@ichinese/open-js-sdk 0.0.0-stage → 1.0.0-rc.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Center for Language Education and Cooperation (CLEC)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,40 @@
-# Temporary Holding Version
+# iChinese Open Platform JS SDK
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+爱中文开放平台的网页 JS SDK：应用的网页在桌面端、手机 App 和普通浏览器里用同一套代码登录，并调用容器的方法。
+
+The web JS SDK of the iChinese open platform: one set of code for an app's web pages, whether they run in the
+desktop app, the mobile apps' web containers or a plain browser. Inside a container `requestAuthCode()` gets the
+login code straight from the bridge, without a redirect; in a plain browser it falls back to OIDC.
+
+## Install
+
+```sh
+npm install @ichinese/open-js-sdk
+```
+
+## Quick start
+
+```ts
+import * as ichinese from '@ichinese/open-js-sdk';
+
+ichinese.config({ appId: 'cn.cli_…' });
+const env = await ichinese.ready(); // { container: 'desktop' | 'ios' | 'android' | 'browser', … }
+
+// Your backend exchanges the code with the server SDK's exchangeAuthCode.
+const result = await ichinese.requestAuthCode();
+await fetch('/api/login', { method: 'POST', body: JSON.stringify(result) });
+```
+
+In a plain browser `requestAuthCode()` signs in at the issuer (silently first). The page goes there and comes
+back; calling `requestAuthCode()` again on the way back returns the code.
+
+## Documentation
+
+Guides and the API reference: <https://open.ichinese.cn>
+
+This repository is generated from the platform's monorepo at each release, so a change made here would be
+overwritten; please open an issue instead.
+
+## License
+
+MIT

package/dist/bridge.d.ts

@@ -0,0 +1,31 @@
+export interface BridgeHost {
+    postMessage(message: string): void;
+}
+export interface BridgeErrorInfo {
+    code: string;
+    message?: string;
+}
+/** An error from the container (or the fallback): `code` is one of the protocol's error codes. */
+export declare class BridgeError extends Error {
+    readonly code: string;
+    readonly name = "BridgeError";
+    constructor(code: string, message?: string);
+}
+declare global {
+    interface Window {
+        ichOpenBridge?: BridgeHost;
+        __ichOpenBridgeReceive?: (message: string) => void;
+    }
+}
+/** The container's bridge object, when the page is inside one. */
+export declare function host(): BridgeHost | undefined;
+export declare class Transport {
+    private readonly bridge;
+    private seq;
+    private readonly pending;
+    private readonly listeners;
+    constructor(bridge: BridgeHost);
+    call<T>(method: string, params?: Record<string, unknown>, timeoutMs?: number | null): Promise<T>;
+    on(event: string, listener: (data: unknown) => void): () => void;
+    private receive;
+}

package/dist/gen/meta.d.ts

@@ -0,0 +1,8 @@
+/** The JS SDK's version (it follows the open API's). */
+export declare const VERSION = "1.0.0-rc.1";
+/** The single issuer (the plain-browser fallback signs in there); `config({ issuer })` overrides it. */
+export declare const DEFAULT_ISSUER = "https://id.ichinese.cn";
+/** Where each region's web serves the single-file build of this SDK. */
+export declare const SCRIPT_URL = "https://ichinese.cn/open-js-sdk/1/ichinese-open.js";
+/** The version of the container bridge's message protocol (docs/api/open-bridge.md). */
+export declare const BRIDGE_PROTOCOL = 1;

package/dist/ichinese-open.js

@@ -0,0 +1 @@
