@biowiki/auth-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,7 @@
+UNLICENSED
+
+Copyright (c) 2026 BioWiki.
+
+This package is proprietary and may only be used, copied, modified, and
+distributed by authorized BioWiki personnel under the applicable company
+agreement.

package/README.md

@@ -0,0 +1,96 @@
+# @biowiki/auth-sdk
+
+Browser OAuth 2.0 Authorization Code + PKCE (`S256`) client for BioWiki Web applications. It keeps only the short-lived access token in `sessionStorage`; the refresh token remains an Identity-managed HttpOnly Cookie.
+It also maintains a stable per-application browser device ID in `localStorage` and sends it when exchanging or refreshing tokens.
+
+## Install
+
+The package is published only to the company private npm Registry. Configure the scope registry in the consuming project's `.npmrc`:
+
+```ini
+@biowiki:registry=https://npm.company.example/repository/npm-private/
+```
+
+Then install a pinned version:
+
+```bash
+npm install @biowiki/auth-sdk@0.1.0
+```
+
+## Use
+
+```ts
+import { BioWikiAuthClient } from '@biowiki/auth-sdk';
+
+export const auth = new BioWikiAuthClient({
+  authUrl: import.meta.env.VITE_AUTH_URL,
+  clientId: import.meta.env.VITE_SSO_CLIENT_ID,
+  redirectUri: `${window.location.origin}/auth/callback`
+});
+
+export async function login() {
+  await auth.login(window.location.pathname + window.location.search);
+}
+
+export async function completeLogin() {
+  const { returnTo } = await auth.completeLogin();
+  window.location.replace(returnTo.startsWith('/') ? returnTo : '/');
+}
+```
+
+In the callback route, call `completeLogin()` exactly once. For protected pages, use `getSession()` or `requireAuth()`.
+
+## Logout
+
+First revoke the application's current API session through its same-origin BFF,
+then call `logout()`. The SDK clears its local access token and navigates to
+the Identity Service logout endpoint to clear the SSO session before returning
+to the registered application origin.
+
+```ts
+try {
+  await fetch('/api/bff/auth/logout', { method: 'POST' });
+} finally {
+  await auth.logout();
+}
+```
+
+## Registration
+
+The SDK also provides browser registration helpers:
+
+```ts
+await auth.requestRegistrationCode({
+  email: 'user@example.com',
+  botToken: '<turnstile-token>'
+});
+
+await auth.register({
+  email: 'user@example.com',
+  password: 'StrongPassword',
+  verificationCode: '381624'
+});
+```
+
+## Publish
+
+Package maintainers publish from `packages/auth-sdk`:
+
+```bash
+npm ci
+npm run typecheck
+npm run build
+npm pack --dry-run
+npm publish --registry="$NPM_REGISTRY"
+```
+
+Set `NPM_REGISTRY` and `NPM_TOKEN` in CI secrets. Copy `.npmrc.example` to a user-level or CI-generated `.npmrc`, replacing the Registry URL. Never commit an npm token.
+
+`prepublishOnly` rebuilds and typechecks the package before publication. Only `dist/`, `README.md`, and `LICENSE` are included in the published tarball.
+
+## Security
+
+- Do not place `app_secret`, service tokens, JWT signing keys, or npm tokens in frontend environment variables.
+- Register the exact callback URL for each environment in Platform Console.
+- Configure Identity Service `CORS_ORIGIN` to include the application Origin.
+- The SDK does not create Tenants, Applications, OAuth Clients, or API credentials. Use `getSession()`, `isAuthenticated()`, and `requireAuth()` for browser session checks.

