@canopy-io/browser 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @canopy-io/browser
+
+## 0.1.0
+
+### Minor Changes
+
+- 0a59da5: First release. `createCanopyBrowserClient` signs a single-page app in through Canopy's hosted login as a public OAuth client: PKCE with no secret, tokens kept in memory, a reload resumed with `prompt=none`, refreshes shared so a rotated token is never presented twice, and a sign-out that ends Canopy's session too. Zero runtime dependencies.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Canopy Identity Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,70 @@
-# Temporary Holding Version
+# @canopy-io/browser
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Sign a single-page app in through [Canopy](https://canopy-io.com)'s hosted login, with no backend and no secret.
+
+The app registers as a **public** OAuth client: it has a `client_id` and nothing else to keep, and PKCE binds each sign-in to the browser that started it. This package runs that flow and keeps the tokens in memory, out of reach of anything reading `localStorage`. Zero runtime dependencies.
+
+An app that has a backend does not need this package: its server exchanges the code as a confidential client, and the browser never holds a token. Use [`@canopy-io/node`](https://www.npmjs.com/package/@canopy-io/node) there.
+
+## Install
+
+```bash
+npm install @canopy-io/browser
+```
+
+## Before the first sign-in
+
+1. Register an OAuth client in the Developer Console (Integrations → OAuth Clients) with **Client Type** set to **Public**, your callback URL as a redirect URI, and the page `signOut()` lands on as a post-logout redirect URL.
+2. Add your app's origin, such as `https://app.example.com`, to the Environment's **Allowed web origins** (Tenant → Authentication → Sign-in methods). Without it the browser cannot read Canopy's token responses.
+
+## Use
+
+```ts
+import { createCanopyBrowserClient } from "@canopy-io/browser";
+
+const canopy = createCanopyBrowserClient({
+  issuer: "https://canopy-io.com/environments/<environment_id>",
+  clientId: "<public client_id>",
+  redirectUri: `${location.origin}/callback`,
+  postLogoutRedirectUri: `${location.origin}/`,
+  onSessionEnd: () => showSignedOut(),
+});
+
+// Once per page load.
+const result = await canopy.start();
+
+if (result.status === "signed-in") {
+  showSignedIn(canopy.getClaims());
+} else if (result.status !== "redirecting") {
+  showSignedOut();
+}
+
+signInButton.onclick = () => canopy.signIn();
+signOutButton.onclick = () => canopy.signOut();
+
+// On every call to your API.
+const token = await canopy.getAccessToken();
+```
+
+- `start()` finishes a sign-in Canopy has just answered. With nothing in memory (a first visit, a reload) it asks Canopy with `prompt=none`, which returns with tokens while the person's Canopy session lasts and with `login_required` otherwise. Show the sign-in button on `signed-out`, and on `error` (`result.error.needsSignIn` tells the expected answers from a fault).
+- `signIn({ prompt, organization, loginHint, returnTo })` sends the browser to the hosted sign-in. `returnTo` comes back on the result.
+- `getAccessToken()` returns a current access token, refreshed first when it is within a minute of expiring, or `null` once the session has ended. Concurrent calls share one refresh.
+- `getClaims()` returns the ID token's claims: `sub`, and `email` or `name` with those scopes.
+- `signOut()` revokes the refresh token and sends the browser to Canopy's end-session endpoint, so the next `start()` does not sign the person back in.
+
+Your API verifies the access token as it would any Hosted Login token, with `audience` set to the public `client_id` (`TokenVerifier` in `@canopy-io/node`). This package does not verify signatures: it checks the ID token's issuer, audience, nonce and expiry, as OpenID Connect asks of a token received straight from the token endpoint.
+
+## Sessions
+
+A public client's session ends a fixed time after sign-in, however often it refreshes: 30 days by default, set per Environment from 1 to 90 days (**Public app session lifetime**). Then `getAccessToken()` returns `null` and `onSessionEnd` is called.
