@icp-sdk/auth 7.0.0 → 8.0.0

package/dist/esm/client/auth-client.d.ts

@@ -53,6 +53,29 @@ export interface AuthClientCreateOptions {
      * @example "toolbar=0,location=0,menubar=0,width=500,height=500,left=100,top=100"
      */
     windowOpenerFeatures?: string;
+    /**
+     * How the client communicates with the identity provider.
+     *
+     * - `'window'` (default) — the identity provider opens in a separate browser
+     *   tab or window (a popup when {@link windowOpenerFeatures} is set) and
+     *   communicates over the ICRC-29 `postMessage` transport.
+     * - `'redirect'` — the current page navigates to the identity provider over
+     *   the ICRC-167 URL transport, which returns to this same page. The callback
+     *   URL is the current page's URL (`location.origin + location.pathname`), so
+     *   that page must be on an origin you control and declared in that origin's
+     *   `/.well-known/ii-auth-callbacks` allow-list. Use it for full-page sign-in
+     *   that shouldn't need a user gesture to open a window (e.g. redirecting on a
+     *   restricted route), or native apps handing off via universal links.
+     *
+     * With `'redirect'` the page unloads on each step and the flow re-runs on the
+     * return load, so call `signIn` / `requestAttributes` directly on the page's
+     * load (not deferred behind, say, a click handler): a fresh visit starts the
+     * flow and the identity provider's return replays it to completion. Give each
+     * flow its own route so its persisted state stays isolated.
+     * @default 'window'
+     * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_167_browser_url_transport.md
+     */
+    transport?: 'window' | 'redirect';
     /**
      * OpenID provider for one-click sign-in. When set, the identity provider
      * URL includes an `openid` search param so the user authenticates via
@@ -132,16 +155,62 @@ export declare class AuthClient {
     /**
      * Requests signed identity attributes from the identity provider.
      *
+     * The `nonce` is a callback that produces the 32-byte nonce (typically
+     * fetched from the RP canister), returning a promise resolving to it. It is a
+     * callback rather than a value so the redirect flow can journal the nonce and
+     * reuse the exact same bytes when the flow replays on the return load,
+     * instead of fetching a fresh single-use nonce that the signer never signed
+     * against.
+     *
+     * In 'window' mode the callback lets the identity provider window open while the
+     * nonce is still resolving, avoiding a perceived delay before the user sees
+     * the prompt; auto-close of the signer transport channel is temporarily
+     * disabled while awaiting so the window cannot be closed out from under the
+     * pending flow.
+     *
      * @param params - Request parameters.
      * @param params.keys - Attribute keys to request (e.g. `['email', 'name']`).
-     * @param params.nonce - 32-byte nonce issued by the RP canister.
+     * @param params.nonce - Produces the 32-byte nonce issued by the RP canister,
+     *   as a promise resolving to it.
      * @returns Signed attribute data and signature.
      * @throws When the identity provider returns an error or an invalid response.
      */
     requestAttributes(params: {
         keys: string[];
-        nonce: Uint8Array;
+        nonce: () => Promise<Uint8Array>;
     }): Promise<SignedAttributes>;
+    /**
+     * Runs and journals a piece of your own async work so its result stays stable
+     * across the `'redirect'` flow.
+     *
+     * In `'redirect'` mode the page unloads on each step and `signIn` /
+     * `requestAttributes` re-run on the return load, so a value you compute on the
+     * first visit (from `location`, a fetch, `crypto`, …) would otherwise be
+     * recomputed — and may differ — on the return. Wrap it in `memoize`: it runs
+     * `produce` once on the first visit, journals the result, and replays that
+     * result on the return load instead of re-running. Use it for a value the
+     * post-flow code depends on, e.g. the URL to navigate to once sign-in
+     * completes:
+     *
+     * ```ts
+     * const next = await authClient.memoize(
+     *   () => new URLSearchParams(location.search).get('next') ?? '/',
+     * );
+     * await authClient.signIn();
+     * location.assign(next); // the value captured before the redirect
+     * ```
+     *
+     * Call `memoize` in a stable order relative to `signIn` / `requestAttributes`
+     * across loads (same order every load — branch only on values recovered from
+     * earlier results), and keep the result JSON-serializable, since the journal
+     * is JSON.
+     *
+     * In `'window'` mode there is no redirect, so this simply runs `produce` and
+     * returns its result without persisting anything.
+     * @param produce - Produces the value to journal on the first load.
+     * @returns The produced value, or the journaled value on a replay load.
+     */
+    memoize<T>(produce: () => T | Promise<T>): Promise<T>;
     /**
      * Clears the stored session and resets the client to an anonymous state.
      *