package/dist/index.d.ts

@@ -0,0 +1,51 @@
+interface AuthSdkConfig {
+    authUrl: string;
+    clientId: string;
+    redirectUri: string;
+    scope?: string;
+}
+interface TokenSet {
+    accessToken: string;
+    expiresIn: number;
+}
+interface RegistrationInput {
+    email: string;
+    password: string;
+    verificationCode: string;
+}
+interface RegistrationResult<TUser = unknown> {
+    user: TUser;
+    registered: true;
+}
+interface RegistrationCodeInput {
+    email: string;
+    botToken?: string;
+}
+declare class BioWikiAuthClient {
+    private readonly config;
+    constructor(config: AuthSdkConfig);
+    private key;
+    getToken(): string;
+    getDeviceId(): string;
+    isAuthenticated(): boolean;
+    requestRegistrationCode({ email, botToken }: RegistrationCodeInput): Promise<{
+        success: true;
+        message: string;
+    }>;
+    register<TUser = unknown>(input: RegistrationInput): Promise<RegistrationResult<TUser>>;
+    login(returnTo?: string): Promise<void>;
+    beginRegistration(returnTo?: string): Promise<void>;
+    private startAuthorization;
+    completeLogin(url?: string): Promise<{
+        returnTo: string;
+        token: TokenSet;
+    }>;
+    refresh(): Promise<TokenSet>;
+    getUser<T>(): Promise<T>;
+    getSession<TUser = unknown>(): Promise<TUser | null>;
+    requireAuth(returnTo?: string): Promise<boolean>;
+    logout(returnTo?: string): Promise<void>;
+    private authRequest;
+}
+
+export { type AuthSdkConfig, BioWikiAuthClient, type RegistrationCodeInput, type RegistrationInput, type RegistrationResult, type TokenSet };

package/dist/index.js

@@ -0,0 +1,305 @@
+// src/index.ts
+var storagePrefix = "biowiki.auth-sdk";
+function base64Url(bytes) {
+  return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function randomValue(bytes = 32) {
+  const value = new Uint8Array(bytes);
+  crypto.getRandomValues(value);
+  return base64Url(value);
+}
+async function challenge(verifier) {
+  const input = new TextEncoder().encode(verifier);
+  if (crypto.subtle) {
+    const digest = await crypto.subtle.digest("SHA-256", input);
+    return base64Url(new Uint8Array(digest));
+  }
+  return base64Url(sha256(input));
+}
+function sha256(input) {
+  const bitLength = input.length * 8;
+  const paddedLength = Math.ceil((input.length + 9) / 64) * 64;
+  const bytes = new Uint8Array(paddedLength);
+  bytes.set(input);
+  bytes[input.length] = 128;
+  let length = bitLength;
+  for (let index = 0; index < 8; index += 1) {
+    bytes[paddedLength - 1 - index] = length & 255;
+    length = Math.floor(length / 256);
+  }
+  const words = new Uint32Array(64);
+  const hash = new Uint32Array([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  for (let offset = 0; offset < bytes.length; offset += 64) {
+    for (let index = 0; index < 16; index += 1) {
+      const position = offset + index * 4;
+      words[index] = bytes[position] << 24 | bytes[position + 1] << 16 | bytes[position + 2] << 8 | bytes[position + 3];
+    }
+    for (let index = 16; index < 64; index += 1) {
+      const a2 = words[index - 15];
+      const b2 = words[index - 2];
+      const sigma0 = (a2 >>> 7 | a2 << 25) ^ (a2 >>> 18 | a2 << 14) ^ a2 >>> 3;
+      const sigma1 = (b2 >>> 17 | b2 << 15) ^ (b2 >>> 19 | b2 << 13) ^ b2 >>> 10;
+      words[index] = words[index - 16] + sigma0 + words[index - 7] + sigma1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, h] = hash;
+    for (let index = 0; index < 64; index += 1) {
+      const sigma1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
+      const choice = e & f ^ ~e & g;
+      const temp1 = h + sigma1 + choice + SHA256_CONSTANTS[index] + words[index] >>> 0;
+      const sigma0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
+      const majority = a & b ^ a & c ^ b & c;
+      const temp2 = sigma0 + majority >>> 0;
