scope-denied` event so an
+ * integrator learns their SDK client is missing an entitlement instead of staring at an empty widget.
+ */
+export declare const deniedScopes: (requested: readonly SdkModuleScope[], grantedModules: ReadonlySet<string>) => SdkModuleScope[];
+//# sourceMappingURL=module-scopes.d.ts.map

package/types/sdk/runtime/module-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-scopes.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/module-scopes.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAK3E,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,cACZ,CAAC;AAE/C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,GACjC,gBAAgB,WAAW,CAAC,MAAM,CAAC,KAClC,cAAc,EACuE,CAAC;AAEzF;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,WAAW,SAAS,cAAc,EAAE,EACpC,gBAAgB,WAAW,CAAC,MAAM,CAAC,KAClC,cAAc,EACgE,CAAC"}

package/types/sdk/runtime/sdk-composition-root.d.ts

@@ -0,0 +1,44 @@
+import { QueryClient } from '@tanstack/react-query';
+import { type Logger } from '@core/logger';
+import { type AuthStore } from '@features/auth';
+import type { ModuleAccessModule } from '@features/module-access';
+import { type ChatModule } from '@features/chat';
+import { type FeedModule } from '@features/feed';
+import { type MeetingsModule } from '@features/meetings';
+import { type ScheduleModule } from '@features/schedule';
+import { type SettingsModule } from '@features/settings';
+import { type CallsModule } from '@features/calls';
+import { type MeetingVideoModule } from '@features/meeting-video';
+import type { SdkModuleScope } from '../types';
+export interface SdkComposition {
+    readonly logger: Logger;
+    readonly authStore: AuthStore;
+    readonly moduleAccessModule: ModuleAccessModule;
+    readonly chatModule: ChatModule;
+    readonly feedModule: FeedModule;
+    readonly meetingsModule: MeetingsModule;
+    readonly meetingVideoModule: MeetingVideoModule;
+    readonly scheduleModule: ScheduleModule;
+    /**
+     * Not admin surfaces, despite living in modules that mostly are: the chat pane reads group
+     * categories to label a conversation, and a DM header offers a call button. Both throw without
+     * their provider, so a chat widget cannot render at all when they are absent.
+     */
+    readonly settingsModule: SettingsModule;
+    readonly callsModule: CallsModule;
+    readonly queryClient: QueryClient;
+    /**
+     * Releases everything this composition owns: both realtime connections, the auth-store
+     * subscription, and the query cache. Without it a re-created composition leaks a SignalR socket
+     * that keeps reconnecting forever against a token nobody refreshes.
+     */
+    dispose(): Promise<void>;
+}
+export interface SdkCompositionInput {
+    readonly apiBaseUrl: string;
+    readonly authStore: AuthStore;
+    readonly modules?: readonly SdkModuleScope[] | undefined;
+    readonly logger?: Logger | undefined;
+}
+export declare const createSdkComposition: (input: SdkCompositionInput) => SdkComposition;
+//# sourceMappingURL=sdk-composition-root.d.ts.map

package/types/sdk/runtime/sdk-composition-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-composition-root.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/sdk-composition-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAa1D,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AA2CD,eAAO,MAAM,oBAAoB,GAAI,OAAO,mBAAmB,KAAG,cAmEjE,CAAC"}

package/types/sdk/runtime/sdk-module-access-gateway.d.ts

@@ -0,0 +1,19 @@
+import type { HttpClient } from '@core/http';
+import type { Logger } from '@core/logger';
+import { type Result } from '@core/result';
+import { type ModuleAccess, type ModuleAccessError, type ModuleAccessGateway } from '@features/module-access/domain';
+export interface SdkModuleAccessGatewayDeps {
+    readonly httpClient: HttpClient;
+    readonly logger: Logger;
+}
+/**
+ * Fail-closed {@link ModuleAccessGateway} for the SDK. Fetches the effective capabilities and
+ * restricts access strictly to them — an unreachable or malformed response grants NOTHING.
+ */
+export declare class SdkModuleAccessGateway implements ModuleAccessGateway {
+    private readonly httpClient;
+    private readonly logger;
+    constructor(deps: SdkModuleAccessGatewayDeps);
+    getModuleAccess(): Promise<Result<ModuleAccess, ModuleAccessError>>;
+}
+//# sourceMappingURL=sdk-module-access-gateway.d.ts.map

package/types/sdk/runtime/sdk-module-access-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-module-access-gateway.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/sdk-module-access-gateway.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,cAAc,CAAC;AACpD,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAgCxC,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEb,IAAI,EAAE,0BAA0B;IAKtC,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;CAiBjF"}