package/dist/esm/client/auth-client.js

@@ -1,7 +1,7 @@
 import { AnonymousIdentity } from '@icp-sdk/core/agent';
 import { DelegationChain, DelegationIdentity, ECDSAKeyIdentity, Ed25519KeyIdentity, isDelegationValid, PartialDelegationIdentity, } from '@icp-sdk/core/identity';
 import { Signer } from '@icp-sdk/signer';
-import { PostMessageTransport } from '@icp-sdk/signer/web';
+import { PostMessageTransport, UrlTransport } from '@icp-sdk/signer/web';
 import { IdleManager } from './idle-manager.js';
 import { IdbStorage, KEY_STORAGE_DELEGATION, KEY_STORAGE_KEY, KEY_VECTOR, LocalStorage, } from './storage.js';
 const NANOSECONDS_PER_SECOND = BigInt(1_000_000_000);
@@ -14,6 +14,10 @@ const ED25519_KEY_LABEL = 'Ed25519';
 // localStorage key used to cache the delegation expiration so that
 // isAuthenticated() can answer synchronously without hitting IndexedDB.
 const KEY_STORAGE_EXPIRATION = 'ic-delegation_expiration';
+// Storage key prefix for a redirect flow's session key, held only while the
+// flow is in progress (keyed by a per-flow id) and removed once the delegation
+// is persisted. See AuthClient.#acquireSessionKey.
+const PENDING_KEY_PREFIX = 'ic-auth-pending-key:';
 export const OPENID_PROVIDER_URLS = {
     google: 'https://accounts.google.com',
     apple: 'https://appleid.apple.com',
@@ -35,6 +39,9 @@ export class AuthClient {
     #chain = null;
     #storage;
     #signer;
+    // Set only in redirect mode, so the redirect-specific paths (nonce/key
+    // journaling) can reach `memoize`. Undefined in the default 'window' mode.
+    #urlTransport;
     #options;
     #initPromise = null;
     idleManager;
@@ -45,10 +52,19 @@ export class AuthClient {
         if (options.openIdProvider) {
             identityProviderUrl.searchParams.set('openid', OPENID_PROVIDER_URLS[options.openIdProvider]);
         }
-        const transport = new PostMessageTransport({
-            url: identityProviderUrl.toString(),
-            windowOpenerFeatures: options.windowOpenerFeatures,
-        });
+        const transport = options.transport === 'redirect'
+            ? new UrlTransport({
+                url: identityProviderUrl.toString(),
+                // The callback is this page: a fresh visit starts the flow and the
+                // provider's return lands back here to replay it. Drop any query
+                // and fragment so it stays stable across the redirect.
+                callbackUrl: `${globalThis.location.origin}${globalThis.location.pathname}`,
+            })
+            : new PostMessageTransport({
+                url: identityProviderUrl.toString(),
+                windowOpenerFeatures: options.windowOpenerFeatures,
+            });
+        this.#urlTransport = transport instanceof UrlTransport ? transport : undefined;
         this.#signer = new Signer({
             transport,
             derivationOrigin: options.derivationOrigin?.toString(),
@@ -95,8 +111,10 @@ export class AuthClient {
     async signIn(options) {
         await this.#signer.openChannel();
         const maxTimeToLive = options?.maxTimeToLive ?? DEFAULT_MAX_TIME_TO_LIVE;
-        // Fresh key per sign-in so each session has its own cryptographic identity.
-        const key = this.#options.identity ?? (await generateKey(this.#options.keyType ?? ECDSA_KEY_LABEL));
+        const keyType = this.#options.keyType ?? ECDSA_KEY_LABEL;
+        const { key, pendingKeySlot } = this.#urlTransport
+            ? await this.#ensureSessionKeyForRedirectFlow(this.#urlTransport, keyType)
+            : { key: await this.#ensureSessionKeyForWindowFlow(keyType) };
         const delegationChain = await this.#signer.requestDelegation({
             publicKey: key.getPublicKey(),
             targets: options?.targets,
@@ -118,19 +136,70 @@ export class AuthClient {
         // Persist so the session survives page reloads.
         await persistChain(this.#storage, this.#chain);