+"use strict";var ichinese=(()=>{var v=Object.defineProperty;var A=Object.getOwnPropertyDescriptor;var L=Object.getOwnPropertyNames;var V=Object.prototype.hasOwnProperty;var D=(e,r,n)=>r in e?v(e,r,{enumerable:!0,configurable:!0,writable:!0,value:n}):e[r]=n;var $=(e,r)=>{for(var n in r)v(e,n,{get:r[n],enumerable:!0})},q=(e,r,n,t)=>{if(r&&typeof r=="object"||typeof r=="function")for(let i of L(r))!V.call(e,i)&&i!==n&&v(e,i,{get:()=>r[i],enumerable:!(t=A(r,i))||t.enumerable});return e};var M=e=>q(v({},"__esModule",{value:!0}),e);var g=(e,r,n)=>D(e,typeof r!="symbol"?r+"":r,n);var re={};$(re,{BRIDGE_PROTOCOL:()=>_,BridgeError:()=>d,DEFAULT_ISSUER:()=>y,SCRIPT_URL:()=>P,VERSION:()=>h,_reset:()=>ee,close:()=>Y,config:()=>J,env:()=>B,inContainer:()=>K,on:()=>Z,openExternal:()=>z,ready:()=>f,requestAuthCode:()=>W,setTitle:()=>X,shareToChat:()=>Q});var h="1.0.0-rc.1",y="https://id.ichinese.cn",P="https://ichinese.cn/open-js-sdk/1/ichinese-open.js",_=1;var d=class extends Error{constructor(n,t){super(t||n);g(this,"code",n);g(this,"name","BridgeError")}},R=()=>typeof window=="undefined"?void 0:window;function b(){var r;let e=(r=R())==null?void 0:r.ichOpenBridge;return e&&typeof e.postMessage=="function"?e:void 0}var x=class{constructor(r){g(this,"bridge",r);g(this,"seq",0);g(this,"pending",new Map);g(this,"listeners",new Map);let n=R();if(!n)return;let t=n.__ichOpenBridgeReceive;n.__ichOpenBridgeReceive=i=>{this.receive(i),t&&t!==n.__ichOpenBridgeReceive&&t(i)}}call(r,n={},t=15e3){let i=`${Date.now().toString(36)}-${(++this.seq).toString(36)}`;return new Promise((c,s)=>{let o=t===null?null:setTimeout(()=>{this.pending.delete(i),s(new d("timeout",`${r}: no answer from the container`))},t);this.pending.set(i,{resolve:c,reject:s,timer:o});try{this.bridge.postMessage(JSON.stringify({v:1,id:i,method:r,params:n}))}catch(p){o&&clearTimeout(o),this.pending.delete(i),s(new d("internal",p.message))}})}on(r,n){let t=this.listeners.get(r);return t||(t=new Set,this.listeners.set(r,t)),t.add(n),()=>t.delete(n)}receive(r){var i,c,s,o,p;let n;try{n=typeof r=="string"?JSON.parse(r):r}catch{return}if(!n||typeof n!="object")return;if(typeof n.event=="string"){for(let w of(i=this.listeners.get(n.event))!=null?i:[])try{w(n.data)}catch{}return}let t=n.id?this.pending.get(n.id):void 0;t&&(this.pending.delete(n.id),t.timer&&clearTimeout(t.timer),n.ok?t.resolve((c=n.result)!=null?c:{}):t.reject(new d((o=(s=n.error)==null?void 0:s.code)!=null?o:"internal",(p=n.error)==null?void 0:p.message)))}};var I="ichopen:oidc:",N=10*6e4,j=new Set(["login_required","consent_required","interaction_required","account_selection_required"]),U=e=>btoa(String.fromCharCode(...e)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,""),E=e=>U(crypto.getRandomValues(new Uint8Array(e)));async function H(e){let r=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return U(new Uint8Array(r))}function O(){try{return window.sessionStorage}catch{return null}}function G(e){for(let r of["code","state","error","error_description","iss","session_state"])e.searchParams.delete(r);try{history.replaceState(history.state,"",e.toString())}catch{}}function T(){let e=new URL(window.location.href),r=e.searchParams.get("state"),n=e.searchParams.get("code"),t=e.searchParams.get("error");if(!r||!n&&!t)return null;let i=O(),c=i==null?void 0:i.getItem(I+r);if(!c)return null;i==null||i.removeItem(I+r),G(e);let s=JSON.parse(c);return Date.now()-s.at>N?{error:"expired"}:n?{ok:{code:n,state:r,redirectUri:s.redirectUri,codeVerifier:s.verifier}}:s.silent&&t&&j.has(t)?{retry:{...s,state:r}}:{error:t!=null?t:"unknown"}}async function S(e,r){let n=O();if(!n)throw new d("unsupported","sessionStorage is not available");let t=E(16),i=E(32);n.setItem(I+t,JSON.stringify({verifier:i,redirectUri:e.redirectUri,appId:e.appId,silent:r,at:Date.now()}));let c=new URLSearchParams({client_id:e.appId,redirect_uri:e.redirectUri,response_type:"code",scope:["openid",...e.scopes.filter(s=>s!