@chaindaddy/js 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,410 @@
+// src/core.ts
+var VERSION = true ? "0.2.0" : "0.0.0";
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function listen(type, origin, onMessage, channel) {
+  const accept = (data) => {
+    if (data && typeof data === "object" && data.type === type) {
+      try {
+        onMessage(data);
+      } catch {
+      }
+    }
+  };
+  const onWindow = (e) => {
+    if (e.origin === origin) accept(e.data);
+  };
+  window.addEventListener("message", onWindow);
+  let bc = null;
+  if (channel && typeof BroadcastChannel === "function" && origin === location.origin) {
+    try {
+      bc = new BroadcastChannel(channel);
+      bc.onmessage = (e) => accept(e.data);
+    } catch {
+      bc = null;
+    }
+  }
+  return () => {
+    window.removeEventListener("message", onWindow);
+    bc?.close();
+  };
+}
+var store = {
+  get(key) {
+    try {
+      return sessionStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    try {
+      sessionStorage.setItem(key, value);
+    } catch {
+    }
+  },
+  remove(key) {
+    try {
+      sessionStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+
+// src/signin.ts
+var DEFAULT_ISSUER = "https://api.chaindaddy.io";
+var AUTHORIZE = {
+  "https://api.chaindaddy.io": "https://chaindaddy.io/_oauth/authorize",
+  "https://staging-api.chaindaddy.io": "https://staging.chaindaddy.io/_oauth/authorize"
+};
+var POPUP_NAME = "cd-signin";
+var MESSAGE = "cd:signin";
+var STORAGE_KEY = "cd.signin";
+async function challengeFor(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return b64url(new Uint8Array(digest));
+}
+function withOpenID(scope = "openid") {
+  const parts = scope.split(/\s+/).filter(Boolean);
+  return (parts.includes("openid") ? parts : ["openid", ...parts]).join(" ");
+}
+async function authorizeURL(o, p, authorize) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: p.clientId,
+    redirect_uri: p.redirectUri,
+    scope: withOpenID(o.scope),
+    state: p.state,
+    nonce: p.nonce,
+    code_challenge: await challengeFor(p.verifier),
+    code_challenge_method: "S256"
+  });
+  if (o.claims) q.set("claims", typeof o.claims === "string" ? o.claims : JSON.stringify(o.claims));
+  return `${authorize}?${q}`;
+}
+function result(p, code) {
+  return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
+}
+function signIn(o) {
+  const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
+  const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
+  if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
+  if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
+  store.set(STORAGE_KEY, JSON.stringify(p));
+  const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
+  return (async () => {
+    const url = await authorizeURL(o, p, authorize);
+    if (!popup) {
+      location.assign(url);
+      return null;
+    }
+    popup.location.href = url;
+    const callbackOrigin = new URL(o.redirectUri, location.href).origin;
+    return new Promise((resolve, reject) => {
+      const stop = listen(MESSAGE, callbackOrigin, (m) => {
+        if (m.state !== p.state) return;
+        stop();
+        store.remove(STORAGE_KEY);
+        if (typeof m.error === "string" && m.error) reject(new Error(m.error));
+        else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
+        else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
+        else resolve(result(p, m.code));
+      }, POPUP_NAME);
+      o.signal?.addEventListener("abort", () => {
+        stop();
+        reject(new Error("aborted"));
+      });
+    });
+  })();
+}
+async function handleCallback() {
+  const q = new URLSearchParams(location.search);
+  const message = { type: MESSAGE, code: q.get("code"), state: q.get("state"), iss: q.get("iss"), error: q.get("error") };
+  if (window.name === POPUP_NAME) {
+    try {
+      window.opener?.postMessage(message, location.origin);
+    } catch {
+    }
+    try {
+      const bc = new BroadcastChannel(POPUP_NAME);
+      bc.postMessage(message);
+      bc.close();
+    } catch {
+    }
+    window.close();
+    return null;
+  }
+  const raw = store.get(STORAGE_KEY);
+  store.remove(STORAGE_KEY);
+  const p = raw ? JSON.parse(raw) : null;