         await persistKey(this.#storage, key);
+        // The flow is complete: the delegation is bound to this key and stored, so
+        // the per-flow pending copy is no longer needed.
+        if (pendingKeySlot !== undefined) {
+            await this.#storage.remove(pendingKeySlot);
+        }
         return this.#identity;
     }
+    // Window flow: sign-in completes in a single load, so a fresh session key per
+    // sign-in is enough (or the caller-provided identity), with nothing to
+    // persist for a later load.
+    async #ensureSessionKeyForWindowFlow(keyType) {
+        return this.#options.identity ?? (await generateKey(keyType));
+    }
+    // Redirect flow: `signIn` runs twice — once on the load that navigates to the
+    // identity provider, and again on the return load that replays the delegation
+    // minted for the FIRST load's key. Both runs must therefore use the same key.
+    // A per-flow key id is journaled via the transport (stable across the
+    // redirect) and the key is kept in storage under that id, so the return load
+    // restores the same key rather than generating a fresh one that would not
+    // match the replayed delegation. A caller-provided identity is already stable
+    // across the redirect, so it is used as-is with nothing persisted.
+    async #ensureSessionKeyForRedirectFlow(transport, keyType) {
+        if (this.#options.identity !== undefined) {
+            return { key: this.#options.identity };
+        }
+        const keyId = await transport.memoize(() => globalThis.crypto.randomUUID());
+        const pendingKeySlot = `${PENDING_KEY_PREFIX}${keyId}`;
+        const restored = await restoreKeyAt(this.#storage, pendingKeySlot);
+        if (restored) {
+            return { key: restored, pendingKeySlot };
+        }
+        const key = await generateKey(keyType);
+        await this.#storage.set(pendingKeySlot, serializeKey(key));
+        return { key, pendingKeySlot };
+    }
     /**
      * Requests signed identity attributes from the identity provider.
      *
+     * The `nonce` is a callback that produces the 32-byte nonce (typically
+     * fetched from the RP canister), returning a promise resolving to it. It is a
+     * callback rather than a value so the redirect flow can journal the nonce and
+     * reuse the exact same bytes when the flow replays on the return load,
+     * instead of fetching a fresh single-use nonce that the signer never signed
+     * against.
+     *
+     * In 'window' mode the callback lets the identity provider window open while the
+     * nonce is still resolving, avoiding a perceived delay before the user sees
+     * the prompt; auto-close of the signer transport channel is temporarily
+     * disabled while awaiting so the window cannot be closed out from under the
+     * pending flow.
+     *
      * @param params - Request parameters.
      * @param params.keys - Attribute keys to request (e.g. `['email', 'name']`).
-     * @param params.nonce - 32-byte nonce issued by the RP canister.
+     * @param params.nonce - Produces the 32-byte nonce issued by the RP canister,
+     *   as a promise resolving to it.
      * @returns Signed attribute data and signature.
      * @throws When the identity provider returns an error or an invalid response.
      */
     async requestAttributes(params) {
-        const nonceBytes = params.nonce;
+        // In redirect mode the nonce is journaled (base64, since the journal is
+        // JSON) so the replay on the return load signs against the same bytes.
+        const nonceBytes = this.#urlTransport
+            ? fromBase64(await this.#urlTransport.memoize(async () => toBase64(await params.nonce())))
+            : await this.#resolveNonce(params.nonce);
         const response = await this.#signer.sendRequest({
             jsonrpc: '2.0',
             id: globalThis.crypto.randomUUID(),
@@ -154,6 +223,43 @@ export class AuthClient {