+      [h, g, f, e, d, c, b, a] = [g, f, e, d + temp1 >>> 0, c, b, a, temp1 + temp2 >>> 0];
+    }
+    hash[0] = hash[0] + a >>> 0;
+    hash[1] = hash[1] + b >>> 0;
+    hash[2] = hash[2] + c >>> 0;
+    hash[3] = hash[3] + d >>> 0;
+    hash[4] = hash[4] + e >>> 0;
+    hash[5] = hash[5] + f >>> 0;
+    hash[6] = hash[6] + g >>> 0;
+    hash[7] = hash[7] + h >>> 0;
+  }
+  const digest = new Uint8Array(32);
+  for (let index = 0; index < hash.length; index += 1) {
+    digest[index * 4] = hash[index] >>> 24;
+    digest[index * 4 + 1] = hash[index] >>> 16;
+    digest[index * 4 + 2] = hash[index] >>> 8;
+    digest[index * 4 + 3] = hash[index];
+  }
+  return digest;
+}
+var SHA256_CONSTANTS = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var BioWikiAuthClient = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  key(name) {
+    return `${storagePrefix}:${this.config.clientId}:${name}`;
+  }
+  getToken() {
+    return sessionStorage.getItem(this.key("access-token")) ?? "";
+  }
+  getDeviceId() {
+    const key = this.key("device-id");
+    const existing = localStorage.getItem(key);
+    if (existing) return existing;
+    const deviceId = `web-${randomValue(24)}`;
+    localStorage.setItem(key, deviceId);
+    return deviceId;
+  }
+  isAuthenticated() {
+    return Boolean(this.getToken());
+  }
+  async requestRegistrationCode({ email, botToken }) {
+    return this.authRequest("/api/v1/auth/email/send-code", {
+      email,
+      purpose: "register",
+      ...botToken ? { bot_token: botToken } : {}
+    });
+  }
+  async register(input) {
+    return this.authRequest("/api/v1/auth/register", {
+      email: input.email,
+      password: input.password,
+      verification_code: input.verificationCode
+    });
+  }
+  async login(returnTo = "/") {
+    await this.startAuthorization(returnTo);
+  }
+  async beginRegistration(returnTo = "/") {
+    await this.startAuthorization(returnTo, "signup");
+  }
+  async startAuthorization(returnTo, screenHint) {
+    const state = randomValue();
+    const verifier = randomValue(48);
+    sessionStorage.setItem(this.key("state"), state);
+    sessionStorage.setItem(this.key("verifier"), verifier);
+    sessionStorage.setItem(this.key("return-to"), returnTo);
+    const authorize = new URL("/oauth/authorize", this.config.authUrl);
+    authorize.search = new URLSearchParams({
+      response_type: "code",
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      scope: this.config.scope ?? "openid profile email",
+      state,
+      code_challenge: await challenge(verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    if (screenHint) authorize.searchParams.set("screen_hint", screenHint);
+    window.location.assign(authorize.toString());
+  }
+  async completeLogin(url = window.location.href) {
+    const callback = new URL(url);
+    const code = callback.searchParams.get("code");
+    const state = callback.searchParams.get("state");
+    const expectedState = sessionStorage.getItem(this.key("state"));
+    const verifier = sessionStorage.getItem(this.key("verifier"));
+    if (!code || !state || state !== expectedState || !verifier) {
+      throw new Error("Invalid OAuth callback state.");
+    }
+    const response = await fetch(new URL("/oauth/token", this.config.authUrl), {
+      method: "POST",
+      credentials: "include",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        "x-device-id": this.getDeviceId()
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        client_id: this.config.clientId,
+        redirect_uri: this.config.redirectUri,
+        code_verifier: verifier
+      })
+    });
+    if (!response.ok) throw new Error("OAuth authorization code exchange failed.");
+    const payload = await response.json();
+    const token = { accessToken: payload.access_token, expiresIn: payload.expires_in };
+    sessionStorage.setItem(this.key("access-token"), token.accessToken);