package/types/sdk/runtime/sdk-module-access.d.ts

@@ -0,0 +1,13 @@
+import type { HttpClient } from '@core/http';
+import type { Logger } from '@core/logger';
+import type { ModuleAccessModule } from '@features/module-access';
+export interface SdkModuleAccessModuleDeps {
+    readonly logger: Logger;
+    readonly httpClient: HttpClient;
+}
+/**
+ * Composition root for the SDK module-access feature.
+ * Wires the fail-closed SdkModuleAccessGateway to the use case.
+ */
+export declare const createSdkModuleAccessModule: (deps: SdkModuleAccessModuleDeps) => ModuleAccessModule;
+//# sourceMappingURL=sdk-module-access.d.ts.map

package/types/sdk/runtime/sdk-module-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-module-access.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/sdk-module-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,yBAAyB,KAC9B,kBAeF,CAAC"}

package/types/sdk/runtime/sdk-runtime-registry.d.ts

@@ -0,0 +1,64 @@
+import type { Logger } from '@core/logger';
+import type { SharedHandshake } from './auth/shared-handshake';
+import type { SdkComposition } from './sdk-composition-root';
+/**
+ * Page-level registry of shared SDK runtimes, reference-counted.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Every `<uapp-*>` element mounts its own React root, and a per-root `useMemo` therefore built a
+ * separate dependency graph per widget. Four widgets on one page meant four host assertion
+ * requests, four token exchanges, four JIT provisioning attempts, four query caches and up to
+ * eight WebSockets — for one user, one client, one API.
+ *
+ * That duplication bought nothing. Widgets on a page share an origin and a JS realm, so separate
+ * sessions are not a security boundary; the boundary is the page. Every serious embeddable SDK
+ * shares one runtime for this reason — Stripe: "create and share a single Stripe instance…
+ * multiple instances can lead to performance issues"; Auth0: "you should only have one instance".
+ *
+ * It also actively caused a bug: four simultaneous first-time logins raced to provision the same
+ * new user, and the losers failed their whole token exchange.
+ *
+ * KEYING AND TENANCY
+ * ------------------
+ * The key is `apiBaseUrl | clientKey | authKind`. `clientKey` is what the backend resolves a
+ * tenant from (`SdkClientResolver`), so two tenants are necessarily two client keys and therefore
+ * two runtimes — tenant isolation falls out of the key rather than being enforced separately.
+ * A different API origin or auth mechanism is likewise a genuinely different trust context.
+ *
+ * `modules` is deliberately NOT part of the key. Widgets declaring different modules are the
+ * normal case and must share one session; the runtime requests the union and the server caps it
+ * to the client's registered entitlement.
+ *
+ * LIFETIME
+ * --------
+ * Each mounted widget acquires a reference; unmounting releases it. The runtime is disposed and
+ * evicted when the count reaches zero, so a page that removes every widget leaks no socket, and
+ * one that re-adds a widget afterwards builds a fresh runtime rather than reviving a disposed one.
+ */
+export interface SdkRuntimeKeyParts {
+    readonly apiBaseUrl: string;
+    readonly clientKey: string;
+    readonly authKind: string;
+}
+export declare const buildRuntimeKey: (parts: SdkRuntimeKeyParts) => string;
+export interface AcquiredRuntime {
+    readonly composition: SdkComposition;
+    readonly handshake: SharedHandshake;
+    /** Idempotent: calling it twice releases one reference, not two. */
+    readonly release: () => void;
+}
+export interface SdkRuntimeParts {
+    readonly composition: SdkComposition;
+    readonly handshake: SharedHandshake;
+}
+/**
+ * Returns the runtime for this key, creating it on first use. `factory` runs at most once per
+ * key — concurrent widgets mounting in the same tick all receive the same instance.
+ */
+export declare const acquireSdkRuntime: (key: string, factory: () => SdkRuntimeParts, logger?: Logger) => AcquiredRuntime;
+/** Live reference count for a key. Testing and diagnostics only. */
+export declare const runtimeRefCount: (key: string) => number;
+/** Drops every runtime without disposing. Test isolation only — never call from product code. */
+export declare const resetSdkRuntimeRegistryForTests: () => void;
+//# sourceMappingURL=sdk-runtime-registry.d.ts.map

package/types/sdk/runtime/sdk-runtime-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-runtime-registry.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/sdk-runtime-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAYD,eAAO,MAAM,eAAe,GAAI,OAAO,kBAAkB,KAAG,MACA,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,KAAK,MAAM,EACX,SAAS,MAAM,eAAe,EAC9B,SAAS,MAAM,KACd,eA8CF,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAA0C,CAAC;AAEzF,iGAAiG;AACjG,eAAO,MAAM,+BAA+B,QAAO,IAElD,CAAC"}