             throw new Error('Invalid response: data or signature is not valid base64', { cause });
         }
     }
+    /**
+     * Runs and journals a piece of your own async work so its result stays stable
+     * across the `'redirect'` flow.
+     *
+     * In `'redirect'` mode the page unloads on each step and `signIn` /
+     * `requestAttributes` re-run on the return load, so a value you compute on the
+     * first visit (from `location`, a fetch, `crypto`, …) would otherwise be
+     * recomputed — and may differ — on the return. Wrap it in `memoize`: it runs
+     * `produce` once on the first visit, journals the result, and replays that
+     * result on the return load instead of re-running. Use it for a value the
+     * post-flow code depends on, e.g. the URL to navigate to once sign-in
+     * completes:
+     *
+     * ```ts
+     * const next = await authClient.memoize(
+     *   () => new URLSearchParams(location.search).get('next') ?? '/',
+     * );
+     * await authClient.signIn();
+     * location.assign(next); // the value captured before the redirect
+     * ```
+     *
+     * Call `memoize` in a stable order relative to `signIn` / `requestAttributes`
+     * across loads (same order every load — branch only on values recovered from
+     * earlier results), and keep the result JSON-serializable, since the journal
+     * is JSON.
+     *
+     * In `'window'` mode there is no redirect, so this simply runs `produce` and
+     * returns its result without persisting anything.
+     * @param produce - Produces the value to journal on the first load.
+     * @returns The produced value, or the journaled value on a replay load.
+     */
+    async memoize(produce) {
+        if (this.#urlTransport) {
+            return this.#urlTransport.memoize(produce);
+        }
+        return produce();
+    }
     /**
      * Clears the stored session and resets the client to an anonymous state.
      *
@@ -173,6 +279,24 @@ export class AuthClient {
             }
         }
     }
+    // Popup-mode nonce resolution. Start the fetch, then open the transport
+    // channel so the identity provider window is visible while we wait, and
+    // suspend auto-close so it can't fire mid-await (e.g. due to a close
+    // scheduled by a prior request on the same signer). The original auto-close
+    // setting is restored before sendRequest, so the next response resumes
+    // normal close behaviour.
+    async #resolveNonce(nonce) {
+        const value = nonce();
+        await this.#signer.openChannel();
+        const previousAutoClose = this.#signer.autoCloseTransportChannel;
+        this.#signer.autoCloseTransportChannel = false;
+        try {
+            return await value;
+        }
+        finally {
+            this.#signer.autoCloseTransportChannel = previousAutoClose;
+        }
+    }
     // Memoized — only runs #hydrate once, returns the same promise on repeat calls.
     #init() {
         if (!this.#initPromise) {
@@ -287,6 +411,28 @@ async function restoreKey(storage, keyType) {
         return null;
     }
 }
+/**
+ * Loads a session key from a specific storage slot, deserializing by stored
+ * shape (`CryptoKeyPair` → ECDSA, JSON string → Ed25519). Unlike
+ * {@link restoreKey} it does not migrate from localStorage — it reads only the
+ * given slot, as used for a redirect flow's per-flow pending key.
+ * @param storage - The storage backend.
+ * @param storageKey - The slot to read.
+ */
+async function restoreKeyAt(storage, storageKey) {
+    const stored = await storage.get(storageKey);
+    if (!stored)
+        return null;
+    try {
+        if (typeof stored === 'object') {
+            return await ECDSAKeyIdentity.fromKeyPair(stored);
+        }
+        return Ed25519KeyIdentity.fromJSON(stored);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Converts a key into a format suitable for storage.
  * @param key - The key to serialize.