+
+## Errors
+
+- `CanopyAuthError`: Canopy answered with an OAuth error. Branch on `code` (`login_required`, `interaction_required`, `invalid_grant`, `state_mismatch`).
+- `CanopyConnectionError`: no response could be read. A browser reports a cross-origin refusal the same way as a network failure; on a page that has never signed in, check **Allowed web origins**.
+
+Full guide: [Hosted Login, single-page and mobile apps](https://canopy-io.com/docs/authentication/hosted-login#single-page-and-mobile-apps).
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,505 @@
+'use strict';
+
+var __defProp = Object.defineProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+
+// src/errors.ts
+var NEEDS_SIGN_IN = /* @__PURE__ */ new Set([
+  "login_required",
+  "interaction_required",
+  "consent_required"
+]);
+var CanopyAuthError = class extends Error {
+  constructor(code, description, status) {
+    super(description ? `${code}: ${description}` : code);
+    __publicField(this, "name", "CanopyAuthError");
+    /** The OAuth `error`, e.g. `login_required` or `invalid_grant`. */
+    __publicField(this, "code");
+    /** The `error_description`, for logging. Not meant for end users. */
+    __publicField(this, "description");
+    /** The HTTP status, when the error came from an endpoint rather than the redirect. */
+    __publicField(this, "status");
+    this.code = code;
+    this.description = description;
+    this.status = status;
+  }
+  /**
+   * True when the answer means the person has to sign in: a silent attempt
+   * found no session, or the session needs them for something. Show your
+   * sign-in button rather than trying again silently.
+   */
+  get needsSignIn() {
+    return NEEDS_SIGN_IN.has(this.code);
+  }
+};
+var CanopyConnectionError = class extends Error {
+  constructor(url, cause) {
+    super(
+      `Could not read a response from ${url}. If this page has never signed in, add its origin (${currentOrigin()}) to the Environment's Allowed web origins in the Developer Console; the browser blocks the response otherwise.`,
+      { cause }
+    );
+    __publicField(this, "name", "CanopyConnectionError");
+    /** The URL that could not be read. */
+    __publicField(this, "url");
+    this.url = url;
+  }
+};
+function currentOrigin() {
+  return typeof location === "undefined" ? "this origin" : location.origin;
+}
+function isCanopyAuthError(error) {
+  return error instanceof CanopyAuthError;
+}
+function isCanopyConnectionError(error) {
+  return error instanceof CanopyConnectionError;
+}
+
+// src/pkce.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+function randomString() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}
+async function createPkcePair() {
+  const verifier = randomString();
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier)
+  );
+  return { verifier, challenge: base64UrlEncode(new Uint8Array(digest)) };
+}
+
+// src/id-token.ts
+function decodeJwtPayload(token) {
+  const payload = token.split(".")[1];
+  if (!payload) {
+    throw new CanopyAuthError("invalid_token", "The token is not a JWT.");
+  }
+  const parsed = JSON.parse(base64UrlDecode(payload));
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new CanopyAuthError("invalid_token", "The token has no claims.");
+  }
+  return parsed;
+}
+function checkIdToken(token, expected, nowSeconds) {
+  const claims = decodeJwtPayload(token);
+  const audience = claims["aud"];
+  const audiences = Array.isArray(audience) ? audience : [audience];
+  if (claims["iss"] !== expected.issuer) {
+    throw new CanopyAuthError(
+      "invalid_token",
+      `The ID token's issuer is ${String(claims["iss"])}, not ${expected.issuer}.`
+    );
+  }
+  if (!audiences.includes(expected.clientId)) {
+    throw new CanopyAuthError(
+      "invalid_token",
+      "The ID token was not issued to this client."
+    );
+  }
+  if (expected.nonce !== void 0 && claims["nonce"] !== expected.nonce) {
+    throw new CanopyAuthError(
+      "invalid_token",
+      "The ID token answers another sign-in: its nonce does not match."
