@ghostly-solutions/auth 0.1.0 → 0.2.1

package/dist/extension.js

@@ -0,0 +1,502 @@
+// src/constants/auth-endpoints.ts
+var authApiPrefix = "/oauth";
+var authEndpoints = {
+  authorize: `${authApiPrefix}/authorize`,
+  session: `${authApiPrefix}/session`,
+  refresh: `${authApiPrefix}/refresh`,
+  logout: `${authApiPrefix}/logout`
+};
+
+// src/errors/auth-sdk-error.ts
+var AuthSdkError = class extends Error {
+  code;
+  details;
+  status;
+  constructor(payload) {
+    super(payload.message);
+    this.name = "AuthSdkError";
+    this.code = payload.code;
+    this.details = payload.details;
+    this.status = payload.status;
+  }
+};
+
+// src/types/auth-error-code.ts
+var authErrorCode = {
+  unauthorized: "unauthorized",
+  networkError: "network_error",
+  apiError: "api_error",
+  broadcastChannelUnsupported: "broadcast_channel_unsupported"};
+
+// src/core/api-origin.ts
+var slash = "/";
+function normalizeApiOrigin(apiOrigin) {
+  const trimmed = apiOrigin.trim();
+  if (!trimmed) {
+    throw new AuthSdkError({
+      code: authErrorCode.apiError,
+      details: null,
+      message: "Auth API origin must be a non-empty absolute URL.",
+      status: null
+    });
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch (error) {
+    throw new AuthSdkError({
+      code: authErrorCode.apiError,
+      details: error,
+      message: "Auth API origin must be a valid absolute URL.",
+      status: null
+    });
+  }
+  if (parsed.pathname !== slash || parsed.search || parsed.hash) {
+    throw new AuthSdkError({
+      code: authErrorCode.apiError,
+      details: null,
+      message: "Auth API origin must not include path, query, or hash.",
+      status: null
+    });
+  }
+  return parsed.origin;
+}
+function resolveApiEndpoint(path, apiOrigin) {
+  if (!apiOrigin) {
+    return path;
+  }
+  return `${normalizeApiOrigin(apiOrigin)}${path}`;
+}
+
+// src/constants/http-status.ts
+var httpStatus = {
+  ok: 200,
+  noContent: 204,
+  unauthorized: 401
+};
+
+// src/constants/auth-keys.ts
+var authBroadcast = {
+  channelName: "ghostly-auth-channel",
+  sessionUpdatedEvent: "session-updated"
+};
+var authRoutes = {
+  root: "/"
+};
+
+// src/core/object-guards.ts
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function isStringValue(value) {
+  return typeof value === "string";
+}
+
+// src/core/session-parser.ts
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => isStringValue(entry));
+}
+function isGhostlySession(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  return isStringValue(value.id) && isStringValue(value.username) && (value.firstName === null || isStringValue(value.firstName)) && (value.lastName === null || isStringValue(value.lastName)) && isStringValue(value.email) && isStringValue(value.role) && isStringArray(value.permissions);
+}
+
+// src/core/broadcast-sync.ts
+function isSessionUpdatedMessage(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (!isStringValue(value.type)) {
+    return false;
+  }
+  if (value.type !== authBroadcast.sessionUpdatedEvent) {
+    return false;
+  }
+  return value.session === null || isGhostlySession(value.session);
+}
+function createUnsupportedBroadcastChannelError() {
+  return new AuthSdkError({
+    code: authErrorCode.broadcastChannelUnsupported,
+    details: null,
+    message: "BroadcastChannel is unavailable in this runtime.",
+    status: null
+  });
+}
+function createBroadcastSync(options) {
+  if (typeof BroadcastChannel === "undefined") {
+    throw createUnsupportedBroadcastChannelError();
+  }
+  const channel = new BroadcastChannel(authBroadcast.channelName);
+  const onMessage = (event) => {
+    const messageEvent = event;
+    if (!isSessionUpdatedMessage(messageEvent.data)) {
+      return;
+    }
+    options.onSessionUpdated(messageEvent.data.session);
+  };
+  channel.addEventListener("message", onMessage);
+  return {
+    close() {
+      channel.removeEventListener("message", onMessage);
+      channel.close();
+    },
+    publishSession(session) {
+      const payload = {
+        session,
+        type: authBroadcast.sessionUpdatedEvent
+      };
+      channel.postMessage(payload);
+    }
+  };
+}
+
+// src/core/http-client.ts
+var jsonContentType = "application/json";
+var jsonHeaderName = "content-type";
+var includeCredentials = "include";
+var noStoreCache = "no-store";
+function toTypedValue(value) {
+  return value;
+}
+function mapHttpStatusToAuthErrorCode(status) {
+  if (status === httpStatus.unauthorized) {
+    return authErrorCode.unauthorized;
+  }
+  return authErrorCode.apiError;
+}
+async function parseJsonPayload(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function parseErrorPayload(response) {
+  const payload = await parseJsonPayload(response);
+  if (!isObjectRecord(payload)) {
+    return {
+      code: null,
+      details: null,
+      message: null
+    };
+  }
+  const maybeCode = payload.code;
+  const maybeMessage = payload.message;
+  return {
+    code: isStringValue(maybeCode) ? maybeCode : null,
+    details: "details" in payload ? payload.details : null,
+    message: isStringValue(maybeMessage) ? maybeMessage : null
+  };
+}
+function buildApiErrorMessage(method, path) {
+  return `Auth API request failed: ${method} ${path}`;
+}
+function buildNetworkErrorMessage(method, path) {
+  return `Auth API network failure: ${method} ${path}`;
+}
+async function request(options) {
+  const expectedStatus = options.expectedStatus ?? httpStatus.ok;
+  const headers = new Headers();
+  const hasBody = typeof options.body !== "undefined";
+  if (hasBody) {
+    headers.set(jsonHeaderName, jsonContentType);
+  }
+  const requestInit = {
+    cache: noStoreCache,
+    credentials: includeCredentials,
+    headers,
+    method: options.method
+  };
+  if (hasBody) {
+    requestInit.body = JSON.stringify(options.body);
+  }
+  let response;
+  try {
+    response = await fetch(options.path, requestInit);
+  } catch (error) {
+    throw new AuthSdkError({
+      code: authErrorCode.networkError,
+      details: error,
+      message: buildNetworkErrorMessage(options.method, options.path),
+      status: null
+    });
+  }
+  if (response.status !== expectedStatus) {
+    const parsed = await parseErrorPayload(response);
+    throw new AuthSdkError({
+      code: mapHttpStatusToAuthErrorCode(response.status),
