@atlasauth/js 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @atlasauth/js changelog
 
+## 0.7.0
+- **Popup OAuth completes when the opener page sends `Cross-Origin-Opener-Policy: same-origin`.** That
+  header puts the provider popup in another browsing-context group: `popup.closed` reads `true` at once and
+  the popup has no `window.opener`, so the result could never be posted back and the flow settled as a
+  cancel while the popup stayed open. Now the popup lands back on your page with the result in the URL
+  fragment (`#atlas_popup_result=…`, never the query string), the SDK there hands it to the opener over
+  `BroadcastChannel('atlas:oauth:<nonce>')` (a `localStorage` `storage` event where BroadcastChannel is
+  missing) and closes the popup.
+- **Changed `startOauthPopup` cancel semantics.** `popup.closed` turning true within 1.5 s of opening means
+  the opener link was severed, not that the user closed it: the flow keeps waiting, probing `GET /v1/client`
+  with back-off, for up to 5 minutes, and settles as `popup_closed` only on that timeout, an explicit error
+  result, `signal` aborting, or a newer popup flow starting. A close after 1.5 s is a cancel after one final
+  session probe (as before).
+- **Changed `startOauthPopup` request.** It now sends `popup_nonce` and `opener_origin`
+  (`window.location.origin`) with `mode: 'popup'`, and opens the popup with the window name `atlas:oauth`.
+- **Added** to `startOauthPopup`: `input.signal?: AbortSignal`, `handlers.onSevered?: () => void`,
+  `PopupStartResult.severed?: boolean`; new `OAuthPopupInput` type; `POPUP_SEVERED_WINDOW_MS` (1500) and
+  `POPUP_SEVERED_TIMEOUT_MS` (300000); `mapOAuthPopupPayload(data)` (the payload half of
+  `parseOAuthPopupMessage`).
+- **Added popup channel helpers:** `completeOAuthPopupLanding({ win?, ackTimeoutMs? })` →
+  `PopupLanding | null` (`{ payload, delivered }`; reads and scrubs the fragment, relays the result and
+  closes once the opener acknowledges — call it on startup), `closeOAuthPopupAfterSignIn({ win?, ackTimeoutMs? })`
+  (a page that finished a sign-in inside the Atlas popup closes itself when an opener is waiting),
+  `listenForPopupResult(nonce, { onResult, onSignedIn? })`, `readPopupLanding(hash)`, `popupChannelName(nonce)`,
+  `createPopupNonce()`, `PopupRelayMessage`, and the constants `OAUTH_POPUP_WINDOW_NAME`
+  (`'atlas:oauth'`), `POPUP_RESULT_FRAGMENT` (`'atlas_popup_result'`), `POPUP_SIGNAL_CHANNEL`.
+- **Sign-out tombstones are shared by every tab.** `SessionTombstones` moved from `sessionStorage` to
+  `localStorage`, so after a failed revoke a newly opened tab no longer re-adopts the session. Entries are
+  `{ id, at }`, at most 20, kept 30 days, pruned on every read, and keyed per Frontend API origin
+  (`atlas:signed-out-sessions:<origin>`). `sessionStorage` is used only when `localStorage` throws; tombstones
+  an earlier version kept in `sessionStorage` are carried over.
+- **Changed** `new SessionTombstones(options?)`: accepts `{ frontendApi?, storageKey?, now? }`
+  (`SessionTombstonesOptions`); a bare storage-key string is still accepted. **Added** `remove(...ids)` (forget
+  a tombstone once a later revoke is confirmed) and `subscribe(listener)` (another tab's changes, via the
+  `storage` event). `has()`/`list()` re-read storage, so other tabs' changes are seen.
+
 ## 0.6.0
 - **Per-flow captcha widget rendering**, shared by the prebuilt sign-in / sign-up UIs:
   `renderCaptchaWidget(flow, container)` → `{ token: Promise<string>, remove() }`,

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './token-cache';
 export * from './tab-election';
 export * from './attempt';
 export * from './redirect';
+export * from './popup-channel';
 export * from './fapi';
 export * from './native';
 export * from './native-session';

package/dist/index.js

@@ -22,6 +22,8 @@ __exportStar(require("./token-cache"), exports);
 __exportStar(require("./tab-election"), exports);
 __exportStar(require("./attempt"), exports);
 __exportStar(require("./redirect"), exports);
+// §oauth popup mode: the same-origin hand-back for a popup whose opener was severed.
+__exportStar(require("./popup-channel"), exports);
 __exportStar(require("./fapi"), exports);
 __exportStar(require("./native"), exports);
 __exportStar(require("./native-session"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/popup-channel.d.ts