+    const returnTo = sessionStorage.getItem(this.key("return-to")) ?? "/";
+    sessionStorage.removeItem(this.key("state"));
+    sessionStorage.removeItem(this.key("verifier"));
+    sessionStorage.removeItem(this.key("return-to"));
+    return { returnTo, token };
+  }
+  async refresh() {
+    const response = await fetch(new URL("/oauth/token", this.config.authUrl), {
+      method: "POST",
+      credentials: "include",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        "x-device-id": this.getDeviceId()
+      },
+      body: new URLSearchParams({ grant_type: "refresh_token", client_id: this.config.clientId })
+    });
+    if (!response.ok) throw new Error("OAuth refresh failed.");
+    const payload = await response.json();
+    const token = { accessToken: payload.access_token, expiresIn: payload.expires_in };
+    sessionStorage.setItem(this.key("access-token"), token.accessToken);
+    return token;
+  }
+  async getUser() {
+    const token = this.getToken() || (await this.refresh()).accessToken;
+    const response = await fetch(new URL("/oauth/userinfo", this.config.authUrl), {
+      headers: { authorization: `Bearer ${token}` },
+      credentials: "include"
+    });
+    if (!response.ok) throw new Error("OAuth userinfo request failed.");
+    return response.json();
+  }
+  async getSession() {
+    try {
+      return await this.getUser();
+    } catch {
+      return null;
+    }
+  }
+  async requireAuth(returnTo = window.location.pathname + window.location.search) {
+    if (this.isAuthenticated()) return true;
+    await this.login(returnTo);
+    return false;
+  }
+  async logout(returnTo = `${window.location.origin}/`) {
+    const logout = new URL("/oauth/logout", this.config.authUrl);
+    logout.search = new URLSearchParams({
+      client_id: this.config.clientId,
+      post_logout_redirect_uri: returnTo
+    }).toString();
+    sessionStorage.removeItem(this.key("access-token"));
+    window.location.assign(logout.toString());
+  }
+  async authRequest(path, body) {
+    const response = await fetch(new URL(path, this.config.authUrl), {
+      method: "POST",
+      credentials: "include",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) {
+      throw new Error(payload?.error?.message ?? "Identity registration request failed.");
+    }
+    return payload?.data ?? payload;
+  }
+};
+export {
+  BioWikiAuthClient
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export interface AuthSdkConfig {\n  authUrl: string;\n  clientId: string;\n  redirectUri: string;\n  scope?: string;\n}\n\nexport interface TokenSet {\n  accessToken: string;\n  expiresIn: number;\n}\n\nexport interface RegistrationInput {\n  email: string;\n  password: string;\n  verificationCode: string;\n}\n\nexport interface RegistrationResult<TUser = unknown> {\n  user: TUser;\n  registered: true;\n}\n\nexport interface RegistrationCodeInput {\n  email: string;\n  botToken?: string;\n}\n\nconst storagePrefix = 'biowiki.auth-sdk';\n\nfunction base64Url(bytes: Uint8Array) {\n  return btoa(String.fromCharCode(...bytes))\n    .replaceAll('+', '-')\n    .replaceAll('/', '_')\n    .replaceAll('=', '');\n}\n\nfunction randomValue(bytes = 32) {\n  const value = new Uint8Array(bytes);\n  crypto.getRandomValues(value);\n  return base64Url(value);\n}\n\nasync function challenge(verifier: string) {\n  const input = new TextEncoder().encode(verifier);\n  if (crypto.subtle) {\n    const digest = await crypto.subtle.digest('SHA-256', input);\n    return base64Url(new Uint8Array(digest));\n  }\n  // Browsers do not expose SubtleCrypto for HTTP pages served from a LAN IP.