+      details: {
+        apiCode: parsed.code,
+        apiDetails: parsed.details
+      },
+      message: parsed.message ?? buildApiErrorMessage(options.method, options.path),
+      status: response.status
+    });
+  }
+  if (response.status === httpStatus.noContent) {
+    return toTypedValue(null);
+  }
+  const payload = await parseJsonPayload(response);
+  return toTypedValue(payload);
+}
+function getJson(path) {
+  return request({
+    method: "GET",
+    path
+  });
+}
+function postJsonWithoutBody(path) {
+  return request({
+    method: "POST",
+    path
+  });
+}
+function postEmpty(path) {
+  return request({
+    expectedStatus: httpStatus.noContent,
+    method: "POST",
+    path
+  });
+}
+
+// src/core/runtime.ts
+var browserRuntimeErrorMessage = "Browser runtime is required for this auth operation.";
+function isBrowserRuntime() {
+  return typeof window !== "undefined";
+}
+function assertBrowserRuntime() {
+  if (isBrowserRuntime()) {
+    return;
+  }
+  throw new AuthSdkError({
+    code: authErrorCode.apiError,
+    details: null,
+    message: browserRuntimeErrorMessage,
+    status: null
+  });
+}
+
+// src/core/return-to-storage.ts
+function sanitizeReturnTo(value) {
+  if (!value) {
+    return authRoutes.root;
+  }
+  if (!value.startsWith(authRoutes.root)) {
+    return authRoutes.root;
+  }
+  const protocolRelativePrefix = "//";
+  if (value.startsWith(protocolRelativePrefix)) {
+    return authRoutes.root;
+  }
+  return value;
+}
+function getCurrentBrowserPath() {
+  return `${window.location.pathname}${window.location.search}${window.location.hash}`;
+}
+function resolveReturnToPath(returnTo) {
+  assertBrowserRuntime();
+  const fallbackPath = getCurrentBrowserPath();
+  return sanitizeReturnTo(returnTo ?? fallbackPath);
+}
+
+// src/core/session-store.ts
+var SessionStore = class {
+  listeners = /* @__PURE__ */ new Set();
+  resolvedSession = null;
+  resolveState = "pending";
+  getSessionIfResolved() {
+    if (this.resolveState === "pending") {
+      return null;
+    }
+    return this.resolvedSession;
+  }
+  hasResolvedSession() {
+    return this.resolveState === "resolved";
+  }
+  setSession(session) {
+    this.resolveState = "resolved";
+    this.resolvedSession = session;
+    for (const listener of this.listeners) {
+      listener(session);
+    }
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+};
+
+// src/core/auth-client.ts
+function createInvalidSessionPayloadError(path) {
+  return new AuthSdkError({
+    code: authErrorCode.apiError,
+    details: null,
+    message: `Auth API response has invalid session shape: ${path}`,
+    status: null
+  });
+}
+function toValidatedSession(payload, path) {
+  if (!isGhostlySession(payload)) {
+    throw createInvalidSessionPayloadError(path);
+  }
+  return payload;
+}
+function toSessionPayload(payload, path) {
+  if (payload === null) {
+    return null;
+  }
+  return toValidatedSession(payload, path);
+}
+function createNoopBroadcastSync() {
+  return {
+    close() {
+    },
+    publishSession() {
+    }
+  };
+}
+function createSafeBroadcastSync(onSessionUpdated) {
+  try {
+    return createBroadcastSync({
+      onSessionUpdated
+    });
+  } catch (error) {
+    if (error instanceof AuthSdkError && error.code === authErrorCode.broadcastChannelUnsupported) {
+      return createNoopBroadcastSync();
+    }
+    throw error;
+  }
+}
+function toInitResult(session) {
+  return {
+    session,
+    status: session ? "authenticated" : "unauthenticated"
+  };
+}
+function createAuthClient(options = {}) {
+  let initPromise = null;
+  const defaultApplication = options.application?.trim() || "";
+  const sessionStore = new SessionStore();
+  const broadcastSync = createSafeBroadcastSync((session) => {
+    sessionStore.setSession(session);
+  });
+  const resolveEndpoint = (path) => resolveApiEndpoint(path, options.apiOrigin);
+  const loadSession = async () => {
+    const payload = await getJson(resolveEndpoint(authEndpoints.session));
+    return toSessionPayload(payload, authEndpoints.session);
+  };
+  const init = async (initOptions) => {
+    const forceRefresh = initOptions?.forceRefresh ?? false;
+    if (sessionStore.hasResolvedSession() && !forceRefresh) {
+      return toInitResult(sessionStore.getSessionIfResolved());
+    }
+    if (initPromise) {
+      return initPromise;
+    }
+    initPromise = (async () => {
+      const session = await loadSession();
+      sessionStore.setSession(session);
+      broadcastSync.publishSession(session);
+      return toInitResult(session);
+    })();
+    try {
+      return await initPromise;
+    } finally {
+      initPromise = null;
+    }
+  };
+  const getSession = async (requestOptions) => {
+    const result = await init({
+      forceRefresh: requestOptions?.forceRefresh ?? false
+    });
+    return result.session;
+  };
+  const refresh = async () => {
+    const payload = await postJsonWithoutBody(resolveEndpoint(authEndpoints.refresh));
+    const session = toSessionPayload(payload, authEndpoints.refresh);
+    sessionStore.setSession(session);
+    broadcastSync.publishSession(session);
+    return session;
+  };
+  const requireSession = async () => {
+    const session = await getSession();
+    if (session) {
+      return session;
+    }
+    throw new AuthSdkError({
+      code: authErrorCode.unauthorized,
+      details: null,
+      message: "Authenticated session is required.",
+      status: httpStatus.unauthorized
+    });
+  };
+  const login = (loginOptions) => {
+    const returnTo = resolveReturnToPath(loginOptions?.returnTo);
+    const authorizeUrl = new URL(resolveEndpoint(authEndpoints.authorize), window.location.origin);
+    authorizeUrl.searchParams.set("return_to", returnTo);
+    const application = loginOptions?.application?.trim() || defaultApplication;
+    if (application) {
+      authorizeUrl.searchParams.set("app", application);
+    }
+    window.location.assign(authorizeUrl.toString());
+  };
+  const logout = async () => {
+    await postEmpty(resolveEndpoint(authEndpoints.logout));
+    sessionStore.setSession(null);
+    broadcastSync.publishSession(null);
+  };
+  const subscribe = sessionStore.subscribe.bind(sessionStore);
+  return {
+    init,
+    getSession,
+    login,
+    logout,
+    refresh,
+    requireSession,