@@ -0,0 +1,95 @@
+/**
+ * §oauth popup mode — the same-origin hand-back for a popup whose
+ * `window.opener` was severed.
+ *
+ * When the page that opens the sign-in popup sends a restrictive
+ * Cross-Origin-Opener-Policy (`same-origin`), the browser puts the cross-origin
+ * popup in another browsing-context group: `popup.closed` reads `true` to the
+ * opener almost at once and `window.opener` is `null` inside the popup, so the
+ * Frontend API's `postMessage` can never arrive. The Frontend API then sends the
+ * popup back to the OPENER's own page with the result in the URL fragment
+ * (`#atlas_popup_result=…`, never the query). That page runs the SDK, which:
+ *
+ *   1. reads and scrubs the fragment ({@link completeOAuthPopupLanding}),
+ *   2. relays the result to the opener over
+ *      `BroadcastChannel('atlas:oauth:<nonce>')` (a `localStorage` `storage`
+ *      event where BroadcastChannel is missing) — both are same-origin, so
+ *      they connect where `window.opener` cannot,
+ *   3. closes the popup once the opener acknowledges.
+ *
+ * Nothing here carries a token: the result is the same one-time ticket (or
+ * continuation) the redirect flow puts in its URL, and the opener exchanges it.
+ */
+/** The window name {@link startOauthPopup} opens the popup with. */
+export declare const OAUTH_POPUP_WINDOW_NAME = "atlas:oauth";
+/** The fragment key the Frontend API lands the popup result in. */
+export declare const POPUP_RESULT_FRAGMENT = "atlas_popup_result";
+/** The channel a page that finished sign-in inside the popup announces on. */
+export declare const POPUP_SIGNAL_CHANNEL = "atlas:oauth";
+/** The per-flow channel: `atlas:oauth:<nonce>`. */
+export declare function popupChannelName(nonce: string): string;
+/** A fresh base64url channel nonce (22 characters). */
+export declare function createPopupNonce(): string;
+/** The messages on the popup channels. */
+export type PopupRelayMessage = {
+    type: 'atlas:oauth:result';
+    id: string;
+    result: Record<string, unknown>;
+} | {
+    type: 'atlas:oauth:signed_in';
+    id: string;
+} | {
+    type: 'atlas:oauth:ack';
+    id: string;
+};
+/**
+ * Opener side: listen on the flow's channel (and the shared signal channel) for
+ * the popup's result. Every message is acknowledged so the popup can close.
+ * Returns the stop function.
+ */
+export declare function listenForPopupResult(nonce: string, handlers: {
+    /** The landing page relayed the Frontend API's result payload. */
+    onResult: (payload: Record<string, unknown>) => void;
+    /** A page in the popup finished the sign-in itself (cookies are set). */
+    onSignedIn?: () => void;
+}): () => void;
+/** The popup result the Frontend API put in a URL fragment, or null. */
+export declare function readPopupLanding(hash: string): {
+    nonce: string;
+    payload: Record<string, unknown>;
+} | null;
+/** What {@link completeOAuthPopupLanding} did with a landed popup result. */
+export interface PopupLanding {
+    /** The Frontend API's result payload (`type`, `ticket`, `attemptId`, …). */
+    payload: Record<string, unknown>;
+    /**
+     * True when the opener acknowledged the result: it completes the sign-in and
+     * this window is being closed. False when nobody was listening (the opener tab
+     * was closed, or is on another origin) — the caller should complete the
+     * sign-in on this page instead, exactly like a redirect.
+     */
+    delivered: boolean;
+}
+/**
+ * Popup side, run on startup: if this page is the landing of a severed popup
+ * (`#atlas_popup_result=…` in the URL — normally with `window.name ===
+ * 'atlas:oauth'`, though a browser may clear the name when the opener's COOP
+ * switched browsing-context groups, so the fragment alone is decisive), scrub
+ * the fragment, relay the result to the opener and close this window once the
+ * opener acknowledges. Returns null when this is not such a landing.
+ */
+export declare function completeOAuthPopupLanding(options?: {
+    win?: Window;
+    ackTimeoutMs?: number;
+}): Promise<PopupLanding | null>;
+/**
+ * Popup side, after a sign-in completed ON this page (the redirect flow ran in
+ * the popup — e.g. an SDK or provider path without the channel): when this is
+ * the Atlas popup window, tell the waiting opener and close. It closes only when
+ * an opener is there to take over (it acknowledged, or `window.opener` is live),
+ * never stranding a user whose opener tab is gone. Resolves whether it closed.
+ */
+export declare function closeOAuthPopupAfterSignIn(options?: {
+    win?: Window;
+    ackTimeoutMs?: number;
+}): Promise<boolean>;