\n  return base64Url(sha256(input));\n}\n\nfunction sha256(input: Uint8Array) {\n  const bitLength = input.length * 8;\n  const paddedLength = Math.ceil((input.length + 9) / 64) * 64;\n  const bytes = new Uint8Array(paddedLength);\n  bytes.set(input);\n  bytes[input.length] = 0x80;\n\n  let length = bitLength;\n  for (let index = 0; index < 8; index += 1) {\n    bytes[paddedLength - 1 - index] = length & 0xff;\n    length = Math.floor(length / 256);\n  }\n\n  const words = new Uint32Array(64);\n  const hash = new Uint32Array([\n    0x6a09e667,\n    0xbb67ae85,\n    0x3c6ef372,\n    0xa54ff53a,\n    0x510e527f,\n    0x9b05688c,\n    0x1f83d9ab,\n    0x5be0cd19\n  ]);\n\n  for (let offset = 0; offset < bytes.length; offset += 64) {\n    for (let index = 0; index < 16; index += 1) {\n      const position = offset + index * 4;\n      words[index] =\n        (bytes[position] << 24) |\n        (bytes[position + 1] << 16) |\n        (bytes[position + 2] << 8) |\n        bytes[position + 3];\n    }\n    for (let index = 16; index < 64; index += 1) {\n      const a = words[index - 15];\n      const b = words[index - 2];\n      const sigma0 = ((a >>> 7) | (a << 25)) ^ ((a >>> 18) | (a << 14)) ^ (a >>> 3);\n      const sigma1 = ((b >>> 17) | (b << 15)) ^ ((b >>> 19) | (b << 13)) ^ (b >>> 10);\n      words[index] = (words[index - 16] + sigma0 + words[index - 7] + sigma1) >>> 0;\n    }\n\n    let [a, b, c, d, e, f, g, h] = hash;\n    for (let index = 0; index < 64; index += 1) {\n      const sigma1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));\n      const choice = (e & f) ^ (~e & g);\n      const temp1 = (h + sigma1 + choice + SHA256_CONSTANTS[index] + words[index]) >>> 0;\n      const sigma0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));\n      const majority = (a & b) ^ (a & c) ^ (b & c);\n      const temp2 = (sigma0 + majority) >>> 0;\n      [h, g, f, e, d, c, b, a] = [g, f, e, (d + temp1) >>> 0, c, b, a, (temp1 + temp2) >>> 0];\n    }\n\n    hash[0] = (hash[0] + a) >>> 0;\n    hash[1] = (hash[1] + b) >>> 0;\n    hash[2] = (hash[2] + c) >>> 0;\n    hash[3] = (hash[3] + d) >>> 0;\n    hash[4] = (hash[4] + e) >>> 0;\n    hash[5] = (hash[5] + f) >>> 0;\n    hash[6] = (hash[6] + g) >>> 0;\n    hash[7] = (hash[7] + h) >>> 0;\n  }\n\n  const digest = new Uint8Array(32);\n  for (let index = 0; index < hash.length; index += 1) {\n    digest[index * 4] = hash[index] >>> 24;\n    digest[index * 4 + 1] = hash[index] >>> 16;\n    digest[index * 4 + 2] = hash[index] >>> 8;\n    digest[index * 4 + 3] = hash[index];\n  }\n  return digest;\n}\n\nconst SHA256_CONSTANTS = new Uint32Array([\n  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2\n]);\n\nexport class BioWikiAuthClient {\n  constructor(private readonly config: AuthSdkConfig) {}\n\n  private key(name: string) {\n    return `${storagePrefix}:${this.config.clientId}:${name}`;\n  }\n\n  getToken() {\n    return sessionStorage.getItem(this.key('access-token')) ?? '';\n  }\n\n  getDeviceId() {\n    const key = this.key('device-id');\n    const existing = localStorage.getItem(key);\n    if (existing) return existing;\n    const deviceId = `web-${randomValue(24)}`;\n    localStorage.setItem(key, deviceId);\n    return deviceId;\n  }\n\n  isAuthenticated() {\n    return Boolean(this.getToken());\n  }\n\n  async requestRegistrationCode({ email, botToken }: RegistrationCodeInput) {\n    return this.authRequest('/api/v1/auth/email/send-code', {\n      email,\n      purpose: 'register',\n      ...(botToken ? { bot_token: botToken } : {})\n    });\n  }\n\n  async register<TUser = unknown>(input: RegistrationInput): Promise<RegistrationResult<TUser>> {\n    return this.authRequest<RegistrationResult<TUser>>('/api/v1/auth/register', {\n      email: input.email,\n      password: input.password,\n      verification_code: input.verificationCode\n    });\n  }\n\n  async login(returnTo = '/') {\n    await this.startAuthorization(returnTo);\n  }\n\n  async beginRegistration(returnTo = '/') {\n    await this.startAuthorization(returnTo, 'signup');\n  }\n\n  private async startAuthorization(returnTo: string, screenHint?: 'signup') {\n    const state = randomValue();\n    const verifier = randomValue(48);\n    sessionStorage.setItem(this.key('state'), state);\n    sessionStorage.setItem(this.key('verifier'), verifier);\n    sessionStorage.setItem(this.key('return-to'), returnTo);\n    const authorize = new URL('/oauth/authorize', this.config.authUrl);\n    authorize.search = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: this.config.scope ?? 