+    );
+  }
+  if (typeof claims["exp"] !== "number" || claims["exp"] <= nowSeconds) {
+    throw new CanopyAuthError("invalid_token", "The ID token has expired.");
+  }
+  return claims;
+}
+
+// src/client.ts
+var DEFAULT_SCOPES = ["openid", "profile", "email"];
+var RESPONSE_PARAMS = [
+  "code",
+  "state",
+  "error",
+  "error_description",
+  "error_uri",
+  "iss"
+];
+function createCanopyBrowserClient(options) {
+  return new CanopyBrowserClient(options);
+}
+var _issuer, _clientId, _redirectUri, _scopes, _postLogoutRedirectUri, _leewayMs, _onSessionEnd, _storage, _navigate, _replaceUrl, _fetch, _now, _discovery, _session, _refreshing, _CanopyBrowserClient_instances, refresh_fn, keep_fn, token_fn, post_fn, discover_fn, readDiscovery_fn, pendingKey_fn, takePending_fn;
+var CanopyBrowserClient = class {
+  constructor(options) {
+    __privateAdd(this, _CanopyBrowserClient_instances);
+    __privateAdd(this, _issuer);
+    __privateAdd(this, _clientId);
+    __privateAdd(this, _redirectUri);
+    __privateAdd(this, _scopes);
+    __privateAdd(this, _postLogoutRedirectUri);
+    __privateAdd(this, _leewayMs);
+    __privateAdd(this, _onSessionEnd);
+    __privateAdd(this, _storage);
+    __privateAdd(this, _navigate);
+    __privateAdd(this, _replaceUrl);
+    __privateAdd(this, _fetch);
+    __privateAdd(this, _now);
+    __privateAdd(this, _discovery);
+    __privateAdd(this, _session);
+    __privateAdd(this, _refreshing);
+    if (!options.issuer || !options.clientId || !options.redirectUri) {
+      throw new TypeError(
+        "createCanopyBrowserClient needs an issuer, a clientId and a redirectUri."
+      );
+    }
+    __privateSet(this, _issuer, withoutTrailingSlashes(options.issuer));
+    __privateSet(this, _clientId, options.clientId);
+    __privateSet(this, _redirectUri, options.redirectUri);
+    __privateSet(this, _scopes, options.scopes ?? DEFAULT_SCOPES);
+    __privateSet(this, _postLogoutRedirectUri, options.postLogoutRedirectUri);
+    __privateSet(this, _leewayMs, (options.refreshLeewaySeconds ?? 60) * 1e3);
+    __privateSet(this, _onSessionEnd, options.onSessionEnd);
+    __privateSet(this, _storage, options.storage ?? sessionStorage);
+    __privateSet(this, _navigate, options.navigate ?? ((url) => location.assign(url)));
+    __privateSet(this, _replaceUrl, options.replaceUrl ?? ((url) => history.replaceState(history.state, "", url)));
+    __privateSet(this, _fetch, options.fetch ?? globalThis.fetch.bind(globalThis));
+    __privateSet(this, _now, options.now ?? Date.now);
+  }
+  /**
+   * Run once when the app loads. Finishes a sign-in when Canopy has just sent
+   * the browser back, and otherwise tries to resume Canopy's session without
+   * showing a page. Show your sign-in button on `signed-out`, and on `error`
+   * when `error.needsSignIn`.