package/dist/popup-channel.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * §oauth popup mode — the same-origin hand-back for a popup whose
+ * `window.opener` was severed.
+ *
+ * When the page that opens the sign-in popup sends a restrictive
+ * Cross-Origin-Opener-Policy (`same-origin`), the browser puts the cross-origin
+ * popup in another browsing-context group: `popup.closed` reads `true` to the
+ * opener almost at once and `window.opener` is `null` inside the popup, so the
+ * Frontend API's `postMessage` can never arrive. The Frontend API then sends the
+ * popup back to the OPENER's own page with the result in the URL fragment
+ * (`#atlas_popup_result=…`, never the query). That page runs the SDK, which:
+ *
+ *   1. reads and scrubs the fragment ({@link completeOAuthPopupLanding}),
+ *   2. relays the result to the opener over
+ *      `BroadcastChannel('atlas:oauth:<nonce>')` (a `localStorage` `storage`
+ *      event where BroadcastChannel is missing) — both are same-origin, so
+ *      they connect where `window.opener` cannot,
+ *   3. closes the popup once the opener acknowledges.
+ *
+ * Nothing here carries a token: the result is the same one-time ticket (or
+ * continuation) the redirect flow puts in its URL, and the opener exchanges it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POPUP_SIGNAL_CHANNEL = exports.POPUP_RESULT_FRAGMENT = exports.OAUTH_POPUP_WINDOW_NAME = void 0;
+exports.popupChannelName = popupChannelName;
+exports.createPopupNonce = createPopupNonce;
+exports.listenForPopupResult = listenForPopupResult;
+exports.readPopupLanding = readPopupLanding;
+exports.completeOAuthPopupLanding = completeOAuthPopupLanding;
+exports.closeOAuthPopupAfterSignIn = closeOAuthPopupAfterSignIn;
+const tab_election_1 = require("./tab-election");
+/** The window name {@link startOauthPopup} opens the popup with. */
+exports.OAUTH_POPUP_WINDOW_NAME = 'atlas:oauth';
+/** The fragment key the Frontend API lands the popup result in. */
+exports.POPUP_RESULT_FRAGMENT = 'atlas_popup_result';
+/** The channel a page that finished sign-in inside the popup announces on. */
+exports.POPUP_SIGNAL_CHANNEL = 'atlas:oauth';
+/** The per-flow channel: `atlas:oauth:<nonce>`. */
+function popupChannelName(nonce) {
+    return `${exports.POPUP_SIGNAL_CHANNEL}:${nonce}`;
+}
+/** A fresh base64url channel nonce (22 characters). */
+function createPopupNonce() {
+    const bytes = new Uint8Array(16);
+    const c = globalThis.crypto;
+    if (c?.getRandomValues)
+        c.getRandomValues(bytes);
+    else
+        for (let i = 0; i < bytes.length; i++)
+            bytes[i] = Math.floor(Math.random() * 256);
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function isRelayMessage(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const m = value;
+    if (typeof m.id !== 'string')
+        return false;
+    if (m.type === 'atlas:oauth:result')
+        return !!m.result && typeof m.result === 'object';
+    return m.type === 'atlas:oauth:signed_in' || m.type === 'atlas:oauth:ack';
+}
+function openChannel(name) {
+    try {
+        return (0, tab_election_1.broadcastChannel)(name) ?? (0, tab_election_1.storageChannel)(name);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Post `message` on `name` and resolve whether anyone acknowledged it within
+ * `timeoutMs`.
+ */
+function relay(name, message, timeoutMs) {
+    const channel = openChannel(name);
+    if (!channel)
+        return Promise.resolve(false);
+    const id = createPopupNonce();
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (acked) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            unsubscribe();
+            channel.close();
+            resolve(acked);
+        };
+        const unsubscribe = channel.subscribe((m) => {
+            if (isRelayMessage(m) && m.type === 'atlas:oauth:ack' && m.id === id)
+                finish(true);
+        });
+        const timer = setTimeout(() => finish(false), timeoutMs);
+        try {
+            channel.post({ ...message, id });
+        }
+        catch {
+            finish(false);
+        }
+    });
+}
+/**
+ * Opener side: listen on the flow's channel (and the shared signal channel) for
+ * the popup's result. Every message is acknowledged so the popup can close.
+ * Returns the stop function.
+ */
+function listenForPopupResult(nonce, handlers) {
+    const flow = openChannel(popupChannelName(nonce));
+    const signal = handlers.onSignedIn ? openChannel(exports.POPUP_SIGNAL_CHANNEL) : null;
+    const unsubscribers = [];
+    if (flow) {
+        unsubscribers.push(flow.subscribe((m) => {
+            if (!isRelayMessage(m) || m.type !== 'atlas:oauth:result')
+                return;
+            flow.post({ type: 'atlas:oauth:ack', id: m.id });
+            handlers.onResult(m.result);
+        }));
+    }
+    if (signal) {
+        unsubscribers.push(signal.subscribe((m) => {
+            if (!isRelayMessage(m) || m.type !== 'atlas:oauth:signed_in')
+                return;
+            signal.post({ type: 'atlas:oauth:ack', id: m.id });
+            handlers.onSignedIn?.();
+        }));
+    }
+    return () => {
+        for (const u of unsubscribers)
+            u();
+        flow?.close();
+        signal?.close();
+    };
+}
+/** The popup result the Frontend API put in a URL fragment, or null. */
+function readPopupLanding(hash) {
+    if (!hash || hash.length < 2)
+        return null;
+    const raw = new URLSearchParams(hash.replace(/^#/, '')).get(exports.POPUP_RESULT_FRAGMENT);
+    if (!raw)
+        return null;
+    try {
+        const b64 = raw.replace(/-/g, '+').replace(/_/g, '/');
+        const bin = atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+        const bytes = Uint8Array.from(bin, (ch) => ch.charCodeAt(0));
+        const payload = JSON.parse(new TextDecoder().decode(bytes));
+        if (!payload || typeof payload !== 'object')
+            return null;
+        const p = payload;
+        if (p.v !== 1 || typeof p.n !== 'string' || !p.n)
+            return null;
+        if (typeof p.type !== 'string' || !p.type.startsWith('atlas:oauth:'))
+            return null;
+        return { nonce: p.n, payload: p };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Popup side, run on startup: if this page is the landing of a severed popup
+ * (`#atlas_popup_result=…` in the URL — normally with `window.name ===
+ * 'atlas:oauth'`, though a browser may clear the name when the opener's COOP
+ * switched browsing-context groups, so the fragment alone is decisive), scrub
+ * the fragment, relay the result to the opener and close this window once the
+ * opener acknowledges. Returns null when this is not such a landing.
+ */
+async function completeOAuthPopupLanding(options = {}) {
+    const win = options.win ?? (typeof window !== 'undefined' ? window : undefined);
+    if (!win)
+        return null;
+    const landing = readPopupLanding(win.location.hash);
+    if (!landing)
+        return null;
+    // Scrub first: a reload, the back button or a copied URL must never replay it.
+    try {
+        win.history.replaceState(win.history.state, '', win.location.href.split('#')[0]);
+    }
+    catch {
+        /* a sandboxed history; the ticket is single-use regardless */
+    }
+    // We ARE the Atlas popup, whatever the browser did to the name.
+    try {
+        win.name = exports.OAUTH_POPUP_WINDOW_NAME;
+    }
+    catch {
+        /* ignore */
+    }
+    const delivered = await relay(popupChannelName(landing.nonce), { type: 'atlas:oauth:result', result: landing.payload }, options.ackTimeoutMs ?? 1_500);
+    if (delivered)
+        closeWindow(win);
+    return { payload: landing.payload, delivered };
+}
+/**
+ * Popup side, after a sign-in completed ON this page (the redirect flow ran in
+ * the popup — e.g. an SDK or provider path without the channel): when this is
+ * the Atlas popup window, tell the waiting opener and close. It closes only when
+ * an opener is there to take over (it acknowledged, or `window.opener` is live),
+ * never stranding a user whose opener tab is gone. Resolves whether it closed.
+ */
+async function closeOAuthPopupAfterSignIn(options = {}) {
+    const win = options.win ?? (typeof window !== 'undefined' ? window : undefined);
+    if (!win || win.name !== exports.OAUTH_POPUP_WINDOW_NAME)
+        return false;
+    const acked = await relay(exports.POPUP_SIGNAL_CHANNEL, { type: 'atlas:oauth:signed_in' }, options.ackTimeoutMs ?? 1_500);
+    let hasOpener = false;
+    try {
+        hasOpener = !!win.opener && !win.opener.closed;
+    }
+    catch {
+        hasOpener = false;
+    }
+    if (!acked && !hasOpener)
+        return false;
+    closeWindow(win);
+    return true;
+}
+function closeWindow(win) {
+    try {
+        win.close();
+    }
+    catch {
+        /* the browser refused; nothing else to do */
+    }
+}
+//# sourceMappingURL=popup-channel.js.map

package/dist/popup-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"popup-channel.js","sourceRoot":"","sources":["../src/popup-channel.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAYH,4CAEC;AAGD,4CAQC;AA+DD,oDAmCC;AAGD,4CAmBC;AAuBD,8DA0BC;AASD,gEAeC;AAxND,iDAAgF;AAEhF,oEAAoE;AACvD,QAAA,uBAAuB,GAAG,aAAa,CAAC;AACrD,mEAAmE;AACtD,QAAA,qBAAqB,GAAG,oBAAoB,CAAC;AAC1D,8EAA8E;AACjE,QAAA,oBAAoB,GAAG,aAAa,CAAC;AAElD,mDAAmD;AACnD,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,GAAG,4BAAoB,IAAI,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,uDAAuD;AACvD,SAAgB,gBAAgB;IAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,UAAU,CAAC,MAA4B,CAAC;IAClD,IAAI,CAAC,EAAE,eAAe;QAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACvF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAQD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAA2D,CAAC;IACtE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;IACvF,OAAO,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAA,+BAAgB,EAAC,IAAI,CAAC,IAAI,IAAA,6BAAc,EAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,KAAK,CACZ,IAAY,EACZ,OAA4G,EAC5G,SAAiB;IAEjB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAC9B,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;YAChC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAClC,KAAa,EACb,QAKC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,4BAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,aAAa,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;gBAAE,OAAO;YAClE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,aAAa,CAAC,IAAI,CAChB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACrB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAAE,OAAO;YACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,IAAI,aAAa;YAAE,CAAC,EAAE,CAAC;QACnC,IAAI,EAAE,KAAK,EAAE,CAAC;QACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAgB,gBAAgB,CAC9B,IAAY;IAEZ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,6BAAqB,CAAC,CAAC;IACnF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;QACvE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,CAAC,GAAG,OAAkC,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD;;;;;;;GAOG;AACI,KAAK,UAAU,yBAAyB,CAC7C,UAAmD,EAAE;IAErD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,IAAI,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IACD,gEAAgE;IAChE,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,+BAAuB,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAC3B,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAC/B,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EACvD,OAAO,CAAC,YAAY,IAAI,KAAK,CAC9B,CAAC;IACF,IAAI,SAAS;QAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,0BAA0B,CAC9C,UAAmD,EAAE;IAErD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,+BAAuB;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,4BAAoB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC;IAClH,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC"}