+    subscribe
+  };
+}
+
+// src/adapters/extension/auth-client.ts
+function buildAuthorizeUrl(apiOrigin, returnTo, application) {
+  const authorizeEndpoint = resolveApiEndpoint(authEndpoints.authorize, apiOrigin);
+  const authorizeUrl = new URL(authorizeEndpoint, window.location.origin);
+  authorizeUrl.searchParams.set("return_to", returnTo);
+  if (application?.trim()) {
+    authorizeUrl.searchParams.set("app", application.trim());
+  }
+  return authorizeUrl.toString();
+}
+function createExtensionAuthClient(options) {
+  const baseClient = createAuthClient({
+    apiOrigin: options.apiOrigin,
+    application: options.application
+  });
+  const loginWithWebAuthFlow = async (loginOptions) => {
+    const returnTo = resolveReturnToPath(loginOptions?.returnTo);
+    const authorizeUrl = buildAuthorizeUrl(
+      options.apiOrigin,
+      returnTo,
+      loginOptions?.application ?? options.application
+    );
+    await options.launchWebAuthFlow({
+      authorizeUrl
+    });
+    await baseClient.refresh();
+  };
+  return {
+    ...baseClient,
+    login(loginOptions) {
+      void loginWithWebAuthFlow(loginOptions);
+    },
+    loginWithWebAuthFlow
+  };
+}
+
+export { createExtensionAuthClient };
+//# sourceMappingURL=extension.js.map
+//# sourceMappingURL=extension.js.map

package/dist/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants/auth-endpoints.ts","../src/errors/auth-sdk-error.ts","../src/types/auth-error-code.ts","../src/core/api-origin.ts","../src/constants/http-status.ts","../src/constants/auth-keys.ts","../src/core/object-guards.ts","../src/core/session-parser.ts","../src/core/broadcast-sync.ts","../src/core/http-client.ts","../src/core/runtime.ts","../src/core/return-to-storage.ts","../src/core/session-store.ts","../src/core/auth-client.ts","../src/adapters/extension/auth-client.ts"],"names":[],"mappings":";AAAA,IAAM,aAAA,GAAgB,QAAA;AAEf,IAAM,aAAA,GAAgB;AAAA,EAC3B,SAAA,EAAW,GAAG,aAAa,CAAA,UAAA,CAAA;AAAA,EAE3B,OAAA,EAAS,GAAG,aAAa,CAAA,QAAA,CAAA;AAAA,EACzB,OAAA,EAAS,GAAG,aAAa,CAAA,QAAA,CAAA;AAAA,EACzB,MAAA,EAAQ,GAAG,aAAa,CAAA,OAAA;AAC1B,CAAA;;;ACCO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAC7B,IAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EAET,YAAY,OAAA,EAA8B;AACxC,IAAA,KAAA,CAAM,QAAQ,OAAO,CAAA;AACrB,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AAAA,EACxB;AACF,CAAA;;;ACrBO,IAAM,aAAA,GAAgB;AAAA,EAC3B,YAAA,EAAc,cAAA;AAAA,EACd,YAAA,EAAc,eAAA;AAAA,EACd,QAAA,EAAU,WAAA;AAAA,EACV,2BAAA,EAA6B,+BAE/B,CAAA;;;ACHA,IAAM,KAAA,GAAQ,GAAA;AAEd,SAAS,mBAAmB,SAAA,EAA2B;AACrD,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAE/B,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa;AAAA,MACrB,MAAM,aAAA,CAAc,QAAA;AAAA,MACpB,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,mDAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,MAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,IAAI,OAAO,CAAA;AAAA,EAC1B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,YAAA,CAAa;AAAA,MACrB,MAAM,aAAA,CAAc,QAAA;AAAA,MACpB,OAAA,EAAS,KAAA;AAAA,MACT,OAAA,EAAS,+CAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,OAAO,QAAA,KAAa,KAAA,IAAS,MAAA,CAAO,MAAA,IAAU,OAAO,IAAA,EAAM;AAC7D,IAAA,MAAM,IAAI,YAAA,CAAa;AAAA,MACrB,MAAM,aAAA,CAAc,QAAA;AAAA,MACpB,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,wDAAA;AAAA,MACT,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA;AAChB;AAEO,SAAS,kBAAA,CAAmB,MAAc,SAAA,EAA4B;AAC3E,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,CAAA,EAAG,kBAAA,CAAmB,SAAS,CAAC,GAAG,IAAI,CAAA,CAAA;AAChD;;;AChDO,IAAM,UAAA,GAAa;AAAA,EACxB,EAAA,EAAI,GAAA;AAAA,EAEJ,SAAA,EAAW,GAAA;AAAA,EAEX,YAAA,EAAc;AAChB,CAAA;;;ACNO,IAAM,aAAA,GAAgB;AAAA,EAC3B,WAAA,EAAa,sBAAA;AAAA,EACb,mBAAA,EAAqB;AACvB,CAAA;AAEO,IAAM,UAAA,GAAa;AAAA,EACxB,IAAA,EAAM;AACR,CAAA;;;ACPO,SAAS,eAAe,KAAA,EAAkD;AAC/E,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA;AAChD;AAEO,SAAS,cAAc,KAAA,EAAiC;AAC7D,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA;AAC1B;;;ACHO,SAAS,cAAc,KAAA,EAAmC;AAC/D,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,MAAM,CAAC,KAAA,KAAU,aAAA,CAAc,KAAK,CAAC,CAAA;AAC5E;AAEO,SAAS,iBAAiB,KAAA,EAAyC;AACxE,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OACE,aAAA,CAAc,KAAA,CAAM,EAAE,CAAA,IACtB,cAAc,KAAA,CAAM,QAAQ,CAAA,KAC3B,KAAA,CAAM,SAAA,KAAc,IAAA,IAAQ,aAAA,CAAc,KAAA,CAAM,SAAS,CAAA,CAAA,KACzD,KAAA,CAAM,QAAA,KAAa,IAAA,IAAQ,aAAA,CAAc,KAAA,CAAM,QAAQ,CAAA,CAAA,IACxD,cAAc,KAAA,CAAM,KAAK,CAAA,IACzB,aAAA,CAAc,KAAA,CAAM,IAAI,CAAA,IACxB,aAAA,CAAc,MAAM,WAAW,CAAA;AAEnC;;;ACAA,SAAS,wBAAwB,KAAA,EAAgD;AAC/E,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAA,CAAM,IAAI,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,aAAA,CAAc,mBAAA,EAAqB;AACpD,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,KAAA,CAAM,OAAA,KAAY,IAAA,IAAQ,gBAAA,CAAiB,MAAM,OAAO,CAAA;AACjE;AAEA,SAAS,sCAAA,GAAuD;AAC9D,EAAA,OAAO,IAAI,YAAA,CAAa;AAAA,IACtB,MAAM,aAAA,CAAc,2BAAA;AAAA,IACpB,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS,kDAAA;AAAA,IACT,MAAA,EAAQ;AAAA,GACT,CAAA;AACH;AAEO,SAAS,oBAAoB,OAAA,EAAoD;AACtF,EAAA,IAAI,OAAO,qBAAqB,WAAA,EAAa;AAC3C,IAAA,MAAM,sCAAA,EAAuC;AAAA,EAC/C;AAEA,EAAA,MAAM,OAAA,GAAU,IAAI,gBAAA,CAAiB,aAAA,CAAc,WAAW,CAAA;AAE9D,EAAA,MAAM,SAAA,GAA2B,CAAC,KAAA,KAAU;AAC1C,IAAA,MAAM,YAAA,GAAe,KAAA;AAErB,IAAA,IAAI,CAAC,uBAAA,CAAwB,YAAA,CAAa,IAAI,CAAA,EAAG;AAC/C,MAAA;AAAA,IACF;AAEA,IAAA,OAAA,CAAQ,gBAAA,CAAiB,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,OAAA,CAAQ,gBAAA,CAAiB,WAAW,SAAS,CAAA;AAE7C,EAAA,OAAO;AAAA,IACL,KAAA,GAAQ;AACN,MAAA,OAAA,CAAQ,mBAAA,CAAoB,WAAW,SAAS,CAAA;AAChD,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAA;AAAA,IACA,eAAe,OAAA,EAAS;AACtB,MAAA,MAAM,OAAA,GAAiC;AAAA,QACrC,OAAA;AAAA,QACA,MAAM,aAAA,CAAc;AAAA,OACtB;AAEA,MAAA,OAAA,CAAQ,YAAY,OAAO,CAAA;AAAA,IAC7B;AAAA,GACF;AACF;;;AC1EA,IAAM,eAAA,GAAkB,kBAAA;AACxB,IAAM,cAAA,GAAiB,cAAA;AACvB,IAAM,kBAAA,GAAyC,SAAA;AAC/C,IAAM,YAAA,GAA6B,UAAA;AAenC,SAAS,aAAqB,KAAA,EAAwB;AACpD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,6BAA6B,MAAA,EAAgB;AACpD,EAAA,IAAI,MAAA,KAAW,WAAW,YAAA,EAAc;AACtC,IAAA,OAAO,aAAA,CAAc,YAAA;AAAA,EACvB;AAEA,EAAA,OAAO,aAAA,CAAc,QAAA;AACvB;AAEA,eAAe,iBAAiB,QAAA,EAAsC;AACpE,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,QAAA,EAAiD;AAChF,EAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,QAAQ,CAAA;AAE/C,EAAA,IAAI,CAAC,cAAA,CAAe,OAAO,CAAA,EAAG;AAC5B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,IAAA;AAAA,MACN,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,MAAM,YAAY,OAAA,CAAQ,IAAA;AAC1B,EAAA,MAAM,eAAe,OAAA,CAAQ,OAAA;AAE7B,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,aAAA,CAAc,SAAS,CAAA,GAAI,SAAA,GAAY,IAAA;AAAA,IAC7C,OAAA,EAAS,SAAA,IAAa,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,IAAA;AAAA,IAClD,OAAA,EAAS,aAAA,CAAc,YAAY,CAAA,GAAI,YAAA,GAAe;AAAA,GACxD;AACF;AAEA,SAAS,oBAAA,CAAqB,QAA2C,IAAA,EAAsB;AAC7F,EAAA,OAAO,CAAA,yBAAA,EAA4B,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AACnD;AAEA,SAAS,wBAAA,CAAyB,QAA2C,IAAA,EAAsB;AACjG,EAAA,OAAO,CAAA,0BAAA,EAA6B,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AACpD;AAEA,eAAe,QACb,OAAA,EACoB;AACpB,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,cAAA,IAAkB,UAAA,CAAW,EAAA;AAC5D,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,CAAQ,IAAA,KAAS,WAAA;AAExC,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,eAAe,CAAA;AAAA,EAC7C;AAEA,EAAA,MAAM,WAAA,GAA2B;AAAA,IAC/B,KAAA,EAAO,YAAA;AAAA,IACP,WAAA,EAAa,kBAAA;AAAA,IACb,OAAA;AAAA,IACA,QAAQ,OAAA,CAAQ;AAAA,GAClB;AAEA,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,WAAA,CAAY,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,EAChD;AAEA,EAAA,IAAI,QAAA;AAEJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,WAAW,CAAA;AAAA,EAClD,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,YAAA,CAAa;AAAA,MACrB,MAAM,aAAA,CAAc,YAAA;AAAA,MACpB,OAAA,EAAS,KAAA;AAAA,MACT,OAAA,EAAS,wBAAA,CAAyB,OAAA,CAAQ,MAAA,EAAQ,QAAQ,IAAI,CAAA;AAAA,MAC9D,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,QAAA,CAAS,WAAW,cAAA,EAAgB;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,QAAQ,CAAA;AAE/C,IAAA,MAAM,IAAI,YAAA,CAAa;AAAA,MACrB,IAAA,EAAM,4BAAA,CAA6B,QAAA,CAAS,MAAM,CAAA;AAAA,MAClD,OAAA,EAAS;AAAA,QACP,SAAS,MAAA,CAAO,IAAA;AAAA,QAChB,YAAY,MAAA,CAAO;AAAA,OACrB;AAAA,MACA,SAAS,MAAA,CAAO,OAAA,IAAW,qBAAqB,OAAA,CAAQ,MAAA,EAAQ,QAAQ,IAAI,CAAA;AAAA,MAC5E,QAAQ,QAAA,CAAS;AAAA,KAClB,CAAA;AAAA,EACH;AAEA,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,UAAA,CAAW,SAAA,EAAW;AAC5C,IAAA,OAAO,aAAwB,IAAI,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,QAAQ,CAAA;AAC/C,EAAA,OAAO,aAAwB,OAAO,CAAA;AACxC;AAEO,SAAS,QAAmB,IAAA,EAAkC;AACnE,EAAA,OAAO,OAAA,CAAmB;AAAA,IACxB,MAAA,EAAQ,KAAA;AAAA,IACR;AAAA,GACD,CAAA;AACH;AAUO,SAAS,oBAA+B,IAAA,EAAkC;AAC/E,EAAA,OAAO,OAAA,CAAmB;AAAA,IACxB,MAAA,EAAQ,MAAA;AAAA,IACR;AAAA,GACD,CAAA;AACH;AAEO,SAAS,UAAU,IAAA,EAA6B;AACrD,EAAA,OAAO,OAAA,CAAc;AAAA,IACnB,gBAAgB,UAAA,CAAW,SAAA;AAAA,IAC3B,MAAA,EAAQ,MAAA;AAAA,IACR;AAAA,GACD,CAAA;AACH;;;AC1JA,IAAM,0BAAA,GAA6B,sDAAA;AAE5B,SAAS,gBAAA,GAA4B;AAC1C,EAAA,OAAO,OAAO,MAAA,KAAW,WAAA;AAC3B;AAEO,SAAS,oBAAA,GAA6B;AAC3C,EAAA,IAAI,kBAAiB,EAAG;AACtB,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,YAAA,CAAa;AAAA,IACrB,MAAM,aAAA,CAAc,QAAA;AAAA,IACpB,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS,0BAAA;AAAA,IACT,MAAA,EAAQ;AAAA,GACT,CAAA;AACH;;;ACjBA,SAAS,iBAAiB,KAAA,EAA0C;AAClE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,UAAA,CAAW,IAAA;AAAA,EACpB;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,EAAG;AACtC,IAAA,OAAO,UAAA,CAAW,IAAA;AAAA,EACpB;AAEA,EAAA,MAAM,sBAAA,GAAyB,IAAA;AAE/B,EAAA,IAAI,KAAA,CAAM,UAAA,CAAW,sBAAsB,CAAA,EAAG;AAC5C,IAAA,OAAO,UAAA,CAAW,IAAA;AAAA,EACpB;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,qBAAA,GAAgC;AACvC,EAAA,OAAO,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,CAAA;AACpF;AAEO,SAAS,oBAAoB,QAAA,EAAsC;AACxE,EAAA,oBAAA,EAAqB;AAErB,EAAA,MAAM,eAAe,qBAAA,EAAsB;AAC3C,EAAA,OAAO,gBAAA,CAAiB,YAAY,YAAY,CAAA;AAClD;;;ACzBO,IAAM,eAAN,MAAmB;AAAA,EAChB,SAAA,uBAAgB,GAAA,EAAqB;AAAA,EACrC,eAAA,GAAyC,IAAA;AAAA,EACzC,YAAA,GAAoC,SAAA;AAAA,EAE5C,oBAAA,GAA8C;AAC5C,IAAA,IAAI,IAAA,CAAK,iBAAiB,SAAA,EAAW;AACnC,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACd;AAAA,EAEA,kBAAA,GAA8B;AAC5B,IAAA,OAAO,KAAK,YAAA,KAAiB,UAAA;AAAA,EAC/B;AAAA,EAEA,WAAW,OAAA,EAAsC;AAC/C,IAAA,IAAA,CAAK,YAAA,GAAe,UAAA;AACpB,IAAA,IAAA,CAAK,eAAA,GAAkB,OAAA;AAEvB,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,SAAA,EAAW;AACrC,MAAA,QAAA,CAAS,OAAO,CAAA;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,UAAU,QAAA,EAAuC;AAC/C,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,QAAQ,CAAA;AAE3B,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,IAChC,CAAA;AAAA,EACF;AACF,CAAA;;;ACjBA,SAAS,iCAAiC,IAAA,EAA4B;AACpE,EAAA,OAAO,IAAI,YAAA,CAAa;AAAA,IACtB,MAAM,aAAA,CAAc,QAAA;AAAA,IACpB,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS,gDAAgD,IAAI,CAAA,CAAA;AAAA,IAC7D,MAAA,EAAQ;AAAA,GACT,CAAA;AACH;AAEA,SAAS,kBAAA,CAAmB,SAAkB,IAAA,EAA8B;AAC1E,EAAA,IAAI,CAAC,gBAAA,CAAiB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,iCAAiC,IAAI,CAAA;AAAA,EAC7C;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,SAAkB,IAAA,EAAqC;AAC/E,EAAA,IAAI,YAAY,IAAA,EAAM;AACpB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,kBAAA,CAAmB,SAAS,IAAI,CAAA;AACzC;AAEA,SAAS,uBAAA,GAAyC;AAChD,EAAA,OAAO;AAAA,IACL,KAAA,GAAQ;AAAA,IAAC,CAAA;AAAA,IACT,cAAA,GAAiB;AAAA,IAAC;AAAA,GACpB;AACF;AAEA,SAAS,wBACP,gBAAA,EACe;AACf,EAAA,IAAI;AACF,IAAA,OAAO,mBAAA,CAAoB;AAAA,MACzB;AAAA,KACD,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,YAAA,IAAgB,KAAA,CAAM,IAAA,KAAS,cAAc,2BAAA,EAA6B;AAC7F,MAAA,OAAO,uBAAA,EAAwB;AAAA,IACjC;AAEA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,SAAS,aAAa,OAAA,EAAgD;AACpE,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,MAAA,EAAQ,UAAU,eAAA,GAAkB;AAAA,GACtC;AACF;AAEO,SAAS,gBAAA,CAAiB,OAAA,GAA6B,EAAC,EAAe;AAC5E,EAAA,IAAI,WAAA,GAA8C,IAAA;AAClD,EAAA,MAAM,kBAAA,GAAqB,OAAA,CAAQ,WAAA,EAAa,IAAA,EAAK,IAAK,EAAA;AAE1D,EAAA,MAAM,YAAA,GAAe,IAAI,YAAA,EAAa;AACtC,EAAA,MAAM,aAAA,GAAgB,uBAAA,CAAwB,CAAC,OAAA,KAAY;AACzD,IAAA,YAAA,CAAa,WAAW,OAAO,CAAA;AAAA,EACjC,CAAC,CAAA;AAED,EAAA,MAAM,kBAAkB,CAAC,IAAA,KAAyB,kBAAA,CAAmB,IAAA,EAAM,QAAQ,SAAS,CAAA;AAE5F,EAAA,MAAM,cAAc,YAA4C;AAC9D,IAAA,MAAM,UAAU,MAAM,OAAA,CAAiB,eAAA,CAAgB,aAAA,CAAc,OAAO,CAAC,CAAA;AAC7E,IAAA,OAAO,gBAAA,CAAiB,OAAA,EAAS,aAAA,CAAc,OAAO,CAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,IAAA,GAAO,OAAO,WAAA,KAA2D;AAC7E,IAAA,MAAM,YAAA,GAAe,aAAa,YAAA,IAAgB,KAAA;AAElD,IAAA,IAAI,YAAA,CAAa,kBAAA,EAAmB,IAAK,CAAC,YAAA,EAAc;AACtD,MAAA,OAAO,YAAA,CAAa,YAAA,CAAa,oBAAA,EAAsB,CAAA;AAAA,IACzD;AAEA,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,OAAO,WAAA;AAAA,IACT;AAEA,IAAA,WAAA,GAAA,CAAe,YAAY;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,MAAA,YAAA,CAAa,WAAW,OAAO,CAAA;AAC/B,MAAA,aAAA,CAAc,eAAe,OAAO,CAAA;AACpC,MAAA,OAAO,aAAa,OAAO,CAAA;