'openid profile email',\n      state,\n      code_challenge: await challenge(verifier),\n      code_challenge_method: 'S256'\n    }).toString();\n    if (screenHint) authorize.searchParams.set('screen_hint', screenHint);\n    window.location.assign(authorize.toString());\n  }\n\n  async completeLogin(url = window.location.href): Promise<{ returnTo: string; token: TokenSet }> {\n    const callback = new URL(url);\n    const code = callback.searchParams.get('code');\n    const state = callback.searchParams.get('state');\n    const expectedState = sessionStorage.getItem(this.key('state'));\n    const verifier = sessionStorage.getItem(this.key('verifier'));\n    if (!code || !state || state !== expectedState || !verifier) {\n      throw new Error('Invalid OAuth callback state.');\n    }\n    const response = await fetch(new URL('/oauth/token', this.config.authUrl), {\n      method: 'POST',\n      credentials: 'include',\n      headers: {\n        'content-type': 'application/x-www-form-urlencoded',\n        'x-device-id': this.getDeviceId()\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: verifier\n      })\n    });\n    if (!response.ok) throw new Error('OAuth authorization code exchange failed.');\n    const payload = await response.json();\n    const token = { accessToken: payload.access_token, expiresIn: payload.expires_in };\n    sessionStorage.setItem(this.key('access-token'), token.accessToken);\n    const returnTo = sessionStorage.getItem(this.key('return-to')) ?? '/';\n    sessionStorage.removeItem(this.key('state'));\n    sessionStorage.removeItem(this.key('verifier'));\n    sessionStorage.removeItem(this.key('return-to'));\n    return { returnTo, token };\n  }\n\n  async refresh(): Promise<TokenSet> {\n    const response = await fetch(new URL('/oauth/token', this.config.authUrl), {\n      method: 'POST',\n      credentials: 'include',\n      headers: {\n        'content-type': 'application/x-www-form-urlencoded',\n        'x-device-id': this.getDeviceId()\n      },\n      body: new URLSearchParams({ grant_type: 'refresh_token', client_id: this.config.clientId })\n    });\n    if (!response.ok) throw new Error('OAuth refresh failed.');\n    const payload = await response.json();\n    const token = { accessToken: payload.access_token, expiresIn: payload.expires_in };\n    sessionStorage.setItem(this.key('access-token'), token.accessToken);\n    return token;\n  }\n\n  async getUser<T>() {\n    const token = this.getToken() || (await this.refresh()).accessToken;\n    const response = await fetch(new URL('/oauth/userinfo', this.config.authUrl), {\n      headers: { authorization: `Bearer ${token}` },\n      credentials: 'include'\n    });\n    if (!response.ok) throw new Error('OAuth userinfo request failed.');\n    return response.json() as Promise<T>;\n  }\n\n  async getSession<TUser = unknown>(): Promise<TUser | null> {\n    try {\n      return await this.getUser<TUser>();\n    } catch {\n      return null;\n    }\n  }\n\n  async requireAuth(returnTo = window.location.pathname + window.location.search) {\n    if (this.isAuthenticated()) return true;\n    await this.login(returnTo);\n    return false;\n  }\n\n  async logout(returnTo = `${window.location.origin}/`) {\n    const logout = new URL('/oauth/logout', this.config.authUrl);\n    logout.search = new URLSearchParams({\n      client_id: this.config.clientId,\n      post_logout_redirect_uri: returnTo\n    }).toString();\n    sessionStorage.removeItem(this.key('access-token'));\n    window.location.assign(logout.toString());\n  }\n\n  private async authRequest<T = { success: true; message: string }>(path: string, body: Record<string, string>) {\n    const response = await fetch(new URL(path, this.config.authUrl), {\n      method: 'POST',\n      credentials: 'include',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify(body)\n    });\n    const payload = await response.json().catch(() => null);\n    if (!response.ok) {\n      throw new Error(payload?.error?.message ?? 