+  if (!p || message.state !== p.state) throw new Error("the sign-in state does not match: start again");
+  if (message.error) throw new Error(message.error);
+  if (message.iss !== p.issuer) throw new Error("the answer came from another issuer");
+  if (!message.code) throw new Error("the answer carried no code");
+  return result(p, message.code);
+}
+async function exchangeCode(r) {
+  const res = await fetch(`${r.issuer}/api/v2/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ grant_type: "authorization_code", code: r.code, redirect_uri: r.redirectUri, client_id: r.clientId, code_verifier: r.codeVerifier })
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(`${body.error ?? res.status}: ${body.error_description ?? ""}`.trim());
+  return body;
+}
+
+// src/button.ts
+var CROWN = `<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>`;
+var STYLE = `
+:host { display: inline-block; }
+button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
+  min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
+  cursor: pointer; border: 1px solid #d0d5dd; background: #ffffff; color: #101828; }
+button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #101828; }
+button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
+button:disabled { opacity: .6; cursor: default; }
+svg { flex: none; }
+`;
+function defineSignInButton() {
+  if (typeof customElements === "undefined" || customElements.get("cd-signin-button")) return;
+  class CdSigninButton extends HTMLElement {
+    constructor() {
+      super();
+      this.root = this.attachShadow({ mode: "open" });
+    }
+    connectedCallback() {
+      this.render();
+    }
+    attributeChangedCallback() {
+      if (this.isConnected) this.render();
+    }
+    render() {
+      const label = this.getAttribute("text") === "continue" ? "Continue with Chain Daddy" : "Sign in with Chain Daddy";
+      const theme = this.getAttribute("theme") === "dark" ? "dark" : "light";
+      this.root.innerHTML = `<style>${STYLE}</style><button type="button" part="button" data-theme="${theme}">${CROWN}<span></span></button>`;
+      const button = this.root.querySelector("button");
+      button.querySelector("span").textContent = label;
+      button.addEventListener("click", () => this.start());
+    }
+    start() {
+      const attr = (n) => this.getAttribute(n) || void 0;
+      signIn({
+        clientId: attr("client-id") ?? "",
+        redirectUri: attr("redirect-uri") ?? "",
+        scope: attr("scope"),
+        claims: attr("claims"),
+        issuer: attr("issuer"),
+        authorizeUrl: attr("authorize-url")
+      }).then(
+        (r) => r && this.dispatchEvent(new CustomEvent("cd-signin", { detail: r, bubbles: true, composed: true })),
+        (e) => this.dispatchEvent(new CustomEvent("cd-signin-error", { detail: { message: String(e?.message ?? e) }, bubbles: true, composed: true }))
+      );
+    }
+  }
+  CdSigninButton.observedAttributes = ["theme", "text"];
+  customElements.define("cd-signin-button", CdSigninButton);
+}
+
+// src/embed.ts
+var PROD_ORIGIN = "https://embed.chaindaddy.io";
+var STAGING_ORIGIN = "https://embed-staging.chaindaddy.io";
+var READY_TIMEOUT_MS = 8e3;
+var MAX_HEIGHT = 4e3;
+var THEME_TOKENS = ["--cd-accent", "--cd-surface", "--cd-text", "--cd-text-muted", "--cd-border"];
+function embedOriginFor(scriptSrc) {
+  try {
+    if (scriptSrc && new URL(scriptSrc).hostname === "js.staging.chaindaddy.io") return STAGING_ORIGIN;
+  } catch {
+  }
+  return PROD_ORIGIN;
+}
+var STYLE2 = `
+:host { display: block; }
+iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
+:host([data-cd-ready]) iframe { opacity: 1; }
+:host([data-cd-ready]) slot { display: none; }
+:host([data-cd-unavailable]) iframe { display: none; }
+`;
+var BUY_STYLE = `
+:host { display: inline-block; }
+button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
+  font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
+  border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
+button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
+`;
+function defineEmbedElements(options = {}) {
+  try {
+    if (typeof customElements === "undefined" || typeof HTMLElement === "undefined") return;
+    const origin = options.origin === STAGING_ORIGIN ? STAGING_ORIGIN : PROD_ORIGIN;