=="openid")].join(" "),state:t,nonce:E(16),code_challenge:await H(i),code_challenge_method:"S256",...r?{prompt:"none"}:{},...e.locale?{ui_locales:e.locale}:{}});return window.location.assign(`${e.issuer.replace(/\/$/,"")}/auth?${c}`),new Promise(()=>{})}var u={},a,l,m;function J(e){u={...u,...e}}function k(){var r;let e=typeof matchMedia=="function"&&matchMedia("(prefers-color-scheme: dark)").matches;return{container:"browser",containerVersion:null,locale:typeof navigator!="undefined"&&navigator.language||"en",theme:e?"dark":"light",appId:(r=u.appId)!=null?r:null,sdkVersion:h}}function f(){return m||(m=(async()=>{var n,t,i,c,s;typeof document!="undefined"&&document.readyState==="loading"&&await new Promise(o=>document.addEventListener("DOMContentLoaded",()=>o(),{once:!0}));let e=b();for(let o=0;!e&&o<5&&F();o++)await new Promise(p=>setTimeout(p,60)),e=b();if(!e)return l=k(),l;a=new x(e);let r=await a.call("env",{},5e3);return l={container:r.container,containerVersion:(n=r.container_version)!=null?n:null,locale:(t=r.locale)!=null?t:k().locale,theme:(i=r.theme)!=null?i:"light",appId:(s=(c=r.app_id)!=null?c:u.appId)!=null?s:null,sdkVersion:h},a.on("themeChanged",o=>{l&&o&&typeof o=="object"&&(l.theme=o.theme)}),a.on("localeChanged",o=>{l&&o&&typeof o=="object"&&(l.locale=o.locale)}),l})(),m)}function F(){return typeof navigator!="undefined"&&/\bIchineseApp\//.test(navigator.userAgent)}function B(){return l!=null?l:k()}var K=()=>B().container!=="browser";async function W(e={}){var c,s,o,p,w;let r=await f();if(r.container!=="browser"&&a){let C=await a.call("requestAuthCode",(c=e.scopes)!=null&&c.length?{scopes:e.scopes}:{},null);return{code:C.code,via:"bridge",expiresIn:C.expires_in}}let n=T();if(n&&"ok"in n)return{...n.ok,via:"oidc"};let t=u.appId;if(!t)throw new d("invalid_params","config({ appId }) first: needed outside the containers");let i={issuer:(s=u.issuer)!=null?s:y,appId:t,redirectUri:(o=u.redirectUri)!=null?o:`${location.origin}${location.pathname}`,scopes:(w=(p=e.scopes)!=null?p:u.scopes)!=null?w:[],locale:r.locale};if(n&&"retry"in n)return S(i,!1);if(n&&"error"in n)throw new d(n.error==="access_denied"?"consent_denied":n.error,`the issuer answered ${n.error}`);return S(i,!0)}async function X(e){let r=await f(),n=String(e).slice(0,100);if(r.container==="browser"||!a){document.title=n;return}await a.call("setTitle",{title:n})}async function Y(){if((await f()).container==="browser"||!a){window.close();return}await a.call("close")}async function z(e){let r=new URL(e,location.href);if(r.protocol!=="https:"&&r.protocol!=="http:")throw new d("invalid_params","http(s) links only");if((await f()).container==="browser"||!a){window.open(r.toString(),"_blank","noopener,noreferrer");return}await a.call("openExternal",{url:r.toString()})}async function Q(e){if((await f()).container==="browser"||!a){if(typeof navigator!="undefined"&&typeof navigator.share=="function")try{return await navigator.share({title:e.title,text:e.description,url:e.url}),{shared:!0}}catch{return{shared:!1}}throw new d("unsupported_method","sharing to a conversation needs the desktop or mobile app")}return a.call("shareToChat",{title:e.title,description:e.description,url:e.url,image_url:e.imageUrl},null)}function Z(e,r){return a?a.on(e,r):()=>{}}function ee(){u={},a=void 0,l=void 0,m=void 0}return M(re);})();

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+export { BridgeError } from './bridge.ts';