AAAA,IAC7B,CAAA,GAAG;AAEH,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,WAAA;AAAA,IACf,CAAA,SAAE;AACA,MAAA,WAAA,GAAc,IAAA;AAAA,IAChB;AAAA,EACF,CAAA;AAEA,EAAA,MAAM,UAAA,GAAa,OACjB,cAAA,KACmC;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK;AAAA,MACxB,YAAA,EAAc,gBAAgB,YAAA,IAAgB;AAAA,KAC/C,CAAA;AAED,IAAA,OAAO,MAAA,CAAO,OAAA;AAAA,EAChB,CAAA;AAEA,EAAA,MAAM,UAAU,YAA4C;AAC1D,IAAA,MAAM,UAAU,MAAM,mBAAA,CAA6B,eAAA,CAAgB,aAAA,CAAc,OAAO,CAAC,CAAA;AACzF,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,OAAA,EAAS,aAAA,CAAc,OAAO,CAAA;AAC/D,IAAA,YAAA,CAAa,WAAW,OAAO,CAAA;AAC/B,IAAA,aAAA,CAAc,eAAe,OAAO,CAAA;AACpC,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,iBAAiB,YAAqC;AAC1D,IAAA,MAAM,OAAA,GAAU,MAAM,UAAA,EAAW;AAEjC,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAO,OAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAI,YAAA,CAAa;AAAA,MACrB,MAAM,aAAA,CAAc,YAAA;AAAA,MACpB,OAAA,EAAS,IAAA;AAAA,MACT,OAAA,EAAS,oCAAA;AAAA,MACT,QAAQ,UAAA,CAAW;AAAA,KACpB,CAAA;AAAA,EACH,CAAA;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,YAAA,KAAsC;AACnD,IAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,YAAA,EAAc,QAAQ,CAAA;AAC3D,IAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,eAAA,CAAgB,cAAc,SAAS,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAC7F,IAAA,YAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AACnD,IAAA,MAAM,WAAA,GAAc,YAAA,EAAc,WAAA,EAAa,IAAA,EAAK,IAAK,kBAAA;AACzD,IAAA,IAAI,WAAA,EAAa;AACf,MAAA,YAAA,CAAa,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,WAAW,CAAA;AAAA,IAClD;AACA,IAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,YAAA,CAAa,QAAA,EAAU,CAAA;AAAA,EAChD,CAAA;AAEA,EAAA,MAAM,SAAS,YAA2B;AACxC,IAAA,MAAM,SAAA,CAAU,eAAA,CAAgB,aAAA,CAAc,MAAM,CAAC,CAAA;AACrD,IAAA,YAAA,CAAa,WAAW,IAAI,CAAA;AAC5B,IAAA,aAAA,CAAc,eAAe,IAAI,CAAA;AAAA,EACnC,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,YAAA,CAAa,SAAA,CAAU,IAAA,CAAK,YAAY,CAAA;AAE1D,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AACF;;;AC9JA,SAAS,iBAAA,CAAkB,SAAA,EAAmB,QAAA,EAAkB,WAAA,EAA8B;AAC5F,EAAA,MAAM,iBAAA,GAAoB,kBAAA,CAAmB,aAAA,CAAc,SAAA,EAAW,SAAS,CAAA;AAC/E,EAAA,MAAM,eAAe,IAAI,GAAA,CAAI,iBAAA,EAAmB,MAAA,CAAO,SAAS,MAAM,CAAA;AACtE,EAAA,YAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AACnD,EAAA,IAAI,WAAA,EAAa,MAAK,EAAG;AACvB,IAAA,YAAA,CAAa,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,WAAA,CAAY,MAAM,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,aAAa,QAAA,EAAS;AAC/B;AAEO,SAAS,0BACd,OAAA,EACqB;AACrB,EAAA,MAAM,aAAa,gBAAA,CAAiB;AAAA,IAClC,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,aAAa,OAAA,CAAQ;AAAA,GACtB,CAAA;AAED,EAAA,MAAM,oBAAA,GAAuB,OAAO,YAAA,KAA+C;AACjF,IAAA,MAAM,QAAA,GAAW,mBAAA,CAAoB,YAAA,EAAc,QAAQ,CAAA;AAC3D,IAAA,MAAM,YAAA,GAAe,iBAAA;AAAA,MACnB,OAAA,CAAQ,SAAA;AAAA,MACR,QAAA;AAAA,MACA,YAAA,EAAc,eAAe,OAAA,CAAQ;AAAA,KACvC;AACA,IAAA,MAAM,QAAQ,iBAAA,CAAkB;AAAA,MAC9B;AAAA,KACD,CAAA;AACD,IAAA,MAAM,WAAW,OAAA,EAAQ;AAAA,EAC3B,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,GAAG,UAAA;AAAA,IACH,MAAM,YAAA,EAA6B;AACjC,MAAA,KAAK,qBAAqB,YAAY,CAAA;AAAA,IACxC,CAAA;AAAA,IACA;AAAA,GACF;AACF","file":"extension.js","sourcesContent":["const authApiPrefix = \"/oauth\";\n\nexport const authEndpoints = {\n  authorize: `${authApiPrefix}/authorize`,\n  providerCallback: `${authApiPrefix}/callback/provider`,\n  session: `${authApiPrefix}/session`,\n  refresh: `${authApiPrefix}/refresh`,\n  logout: `${authApiPrefix}/logout`,\n} as const;\n","import type { AuthErrorCode } from \"../types/auth-error-code\";\n\nexport interface AuthSdkErrorPayload {\n  code: AuthErrorCode;\n  details: unknown;\n  message: string;\n  status: number | null;\n}\n\nexport class AuthSdkError extends Error {\n  readonly code: AuthErrorCode;\n  readonly details: unknown;\n  readonly status: number | null;\n\n  constructor(payload: AuthSdkErrorPayload) {\n    super(payload.message);\n    this.name = \"AuthSdkError\";\n    this.code = payload.code;\n    this.details = payload.details;\n    this.status = payload.status;\n  }\n}\n","export const authErrorCode = {\n  unauthorized: \"unauthorized\",\n  networkError: \"network_error\",\n  apiError: \"api_error\",\n  broadcastChannelUnsupported: \"broadcast_channel_unsupported\",\n  serverOriginResolutionFailed: \"server_origin_resolution_failed\",\n} as const;\n\nexport type AuthErrorCode = (typeof authErrorCode)[keyof typeof authErrorCode];\n","import { AuthSdkError } from \"../errors/auth-sdk-error\";\nimport { authErrorCode } from \"../types/auth-error-code\";\n\nconst slash = \"/\";\n\nfunction normalizeApiOrigin(apiOrigin: string): string {\n  const trimmed = apiOrigin.trim();\n\n  if (!trimmed) {\n    throw new AuthSdkError({\n      code: authErrorCode.apiError,\n      details: null,\n      message: \"Auth API origin must be a non-empty absolute URL.\",\n      status: null,\n    });\n  }\n\n  let parsed: URL;\n\n  try {\n    parsed = new URL(trimmed);\n  } catch (error) {\n    throw new AuthSdkError({\n      code: authErrorCode.apiError,\n      details: error,\n      message: \"Auth API origin must be a valid absolute URL.\",\n      status: null,\n    });\n  }\n\n  if (parsed.pathname !== slash || parsed.search || parsed.hash) {\n    throw new AuthSdkError({\n      code: authErrorCode.apiError,\n      details: null,\n      message: \"Auth API origin must not include path, query, or hash.\",\n      status: null,\n    });\n  }\n\n  return parsed.origin;\n}\n\nexport function resolveApiEndpoint(path: string, apiOrigin?: string): string {\n  if (!apiOrigin) {\n    return path;\n  }\n\n  return `${normalizeApiOrigin(apiOrigin)}${path}`;\n}\n","export const httpStatus = {\n  ok: 200,\n  found: 302,\n  noContent: 204,\n  badRequest: 400,\n  unauthorized: 401,\n} as const;\n","export const authBroadcast = {\n  channelName: \"ghostly-auth-channel\",\n  sessionUpdatedEvent: \"session-updated\",\n} as const;\n\nexport const authRoutes = {\n  root: \"/\",\n} as const;\n","export function isObjectRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nexport function isStringValue(value: unknown): value is string {\n  return typeof value === \"string\";\n}\n","import type { GhostlySession } from \"../types/ghostly-session\";\nimport { isObjectRecord, isStringValue } from \"./object-guards\";\n\nexport function isStringArray(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every((entry) => isStringValue(entry));\n}\n\nexport