package/dist/esm/client/auth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../src/client/auth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoC,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAEL,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,YAAY,GAEb,MAAM,cAAc,CAAC;AAEtB,MAAM,sBAAsB,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;AAEvE,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAGpC,mEAAmE;AACnE,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAI1D,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,2BAA2B;IAClC,SAAS,EAAE,8CAA8C;CACR,CAAC;AAEpD,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AA4F/E;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IACrB,SAAS,GAA+B,IAAI,iBAAiB,EAAE,CAAC;IAChE,MAAM,GAA2B,IAAI,CAAC;IACtC,QAAQ,CAAoB;IAC5B,OAAO,CAAS;IAChB,QAAQ,CAA0B;IAClC,YAAY,GAAyB,IAAI,CAAC;IAC1C,WAAW,CAA0B;IAErC,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;QAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,yBAAyB,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,MAAM,CAAC;YACxB,SAAS;YACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,2DAA2D;QAC3D,2DAA2D;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,6EAA6E;QAC7E,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,KAAK,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,OAAiC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjC,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,wBAAwB,CAAC;QAEzE,4EAA4E;QAC5E,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC;QAE1F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3D,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE;YAC7B,OAAO,EAAE,OAAO,EAAE,OAAO;YACzB,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;QAE9B,mEAAmE;QACnE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClC,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;SAC3D,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;QACtE,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,iDAAiD;IACjD,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACtB,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,4BAA4B;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE,0BAA0B,EAAE,CAAC;YACrE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,GAAG,EAAE;gBACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,UAAU,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,YAAY,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9E,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,OAAoB;IAC7C,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,wDAAwD;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,iEAAiE;QACjE,2CAA2C;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAmC;IACvD,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,KAAsB;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1E,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1D,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,OAA0B;IACrD,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,YAAY,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAGxB,MAGD;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,QAAQ,IAAI,GAAG,EAAuD,CAC1F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../src/client/auth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoC,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAEL,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,YAAY,GAEb,MAAM,cAAc,CAAC;AAEtB,MAAM,sBAAsB,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;AAEvE,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAGpC,mEAAmE;AACnE,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAE1D,4EAA4E;AAC5E,+EAA+E;AAC/E,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAIlD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,2BAA2B;IAClC,SAAS,EAAE,8CAA8C;CACR,CAAC;AAEpD,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAoH/E;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IACrB,SAAS,GAA+B,IAAI,iBAAiB,EAAE,CAAC;IAChE,MAAM,GAA2B,IAAI,CAAC;IACtC,QAAQ,CAAoB;IAC5B,OAAO,CAAS;IAChB,uEAAuE;IACvE,2EAA2E;IAC3E,aAAa,CAA2B;IACxC,QAAQ,CAA0B;IAClC,YAAY,GAAyB,IAAI,CAAC;IAC1C,WAAW,CAA0B;IAErC,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;QAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,yBAAyB,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,UAAU;YAC9B,CAAC,CAAC,IAAI,YAAY,CAAC;gBACf,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,mEAAmE;gBACnE,iEAAiE;gBACjE,uDAAuD;gBACvD,WAAW,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE;aAC5E,CAAC;YACJ,CAAC,CAAC,IAAI,oBAAoB,CAAC;gBACvB,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;aACnD,CAAC,CAAC;QACT,IAAI,CAAC,aAAa,GAAG,SAAS,YAAY,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/E,IAAI,CAAC,OAAO,GAAG,IAAI,MAAM,CAAC;YACxB,SAAS;YACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,2DAA2D;QAC3D,2DAA2D;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,6EAA6E;QAC7E,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,KAAK,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,OAAiC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjC,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,wBAAwB,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC;QAEzD,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,aAAa;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;YAC1E,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;QAEhE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3D,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE;YAC7B,OAAO,EAAE,OAAO,EAAE,OAAO;YACzB,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;QAE9B,mEAAmE;QACnE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAErC,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,4BAA4B;IAC5B,KAAK,CAAC,8BAA8B,CAClC,OAAoB;QAEpB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,KAAK,CAAC,gCAAgC,CACpC,SAAuB,EACvB,OAAoB;QAEpB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,GAAG,kBAAkB,GAAG,KAAK,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;YACnC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClC,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;SAC3D,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;QACtE,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,OAAO,CAAI,OAA6B;QAC5C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,4EAA4E;IAC5E,uEAAuE;IACvE,0BAA0B;IAC1B,KAAK,CAAC,aAAa,CAAC,KAAgC;QAClD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,yBAAyB,GAAG,iBAAiB,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,iDAAiD;IACjD,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACtB,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,4BAA4B;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE,0BAA0B,EAAE,CAAC;YACrE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,GAAG,EAAE;gBACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,UAAU,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,YAAY,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9E,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,OAAoB;IAC7C,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,wDAAwD;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,iEAAiE;QACjE,2CAA2C;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CACzB,OAA0B,EAC1B,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAmC;IACvD,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,KAAsB;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1E,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1D,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,OAA0B;IACrD,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,YAAY,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAGxB,MAGD;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,QAAQ,IAAI,GAAG,EAAuD,CAC1F,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@icp-sdk/auth",
-  "version": "7.0.0",
+  "version": "8.0.0",
   "author": "DFINITY Stiftung <sdk@dfinity.org>",
   "license": "Apache-2.0",
   "description": "Authentication library for Internet Computer web apps",
@@ -54,7 +54,7 @@
     "@icp-sdk/core": "^5"
   },
   "dependencies": {
-    "@icp-sdk/signer": "^5.3.1",
+    "@icp-sdk/signer": "^5.5.0",
     "idb": "^7.1.1"
   },
   "scripts": {