'Identity registration request failed.');\n    }\n    return (payload?.data ?? payload) as T;\n  }\n}\n"],"mappings":";AA4BA,IAAM,gBAAgB;AAEtB,SAAS,UAAU,OAAmB;AACpC,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,EAAE;AACvB;AAEA,SAAS,YAAY,QAAQ,IAAI;AAC/B,QAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,SAAO,gBAAgB,KAAK;AAC5B,SAAO,UAAU,KAAK;AACxB;AAEA,eAAe,UAAU,UAAkB;AACzC,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,QAAQ;AAC/C,MAAI,OAAO,QAAQ;AACjB,UAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK;AAC1D,WAAO,UAAU,IAAI,WAAW,MAAM,CAAC;AAAA,EACzC;AAEA,SAAO,UAAU,OAAO,KAAK,CAAC;AAChC;AAEA,SAAS,OAAO,OAAmB;AACjC,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,eAAe,KAAK,MAAM,MAAM,SAAS,KAAK,EAAE,IAAI;AAC1D,QAAM,QAAQ,IAAI,WAAW,YAAY;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,MAAM,MAAM,IAAI;AAEtB,MAAI,SAAS;AACb,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,UAAM,eAAe,IAAI,KAAK,IAAI,SAAS;AAC3C,aAAS,KAAK,MAAM,SAAS,GAAG;AAAA,EAClC;AAEA,QAAM,QAAQ,IAAI,YAAY,EAAE;AAChC,QAAM,OAAO,IAAI,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,WAAS,SAAS,GAAG,SAAS,MAAM,QAAQ,UAAU,IAAI;AACxD,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;AAC1C,YAAM,WAAW,SAAS,QAAQ;AAClC,YAAM,KAAK,IACR,MAAM,QAAQ,KAAK,KACnB,MAAM,WAAW,CAAC,KAAK,KACvB,MAAM,WAAW,CAAC,KAAK,IACxB,MAAM,WAAW,CAAC;AAAA,IACtB;AACA,aAAS,QAAQ,IAAI,QAAQ,IAAI,SAAS,GAAG;AAC3C,YAAMA,KAAI,MAAM,QAAQ,EAAE;AAC1B,YAAMC,KAAI,MAAM,QAAQ,CAAC;AACzB,YAAM,UAAWD,OAAM,IAAMA,MAAK,OAASA,OAAM,KAAOA,MAAK,MAAQA,OAAM;AAC3E,YAAM,UAAWC,OAAM,KAAOA,MAAK,OAASA,OAAM,KAAOA,MAAK,MAAQA,OAAM;AAC5E,YAAM,KAAK,IAAK,MAAM,QAAQ,EAAE,IAAI,SAAS,MAAM,QAAQ,CAAC,IAAI,WAAY;AAAA,IAC9E;AAEA,QAAI,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI;AAC/B,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;AAC1C,YAAM,UAAW,MAAM,IAAM,KAAK,OAAS,MAAM,KAAO,KAAK,OAAS,MAAM,KAAO,KAAK;AACxF,YAAM,SAAU,IAAI,IAAM,CAAC,IAAI;AAC/B,YAAM,QAAS,IAAI,SAAS,SAAS,iBAAiB,KAAK,IAAI,MAAM,KAAK,MAAO;AACjF,YAAM,UAAW,MAAM,IAAM,KAAK,OAAS,MAAM,KAAO,KAAK,OAAS,MAAM,KAAO,KAAK;AACxF,YAAM,WAAY,IAAI,IAAM,IAAI,IAAM,IAAI;AAC1C,YAAM,QAAS,SAAS,aAAc;AACtC,OAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,GAAI,IAAI,UAAW,GAAG,GAAG,GAAG,GAAI,QAAQ,UAAW,CAAC;AAAA,IACxF;AAEA,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAC5B,SAAK,CAAC,IAAK,KAAK,CAAC,IAAI,MAAO;AAAA,EAC9B;AAEA,QAAM,SAAS,IAAI,WAAW,EAAE;AAChC,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,WAAO,QAAQ,CAAC,IAAI,KAAK,KAAK,MAAM;AACpC,WAAO,QAAQ,IAAI,CAAC,IAAI,KAAK,KAAK,MAAM;AACxC,WAAO,QAAQ,IAAI,CAAC,IAAI,KAAK,KAAK,MAAM;AACxC,WAAO,QAAQ,IAAI,CAAC,IAAI,KAAK,KAAK;AAAA,EACpC;AACA,SAAO;AACT;AAEA,IAAM,mBAAmB,IAAI,YAAY;AAAA,EACvC;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACtF,CAAC;AAEM,IAAM,oBAAN,MAAwB;AAAA,EAC7B,YAA6B,QAAuB;AAAvB;AAAA,EAAwB;AAAA,EAAxB;AAAA,EAErB,IAAI,MAAc;AACxB,WAAO,GAAG,aAAa,IAAI,KAAK,OAAO,QAAQ,IAAI,IAAI;AAAA,EACzD;AAAA,EAEA,WAAW;AACT,WAAO,eAAe,QAAQ,KAAK,IAAI,cAAc,CAAC,KAAK;AAAA,EAC7D;AAAA,EAEA,cAAc;AACZ,UAAM,MAAM,KAAK,IAAI,WAAW;AAChC,UAAM,WAAW,aAAa,QAAQ,GAAG;AACzC,QAAI,SAAU,QAAO;AACrB,UAAM,WAAW,OAAO,YAAY,EAAE,CAAC;AACvC,iBAAa,QAAQ,KAAK,QAAQ;AAClC,WAAO;AAAA,EACT;AAAA,EAEA,kBAAkB;AAChB,WAAO,QAAQ,KAAK,SAAS,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,wBAAwB,EAAE,OAAO,SAAS,GAA0B;AACxE,WAAO,KAAK,YAAY,gCAAgC;AAAA,MACtD;AAAA,MACA,SAAS;AAAA,MACT,GAAI,WAAW,EAAE,WAAW,SAAS,IAAI,CAAC;AAAA,IAC5C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SAA0B,OAA8D;AAC5F,WAAO,KAAK,YAAuC,yBAAyB;AAAA,MAC1E,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