package/dist/redirect.d.ts

@@ -59,6 +59,12 @@ export interface PopupOutcome {
  * `postMessage` on the page can never drive the flow.
  */
 export declare function parseOAuthPopupMessage(eventOrigin: string, expectedOrigin: string, data: unknown): PopupOutcome | null;
+/**
+ * Pure: map one of the Frontend API's `atlas:oauth:*` result payloads (from a
+ * `postMessage`, or relayed from a severed popup's landing page) to an outcome,
+ * or null when it is not one.
+ */
+export declare function mapOAuthPopupPayload(data: unknown): PopupOutcome | null;
 export interface OAuthPopupHandlers {
     onOpen?: () => void;
     onComplete?: (r: {
@@ -68,6 +74,14 @@ export interface OAuthPopupHandlers {
     onError?: (code: string) => void;
     /** Fired when the popup couldn't open; the caller should navigate to the URL. */
     onBlockedFallback?: (authorizationUrl: string) => void;
+    /**
+     * Fired when the popup's link to this page was severed right after opening
+     * (this page, or the provider, sends a Cross-Origin-Opener-Policy): the popup
+     * still works, but closing it can no longer be noticed, so the flow keeps
+     * waiting — up to 5 minutes — for its result. A good moment to show "Finish
+     * signing in in the popup window" with a cancel button that aborts `signal`.
+     */
+    onSevered?: () => void;
 }
 export interface PopupStartResult extends PopupOutcome {
     /** True when the popup was blocked — the caller falls back to a full redirect. */
@@ -81,18 +95,45 @@ export interface PopupStartResult extends PopupOutcome {
      * cancel.
      */
     sessionDetected?: boolean;
+    /** True when the popup's opener link was severed (see `onSevered`). */
+    severed?: boolean;
+}
+/** Input to {@link startOauthPopup}. */
+export interface OAuthPopupInput {
+    provider: string;
+    /**
+     * Where the redirect flow would return to — normally the current page. A
+     * popup whose opener link is severed lands back here (result in the
+     * fragment), so it should be a page on THIS origin that runs the SDK.
+     */
+    redirectUrl: string;
+    /** Abort to give up on the popup (settles as `popup_closed`). */
+    signal?: AbortSignal;
 }
+/** `popup.closed` this soon after opening means the opener link was severed, not a user close. */
+export declare const POPUP_SEVERED_WINDOW_MS = 1500;
+/** How long a severed popup is waited for before it counts as cancelled. */
+export declare const POPUP_SEVERED_TIMEOUT_MS: number;
 /**
  * Start a POPUP OAuth sign-in (GSI-style). Opens the provider authorize URL in a
  * popup and resolves when the callback posts back the one-time ticket (complete),
  * an error, or a continuation. Falls back to a full redirect when the popup is
  * blocked — resolves `{ blocked:true, authorizationUrl }` and the caller
  * navigates there, so it is always safe to enable. Browser-only.
+ *
+ * The result arrives by `postMessage` from the Frontend API, or — when a
+ * Cross-Origin-Opener-Policy severed the popup from this page — relayed over
+ * `BroadcastChannel('atlas:oauth:<nonce>')` by the SDK on the page the popup
+ * lands on (see ./popup-channel). Cancel semantics:
+ *   - the popup closes after the first {@link POPUP_SEVERED_WINDOW_MS}: the user
+ *     closed it — one final session probe, then `popup_closed`;
+ *   - `popup.closed` reads true within that window: the link was severed (the
+ *     popup is very much open). Keep waiting for the relayed result, probing
+ *     the session with back-off, and settle as `popup_closed` only after
+ *     {@link POPUP_SEVERED_TIMEOUT_MS}, an explicit error/cancel result,
+ *     `input.signal` aborting, or a newer popup flow starting.
  */
-export declare function startOauthPopup(client: FapiClient, input: {
-    provider: string;
-    redirectUrl: string;
-}, handlers?: OAuthPopupHandlers): Promise<PopupStartResult>;
+export declare function startOauthPopup(client: FapiClient, input: OAuthPopupInput, handlers?: OAuthPopupHandlers): Promise<PopupStartResult>;
 /**
  * Read Atlas's redirect params from a query string (`window.location.search`).
  *