package/src/client/auth-client.ts

@@ -10,7 +10,7 @@ import {
 } from '@icp-sdk/core/identity';
 import type { Principal } from '@icp-sdk/core/principal';
 import { Signer } from '@icp-sdk/signer';
-import { PostMessageTransport } from '@icp-sdk/signer/web';
+import { PostMessageTransport, UrlTransport } from '@icp-sdk/signer/web';
 import { IdleManager, type IdleManagerOptions } from './idle-manager.js';
 import {
   type AuthClientStorage,
@@ -37,6 +37,11 @@ type BaseKeyType = typeof ECDSA_KEY_LABEL | typeof ED25519_KEY_LABEL;
 // isAuthenticated() can answer synchronously without hitting IndexedDB.
 const KEY_STORAGE_EXPIRATION = 'ic-delegation_expiration';
 
+// Storage key prefix for a redirect flow's session key, held only while the
+// flow is in progress (keyed by a per-flow id) and removed once the delegation
+// is persisted. See AuthClient.#acquireSessionKey.
+const PENDING_KEY_PREFIX = 'ic-auth-pending-key:';
+
 export type OpenIdProvider = 'google' | 'apple' | 'microsoft';
 
 export const OPENID_PROVIDER_URLS = {
@@ -94,6 +99,30 @@ export interface AuthClientCreateOptions {
    */
   windowOpenerFeatures?: string;
 
+  /**
+   * How the client communicates with the identity provider.
+   *
+   * - `'window'` (default) — the identity provider opens in a separate browser
+   *   tab or window (a popup when {@link windowOpenerFeatures} is set) and
+   *   communicates over the ICRC-29 `postMessage` transport.
+   * - `'redirect'` — the current page navigates to the identity provider over
+   *   the ICRC-167 URL transport, which returns to this same page. The callback
+   *   URL is the current page's URL (`location.origin + location.pathname`), so
+   *   that page must be on an origin you control and declared in that origin's
+   *   `/.well-known/ii-auth-callbacks` allow-list. Use it for full-page sign-in
+   *   that shouldn't need a user gesture to open a window (e.g. redirecting on a
+   *   restricted route), or native apps handing off via universal links.
+   *
+   * With `'redirect'` the page unloads on each step and the flow re-runs on the
+   * return load, so call `signIn` / `requestAttributes` directly on the page's
+   * load (not deferred behind, say, a click handler): a fresh visit starts the
+   * flow and the identity provider's return replays it to completion. Give each
+   * flow its own route so its persisted state stays isolated.
+   * @default 'window'
+   * @see https://github.com/dfinity/wg-identity-authentication/blob/main/topics/icrc_167_browser_url_transport.md
+   */
+  transport?: 'window' | 'redirect';
+
   /**
    * OpenID provider for one-click sign-in. When set, the identity provider
    * URL includes an `openid` search param so the user authenticates via
@@ -152,6 +181,9 @@ export class AuthClient {
   #chain: DelegationChain | null = null;
   #storage: AuthClientStorage;
   #signer: Signer;
+  // Set only in redirect mode, so the redirect-specific paths (nonce/key
+  // journaling) can reach `memoize`. Undefined in the default 'window' mode.
+  #urlTransport: UrlTransport | undefined;
   #options: AuthClientCreateOptions;
   #initPromise: Promise<void> | null = null;
   idleManager: IdleManager | undefined;
@@ -167,10 +199,20 @@ export class AuthClient {
       identityProviderUrl.searchParams.set('openid', OPENID_PROVIDER_URLS[options.openIdProvider]);
     }
 