+    class CdFrame extends HTMLElement {
+      constructor() {
+        super(...arguments);
+        this.kind = "app";
+        this.frame = null;
+        this.onMessage = (event) => this.receive(event);
+      }
+      connectedCallback() {
+        try {
+          if (!this.shadowRoot) this.attachShadow({ mode: "open" });
+          this.mount();
+        } catch {
+          this.unavailable();
+        }
+      }
+      disconnectedCallback() {
+        try {
+          window.removeEventListener("message", this.onMessage);
+          clearTimeout(this.timer);
+        } catch {
+        }
+      }
+      attributeChangedCallback() {
+        try {
+          if (this.isConnected && this.shadowRoot) this.mount();
+        } catch {
+          this.unavailable();
+        }
+      }
+      /** The frame's address, or null when the element does not name enough. */
+      src() {
+        const crown = (this.getAttribute("crown") ?? "").trim();
+        const chain = (this.getAttribute("chain") ?? "").trim();
+        const app = (this.getAttribute("app") ?? "").trim();
+        if (!/^[0-9]{1,18}$/.test(crown) || !chain || this.kind === "app" && !app) return null;
+        const q = new URLSearchParams({ crown, chain });
+        if (this.kind === "app") q.set("app", app);
+        else q.set("kind", "coin");
+        q.set("mode", this.mode());
+        q.set("v", "1");
+        return `${origin}/v1/frame?${q.toString()}`;
+      }
+      mode() {
+        const attr = this.getAttribute("mode");
+        if (attr === "light" || attr === "dark") return attr;
+        try {
+          return window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+        } catch {
+          return "light";
+        }
+      }
+      mount() {
+        const root = this.shadowRoot;
+        window.removeEventListener("message", this.onMessage);
+        clearTimeout(this.timer);
+        this.removeAttribute("data-cd-ready");
+        this.removeAttribute("data-cd-unavailable");
+        const src = this.src();
+        if (!src) {
+          root.innerHTML = "<slot></slot>";
+          this.frame = null;
+          return;
+        }
+        root.innerHTML = `<style>${STYLE2}</style><slot></slot>`;
+        const frame = document.createElement("iframe");
+        frame.setAttribute("loading", "lazy");
+        frame.setAttribute("referrerpolicy", "strict-origin-when-cross-origin");
+        frame.setAttribute("allow", "clipboard-write; fullscreen");
+        frame.setAttribute("title", this.kind === "coin" ? "Coin on Chain Daddy" : "App on Chain Daddy");
+        frame.src = src;
+        root.appendChild(frame);
+        this.frame = frame;
+        window.addEventListener("message", this.onMessage);
+        this.timer = setTimeout(() => {
+          if (!this.hasAttribute("data-cd-ready")) this.unavailable();
+        }, READY_TIMEOUT_MS);
+      }
+      receive(event) {
+        try {
+          if (event.origin !== origin || !this.frame || !event.source || event.source !== this.frame.contentWindow) return;
+          const data = event.data;
+          if (!data || typeof data !== "object") return;
+          if (data.type === "cd:ready") {
+            clearTimeout(this.timer);
+            this.removeAttribute("data-cd-unavailable");
+            this.setAttribute("data-cd-ready", "");
+            this.sendTheme();
+            this.dispatchEvent(new CustomEvent("cd:ready"));
+          } else if (data.type === "cd:resize") {
+            const h = Number(data.height);
+            if (Number.isFinite(h)) this.frame.style.height = `${Math.max(1, Math.min(MAX_HEIGHT, Math.ceil(h)))}px`;
+          } else if (data.type === "cd:unavailable") {
+            this.unavailable();
+          }
+        } catch {
+        }
+      }
+      /** The page's --cd-* colours, for an app that takes them. */
+      sendTheme() {
+        const tokens = {};
+        const style = getComputedStyle(this);
+        for (const token of THEME_TOKENS) {
+          const value = style.getPropertyValue(token).trim();
+          if (value) tokens[token] = value;
+        }
+        this.frame?.contentWindow?.postMessage({ type: "cd:theme", tokens }, origin);
+      }
+      unavailable() {
+        try {