+   */
+  async start(url = location.href) {
+    if (hasResponse(url)) {
+      return this.handleRedirect(url);
+    }
+    if (__privateGet(this, _session)) {
+      return { status: "signed-in", returnTo: void 0 };
+    }
+    await this.signIn({ prompt: "none" });
+    return { status: "redirecting" };
+  }
+  /** Send the browser to Canopy's sign-in. */
+  async signIn(signIn = {}) {
+    const discovery = await __privateMethod(this, _CanopyBrowserClient_instances, discover_fn).call(this);
+    const { verifier, challenge } = await createPkcePair();
+    const state = randomString();
+    const nonce = randomString();
+    const pending = { verifier, nonce };
+    if (signIn.returnTo !== void 0) {
+      pending.returnTo = signIn.returnTo;
+    }
+    __privateGet(this, _storage).setItem(__privateMethod(this, _CanopyBrowserClient_instances, pendingKey_fn).call(this, state), JSON.stringify(pending));
+    const authorize = new URL(discovery.authorization_endpoint);
+    authorize.search = new URLSearchParams({
+      response_type: "code",
+      client_id: __privateGet(this, _clientId),
+      redirect_uri: __privateGet(this, _redirectUri),
+      scope: __privateGet(this, _scopes).join(" "),
+      state,
+      nonce,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      ...signIn.prompt ? { prompt: signIn.prompt } : {},
+      ...signIn.organization ? { organization: signIn.organization } : {},
+      ...signIn.loginHint ? { login_hint: signIn.loginHint } : {}
+    }).toString();
+    __privateGet(this, _navigate).call(this, authorize.toString());
+  }
+  /**
+   * Finish the sign-in Canopy just sent the browser back from: check `state`
+   * against this browser's own request, exchange the code with the client id
+   * and the PKCE verifier, and take the response parameters out of the URL.
+   */
+  async handleRedirect(url = location.href) {
+    const current = new URL(url);
+    const params = current.searchParams;
+    const state = params.get("state");
+    if (!hasResponse(url)) {
+      return { status: "signed-out" };
+    }
+    __privateGet(this, _replaceUrl).call(this, withoutResponse(current));
+    const pending = state ? __privateMethod(this, _CanopyBrowserClient_instances, takePending_fn).call(this, state) : void 0;
+    if (!pending) {
+      return {
+        status: "error",
+        error: new CanopyAuthError(
+          "state_mismatch",
+          "The response does not answer a sign-in this browser started."
+        ),
+        returnTo: void 0
+      };
+    }
+    const error = params.get("error");
+    if (error) {
+      return {
+        status: "error",
+        error: new CanopyAuthError(
+          error,
+          params.get("error_description") ?? void 0
+        ),
+        returnTo: pending.returnTo
+      };
+    }
+    try {
+      const tokens = await __privateMethod(this, _CanopyBrowserClient_instances, token_fn).call(this, {
+        grant_type: "authorization_code",
+        code: params.get("code") ?? "",
+        redirect_uri: __privateGet(this, _redirectUri),
+        code_verifier: pending.verifier
+      });
+      __privateMethod(this, _CanopyBrowserClient_instances, keep_fn).call(this, tokens, pending.nonce);
+      return { status: "signed-in", returnTo: pending.returnTo };
+    } catch (caught) {
+      if (caught instanceof CanopyAuthError) {
+        return { status: "error", error: caught, returnTo: pending.returnTo };
+      }
+      throw caught;
+    }
+  }
+  /** Whether tokens are in memory. */
+  isSignedIn() {
+    return __privateGet(this, _session) !== void 0;
+  }
+  /**
+   * A current access token for `Authorization: Bearer`, refreshed first when
+   * it is about to expire. `null` when nobody is signed in, or the session has
+   * ended (its lifetime ran out or it was revoked).
+   */
+  async getAccessToken() {
+    if (!__privateGet(this, _session)) {
+      return null;
+    }
+    if (__privateGet(this, _session).expiresAt - __privateGet(this, _leewayMs) <= __privateGet(this, _now).call(this)) {
+      try {
+        await this.refresh();
+      } catch (caught) {
+        if (caught instanceof CanopyAuthError) {
+          return null;
+        }
+        throw caught;
+      }
+    }
+    return __privateGet(this, _session)?.accessToken ?? null;
+  }
+  /**
+   * Trade the refresh token for new tokens now. Concurrent calls share one
+   * request, so the rotated token is never presented twice from this page.