-    const transport = new PostMessageTransport({
-      url: identityProviderUrl.toString(),
-      windowOpenerFeatures: options.windowOpenerFeatures,
-    });
+    const transport =
+      options.transport === 'redirect'
+        ? new UrlTransport({
+            url: identityProviderUrl.toString(),
+            // The callback is this page: a fresh visit starts the flow and the
+            // provider's return lands back here to replay it. Drop any query
+            // and fragment so it stays stable across the redirect.
+            callbackUrl: `${globalThis.location.origin}${globalThis.location.pathname}`,
+          })
+        : new PostMessageTransport({
+            url: identityProviderUrl.toString(),
+            windowOpenerFeatures: options.windowOpenerFeatures,
+          });
+    this.#urlTransport = transport instanceof UrlTransport ? transport : undefined;
 
     this.#signer = new Signer({
       transport,
@@ -223,10 +265,11 @@ export class AuthClient {
     await this.#signer.openChannel();
 
     const maxTimeToLive = options?.maxTimeToLive ?? DEFAULT_MAX_TIME_TO_LIVE;
+    const keyType = this.#options.keyType ?? ECDSA_KEY_LABEL;
 
-    // Fresh key per sign-in so each session has its own cryptographic identity.
-    const key =
-      this.#options.identity ?? (await generateKey(this.#options.keyType ?? ECDSA_KEY_LABEL));
+    const { key, pendingKeySlot } = this.#urlTransport
+      ? await this.#ensureSessionKeyForRedirectFlow(this.#urlTransport, keyType)
+      : { key: await this.#ensureSessionKeyForWindowFlow(keyType) };
 
     const delegationChain = await this.#signer.requestDelegation({
       publicKey: key.getPublicKey(),
@@ -253,23 +296,85 @@ export class AuthClient {
     await persistChain(this.#storage, this.#chain);
     await persistKey(this.#storage, key);
 
+    // The flow is complete: the delegation is bound to this key and stored, so
+    // the per-flow pending copy is no longer needed.
+    if (pendingKeySlot !== undefined) {
+      await this.#storage.remove(pendingKeySlot);
+    }
+
     return this.#identity;
   }
 
+  // Window flow: sign-in completes in a single load, so a fresh session key per
+  // sign-in is enough (or the caller-provided identity), with nothing to
+  // persist for a later load.
+  async #ensureSessionKeyForWindowFlow(
+    keyType: BaseKeyType,
+  ): Promise<SignIdentity | PartialIdentity> {
+    return this.#options.identity ?? (await generateKey(keyType));
+  }
+
+  // Redirect flow: `signIn` runs twice — once on the load that navigates to the
+  // identity provider, and again on the return load that replays the delegation
+  // minted for the FIRST load's key. Both runs must therefore use the same key.
+  // A per-flow key id is journaled via the transport (stable across the
+  // redirect) and the key is kept in storage under that id, so the return load
+  // restores the same key rather than generating a fresh one that would not
+  // match the replayed delegation. A caller-provided identity is already stable
+  // across the redirect, so it is used as-is with nothing persisted.
+  async #ensureSessionKeyForRedirectFlow(
+    transport: UrlTransport,
+    keyType: BaseKeyType,
+  ): Promise<{ key: SignIdentity | PartialIdentity; pendingKeySlot?: string }> {
+    if (this.#options.identity !== undefined) {
+      return { key: this.#options.identity };
+    }
+
+    const keyId = await transport.memoize(() => globalThis.crypto.randomUUID());
+    const pendingKeySlot = `${PENDING_KEY_PREFIX}${keyId}`;
+
+    const restored = await restoreKeyAt(this.#storage, pendingKeySlot);
+    if (restored) {
+      return { key: restored, pendingKeySlot };
+    }
+
+    const key = await generateKey(keyType);
+    await this.#storage.set(pendingKeySlot, serializeKey(key));
+    return { key, pendingKeySlot };
+  }
+
   /**
    * Requests signed identity attributes from the identity provider.
    *
+   * The `nonce` is a callback that produces the 32-byte nonce (typically
+   * fetched from the RP canister), returning a promise resolving to it. It is a
+   * callback rather than a value so the redirect flow can journal the nonce and
+   * reuse the exact same bytes when the flow replays on the return load,
+   * instead of fetching a fresh single-use nonce that the signer never signed
+   * against.
+   *
+   * In 'window' mode the callback lets the identity provider window open while the
+   * nonce is still resolving, avoiding a perceived delay before the user sees
+   * the prompt; auto-close of the signer transport channel is temporarily
+   * disabled while awaiting so the window cannot be closed out from under the
+   * pending flow.
+   *
    * @param params - Request parameters.
    * @param params.keys - Attribute keys to request (e.g. `['email', 'name']`).
-   * @param params.nonce - 32-byte nonce issued by the RP canister.
+   * @param params.nonce - Produces the 32-byte nonce issued by the RP canister,
+   *   as a promise resolving to it.
    * @returns Signed attribute data and signature.
    * @throws When the identity provider returns an error or an invalid response.
    */
   async requestAttributes(params: {
     keys: string[];
-    nonce: Uint8Array;
+    nonce: () => Promise<Uint8Array>;
   }): Promise<SignedAttributes> {
-    const nonceBytes = params.nonce;
+    // In redirect mode the nonce is journaled (base64, since the journal is
+    // JSON) so the replay on the return load signs against the same bytes.
+    const nonceBytes = this.#urlTransport
+      ? fromBase64(await this.#urlTransport.memoize(async () => toBase64(await params.nonce())))
+      : await this.#resolveNonce(params.nonce);
 