package/dist/redirect.js

@@ -15,12 +15,14 @@
  * the React provider and any custom integration read the exact same contract.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REDIRECT_PARAMS = void 0;
+exports.POPUP_SEVERED_TIMEOUT_MS = exports.POPUP_SEVERED_WINDOW_MS = exports.REDIRECT_PARAMS = void 0;
 exports.startOauthRedirect = startOauthRedirect;
 exports.parseOAuthPopupMessage = parseOAuthPopupMessage;
+exports.mapOAuthPopupPayload = mapOAuthPopupPayload;
 exports.startOauthPopup = startOauthPopup;
 exports.readRedirectResult = readRedirectResult;
 exports.stripRedirectParams = stripRedirectParams;
+const popup_channel_1 = require("./popup-channel");
 exports.REDIRECT_PARAMS = ['__atlas_attempt', '__atlas_ticket', '__atlas_status'];
 /**
  * Start a redirect-based OAuth sign-in for a provider that has no in-page native
@@ -48,6 +50,14 @@ async function startOauthRedirect(client, input) {
 function parseOAuthPopupMessage(eventOrigin, expectedOrigin, data) {
     if (eventOrigin !== expectedOrigin)
         return null;
+    return mapOAuthPopupPayload(data);
+}
+/**
+ * Pure: map one of the Frontend API's `atlas:oauth:*` result payloads (from a
+ * `postMessage`, or relayed from a severed popup's landing page) to an outcome,
+ * or null when it is not one.
+ */
+function mapOAuthPopupPayload(data) {
     if (!data || typeof data !== 'object')
         return null;
     const d = data;
@@ -67,6 +77,12 @@ function parseOAuthPopupMessage(eventOrigin, expectedOrigin, data) {
             return null;
     }
 }
+/** `popup.closed` this soon after opening means the opener link was severed, not a user close. */
+exports.POPUP_SEVERED_WINDOW_MS = 1_500;
+/** How long a severed popup is waited for before it counts as cancelled. */
+exports.POPUP_SEVERED_TIMEOUT_MS = 5 * 60_000;
+/** Back-off between session probes while a severed popup is pending. */
+const SEVERED_PROBE_DELAYS_MS = [2_000, 3_000, 5_000, 8_000, 13_000, 21_000, 30_000];
 function centeredPopupFeatures(w, h) {
     const dualLeft = (window.screenLeft ?? window.screenX ?? 0);
     const dualTop = (window.screenTop ?? window.screenY ?? 0);
@@ -76,18 +92,35 @@ function centeredPopupFeatures(w, h) {
     const top = Math.max(0, dualTop + (vh - h) / 2);
     return `popup,width=${w},height=${h},left=${Math.round(left)},top=${Math.round(top)}`;
 }
+/** The popup flow currently waiting in this page; a new one supersedes it. */
+let cancelActivePopup = null;
 /**
  * Start a POPUP OAuth sign-in (GSI-style). Opens the provider authorize URL in a
  * popup and resolves when the callback posts back the one-time ticket (complete),
  * an error, or a continuation. Falls back to a full redirect when the popup is
  * blocked — resolves `{ blocked:true, authorizationUrl }` and the caller
  * navigates there, so it is always safe to enable. Browser-only.
+ *
+ * The result arrives by `postMessage` from the Frontend API, or — when a
+ * Cross-Origin-Opener-Policy severed the popup from this page — relayed over
+ * `BroadcastChannel('atlas:oauth:<nonce>')` by the SDK on the page the popup
+ * lands on (see ./popup-channel). Cancel semantics:
+ *   - the popup closes after the first {@link POPUP_SEVERED_WINDOW_MS}: the user
+ *     closed it — one final session probe, then `popup_closed`;
+ *   - `popup.closed` reads true within that window: the link was severed (the
+ *     popup is very much open). Keep waiting for the relayed result, probing
+ *     the session with back-off, and settle as `popup_closed` only after
+ *     {@link POPUP_SEVERED_TIMEOUT_MS}, an explicit error/cancel result,
+ *     `input.signal` aborting, or a newer popup flow starting.
  */
 async function startOauthPopup(client, input, handlers = {}) {
+    const nonce = (0, popup_channel_1.createPopupNonce)();
     const res = await client.post('/v1/client/sign_ins/oauth', {
         provider: input.provider,
         redirect_url: input.redirectUrl,
         mode: 'popup',
+        popup_nonce: nonce,
+        opener_origin: window.location.origin,
     });
     const authorizationUrl = res.ok ? res.data?.authorization_url : undefined;
     if (!authorizationUrl)
@@ -95,7 +128,7 @@ async function startOauthPopup(client, input, handlers = {}) {
     const expectedOrigin = client.frontendApiOrigin || window.location.origin;
     let popup = null;
     try {
-        popup = window.open(authorizationUrl, 'atlas:oauth', centeredPopupFeatures(500, 650));
+        popup = window.open(authorizationUrl, popup_channel_1.OAUTH_POPUP_WINDOW_NAME, centeredPopupFeatures(500, 650));
     }
     catch {
         popup = null;
@@ -104,15 +137,28 @@ async function startOauthPopup(client, input, handlers = {}) {
         handlers.onBlockedFallback?.(authorizationUrl);
         return { blocked: true, authorizationUrl };
     }
+    const openedAt = Date.now();
     handlers.onOpen?.();
+    // Only one popup flow at a time: starting another cancels the one waiting.
+    cancelActivePopup?.();
     return await new Promise((resolve) => {
         let done = false;
+        let severed = false;
+        let probeTimer;
+        let deadline;
+        const cancel = () => settle({ error: 'popup_closed' });
         const settle = (r) => {
             if (done)
                 return;
             done = true;
             window.removeEventListener('message', onMessage);
             clearInterval(timer);
+            clearTimeout(probeTimer);
+            clearTimeout(deadline);
+            stopListening();
+            input.signal?.removeEventListener('abort', cancel);
+            if (cancelActivePopup === cancel)
+                cancelActivePopup = null;
             try {
                 if (popup && !popup.closed)
                     popup.close();
@@ -120,11 +166,10 @@ async function startOauthPopup(client, input, handlers = {}) {
             catch {
                 /* cross-origin close can throw; ignore */
             }
-            resolve(r);
+            resolve(severed ? { ...r, severed: true } : r);
         };
-        const onMessage = (ev) => {
-            const outcome = parseOAuthPopupMessage(ev.origin, expectedOrigin, ev.data);
-            if (!outcome)
+        const deliver = (outcome) => {
+            if (done)
                 return;
             if (outcome.ticket)
                 handlers.onComplete?.({ ticket: outcome.ticket, attemptId: outcome.attemptId });
@@ -132,21 +177,62 @@ async function startOauthPopup(client, input, handlers = {}) {
                 handlers.onError?.(outcome.error);
             settle(outcome);
         };
+        const onMessage = (ev) => {
+            const outcome = parseOAuthPopupMessage(ev.origin, expectedOrigin, ev.data);
+            if (outcome)
+                deliver(outcome);
+        };
+        // A probe that finds a session settles; otherwise `onMiss` decides.
+        const probe = (onMiss) => {
+            if (done)
+                return;
+            void probeSession(client).then((signedIn) => {
+                if (done)
+                    return;
+                if (signedIn)
+                    settle({ error: 'popup_closed', sessionDetected: true });
+                else
+                    onMiss();
+            });
+        };
+        const scheduleProbe = (attempt) => {
+            const delay = SEVERED_PROBE_DELAYS_MS[Math.min(attempt, SEVERED_PROBE_DELAYS_MS.length - 1)];
+            probeTimer = setTimeout(() => probe(() => scheduleProbe(attempt + 1)), delay);
+        };
+        const stopListening = (0, popup_channel_1.listenForPopupResult)(nonce, {
+            onResult: (payload) => {
+                const outcome = mapOAuthPopupPayload(payload);
+                if (outcome)
+                    deliver(outcome);
+            },
+            // A page in the popup finished the sign-in itself: check now.
+            onSignedIn: () => probe(() => undefined),
+        });
         // The user closing the popup without finishing is a cancellation, not a hang.
-        // But a popup can also close (or look closed to us) after completing the
-        // sign-in itself: when a browser severs `window.opener` (a Cross-Origin-
-        // Opener-Policy on some hop, a privacy feature), the callback page cannot
-        // post back and finishes via the ordinary redirect instead, which sets the
-        // session cookies. So check the session once before calling it a cancel.
-        let probing = false;
+        // But `popup.closed` turning true right after opening is not a close: the
+        // opener link was severed (Cross-Origin-Opener-Policy) and the popup is
+        // still on screen. Then wait for the relayed result instead.
         const timer = setInterval(() => {
-            if (!popup || !popup.closed || probing || done)
+            if (!popup || !popup.closed || done)
                 return;
-            probing = true;
             clearInterval(timer);
-            void probeSession(client).then((signedIn) => settle(signedIn ? { error: 'popup_closed', sessionDetected: true } : { error: 'popup_closed' }));
-        }, 500);
+            if (Date.now() - openedAt <= exports.POPUP_SEVERED_WINDOW_MS) {
+                severed = true;
+                handlers.onSevered?.();
+                deadline = setTimeout(cancel, exports.POPUP_SEVERED_TIMEOUT_MS);
+                scheduleProbe(0);
+                return;
+            }
+            // A real close. It can still follow a sign-in the popup finished on its
+            // own (an opener the browser severed later, mid-flow), so check the
+            // session once before calling it a cancel.
+            probe(cancel);
+        }, 250);
         window.addEventListener('message', onMessage);
+        input.signal?.addEventListener('abort', cancel);
+        if (input.signal?.aborted)
+            cancel();
+        cancelActivePopup = cancel;
     });
 }
 /** One `GET /v1/client`: is there a signed-in session on this browser now? */