+   * A refused refresh ends the session in memory and calls `onSessionEnd`.
+   */
+  refresh() {
+    __privateGet(this, _refreshing) ?? __privateSet(this, _refreshing, __privateMethod(this, _CanopyBrowserClient_instances, refresh_fn).call(this).finally(() => {
+      __privateSet(this, _refreshing, void 0);
+    }));
+    return __privateGet(this, _refreshing);
+  }
+  /** The signed-in person's ID token claims, or `null`. */
+  getClaims() {
+    return __privateGet(this, _session)?.claims ?? null;
+  }
+  /**
+   * Sign out of the app and of Canopy: revoke the refresh token, forget the
+   * tokens, then send the browser to Canopy's end-session endpoint with the
+   * ID token as the hint. Skipping the second half would let the next
+   * `start()` sign the person straight back in.
+   */
+  async signOut() {
+    const session = __privateGet(this, _session);
+    const discovery = await __privateMethod(this, _CanopyBrowserClient_instances, discover_fn).call(this);
+    __privateSet(this, _session, void 0);
+    if (session?.refreshToken && discovery.revocation_endpoint) {
+      try {
+        await __privateMethod(this, _CanopyBrowserClient_instances, post_fn).call(this, discovery.revocation_endpoint, {
+          token: session.refreshToken,
+          token_type_hint: "refresh_token"
+        });
+      } catch {
+      }
+    }
+    if (!discovery.end_session_endpoint) {
+      return;
+    }
+    const endSession = new URL(discovery.end_session_endpoint);
+    const query = new URLSearchParams({ client_id: __privateGet(this, _clientId) });
+    if (session) {
+      query.set("id_token_hint", session.idToken);
+    }
+    if (__privateGet(this, _postLogoutRedirectUri)) {
+      query.set("post_logout_redirect_uri", __privateGet(this, _postLogoutRedirectUri));
+    }
+    endSession.search = query.toString();
+    __privateGet(this, _navigate).call(this, endSession.toString());
+  }
+};
+_issuer = new WeakMap();
+_clientId = new WeakMap();
+_redirectUri = new WeakMap();
+_scopes = new WeakMap();
+_postLogoutRedirectUri = new WeakMap();
+_leewayMs = new WeakMap();
+_onSessionEnd = new WeakMap();
+_storage = new WeakMap();
+_navigate = new WeakMap();
+_replaceUrl = new WeakMap();
+_fetch = new WeakMap();
+_now = new WeakMap();
+_discovery = new WeakMap();
+_session = new WeakMap();
+_refreshing = new WeakMap();
+_CanopyBrowserClient_instances = new WeakSet();
+refresh_fn = async function() {
+  var _a;
+  const session = __privateGet(this, _session);
+  if (!session?.refreshToken) {
+    throw new CanopyAuthError(
+      "invalid_grant",
+      "There is no refresh token to use."
+    );
+  }
+  try {
+    const tokens = await __privateMethod(this, _CanopyBrowserClient_instances, token_fn).call(this, {
+      grant_type: "refresh_token",
+      refresh_token: session.refreshToken
+    });
+    __privateMethod(this, _CanopyBrowserClient_instances, keep_fn).call(this, tokens, void 0, session);
+  } catch (caught) {
+    if (caught instanceof CanopyAuthError) {
+      __privateSet(this, _session, void 0);
+      (_a = __privateGet(this, _onSessionEnd)) == null ? void 0 : _a.call(this, caught);
+    }
+    throw caught;
+  }
+};
+keep_fn = function(tokens, nonce, previous) {
+  const idToken = tokens.id_token ?? previous?.idToken;
+  if (!idToken) {
+    throw new CanopyAuthError(
+      "invalid_token",
+      "The token response carried no ID token. Ask for the openid scope."