function isGhostlySession(value: unknown): value is GhostlySession {\n  if (!isObjectRecord(value)) {\n    return false;\n  }\n\n  return (\n    isStringValue(value.id) &&\n    isStringValue(value.username) &&\n    (value.firstName === null || isStringValue(value.firstName)) &&\n    (value.lastName === null || isStringValue(value.lastName)) &&\n    isStringValue(value.email) &&\n    isStringValue(value.role) &&\n    isStringArray(value.permissions)\n  );\n}\n","import { authBroadcast } from \"../constants/auth-keys\";\nimport { AuthSdkError } from \"../errors/auth-sdk-error\";\nimport { authErrorCode } from \"../types/auth-error-code\";\nimport type { GhostlySession } from \"../types/ghostly-session\";\nimport { isObjectRecord, isStringValue } from \"./object-guards\";\nimport { isGhostlySession } from \"./session-parser\";\n\ninterface SessionUpdatedMessage {\n  session: GhostlySession | null;\n  type: typeof authBroadcast.sessionUpdatedEvent;\n}\n\nexport interface BroadcastSync {\n  close(): void;\n  publishSession(session: GhostlySession | null): void;\n}\n\ninterface CreateBroadcastSyncOptions {\n  onSessionUpdated: (session: GhostlySession | null) => void;\n}\n\nfunction isSessionUpdatedMessage(value: unknown): value is SessionUpdatedMessage {\n  if (!isObjectRecord(value)) {\n    return false;\n  }\n\n  if (!isStringValue(value.type)) {\n    return false;\n  }\n\n  if (value.type !== authBroadcast.sessionUpdatedEvent) {\n    return false;\n  }\n\n  return value.session === null || isGhostlySession(value.session);\n}\n\nfunction createUnsupportedBroadcastChannelError(): AuthSdkError {\n  return new AuthSdkError({\n    code: authErrorCode.broadcastChannelUnsupported,\n    details: null,\n    message: \"BroadcastChannel is unavailable in this runtime.\",\n    status: null,\n  });\n}\n\nexport function createBroadcastSync(options: CreateBroadcastSyncOptions): BroadcastSync {\n  if (typeof BroadcastChannel === \"undefined\") {\n    throw createUnsupportedBroadcastChannelError();\n  }\n\n  const channel = new BroadcastChannel(authBroadcast.channelName);\n\n  const onMessage: EventListener = (event) => {\n    const messageEvent = event as MessageEvent<unknown>;\n\n    if (!isSessionUpdatedMessage(messageEvent.data)) {\n      return;\n    }\n\n    options.onSessionUpdated(messageEvent.data.session);\n  };\n\n  channel.addEventListener(\"message\", onMessage);\n\n  return {\n    close() {\n      channel.removeEventListener(\"message\", onMessage);\n      channel.close();\n    },\n    publishSession(session) {\n      const payload: SessionUpdatedMessage = {\n        session,\n        type: authBroadcast.sessionUpdatedEvent,\n      };\n\n      channel.postMessage(payload);\n    },\n  };\n}\n","import { httpStatus } from \"../constants/http-status\";\nimport { AuthSdkError } from \"../errors/auth-sdk-error\";\nimport { authErrorCode } from \"../types/auth-error-code\";\nimport { isObjectRecord, isStringValue } from \"./object-guards\";\n\nconst jsonContentType = \"application/json\";\nconst jsonHeaderName = \"content-type\";\nconst includeCredentials: RequestCredentials = \"include\";\nconst noStoreCache: RequestCache = \"no-store\";\n\ninterface RequestOptions<TBody> {\n  body?: TBody;\n  expectedStatus?: number;\n  method: \"GET\" | \"POST\";\n  path: string;\n}\n\ninterface ParsedErrorPayload {\n  code: string | null;\n  details: unknown;\n  message: string | null;\n}\n\nfunction toTypedValue<TValue>(value: unknown): TValue {\n  return value as TValue;\n}\n\nfunction mapHttpStatusToAuthErrorCode(status: number) {\n  if (status === httpStatus.unauthorized) {\n    return authErrorCode.unauthorized;\n  }\n\n  return authErrorCode.apiError;\n}\n\nasync function parseJsonPayload(response: Response): Promise<unknown> {\n  try {\n    return await response.json();\n  } catch {\n    return null;\n  }\n}\n\nasync function parseErrorPayload(response: Response): Promise<ParsedErrorPayload> {\n  const payload = await parseJsonPayload(response);\n\n  if (!isObjectRecord(payload)) {\n    return {\n      code: null,\n      details: null,\n      message: null,\n    };\n  }\n\n  const maybeCode = payload.code;\n  const maybeMessage = payload.message;\n\n  return {\n    code: isStringValue(maybeCode) ? maybeCode : null,\n    details: \"details\" in payload ? payload.details : null,\n    message: isStringValue(maybeMessage) ? maybeMessage : null,\n  };\n}\n\nfunction buildApiErrorMessage(method: RequestOptions<unknown>[\"method\"], path: string): string {\n  return `Auth API request failed: ${method} ${path}`;\n}\n\nfunction buildNetworkErrorMessage(method: RequestOptions<unknown>[\"method\"], path: string): string {\n  return `Auth API network failure: ${method} ${path}`;\n}\n\nasync function request<TResponse, TBody = undefined>(\n  options: RequestOptions<TBody>,\n): Promise<TResponse> {\n  const expectedStatus = options.expectedStatus ?? httpStatus.ok;\n  const headers = new Headers();\n  const hasBody = typeof options.body !== \"undefined\";\n\n  if (hasBody) {\n    headers.set(jsonHeaderName, jsonContentType);\n  }\n\n  const requestInit: RequestInit = {\n    cache: noStoreCache,\n    credentials: includeCredentials,\n    headers,\n    method: options.method,\n  };\n\n  if (hasBody) {\n    requestInit.body = JSON.stringify(options.body);\n  }\n\n  let response: Response;\n\n  try {\n    response = await fetch(options.path, requestInit);\n  } catch (error) {\n    throw new AuthSdkError({\n      code: authErrorCode.networkError,\n      details: error,\n      message: buildNetworkErrorMessage(options.method, options.path),\n      status: null,\n    });\n  }\n\n  if (response.status !