package/dist/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAcH,gDAUC;AAiCD,wDAuBC;AAyCD,0CAiEC;AAmBD,gDAcC;AAQD,kDAIC;AAnOY,QAAA,eAAe,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAEhG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,cAAsB,EACtB,IAAa;IAEb,IAAI,WAAW,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,KAAK,sBAAsB;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;aACxC,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAwBD,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,KAAgD,EAChD,WAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAEpB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;YACrC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,8EAA8E;QAC9E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO;YACvD,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAChG,CAAC;QACJ,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,YAAY,CAAC,MAAkB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwC,YAAY,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,uBAAe;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAmBH,gDAUC;AAiCD,wDAOC;AAOD,oDAkBC;AAsFD,0CA+GC;AAmBD,gDAcC;AAQD,kDAIC;AA7UD,mDAIyB;AAEZ,QAAA,eAAe,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAEhG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,KAAgD;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AA0BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,cAAsB,EACtB,IAAa;IAEb,IAAI,WAAW,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,sBAAsB;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,KAAK,sBAAsB;YACzB,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;aACxC,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AA+CD,kGAAkG;AACrF,QAAA,uBAAuB,GAAG,KAAK,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAC;AACnD,wEAAwE;AACxE,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErF,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAW,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1E,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,8EAA8E;AAC9E,IAAI,iBAAiB,GAAwB,IAAI,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,KAAsB,EACtB,WAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,IAAA,gCAAgB,GAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiC,2BAA2B,EAAE;QACzF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;KACtC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE1E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,uCAAuB,EAAE,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,2EAA2E;IAC3E,iBAAiB,EAAE,EAAE,CAAC;IAEtB,OAAO,MAAM,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAAqD,CAAC;QAC1D,IAAI,QAAmD,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;YACrC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,iBAAiB,KAAK,MAAM;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YAC3D,IAAI,CAAC;gBACH,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAE,EAAE;YACxC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,KAAK;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,EAAgB,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,OAAO;gBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,oEAAoE;QACpE,MAAM,KAAK,GAAG,CAAC,MAAkB,EAAE,EAAE;YACnC,IAAI,IAAI;gBAAE,OAAO;YACjB,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC1C,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,QAAQ;oBAAE,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;;oBAClE,MAAM,EAAE,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;YAC9F,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,oCAAoB,EAAC,KAAK,EAAE;YAChD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;gBACpB,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,OAAO;oBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,8DAA8D;YAC9D,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH,8EAA8E;QAC9E,0EAA0E;QAC1E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI;gBAAE,OAAO;YAC5C,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,+BAAuB,EAAE,CAAC;gBACrD,OAAO,GAAG,IAAI,CAAC;gBACf,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;gBACvB,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,gCAAwB,CAAC,CAAC;gBACxD,aAAa,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,wEAAwE;YACxE,oEAAoE;YACpE,2CAA2C;YAC3C,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,EAAE,CAAC;QACpC,iBAAiB,GAAG,MAAM,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,YAAY,CAAC,MAAkB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAwC,YAAY,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,OAAO;QACL,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,uBAAe;QAAE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/sign-out.d.ts

@@ -10,9 +10,9 @@
  *
  * These helpers close that gap: {@link revokeSession} retries once and reports
  * what the server did (including the parked session it promoted, if any), and
- * {@link SessionTombstones} remembers the ids of sessions this tab signed out of
- * so a reload never re-adopts one, even when the revoke never reached the
- * server.
+ * {@link SessionTombstones} remembers the ids of sessions this browser signed
+ * out of so a reload — or a tab opened later — never re-adopts one, even when
+ * the revoke never reached the server.
  */
 /** What `signOut()` resolves with. */
 export interface SignOutResult {
@@ -58,17 +58,58 @@ export interface RevokeSessionOutcome {
 export declare function revokeSession(request: (path: string, init?: RequestInit) => Promise<Response>, sessionId: string, options?: {
     retries?: number;
 }): Promise<RevokeSessionOutcome>;
+/** Options for {@link SessionTombstones}. */
+export interface SessionTombstonesOptions {
+    /**
+     * The Frontend API URL or origin the sessions belong to. Tombstones are kept
+     * per Frontend API origin, so two Atlas instances used on one site never
+     * share (or clear) each other's.
+     */
+    frontendApi?: string;
+    /** Override the storage key entirely (the Frontend API scope is then not appended). */
+    storageKey?: string;
+    /** Clock, for tests. */
+    now?: () => number;
+}
 /**
- * The ids of sessions this tab signed out of. Held in memory and mirrored to
- * `sessionStorage` (so a page reload in the same tab remembers them); sibling
- * tabs learn them through the SDK's cross-tab session broadcast. Never holds a
- * token — a session id is not a credential.
+ * The ids of sessions this browser signed out of, so a reload — or a tab opened
+ * later — never re-adopts one from a refresh cookie the revoke did not clear.
+ *
+ * Kept in `localStorage` (shared by every tab of the site and surviving a
+ * restart), at most 20 entries, each for 30 days, pruned whenever it is read,
+ * and keyed per Frontend API origin. Tabs see each other's changes on every
+ * read, and {@link SessionTombstones.subscribe} reports them as they happen
+ * (the `storage` event). `sessionStorage` is used only when `localStorage`
+ * throws (storage disabled, sandboxed frames); memory always backs both. A
+ * confirmed revoke may {@link SessionTombstones.remove} its tombstone. Never
+ * holds a token — a session id is not a credential.
  */
 export declare class SessionTombstones {
+    private entries;
+    /** Ids no storage accepted: only memory remembers them, so a sync keeps them. */
+    private unsaved;
     private readonly storageKey;
-    private readonly ids;
-    constructor(storageKey?: string);
+    private readonly now;
+    constructor(options?: string | SessionTombstonesOptions);
     has(sessionId: string | null | undefined): boolean;
     add(...sessionIds: (string | null | undefined)[]): void;
+    /**
+     * Forget tombstones — called once a later revoke of the session is confirmed
+     * (the server has ended it, so there is nothing left to re-adopt).
+     */
+    remove(...sessionIds: (string | null | undefined)[]): void;
     list(): string[];
+    /**
+     * Call `listener` when another tab adds or removes a tombstone (the `storage`
+     * event). Returns the unsubscribe function; a no-op outside a browser.
+     */
+    subscribe(listener: (ids: string[]) => void): () => void;
+    /**
+     * Re-read storage — the source of truth, so another tab's add or remove is
+     * seen here — keeping only what this tab could not store; then drop expired
+     * entries. With no readable storage, memory is all there is.
+     */
+    private sync;
+    private prune;
+    private persist;
 }