+    );
+  }
+  const claims = tokens.id_token ? checkIdToken(
+    tokens.id_token,
+    { issuer: __privateGet(this, _issuer), clientId: __privateGet(this, _clientId), nonce },
+    Math.floor(__privateGet(this, _now).call(this) / 1e3)
+  ) : previous.claims;
+  __privateSet(this, _session, {
+    accessToken: tokens.access_token,
+    expiresAt: __privateGet(this, _now).call(this) + (tokens.expires_in ?? 0) * 1e3,
+    refreshToken: tokens.refresh_token ?? previous?.refreshToken,
+    idToken,
+    claims
+  });
+};
+token_fn = async function(body) {
+  const discovery = await __privateMethod(this, _CanopyBrowserClient_instances, discover_fn).call(this);
+  return await __privateMethod(this, _CanopyBrowserClient_instances, post_fn).call(this, discovery.token_endpoint, body);
+};
+post_fn = async function(url, body) {
+  let response;
+  try {
+    response = await __privateGet(this, _fetch).call(this, url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ ...body, client_id: __privateGet(this, _clientId) })
+    });
+  } catch (caught) {
+    throw new CanopyConnectionError(url, caught);
+  }
+  const text = await response.text();
+  const parsed = text ? JSON.parse(text) : {};
+  if (!response.ok) {
+    const failure = parsed;
+    throw new CanopyAuthError(
+      failure.error ?? "server_error",
+      failure.error_description,
+      response.status
+    );
+  }
+  return parsed;
+};
+discover_fn = function() {
+  __privateGet(this, _discovery) ?? __privateSet(this, _discovery, __privateMethod(this, _CanopyBrowserClient_instances, readDiscovery_fn).call(this).catch((caught) => {
+    __privateSet(this, _discovery, void 0);
+    throw caught;
+  }));
+  return __privateGet(this, _discovery);
+};
+readDiscovery_fn = async function() {
+  const url = `${__privateGet(this, _issuer)}/.well-known/openid-configuration`;
+  let response;
+  try {
+    response = await __privateGet(this, _fetch).call(this, url);
+  } catch (caught) {
+    throw new CanopyConnectionError(url, caught);
+  }
+  if (!response.ok) {
+    throw new CanopyAuthError(
+      "invalid_issuer",
+      `${url} answered ${response.status}. Check the issuer.`,
+      response.status
+    );
+  }
+  const discovery = await response.json();
+  if (discovery.issuer !== __privateGet(this, _issuer)) {
+    throw new CanopyAuthError(
+      "invalid_issuer",
+      `The discovery document names ${discovery.issuer}, not ${__privateGet(this, _issuer)}.`
+    );
+  }
+  return discovery;
+};
+pendingKey_fn = function(state) {
+  return `canopy.browser.${__privateGet(this, _clientId)}.${state}`;
+};
+takePending_fn = function(state) {
+  const key = __privateMethod(this, _CanopyBrowserClient_instances, pendingKey_fn).call(this, state);
+  const raw = __privateGet(this, _storage).getItem(key);
+  __privateGet(this, _storage).removeItem(key);
+  return raw ? JSON.parse(raw) : void 0;
+};
+function withoutTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+function hasResponse(url) {
+  const params = new URL(url).searchParams;
+  return params.has("state") && (params.has("code") || params.has("error"));
+}
+function withoutResponse(url) {
+  const clean = new URL(url.toString());
+  for (const name of RESPONSE_PARAMS) {
+    clean.searchParams.delete(name);
+  }
+  return clean.toString();
+}
+
+exports.CanopyAuthError = CanopyAuthError;
+exports.CanopyBrowserClient = CanopyBrowserClient;
+exports.CanopyConnectionError = CanopyConnectionError;
+exports.createCanopyBrowserClient = createCanopyBrowserClient;
+exports.isCanopyAuthError = isCanopyAuthError;
+exports.isCanopyConnectionError = isCanopyConnectionError;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map