== expectedStatus) {\n    const parsed = await parseErrorPayload(response);\n\n    throw new AuthSdkError({\n      code: mapHttpStatusToAuthErrorCode(response.status),\n      details: {\n        apiCode: parsed.code,\n        apiDetails: parsed.details,\n      },\n      message: parsed.message ?? buildApiErrorMessage(options.method, options.path),\n      status: response.status,\n    });\n  }\n\n  if (response.status === httpStatus.noContent) {\n    return toTypedValue<TResponse>(null);\n  }\n\n  const payload = await parseJsonPayload(response);\n  return toTypedValue<TResponse>(payload);\n}\n\nexport function getJson<TResponse>(path: string): Promise<TResponse> {\n  return request<TResponse>({\n    method: \"GET\",\n    path,\n  });\n}\n\nexport function postJson<TResponse, TBody>(path: string, body: TBody): Promise<TResponse> {\n  return request<TResponse, TBody>({\n    body,\n    method: \"POST\",\n    path,\n  });\n}\n\nexport function postJsonWithoutBody<TResponse>(path: string): Promise<TResponse> {\n  return request<TResponse>({\n    method: \"POST\",\n    path,\n  });\n}\n\nexport function postEmpty(path: string): Promise<null> {\n  return request<null>({\n    expectedStatus: httpStatus.noContent,\n    method: \"POST\",\n    path,\n  });\n}\n","import { AuthSdkError } from \"../errors/auth-sdk-error\";\nimport { authErrorCode } from \"../types/auth-error-code\";\n\nconst browserRuntimeErrorMessage = \"Browser runtime is required for this auth operation.\";\n\nexport function isBrowserRuntime(): boolean {\n  return typeof window !== \"undefined\";\n}\n\nexport function assertBrowserRuntime(): void {\n  if (isBrowserRuntime()) {\n    return;\n  }\n\n  throw new AuthSdkError({\n    code: authErrorCode.apiError,\n    details: null,\n    message: browserRuntimeErrorMessage,\n    status: null,\n  });\n}\n","import { authRoutes } from \"../constants/auth-keys\";\nimport { assertBrowserRuntime } from \"./runtime\";\n\nfunction sanitizeReturnTo(value: string | null | undefined): string {\n  if (!value) {\n    return authRoutes.root;\n  }\n\n  if (!value.startsWith(authRoutes.root)) {\n    return authRoutes.root;\n  }\n\n  const protocolRelativePrefix = \"//\";\n\n  if (value.startsWith(protocolRelativePrefix)) {\n    return authRoutes.root;\n  }\n\n  return value;\n}\n\nfunction getCurrentBrowserPath(): string {\n  return `${window.location.pathname}${window.location.search}${window.location.hash}`;\n}\n\nexport function resolveReturnToPath(returnTo: string | undefined): string {\n  assertBrowserRuntime();\n\n  const fallbackPath = getCurrentBrowserPath();\n  return sanitizeReturnTo(returnTo ?? fallbackPath);\n}\n","import type { SessionListener } from \"../types/auth-client\";\nimport type { GhostlySession } from \"../types/ghostly-session\";\n\ntype SessionResolveState = \"pending\" | \"resolved\";\n\nexport class SessionStore {\n  private listeners = new Set<SessionListener>();\n  private resolvedSession: GhostlySession | null = null;\n  private resolveState: SessionResolveState = \"pending\";\n\n  getSessionIfResolved(): GhostlySession | null {\n    if (this.resolveState === \"pending\") {\n      return null;\n    }\n\n    return this.resolvedSession;\n  }\n\n  hasResolvedSession(): boolean {\n    return this.resolveState === \"resolved\";\n  }\n\n  setSession(session: GhostlySession | null): void {\n    this.resolveState = \"resolved\";\n    this.resolvedSession = session;\n\n    for (const listener of this.listeners) {\n      listener(session);\n    }\n  }\n\n  subscribe(listener: SessionListener): () => void {\n    this.listeners.add(listener);\n\n    return () => {\n      this.listeners.delete(listener);\n    };\n  }\n}\n","import { authEndpoints } from \"../constants/auth-endpoints\";\nimport { httpStatus } from \"../constants/http-status\";\nimport { AuthSdkError } from \"../errors/auth-sdk-error\";\nimport type {\n  AuthClient,\n  AuthClientOptions,\n  AuthInitOptions,\n  AuthInitResult,\n  LoginOptions,\n  SessionRequestOptions,\n} from \"../types/auth-client\";\nimport { authErrorCode } from \"../types/auth-error-code\";\nimport type { GhostlySession } from \"../types/ghostly-session\";\nimport { resolveApiEndpoint } from \"./api-origin\";\nimport type { BroadcastSync } from \"./broadcast-sync\";\nimport { createBroadcastSync } from \"./broadcast-sync\";\nimport { getJson, postEmpty, postJsonWithoutBody } from \"./http-client\";\nimport { resolveReturnToPath } from \"./return-to-storage\";\nimport { isGhostlySession } from \"./session-parser\";\nimport { SessionStore } from \"./session-store\";\n\nfunction createInvalidSessionPayloadError(path: string): AuthSdkError {\n  return new AuthSdkError({\n    code: authErrorCode.apiError,\n    details: null,\n    message: `Auth API response has invalid session shape: ${path}`,\n    status: null,\n  });\n}\n\nfunction toValidatedSession(payload: unknown, path: string): GhostlySession {\n  if (!isGhostlySession(payload)) {\n    throw createInvalidSessionPayloadError(path);\n  }\n\n  return payload;\n}\n\nfunction toSessionPayload(payload: unknown, path: string): GhostlySession | null {\n  if (payload === null) {\n    return null;\n  }\n\n  return toValidatedSession(payload, path);\n}\n\nfunction createNoopBroadcastSync(): BroadcastSync {\n  return {\n    close() {},\n    publishSession() {},\n  };\n}\n\nfunction createSafeBroadcastSync(\n  onSessionUpdated: (session: GhostlySession | null) => void,\n): BroadcastSync {\n  try {\n    return createBroadcastSync({\n      onSessionUpdated,\n    });\n  } catch (error) {\n    if (error instanceof AuthSdkError && error.code === authErrorCode.broadcastChannelUnsupported) {\n      return createNoopBroadcastSync();\n    }\n\n    throw error;\n  }\n}\n\nfunction toInitResult(session: GhostlySession | null): AuthInitResult {\n  return {\n    session,\n    status: session ? \"authenticated\" : \"unauthenticated\",\n  };\n}\n\nexport function createAuthClient(options: AuthClientOptions = {}): AuthClient {\n  let initPromise: Promise<AuthInitResult> | null = null;\n  const defaultApplication = options.application?.trim() || \"\";\n\n  const sessionStore = new SessionStore();\n  const broadcastSync = createSafeBroadcastSync((session) => {\n    sessionStore.setSession(session);\n  });\n\n  const resolveEndpoint = (path: string): string => resolveApiEndpoint(path, options.apiOrigin);\n\n  const loadSession = async (): Promise<GhostlySession | null> => {\n    const payload = await getJson<unknown>(resolveEndpoint(authEndpoints.session));\n    return toSessionPayload(payload, authEndpoints.session);\n  };\n\n  const init = async (initOptions?: AuthInitOptions): Promise<AuthInitResult> => {\n    const forceRefresh = initOptions?.forceRefresh ?? false;\n\n    if (sessionStore.hasResolvedSession() && !forceRefresh) {\n      return toInitResult(sessionStore.getSessionIfResolved());\n    }\n\n    if (initPromise) {\n      return initPromise;\n    }\n\n    initPromise = (async () => {\n      const session = await