package/dist/sign-out.js

@@ -11,9 +11,9 @@
  *
  * These helpers close that gap: {@link revokeSession} retries once and reports
  * what the server did (including the parked session it promoted, if any), and
- * {@link SessionTombstones} remembers the ids of sessions this tab signed out of
- * so a reload never re-adopts one, even when the revoke never reached the
- * server.
+ * {@link SessionTombstones} remembers the ids of sessions this browser signed
+ * out of so a reload — or a tab opened later — never re-adopts one, even when
+ * the revoke never reached the server.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionTombstones = exports.SignOutError = void 0;
@@ -79,56 +79,219 @@ async function revokeSession(request, sessionId, options = {}) {
 }
 const TOMBSTONE_KEY = 'atlas:signed-out-sessions';
 const TOMBSTONE_LIMIT = 20;
+/** How long a tombstone is kept: longer than any refresh cookie it guards against. */
+const TOMBSTONE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 /**
- * The ids of sessions this tab signed out of. Held in memory and mirrored to
- * `sessionStorage` (so a page reload in the same tab remembers them); sibling
- * tabs learn them through the SDK's cross-tab session broadcast. Never holds a
- * token — a session id is not a credential.
+ * The ids of sessions this browser signed out of, so a reload — or a tab opened
+ * later — never re-adopts one from a refresh cookie the revoke did not clear.
+ *
+ * Kept in `localStorage` (shared by every tab of the site and surviving a
+ * restart), at most 20 entries, each for 30 days, pruned whenever it is read,
+ * and keyed per Frontend API origin. Tabs see each other's changes on every
+ * read, and {@link SessionTombstones.subscribe} reports them as they happen
+ * (the `storage` event). `sessionStorage` is used only when `localStorage`
+ * throws (storage disabled, sandboxed frames); memory always backs both. A
+ * confirmed revoke may {@link SessionTombstones.remove} its tombstone. Never
+ * holds a token — a session id is not a credential.
  */
 class SessionTombstones {
+    entries;
+    /** Ids no storage accepted: only memory remembers them, so a sync keeps them. */
+    unsaved = new Set();
     storageKey;
-    ids;
-    constructor(storageKey = TOMBSTONE_KEY) {
-        this.storageKey = storageKey;
-        this.ids = readStored(storageKey);
+    now;
+    constructor(options = {}) {
+        const opts = typeof options === 'string' ? { storageKey: options } : options;
+        this.storageKey = opts.storageKey ?? scopedKey(opts.frontendApi);
+        this.now = opts.now ?? Date.now;
+        const stored = readStored(this.storageKey) ?? [];
+        const legacy = readLegacy(this.storageKey, this.now()).filter((l) => !stored.some((e) => e.id === l.id));
+        this.entries = this.prune([...stored, ...legacy]);
+        // Carry an older SDK's per-tab tombstones over into the shared store, once.
+        if (legacy.length) {
+            this.persist();
+            try {
+                storage('session')?.removeItem(TOMBSTONE_KEY);
+            }
+            catch {
+                /* sessionStorage unavailable */
+            }
+        }
     }
     has(sessionId) {
-        return typeof sessionId === 'string' && this.ids.includes(sessionId);
+        if (typeof sessionId !== 'string' || !sessionId)
+            return false;
+        this.sync();
+        return this.entries.some((e) => e.id === sessionId);
     }
     add(...sessionIds) {
+        this.sync();
         let changed = false;
         for (const id of sessionIds) {
-            if (typeof id !== 'string' || !id || this.ids.includes(id))
+            if (typeof id !== 'string' || !id || this.entries.some((e) => e.id === id))
                 continue;
-            this.ids.push(id);
+            this.entries.push({ id, at: this.now() });
             changed = true;
         }
-        if (!changed)
+        if (changed)
+            this.persist();
+    }
+    /**
+     * Forget tombstones — called once a later revoke of the session is confirmed
+     * (the server has ended it, so there is nothing left to re-adopt).
+     */
+    remove(...sessionIds) {
+        this.sync();
+        const before = this.entries.length;
+        this.entries = this.entries.filter((e) => !sessionIds.includes(e.id));
+        if (this.entries.length !== before)
+            this.persist();
+    }
+    list() {
+        this.sync();
+        return this.entries.map((e) => e.id);
+    }
+    /**
+     * Call `listener` when another tab adds or removes a tombstone (the `storage`
+     * event). Returns the unsubscribe function; a no-op outside a browser.
+     */
+    subscribe(listener) {
+        const target = globalThis;
+        if (typeof target.addEventListener !== 'function')
+            return () => undefined;
+        const onStorage = (event) => {
+            if (event.key !== this.storageKey && event.key !== null)
+                return;
+            listener(this.list());
+        };
+        target.addEventListener('storage', onStorage);
+        return () => target.removeEventListener?.('storage', onStorage);
+    }
+    /**
+     * Re-read storage — the source of truth, so another tab's add or remove is
+     * seen here — keeping only what this tab could not store; then drop expired
+     * entries. With no readable storage, memory is all there is.
+     */
+    sync() {
+        const stored = readStored(this.storageKey);
+        if (!stored) {
+            this.entries = this.prune(this.entries);
             return;
-        while (this.ids.length > TOMBSTONE_LIMIT)
-            this.ids.shift();
-        try {
-            globalThis.sessionStorage?.setItem(this.storageKey, JSON.stringify(this.ids));
-        }
-        catch {
-            // Private mode / storage disabled: memory still protects this tab.
         }
+        const known = new Set(stored.map((e) => e.id));
+        this.entries = this.prune([
+            ...stored,
+            ...this.entries.filter((e) => this.unsaved.has(e.id) && !known.has(e.id)),
+        ]);
     }
-    list() {
-        return [...this.ids];
+    prune(entries) {
+        const cutoff = this.now() - TOMBSTONE_TTL_MS;
+        const seen = new Set();
+        const fresh = entries
+            .filter((e) => e.at > cutoff && !seen.has(e.id) && seen.add(e.id))
+            .sort((a, b) => a.at - b.at);
+        return fresh.slice(-TOMBSTONE_LIMIT);
+    }
+    persist() {
+        this.entries = this.prune(this.entries);
+        const raw = JSON.stringify(this.entries);
+        if (write('local', this.storageKey, raw)) {
+            // Anything parked in sessionStorage by an earlier failed write is now in localStorage.
+            try {
+                storage('session')?.removeItem(this.storageKey);
+            }
+            catch {
+                /* nothing parked, or sessionStorage unavailable */
+            }
+            this.unsaved.clear();
+            return;
+        }
+        // localStorage threw (disabled, sandboxed, full): fall back to this tab's
+        // sessionStorage, and memory still protects this tab if that throws too.
+        this.unsaved = write('session', this.storageKey, raw) ? new Set() : new Set(this.entries.map((e) => e.id));
     }
 }
 exports.SessionTombstones = SessionTombstones;
-function readStored(key) {
+/** `atlas:signed-out-sessions:<frontend api origin>`. */
+function scopedKey(frontendApi) {
+    if (!frontendApi)
+        return TOMBSTONE_KEY;
+    try {
+        return `${TOMBSTONE_KEY}:${new URL(frontendApi).origin}`;
+    }
+    catch {
+        return `${TOMBSTONE_KEY}:${frontendApi}`;
+    }
+}
+function storage(kind) {
+    // Reading `localStorage` itself throws in some sandboxed contexts.
+    return kind === 'local' ? globalThis.localStorage : globalThis.sessionStorage;
+}
+function write(kind, key, value) {
     try {
-        const raw = globalThis.sessionStorage?.getItem(key);
-        const parsed = raw ? JSON.parse(raw) : [];
-        return Array.isArray(parsed)
-            ? parsed.filter((v) => typeof v === 'string').slice(-TOMBSTONE_LIMIT)
-            : [];
+        const s = storage(kind);
+        if (!s)
+            return false;
+        s.setItem(key, value);
+        return true;
     }
     catch {
+        return false;
+    }
+}
+function parseEntries(raw, now) {
+    if (!raw)
         return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        const out = [];
+        for (const v of parsed) {
+            // Bare ids are the pre-TTL format: date them now.
+            if (typeof v === 'string' && v)
+                out.push({ id: v, at: now });
+            else if (v && typeof v === 'object') {
+                const { id, at } = v;
+                if (typeof id === 'string' && id && typeof at === 'number' && Number.isFinite(at))
+                    out.push({ id, at });
+            }
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * localStorage (plus anything a failed write parked in sessionStorage), or
+ * sessionStorage alone when localStorage throws; null when neither is readable.
+ */
+function readStored(key) {
+    const now = Date.now();
+    try {
+        const s = storage('local');
+        if (s)
+            return [...parseEntries(s.getItem(key), now), ...(readSession(key, now) ?? [])];
     }
+    catch {
+        /* fall through to sessionStorage */
+    }
+    return readSession(key, now);
+}
+function readSession(key, now) {
+    try {
+        const s = storage('session');
+        return s ? parseEntries(s.getItem(key), now) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Tombstones written by earlier SDK versions: per tab, unscoped, in sessionStorage. */
+function readLegacy(key, now) {
+    if (key === TOMBSTONE_KEY)
+        return [];
+    return readSession(TOMBSTONE_KEY, now) ?? [];
 }
 //# sourceMappingURL=sign-out.js.map