+export { BRIDGE_PROTOCOL, DEFAULT_ISSUER, SCRIPT_URL, VERSION } from './gen/meta.ts';
+export type Container = 'desktop' | 'ios' | 'android' | 'browser';
+export interface Env {
+    container: Container;
+    /** The desktop or mobile app's version (null in a browser). */
+    containerVersion: string | null;
+    /** The interface language (BCP 47). */
+    locale: string;
+    theme: 'light' | 'dark';
+    /** The app the container opened (null in a browser: from `config`). */
+    appId: string | null;
+    /** This SDK's version. */
+    sdkVersion: string;
+}
+export interface Config {
+    /** Your App ID (`<region>.cli_…`): needed in a plain browser (the container knows which app it opened). */
+    appId?: string;
+    /** The issuer of the browser fallback (default: the release's, `https://id.ichinese.cn`). */
+    issuer?: string;
+    /** Where the issuer sends the browser back (registered in the developer console; default: this page). */
+    redirectUri?: string;
+    /** Scopes to ask for in the browser fallback besides `openid` (in a container: all the app declares). */
+    scopes?: string[];
+}
+export interface AuthCode {
+    /** One-time, 5 minutes, bound to your app (and in a container, to this page's origin). */
+    code: string;
+    /** `bridge`: from the container; `oidc`: from the issuer (plain browser). */
+    via: 'bridge' | 'oidc';
+    /** For `exchangeAuthCode` (oidc only). */
+    redirectUri?: string;
+    /** For `exchangeAuthCode` (oidc only). */
+    codeVerifier?: string;
+    /** The OAuth state that came back (oidc only; already checked against the one sent). */
+    state?: string;
+    /** Seconds the code stays valid (bridge only). */
+    expiresIn?: number;
+}
+export interface ShareCard {
+    title: string;
+    description?: string;
+    /** A page of your app (on one of its trusted origins). */
+    url: string;
+    imageUrl?: string;
+}
+/** Sets the app and the browser fallback's options (call before `requestAuthCode` in a browser). */
+export declare function config(c: Config): void;
+/** Waits for the page and the container (if any); what `env()` returns afterwards. */
+export declare function ready(): Promise<Env>;
+/** Where the page runs (call after `ready()`; before it, a browser's guess). */
+export declare function env(): Env;
+/** Whether the page is inside the desktop app or a mobile app. */
+export declare const inContainer: () => boolean;
+/**
+ * 免登: an authorization code for the signed-in user, for your backend to exchange (`exchangeAuthCode`
+ * of the server SDKs). In a container, the user is asked scope by scope first when the app is not added
+ * yet or wants something new; `scopes` asks again for ones refused before (unless 「不再询问」).
+ * Rejects with a `BridgeError` (`consent_denied`, `origin_not_trusted`, `app_disabled`, …).
+ */
+export declare function requestAuthCode(opts?: {
+    scopes?: string[];
+}): Promise<AuthCode>;
+/** The window's title (in a browser: the document's). */
+export declare function setTitle(title: string): Promise<void>;
+/** Closes the app's window (or its page in the mobile container). */
+export declare function close(): Promise<void>;
+/** Opens a link in the system browser (http and https only). */
+export declare function openExternal(url: string): Promise<void>;
+/**
+ * 分享到会话: the container's own conversation picker; the chosen conversations get a card of your app.
+ * `shared: false` when the user closed the picker. In a browser: the system share sheet when there is
+ * one, else `BridgeError('unsupported_method')`.