+          clearTimeout(this.timer);
+          this.removeAttribute("data-cd-ready");
+          if (this.hasAttribute("data-cd-unavailable")) return;
+          this.setAttribute("data-cd-unavailable", "");
+          this.dispatchEvent(new CustomEvent("cd:unavailable"));
+        } catch {
+        }
+      }
+    }
+    CdFrame.observedAttributes = ["crown", "chain", "app", "mode"];
+    class CdApp extends CdFrame {
+    }
+    class CdCoin extends CdFrame {
+      constructor() {
+        super(...arguments);
+        this.kind = "coin";
+      }
+    }
+    class CdBuy extends HTMLElement {
+      connectedCallback() {
+        try {
+          const link = this.querySelector("a[href]");
+          const href = link ? new URL(link.getAttribute("href") ?? "", document.baseURI) : null;
+          if (!href || href.protocol !== "https:") return;
+          const root = this.shadowRoot ?? this.attachShadow({ mode: "open" });
+          root.innerHTML = `<style>${BUY_STYLE}</style><button type="button" part="button"></button>`;
+          const button = root.querySelector("button");
+          button.textContent = (link.textContent ?? "").trim() || "Buy on Chain Daddy";
+          button.addEventListener("click", () => {
+            try {
+              if (!window.open(href.toString(), "cd-buy", "popup,width=460,height=760")) window.location.assign(href.toString());
+            } catch {
+            }
+          });
+        } catch {
+        }
+      }
+    }
+    for (const [name, ctor] of [["cd-app", CdApp], ["cd-coin", CdCoin], ["cd-buy", CdBuy]]) {
+      if (!customElements.get(name)) customElements.define(name, ctor);
+    }
+  } catch {
+  }
+}
+export {
+  DEFAULT_ISSUER,
+  VERSION,
+  challengeFor,
+  defineEmbedElements,
+  defineSignInButton,
+  embedOriginFor,
+  exchangeCode,
+  handleCallback,
+  signIn
+};

package/dist/signin.d.ts

@@ -0,0 +1,57 @@
+export declare const DEFAULT_ISSUER = "https://api.chaindaddy.io";
+export interface SignInOptions {
+    /** Your client id: the URL of your client.json, or a registered cdc_ id. */
+    clientId: string;
+    /** Your callback page, exactly as your client lists it. It must be on this page's origin. */
+    redirectUri: string;
+    /** Space-separated scopes; openid is added when missing. Default "openid". */
+    scope?: string;
+    /** The OIDC `claims` request (holdings of your coin, crowns): an object or its JSON. */
+    claims?: object | string;
+    /** Default https://api.chaindaddy.io. */
+    issuer?: string;
+    /** The consent page; derived from the issuer for Chain Daddy's own. */
+    authorizeUrl?: string;
+    /** Stops waiting. Closing the popup does not: a closed-looking popup is not a cancel. */
+    signal?: AbortSignal;
+}
+/** What your server exchanges at the token endpoint (or exchangeCode does here). */
+export interface SignInResult {
+    code: string;
+    codeVerifier: string;
+    state: string;
+    nonce: string;
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+}
+/** RFC 7636 S256: base64url(SHA-256(verifier)). */
+export declare function challengeFor(verifier: string): Promise<string>;
+/**
+ * Starts a sign-in. Call it from a click handler: the popup opens at once,
+ * before anything is awaited, or a browser blocks it. Resolves with the code
+ * once the visitor approves; resolves null when the popup was blocked and the
+ * page is redirecting instead (your callback page then calls handleCallback).
+ * Rejects when they cancel (access_denied) or the answer is not for this
+ * request.
+ */
+export declare function signIn(o: SignInOptions): Promise<SignInResult | null>;
+/**
+ * Runs on your callback page. In the sign-in popup it hands the answer to the
+ * page that opened it (by postMessage to this origin, and by a same-origin
+ * BroadcastChannel in case the opener link was cut), closes, and resolves
+ * null. After a full-page redirect it checks the answer against the request
+ * this tab stored and resolves with the code, or rejects.
+ */
+export declare function handleCallback(): Promise<SignInResult | null>;
+/**
+ * Redeems the code at the token endpoint from the browser (a public client:
+ * no secret). Send the id_token to your server and verify it there; do not
+ * trust it here.