package/types/sdk/runtime/styles.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shadow-root styles for the widgets.
+ *
+ * The SDK bundle inlines every stylesheet into `window.__COMMHUB_SDK_CSS__` (see the
+ * `cssInjectedByJs` plugin in `vite.config.sdk.ts`), already retargeted for the shadow tree by
+ * `scripts/sdk-css-transform.cjs`. From there each widget adopts it as a CONSTRUCTABLE stylesheet
+ * rather than injecting a `<style>` element, because:
+ *
+ *  1. a host page with a strict CSP (no `'unsafe-inline'`) blocks injected `<style>` content
+ *     outright — the widget would render completely unstyled;
+ *  2. `adoptedStyleSheets` shares ONE parsed sheet across every widget instance on the page,
+ *     instead of re-parsing a full copy of the design system per element.
+ *
+ * Browsers without constructable stylesheets (Safari < 16.4) fall back to {@link createSdkStyleElement}.
+ */
+import './shadow-reset.css';
+/** The bundled, shadow-retargeted CSS. Empty in dev/test, where the injection plugin never ran. */
+export declare const readSdkCss: () => string;
+/**
+ * The single stylesheet every widget instance adopts, or an empty list when the platform cannot
+ * construct one (the caller then falls back to {@link createSdkStyleElement}).
+ */
+export declare const sdkStyleSheets: () => readonly CSSStyleSheet[];
+/** CSP-unsafe fallback for platforms without constructable stylesheets. `null` when there is no CSS. */
+export declare const createSdkStyleElement: () => HTMLStyleElement | null;
+//# sourceMappingURL=styles.d.ts.map

package/types/sdk/runtime/styles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/styles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,oBAAoB,CAAC;AAO5B,mGAAmG;AACnG,eAAO,MAAM,UAAU,QAAO,MAG7B,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAO,SAAS,aAAa,EAevD,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,QAAO,gBAAgB,GAAG,IAO3D,CAAC"}

package/types/sdk/runtime/theme.d.ts

@@ -0,0 +1,14 @@
+import type { ThemeConfig, ThemeMode } from '../types';
+/**
+ * Maps the public {@link ThemeConfig} onto the design system's REAL token names
+ * (`--color-*`, `--radius-*`, `--font-sans`, `--space-*`, `--height-*`) as defined in
+ * `src/app/styles/global.css`. Anything this returns is actually consumed by the widget's CSS —
+ * inventing a parallel `--ch-*` namespace would be a silent no-op.
+ */
+export declare const resolveThemeVars: (theme?: ThemeConfig) => Record<string, string>;
+/**
+ * The colour scheme to stamp as `data-theme` on the widget's shadow HOST. `system` resolves to
+ * `null` so no attribute is set and the stylesheet's `prefers-color-scheme` rules take over.
+ */
+export declare const resolveThemeMode: (theme?: ThemeConfig) => ThemeMode | null;
+//# sourceMappingURL=theme.d.ts.map

package/types/sdk/runtime/theme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/theme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAwEvD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,WAAW,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAU3E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,WAAW,KAAG,SAAS,GAAG,IAGlE,CAAC"}

package/types/sdk/runtime/timezone.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Resolves the effective timezone for the SDK based on precedence:
+ * 1. Host prop (passed explicitly to CommsProvider)
+ * 2. Device zone (Intl.DateTimeFormat().resolvedOptions().timeZone)
+ * 3. Fallback to 'UTC'
+ *
+ * (If a saved preference is available from the user profile, it would be inserted at precedence 2,
+ * but that requires an async fetch or token claim which can be wired into the provider later).
+ */
+export declare const resolveTimezone: (hostProp?: string) => string;
+//# sourceMappingURL=timezone.d.ts.map

package/types/sdk/runtime/timezone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timezone.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/timezone.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,WAAW,MAAM,KAAG,MAenD,CAAC"}