+ */
+export declare function shareToChat(card: ShareCard): Promise<{
+    shared: boolean;
+}>;
+/** Container events: `themeChanged` ({ theme }), `localeChanged` ({ locale }). Returns an unsubscribe. */
+export declare function on(event: 'themeChanged' | 'localeChanged', listener: (data: unknown) => void): () => void;
+/** Tests: forget what `ready()` found. */
+export declare function _reset(): void;

package/dist/index.js

@@ -0,0 +1,333 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/gen/meta.ts
+var VERSION = "1.0.0-rc.1";
+var DEFAULT_ISSUER = "https://id.ichinese.cn";
+var SCRIPT_URL = "https://ichinese.cn/open-js-sdk/1/ichinese-open.js";
+var BRIDGE_PROTOCOL = 1;
+
+// src/bridge.ts
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message || code);
+    __publicField(this, "code", code);
+    __publicField(this, "name", "BridgeError");
+  }
+};
+var w = () => typeof window === "undefined" ? void 0 : window;
+function host() {
+  var _a;
+  const b = (_a = w()) == null ? void 0 : _a.ichOpenBridge;
+  return b && typeof b.postMessage === "function" ? b : void 0;
+}
+var Transport = class {
+  constructor(bridge) {
+    __publicField(this, "bridge", bridge);
+    __publicField(this, "seq", 0);
+    __publicField(this, "pending", /* @__PURE__ */ new Map());
+    __publicField(this, "listeners", /* @__PURE__ */ new Map());
+    const win = w();
+    if (!win) return;
+    const previous = win.__ichOpenBridgeReceive;
+    win.__ichOpenBridgeReceive = (message) => {
+      this.receive(message);
+      if (previous && previous !== win.__ichOpenBridgeReceive) previous(message);
+    };
+  }
+  call(method, params = {}, timeoutMs = 15e3) {
+    const id = `${Date.now().toString(36)}-${(++this.seq).toString(36)}`;
+    return new Promise((resolve, reject) => {
+      const timer = timeoutMs === null ? null : setTimeout(() => {
+        this.pending.delete(id);
+        reject(new BridgeError("timeout", `${method}: no answer from the container`));
+      }, timeoutMs);
+      this.pending.set(id, { resolve, reject, timer });
+      try {
+        this.bridge.postMessage(JSON.stringify({ v: BRIDGE_PROTOCOL, id, method, params }));
+      } catch (e) {
+        if (timer) clearTimeout(timer);
+        this.pending.delete(id);
+        reject(new BridgeError("internal", e.message));
+      }
+    });
+  }
+  on(event, listener) {
+    let set = this.listeners.get(event);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.listeners.set(event, set);
+    }
+    set.add(listener);
+    return () => set.delete(listener);
+  }
+  receive(message) {
+    var _a, _b, _c, _d, _e;
+    let m;
+    try {
+      m = typeof message === "string" ? JSON.parse(message) : message;
+    } catch {
+      return;
+    }
+    if (!m || typeof m !== "object") return;
+    if (typeof m.event === "string") {
+      for (const l of (_a = this.listeners.get(m.event)) != null ? _a : []) {
+        try {
+          l(m.data);
+        } catch {
+        }
+      }
+      return;
+    }
+    const p = m.id ? this.pending.get(m.id) : void 0;
+    if (!p) return;
+    this.pending.delete(m.id);
+    if (p.timer) clearTimeout(p.timer);
+    if (m.ok) p.resolve((_b = m.result) != null ? _b : {});
+    else p.reject(new BridgeError((_d = (_c = m.error) == null ? void 0 : _c.code) != null ? _d : "internal", (_e = m.error) == null ? void 0 : _e.message));
+  }
+};
+
+// src/oidc.ts
+var KEY = "ichopen:oidc:";
+var MAX_AGE = 10 * 6e4;
+var INTERACTIVE = /* @__PURE__ */ new Set([
+  "login_required",
+  "consent_required",
+  "interaction_required",
+  "account_selection_required"
+]);
+var b64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var random = (n) => b64url(crypto.getRandomValues(new Uint8Array(n)));
+async function challenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return b64url(new Uint8Array(digest));
+}
+function store() {
+  try {
+    return window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+function cleanUrl(url) {
+  for (const k of ["code", "state", "error", "error_description", "iss", "session_state"]) url.searchParams.delete(k);
+  try {
+    history.replaceState(history.state, "", url.toString());