,mBAAmB,MAAM;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,WAAW,KAAK;AAC1B,UAAM,KAAK,mBAAmB,QAAQ;AAAA,EACxC;AAAA,EAEA,MAAM,kBAAkB,WAAW,KAAK;AACtC,UAAM,KAAK,mBAAmB,UAAU,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAc,mBAAmB,UAAkB,YAAuB;AACxE,UAAM,QAAQ,YAAY;AAC1B,UAAM,WAAW,YAAY,EAAE;AAC/B,mBAAe,QAAQ,KAAK,IAAI,OAAO,GAAG,KAAK;AAC/C,mBAAe,QAAQ,KAAK,IAAI,UAAU,GAAG,QAAQ;AACrD,mBAAe,QAAQ,KAAK,IAAI,WAAW,GAAG,QAAQ;AACtD,UAAM,YAAY,IAAI,IAAI,oBAAoB,KAAK,OAAO,OAAO;AACjE,cAAU,SAAS,IAAI,gBAAgB;AAAA,MACrC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,OAAO,KAAK,OAAO,SAAS;AAAA,MAC5B;AAAA,MACA,gBAAgB,MAAM,UAAU,QAAQ;AAAA,MACxC,uBAAuB;AAAA,IACzB,CAAC,EAAE,SAAS;AACZ,QAAI,WAAY,WAAU,aAAa,IAAI,eAAe,UAAU;AACpE,WAAO,SAAS,OAAO,UAAU,SAAS,CAAC;AAAA,EAC7C;AAAA,EAEA,MAAM,cAAc,MAAM,OAAO,SAAS,MAAsD;AAC9F,UAAM,WAAW,IAAI,IAAI,GAAG;AAC5B,UAAM,OAAO,SAAS,aAAa,IAAI,MAAM;AAC7C,UAAM,QAAQ,SAAS,aAAa,IAAI,OAAO;AAC/C,UAAM,gBAAgB,eAAe,QAAQ,KAAK,IAAI,OAAO,CAAC;AAC9D,UAAM,WAAW,eAAe,QAAQ,KAAK,IAAI,UAAU,CAAC;AAC5D,QAAI,CAAC,QAAQ,CAAC,SAAS,UAAU,iBAAiB,CAAC,UAAU;AAC3D,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,UAAM,WAAW,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO,GAAG;AAAA,MACzE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,KAAK,YAAY;AAAA,MAClC;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,2CAA2C;AAC7E,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,UAAM,QAAQ,EAAE,aAAa,QAAQ,cAAc,WAAW,QAAQ,WAAW;AACjF,mBAAe,QAAQ,KAAK,IAAI,cAAc,GAAG,MAAM,WAAW;AAClE,UAAM,WAAW,eAAe,QAAQ,KAAK,IAAI,WAAW,CAAC,KAAK;AAClE,mBAAe,WAAW,KAAK,IAAI,OAAO,CAAC;AAC3C,mBAAe,WAAW,KAAK,IAAI,UAAU,CAAC;AAC9C,mBAAe,WAAW,KAAK,IAAI,WAAW,CAAC;AAC/C,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AAAA,EAEA,MAAM,UAA6B;AACjC,UAAM,WAAW,MAAM,MAAM,IAAI,IAAI,gBAAgB,KAAK,OAAO,OAAO,GAAG;AAAA,MACzE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,KAAK,YAAY;AAAA,MAClC;AAAA,MACA,MAAM,IAAI,gBAAgB,EAAE,YAAY,iBAAiB,WAAW,KAAK,OAAO,SAAS,CAAC;AAAA,IAC5F,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,uBAAuB;AACzD,UAAM,UAAU,MAAM,SAAS,KAAK;AACpC,UAAM,QAAQ,EAAE,aAAa,QAAQ,cAAc,WAAW,QAAQ,WAAW;AACjF,mBAAe,QAAQ,KAAK,IAAI,cAAc,GAAG,MAAM,WAAW;AAClE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAa;AACjB,UAAM,QAAQ,KAAK,SAAS,MAAM,MAAM,KAAK,QAAQ,GAAG;AACxD,UAAM,WAAW,MAAM,MAAM,IAAI,IAAI,mBAAmB,KAAK,OAAO,OAAO,GAAG;AAAA,MAC5E,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC5C,aAAa;AAAA,IACf,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,gCAAgC;AAClE,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,aAAqD;AACzD,QAAI;AACF,aAAO,MAAM,KAAK,QAAe;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,WAAW,OAAO,SAAS,WAAW,OAAO,SAAS,QAAQ;AAC9E,QAAI,KAAK,gBAAgB,EAAG,QAAO;AACnC,UAAM,KAAK,MAAM,QAAQ;AACzB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,WAAW,GAAG,OAAO,SAAS,MAAM,KAAK;AACpD,UAAM,SAAS,IAAI,IAAI,iBAAiB,KAAK,OAAO,OAAO;AAC3D,WAAO,SAAS,IAAI,gBAAgB;AAAA,MAClC,WAAW,KAAK,OAAO;AAAA,MACvB,0BAA0B;AAAA,IAC5B,CAAC,EAAE,SAAS;AACZ,mBAAe,WAAW,KAAK,IAAI,cAAc,CAAC;AAClD,WAAO,SAAS,OAAO,OAAO,SAAS,CAAC;AAAA,EAC1C;AAAA,EAEA,MAAc,YAAoD,MAAc,MAA8B;AAC5G,UAAM,WAAW,MAAM,MAAM,IAAI,IAAI,MAAM,KAAK,OAAO,OAAO,GAAG;AAAA,MAC/D,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,UAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACtD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,SAAS,OAAO,WAAW,uCAAuC;AAAA,IACpF;AACA,WAAQ,SAAS,QAAQ;AAAA,EAC3B;AACF;","names":["a","b"]}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@biowiki/auth-sdk",
+  "version": "0.1.0",
+  "description": "Browser OAuth 2.0 Authorization Code + PKCE client for BioWiki applications.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run typecheck && npm run build",
+    "prepublishOnly": "npm run typecheck && npm run build"
+  },
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "engines": {
+    "node": ">=24 <25"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.1",
+    "typescript": "^5.7.3"
+  }
+}