+ */
+export declare function exchangeCode(r: SignInResult): Promise<{
+    id_token: string;
+    access_token: string;
+    expires_in: number;
+    scope: string;
+}>;

package/dist/signin.js

@@ -0,0 +1,168 @@
+// src/core.ts
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+function listen(type, origin, onMessage, channel) {
+  const accept = (data) => {
+    if (data && typeof data === "object" && data.type === type) {
+      try {
+        onMessage(data);
+      } catch {
+      }
+    }
+  };
+  const onWindow = (e) => {
+    if (e.origin === origin) accept(e.data);
+  };
+  window.addEventListener("message", onWindow);
+  let bc = null;
+  if (channel && typeof BroadcastChannel === "function" && origin === location.origin) {
+    try {
+      bc = new BroadcastChannel(channel);
+      bc.onmessage = (e) => accept(e.data);
+    } catch {
+      bc = null;
+    }
+  }
+  return () => {
+    window.removeEventListener("message", onWindow);
+    bc?.close();
+  };
+}
+var store = {
+  get(key) {
+    try {
+      return sessionStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    try {
+      sessionStorage.setItem(key, value);
+    } catch {
+    }
+  },
+  remove(key) {
+    try {
+      sessionStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+
+// src/signin.ts
+var DEFAULT_ISSUER = "https://api.chaindaddy.io";
+var AUTHORIZE = {
+  "https://api.chaindaddy.io": "https://chaindaddy.io/_oauth/authorize",
+  "https://staging-api.chaindaddy.io": "https://staging.chaindaddy.io/_oauth/authorize"
+};
+var POPUP_NAME = "cd-signin";
+var MESSAGE = "cd:signin";
+var STORAGE_KEY = "cd.signin";
+async function challengeFor(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return b64url(new Uint8Array(digest));
+}
+function withOpenID(scope = "openid") {
+  const parts = scope.split(/\s+/).filter(Boolean);
+  return (parts.includes("openid") ? parts : ["openid", ...parts]).join(" ");
+}
+async function authorizeURL(o, p, authorize) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: p.clientId,
+    redirect_uri: p.redirectUri,
+    scope: withOpenID(o.scope),
+    state: p.state,
+    nonce: p.nonce,
+    code_challenge: await challengeFor(p.verifier),
+    code_challenge_method: "S256"
+  });
+  if (o.claims) q.set("claims", typeof o.claims === "string" ? o.claims : JSON.stringify(o.claims));
+  return `${authorize}?${q}`;
+}
+function result(p, code) {
+  return { code, codeVerifier: p.verifier, state: p.state, nonce: p.nonce, issuer: p.issuer, clientId: p.clientId, redirectUri: p.redirectUri };
+}
+function signIn(o) {
+  const issuer = (o.issuer ?? DEFAULT_ISSUER).replace(/\/$/, "");
+  const authorize = o.authorizeUrl ?? AUTHORIZE[issuer];
+  if (!authorize) return Promise.reject(new Error("authorizeUrl is required for this issuer"));
+  if (!o.clientId || !o.redirectUri) return Promise.reject(new Error("clientId and redirectUri are required"));
+  const p = { state: randomToken(), nonce: randomToken(), verifier: randomToken(), issuer, clientId: o.clientId, redirectUri: o.redirectUri };
+  store.set(STORAGE_KEY, JSON.stringify(p));
+  const popup = window.open("", POPUP_NAME, "popup,width=480,height=720");
+  return (async () => {
+    const url = await authorizeURL(o, p, authorize);
+    if (!popup) {
+      location.assign(url);
+      return null;
+    }
+    popup.location.href = url;
+    const callbackOrigin = new URL(o.redirectUri, location.href).origin;
+    return new Promise((resolve, reject) => {
+      const stop = listen(MESSAGE, callbackOrigin, (m) => {
+        if (m.state !== p.state) return;
+        stop();
+        store.remove(STORAGE_KEY);
+        if (typeof m.error === "string" && m.error) reject(new Error(m.error));
+        else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
+        else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
+        else resolve(result(p, m.code));
+      }, POPUP_NAME);
+      o.signal?.addEventListener("abort", () => {
+        stop();
+        reject(new Error("aborted"));
+      });
+    });
+  })();
+}
+async function handleCallback() {
+  const q = new URLSearchParams(location.search);
+  const message = { type: MESSAGE, code: q.get("code"), state: q.get("state"), iss: q.get("iss"), error: q.get("error") };
+  if (window.name === POPUP_NAME) {
+    try {
+      window.opener?.postMessage(message, location.origin);
+    } catch {
+    }
+    try {
+      const bc = new BroadcastChannel(POPUP_NAME);
+      bc.postMessage(message);
+      bc.close();
+    } catch {
+    }
+    window.close();
+    return null;
+  }
+  const raw = store.get(STORAGE_KEY);
+  store.remove(STORAGE_KEY);
+  const p = raw ? JSON.parse(raw) : null;
+  if (!p || message.state !== p.state) throw new Error("the sign-in state does not match: start again");
+  if (message.error) throw new Error(message.error);
+  if (message.iss !== p.issuer) throw new Error("the answer came from another issuer");
+  if (!message.code) throw new Error("the answer carried no code");
+  return result(p, message.code);
+}
+async function exchangeCode(r) {
+  const res = await fetch(`${r.issuer}/api/v2/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ grant_type: "authorization_code", code: r.code, redirect_uri: r.redirectUri, client_id: r.clientId, code_verifier: r.codeVerifier })
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(`${body.error ?? res.status}: ${body.error_description ?? ""}`.trim());
+  return body;
+}
+export {
+  DEFAULT_ISSUER,
+  challengeFor,
+  exchangeCode,
+  handleCallback,
+  signIn
+};