+  } catch {
+  }
+}
+function takeResult() {
+  const url = new URL(window.location.href);
+  const state = url.searchParams.get("state");
+  const code = url.searchParams.get("code");
+  const error = url.searchParams.get("error");
+  if (!state || !code && !error) return null;
+  const s = store();
+  const raw = s == null ? void 0 : s.getItem(KEY + state);
+  if (!raw) return null;
+  s == null ? void 0 : s.removeItem(KEY + state);
+  cleanUrl(url);
+  const p = JSON.parse(raw);
+  if (Date.now() - p.at > MAX_AGE) return { error: "expired" };
+  if (code) return { ok: { code, state, redirectUri: p.redirectUri, codeVerifier: p.verifier } };
+  if (p.silent && error && INTERACTIVE.has(error)) return { retry: { ...p, state } };
+  return { error: error != null ? error : "unknown" };
+}
+async function redirect(o, silent) {
+  const s = store();
+  if (!s) throw new BridgeError("unsupported", "sessionStorage is not available");
+  const state = random(16);
+  const verifier = random(32);
+  s.setItem(
+    KEY + state,
+    JSON.stringify({ verifier, redirectUri: o.redirectUri, appId: o.appId, silent, at: Date.now() })
+  );
+  const q = new URLSearchParams({
+    client_id: o.appId,
+    redirect_uri: o.redirectUri,
+    response_type: "code",
+    scope: ["openid", ...o.scopes.filter((x) => x !== "openid")].join(" "),
+    state,
+    nonce: random(16),
+    code_challenge: await challenge(verifier),
+    code_challenge_method: "S256",
+    ...silent ? { prompt: "none" } : {},
+    ...o.locale ? { ui_locales: o.locale } : {}
+  });
+  window.location.assign(`${o.issuer.replace(/\/$/, "")}/auth?${q}`);
+  return new Promise(() => {
+  });
+}
+
+// src/index.ts
+var cfg = {};
+var transport;
+var current;
+var readyPromise;
+function config(c) {
+  cfg = { ...cfg, ...c };
+}
+function browserEnv() {
+  var _a;
+  const dark = typeof matchMedia === "function" && matchMedia("(prefers-color-scheme: dark)").matches;
+  return {
+    container: "browser",
+    containerVersion: null,
+    locale: typeof navigator !== "undefined" && navigator.language || "en",
+    theme: dark ? "dark" : "light",
+    appId: (_a = cfg.appId) != null ? _a : null,
+    sdkVersion: VERSION
+  };
+}
+function ready() {
+  if (readyPromise) return readyPromise;
+  readyPromise = (async () => {
+    var _a, _b, _c, _d, _e;
+    if (typeof document !== "undefined" && document.readyState === "loading") {
+      await new Promise((r) => document.addEventListener("DOMContentLoaded", () => r(), { once: true }));
+    }
+    let b = host();
+    for (let i = 0; !b && i < 5 && looksLikeContainer(); i++) {
+      await new Promise((r) => setTimeout(r, 60));
+      b = host();
+    }
+    if (!b) {
+      current = browserEnv();
+      return current;
+    }
+    transport = new Transport(b);
+    const e = await transport.call("env", {}, 5e3);
+    current = {
+      container: e.container,
+      containerVersion: (_a = e.container_version) != null ? _a : null,
+      locale: (_b = e.locale) != null ? _b : browserEnv().locale,
+      theme: (_c = e.theme) != null ? _c : "light",
+      appId: (_e = (_d = e.app_id) != null ? _d : cfg.appId) != null ? _e : null,
+      sdkVersion: VERSION
+    };
+    transport.on("themeChanged", (d) => {
+      if (current && d && typeof d === "object") current.theme = d.theme;
+    });
+    transport.on("localeChanged", (d) => {
+      if (current && d && typeof d === "object") current.locale = d.locale;
+    });
+    return current;
+  })();
+  return readyPromise;
+}
+function looksLikeContainer() {
+  return typeof navigator !== "undefined" && /\bIchineseApp\//.test(navigator.userAgent);
+}
+function env() {
+  return current != null ? current : browserEnv();
+}
+var inContainer = () => env().container !== "browser";
+async function requestAuthCode(opts = {}) {
+  var _a, _b, _c, _d, _e;
+  const e = await ready();
+  if (e.container !== "browser" && transport) {
+    const r = await transport.call(
+      "requestAuthCode",
+      ((_a = opts.scopes) == null ? void 0 : _a.length) ? { scopes: opts.scopes } : {},
+      // The user may take a while in the consent window.