package/types/sdk/runtime/use-sdk-composition.d.ts

@@ -0,0 +1,38 @@
+import { type Logger } from '@core/logger';
+import { SharedHandshake } from './auth/shared-handshake';
+import { type SdkComposition } from './sdk-composition-root';
+import type { AuthConfig, SdkModuleScope } from '../types';
+export interface UseSdkCompositionInput {
+    readonly apiBaseUrl: string;
+    readonly clientKey: string;
+    readonly authKind: AuthConfig['kind'];
+    readonly modules: readonly SdkModuleScope[] | undefined;
+    readonly logger: Logger | undefined;
+    /**
+     * Asks the HOST for a credential. Captured by the runtime when it builds its single
+     * authentication flow, so only the first widget's callback is used — which is correct: widgets
+     * sharing a runtime share a client key and therefore speak for the same user.
+     */
+    readonly requestCredential: () => Promise<string>;
+}
+/** What a widget receives: the shared graph plus the shared authentication flow. */
+export interface SdkRuntime {
+    readonly composition: SdkComposition;
+    readonly handshake: SharedHandshake;
+}
+/** Asks the host for a credential in the shape its chosen strategy speaks. */
+export declare const requestCredentialFor: (auth: AuthConfig) => Promise<string>;
+/**
+ * Resolves the SDK dependency graph for this widget, SHARED with every other widget on the page
+ * that targets the same API, client and auth mechanism.
+ *
+ * The graph itself lives in `sdkRuntimeRegistry` at module scope rather than in a `useMemo`,
+ * because a `useMemo` is per React root and each custom element mounts its own root — so a
+ * memo-owned graph is per widget no matter how carefully its dependencies are keyed. See that
+ * module for why sharing is correct rather than merely cheaper.
+ *
+ * Everything this hook keys on is still a primitive: a host re-rendering with a fresh `modules`
+ * array or `logger` object must not churn the runtime.
+ */
+export declare const useSdkComposition: (input: UseSdkCompositionInput) => SdkRuntime;
+//# sourceMappingURL=use-sdk-composition.d.ts.map

package/types/sdk/runtime/use-sdk-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-sdk-composition.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/use-sdk-composition.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAS1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMnF,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK3D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,GAAI,MAAM,UAAU,KAAG,OAAO,CAAC,MAAM,CASrE,CAAC;AAoCF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,sBAAsB,KAAG,UAkFjE,CAAC"}

package/types/sdk/runtime/use-sdk-handshake.d.ts

@@ -0,0 +1,24 @@
+import type { SharedHandshake, SdkHandshakeStatus } from './auth/shared-handshake';
+import type { AuthConfig, SdkEvent } from '../types';
+export type { SdkHandshakeStatus };
+export interface UseSdkHandshakeInput {
+    /** The runtime's single authentication flow, shared by every widget attached to it. */
+    readonly handshake: SharedHandshake;
+    readonly auth: AuthConfig;
+    readonly onEvent: ((event: SdkEvent) => void) | undefined;
+}
+/**
+ * Attaches this widget to its runtime's authentication flow and reports the shared status.
+ *
+ * The flow itself is owned by the runtime, not by this hook — see `SharedHandshake`. Previously
+ * every widget built its own runner, so a page with four widgets asked the host for four
+ * assertions, exchanged four tokens and raced to provision the same new user. Now the first
+ * widget to attach starts the one flow and the rest observe it, including widgets that mount
+ * after it has already completed.
+ *
+ * `auth` and `onEvent` are held in a ref rather than used as effect dependencies: hosts pass
+ * object and function literals that are re-created on every render, and re-running the effect
+ * would detach and re-attach — burning a fresh single-use assertion each time the host re-renders.
+ */
+export declare const useSdkHandshake: ({ handshake, auth, onEvent, }: UseSdkHandshakeInput) => SdkHandshakeStatus;
+//# sourceMappingURL=use-sdk-handshake.d.ts.map

package/types/sdk/runtime/use-sdk-handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-sdk-handshake.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/use-sdk-handshake.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAErD,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAEnC,MAAM,WAAW,oBAAoB;IACnC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC3D;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAI,+BAI7B,oBAAoB,KAAG,kBAsBzB,CAAC"}

package/types/sdk/runtime/use-sdk-theme.d.ts

@@ -0,0 +1,9 @@
+import { type RefObject } from 'react';
+import type { ThemeConfig } from '../types';
+/**
+ * Applies the host's {@link ThemeConfig} as real design-system CSS variables plus a `data-theme`
+ * stamp, and cleans both up on unmount. Keyed by VALUE, so a host that passes a fresh `theme`
+ * object literal every render does not re-apply on every render.
+ */
+export declare const useSdkTheme: (theme: ThemeConfig | undefined) => RefObject<HTMLDivElement>;
+//# sourceMappingURL=use-sdk-theme.d.ts.map

package/types/sdk/runtime/use-sdk-theme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-sdk-theme.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/runtime/use-sdk-theme.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAe5C;;;;GAIG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,WAAW,GAAG,SAAS,KAC7B,SAAS,CAAC,cAAc,CA+B1B,CAAC"}