loadSession();\n      sessionStore.setSession(session);\n      broadcastSync.publishSession(session);\n      return toInitResult(session);\n    })();\n\n    try {\n      return await initPromise;\n    } finally {\n      initPromise = null;\n    }\n  };\n\n  const getSession = async (\n    requestOptions?: SessionRequestOptions,\n  ): Promise<GhostlySession | null> => {\n    const result = await init({\n      forceRefresh: requestOptions?.forceRefresh ?? false,\n    });\n\n    return result.session;\n  };\n\n  const refresh = async (): Promise<GhostlySession | null> => {\n    const payload = await postJsonWithoutBody<unknown>(resolveEndpoint(authEndpoints.refresh));\n    const session = toSessionPayload(payload, authEndpoints.refresh);\n    sessionStore.setSession(session);\n    broadcastSync.publishSession(session);\n    return session;\n  };\n\n  const requireSession = async (): Promise<GhostlySession> => {\n    const session = await getSession();\n\n    if (session) {\n      return session;\n    }\n\n    throw new AuthSdkError({\n      code: authErrorCode.unauthorized,\n      details: null,\n      message: \"Authenticated session is required.\",\n      status: httpStatus.unauthorized,\n    });\n  };\n\n  const login = (loginOptions?: LoginOptions): void => {\n    const returnTo = resolveReturnToPath(loginOptions?.returnTo);\n    const authorizeUrl = new URL(resolveEndpoint(authEndpoints.authorize), window.location.origin);\n    authorizeUrl.searchParams.set(\"return_to\", returnTo);\n    const application = loginOptions?.application?.trim() || defaultApplication;\n    if (application) {\n      authorizeUrl.searchParams.set(\"app\", application);\n    }\n    window.location.assign(authorizeUrl.toString());\n  };\n\n  const logout = async (): Promise<void> => {\n    await postEmpty(resolveEndpoint(authEndpoints.logout));\n    sessionStore.setSession(null);\n    broadcastSync.publishSession(null);\n  };\n\n  const subscribe = sessionStore.subscribe.bind(sessionStore);\n\n  return {\n    init,\n    getSession,\n    login,\n    logout,\n    refresh,\n    requireSession,\n    subscribe,\n  };\n}\n","import { authEndpoints } from \"../../constants/auth-endpoints\";\nimport { resolveApiEndpoint } from \"../../core/api-origin\";\nimport { createAuthClient } from \"../../core/auth-client\";\nimport { resolveReturnToPath } from \"../../core/return-to-storage\";\nimport type { AuthClient, LoginOptions } from \"../../types/auth-client\";\n\ninterface LaunchWebAuthFlowPayload {\n  authorizeUrl: string;\n}\n\nexport interface ExtensionAuthClientOptions {\n  apiOrigin: string;\n  application?: string;\n  launchWebAuthFlow: (payload: LaunchWebAuthFlowPayload) => Promise<void>;\n}\n\nexport interface ExtensionAuthClient extends AuthClient {\n  loginWithWebAuthFlow(options?: LoginOptions): Promise<void>;\n}\n\nfunction buildAuthorizeUrl(apiOrigin: string, returnTo: string, application?: string): string {\n  const authorizeEndpoint = resolveApiEndpoint(authEndpoints.authorize, apiOrigin);\n  const authorizeUrl = new URL(authorizeEndpoint, window.location.origin);\n  authorizeUrl.searchParams.set(\"return_to\", returnTo);\n  if (application?.trim()) {\n    authorizeUrl.searchParams.set(\"app\", application.trim());\n  }\n  return authorizeUrl.toString();\n}\n\nexport function createExtensionAuthClient(\n  options: ExtensionAuthClientOptions,\n): ExtensionAuthClient {\n  const baseClient = createAuthClient({\n    apiOrigin: options.apiOrigin,\n    application: options.application,\n  });\n\n  const loginWithWebAuthFlow = async (loginOptions?: LoginOptions): Promise<void> => {\n    const returnTo = resolveReturnToPath(loginOptions?.returnTo);\n    const authorizeUrl = buildAuthorizeUrl(\n      options.apiOrigin,\n      returnTo,\n      loginOptions?.application ?? options.application,\n    );\n    await options.launchWebAuthFlow({\n      authorizeUrl,\n    });\n    await baseClient.refresh();\n  };\n\n  return {\n    ...baseClient,\n    login(loginOptions?: LoginOptions) {\n      void loginWithWebAuthFlow(loginOptions);\n    },\n    loginWithWebAuthFlow,\n  };\n}\n"]}

package/dist/index.d.ts

@@ -1,34 +1,27 @@
-import { A as AuthClient, G as GhostlySession } from './auth-client-CAHMjodm.js';
-export { L as LoginOptions, P as ProcessCallbackResult, S as SessionListener, a as SessionRequestOptions } from './auth-client-CAHMjodm.js';
-export { A as AuthErrorCode, a as AuthSdkError, b as AuthSdkErrorPayload, c as authErrorCode } from './auth-sdk-error-DKM7PyKC.js';
+import { a as AuthClientOptions, A as AuthClient, G as GhostlySession } from './auth-client-Cdkp07ii.js';
+export { b as AuthInitOptions, c as AuthInitResult, L as LoginOptions, S as SessionListener, d as SessionRequestOptions } from './auth-client-Cdkp07ii.js';
+export { A as AuthErrorCode, a as AuthSdkError, b as AuthSdkErrorPayload, c as authErrorCode } from './auth-sdk-error-D3gsfK9d.js';
 
 declare const authEndpoints: {
-    readonly loginStart: "/v1/auth/keycloak/login";
-    readonly validateKeycloakToken: "/v1/auth/keycloak/validate";
-    readonly session: "/v1/auth/me";
-    readonly logout: "/v1/auth/logout";
+    readonly authorize: "/oauth/authorize";
+    readonly providerCallback: "/oauth/callback/provider";
+    readonly session: "/oauth/session";
+    readonly refresh: "/oauth/refresh";
+    readonly logout: "/oauth/logout";
 };
 
-declare const authQueryKeys: {
-    readonly token: "token";
-};
 declare const authRoutes: {
     readonly root: "/";
-    readonly callback: "/auth/callback";
 };
 
-declare function createAuthClient(): AuthClient;
+declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-interface KeycloakValidateRequest {
-    token: string;
-}
-interface KeycloakValidateResponse {
-    session: GhostlySession;
-}
+type OauthSessionResponse = GhostlySession | null;
+type OauthRefreshResponse = GhostlySession | null;
 interface AuthErrorPayload {
     code: string;
     details: unknown;
     message: string;
 }
 
-export { AuthClient, type AuthErrorPayload, GhostlySession, type KeycloakValidateRequest, type KeycloakValidateResponse, authEndpoints, authQueryKeys, authRoutes, createAuthClient };
+export { AuthClient, AuthClientOptions, type AuthErrorPayload, GhostlySession, type OauthRefreshResponse, type OauthSessionResponse, authEndpoints, authRoutes, createAuthClient };