+      null
+    );
+    return { code: r.code, via: "bridge", expiresIn: r.expires_in };
+  }
+  const back = takeResult();
+  if (back && "ok" in back) return { ...back.ok, via: "oidc" };
+  const appId = cfg.appId;
+  if (!appId) throw new BridgeError("invalid_params", "config({ appId }) first: needed outside the containers");
+  const o = {
+    issuer: (_b = cfg.issuer) != null ? _b : DEFAULT_ISSUER,
+    appId,
+    redirectUri: (_c = cfg.redirectUri) != null ? _c : `${location.origin}${location.pathname}`,
+    scopes: (_e = (_d = opts.scopes) != null ? _d : cfg.scopes) != null ? _e : [],
+    locale: e.locale
+  };
+  if (back && "retry" in back) return redirect(o, false);
+  if (back && "error" in back) {
+    throw new BridgeError(
+      back.error === "access_denied" ? "consent_denied" : back.error,
+      `the issuer answered ${back.error}`
+    );
+  }
+  return redirect(o, true);
+}
+async function setTitle(title) {
+  const e = await ready();
+  const t = String(title).slice(0, 100);
+  if (e.container === "browser" || !transport) {
+    document.title = t;
+    return;
+  }
+  await transport.call("setTitle", { title: t });
+}
+async function close() {
+  const e = await ready();
+  if (e.container === "browser" || !transport) {
+    window.close();
+    return;
+  }
+  await transport.call("close");
+}
+async function openExternal(url) {
+  const u = new URL(url, location.href);
+  if (u.protocol !== "https:" && u.protocol !== "http:") throw new BridgeError("invalid_params", "http(s) links only");
+  const e = await ready();
+  if (e.container === "browser" || !transport) {
+    window.open(u.toString(), "_blank", "noopener,noreferrer");
+    return;
+  }
+  await transport.call("openExternal", { url: u.toString() });
+}
+async function shareToChat(card) {
+  const e = await ready();
+  if (e.container === "browser" || !transport) {
+    if (typeof navigator !== "undefined" && typeof navigator.share === "function") {
+      try {
+        await navigator.share({ title: card.title, text: card.description, url: card.url });
+        return { shared: true };
+      } catch {
+        return { shared: false };
+      }
+    }
+    throw new BridgeError("unsupported_method", "sharing to a conversation needs the desktop or mobile app");
+  }
+  return transport.call(
+    "shareToChat",
+    { title: card.title, description: card.description, url: card.url, image_url: card.imageUrl },
+    null
+  );
+}
+function on(event, listener) {
+  if (!transport) return () => {
+  };
+  return transport.on(event, listener);
+}
+function _reset() {
+  cfg = {};
+  transport = void 0;
+  current = void 0;
+  readyPromise = void 0;
+}
+export {
+  BRIDGE_PROTOCOL,
+  BridgeError,
+  DEFAULT_ISSUER,
+  SCRIPT_URL,
+  VERSION,
+  _reset,
+  close,
+  config,
+  env,
+  inContainer,
+  on,
+  openExternal,
+  ready,
+  requestAuthCode,
+  setTitle,
+  shareToChat
+};

package/dist/oidc.d.ts

@@ -0,0 +1,33 @@
+export interface OidcOptions {
+    issuer: string;
+    appId: string;
+    redirectUri: string;
+    scopes: string[];
+    locale?: string;
+}
+export interface OidcCode {
+    code: string;
+    state: string;
+    redirectUri: string;
+    codeVerifier: string;
+}
+interface Pending {
+    verifier: string;
+    redirectUri: string;
+    appId: string;
+    silent: boolean;
+    at: number;
+}
+/** The answer in the current address, if it is the end of one of our own requests. */
+export declare function takeResult(): {
+    ok: OidcCode;
+} | {
+    retry: Pending & {
+        state: string;
+    };
+} | {
+    error: string;
+} | null;
+/** Sends the page to the issuer (the returned promise never settles: the page goes away). */
+export declare function redirect(o: OidcOptions, silent: boolean): Promise<never>;
+export {};

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@ichinese/open-js-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0-rc.1",
+  "description": "Web JS SDK for iChinese open platform web apps: the login bridge (requestAuthCode) in the desktop and mobile apps, falling back to OIDC in a plain browser, and the container's methods",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "node build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ichinese-cn/open-sdk-js.git"
+  },
+  "homepage": "https://github.com/ichinese-cn/open-sdk-js#readme",
+  "bugs": {
+    "url": "https://github.com/ichinese-cn/open-sdk-js/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "24.19.2",
+    "esbuild": "0.28.2",
+    "happy-dom": "21.0.1",
+    "typescript": "5.9.3",
+    "vitest": "5.0.4"
+  }
+}