package/dist/sign-out.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../src/sign-out.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwDH,sCAgCC;AAvED,gFAAgF;AAChF,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,wBAAiC,CAAC;IAClD,6CAA6C;IACpC,SAAS,CAAS;IAC3B,gFAAgF;IACvE,MAAM,CAAS;IAExB,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CACH,MAAM,KAAK,CAAC;YACV,CAAC,CAAC,yFAAyF;YAC3F,CAAC,CAAC,mFAAmF,MAAM,IAAI,CAClG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAjBD,oCAiBC;AAaD;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,OAAgE,EAChE,SAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE;gBACtF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,eAAmC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA2C,CAAC;gBACvF,IAAI,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ;oBAAE,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;GAKG;AACH,MAAa,iBAAiB;IAGC;IAFZ,GAAG,CAAW;IAE/B,YAA6B,aAAqB,aAAa;QAAlC,eAAU,GAAV,UAAU,CAAwB;QAC7D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,SAAoC;QACtC,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,GAAG,CAAC,GAAG,UAAyC;QAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AA9BD,8CA8BC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,MAAM,GAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC;YAClF,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../src/sign-out.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwDH,sCAgCC;AAvED,gFAAgF;AAChF,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,wBAAiC,CAAC;IAClD,6CAA6C;IACpC,SAAS,CAAS;IAC3B,gFAAgF;IACvE,MAAM,CAAS;IAExB,YAAY,SAAiB,EAAE,MAAc;QAC3C,KAAK,CACH,MAAM,KAAK,CAAC;YACV,CAAC,CAAC,yFAAyF;YAC3F,CAAC,CAAC,mFAAmF,MAAM,IAAI,CAClG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAjBD,oCAiBC;AAaD;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,OAAgE,EAChE,SAAiB,EACjB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE;gBACtF,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,eAAmC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA2C,CAAC;gBACvF,IAAI,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ;oBAAE,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;IAC5C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwBlD;;;;;;;;;;;;GAYG;AACH,MAAa,iBAAiB;IACpB,OAAO,CAAmB;IAClC,iFAAiF;IACzE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IACnB,UAAU,CAAS;IACnB,GAAG,CAAe;IAEnC,YAAY,UAA6C,EAAE;QACzD,MAAM,IAAI,GAA6B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QAClD,4EAA4E;QAC5E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,GAAG,CAAC,SAAoC;QACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAAC,GAAG,UAAyC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAS;YACrF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG,UAAyC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,QAAiC;QACzC,MAAM,MAAM,GAAG,UAAoH,CAAC;QACpI,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,UAAU;YAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1E,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YACxC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;gBAAE,OAAO;YAChE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACK,IAAI;QACV,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACxB,GAAG,MAAM;YACT,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,OAAyB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;YACzC,uFAAuF;YACvF,IAAI,CAAC;gBACH,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;CACF;AArHD,8CAqHC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,WAA+B;IAChD,IAAI,CAAC,WAAW;QAAE,OAAO,aAAa,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,aAAa,IAAI,WAAW,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAiB;IAChC,mEAAmE;IACnE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;AAChF,CAAC;AAED,SAAS,KAAK,CAAC,IAAiB,EAAE,GAAW,EAAE,KAAa;IAC1D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAA8B,EAAE,GAAW;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,kDAAkD;YAClD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;iBACxD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAmC,CAAC;gBACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "devDependencies": {