     const response = await this.#signer.sendRequest({
       jsonrpc: '2.0',
@@ -297,6 +402,44 @@ export class AuthClient {
     }
   }
 
+  /**
+   * Runs and journals a piece of your own async work so its result stays stable
+   * across the `'redirect'` flow.
+   *
+   * In `'redirect'` mode the page unloads on each step and `signIn` /
+   * `requestAttributes` re-run on the return load, so a value you compute on the
+   * first visit (from `location`, a fetch, `crypto`, …) would otherwise be
+   * recomputed — and may differ — on the return. Wrap it in `memoize`: it runs
+   * `produce` once on the first visit, journals the result, and replays that
+   * result on the return load instead of re-running. Use it for a value the
+   * post-flow code depends on, e.g. the URL to navigate to once sign-in
+   * completes:
+   *
+   * ```ts
+   * const next = await authClient.memoize(
+   *   () => new URLSearchParams(location.search).get('next') ?? '/',
+   * );
+   * await authClient.signIn();
+   * location.assign(next); // the value captured before the redirect
+   * ```
+   *
+   * Call `memoize` in a stable order relative to `signIn` / `requestAttributes`
+   * across loads (same order every load — branch only on values recovered from
+   * earlier results), and keep the result JSON-serializable, since the journal
+   * is JSON.
+   *
+   * In `'window'` mode there is no redirect, so this simply runs `produce` and
+   * returns its result without persisting anything.
+   * @param produce - Produces the value to journal on the first load.
+   * @returns The produced value, or the journaled value on a replay load.
+   */
+  async memoize<T>(produce: () => T | Promise<T>): Promise<T> {
+    if (this.#urlTransport) {
+      return this.#urlTransport.memoize(produce);
+    }
+    return produce();
+  }
+
   /**
    * Clears the stored session and resets the client to an anonymous state.
    *
@@ -318,6 +461,24 @@ export class AuthClient {
     }
   }
 
+  // Popup-mode nonce resolution. Start the fetch, then open the transport
+  // channel so the identity provider window is visible while we wait, and
+  // suspend auto-close so it can't fire mid-await (e.g. due to a close
+  // scheduled by a prior request on the same signer). The original auto-close
+  // setting is restored before sendRequest, so the next response resumes
+  // normal close behaviour.
+  async #resolveNonce(nonce: () => Promise<Uint8Array>): Promise<Uint8Array> {
+    const value = nonce();
+    await this.#signer.openChannel();
+    const previousAutoClose = this.#signer.autoCloseTransportChannel;
+    this.#signer.autoCloseTransportChannel = false;
+    try {
+      return await value;
+    } finally {
+      this.#signer.autoCloseTransportChannel = previousAutoClose;
+    }
+  }
+
   // Memoized — only runs #hydrate once, returns the same promise on repeat calls.
   #init(): Promise<void> {
     if (!this.#initPromise) {
@@ -446,6 +607,31 @@ async function restoreKey(
   }
 }
 
+/**
+ * Loads a session key from a specific storage slot, deserializing by stored
+ * shape (`CryptoKeyPair` → ECDSA, JSON string → Ed25519). Unlike
+ * {@link restoreKey} it does not migrate from localStorage — it reads only the
+ * given slot, as used for a redirect flow's per-flow pending key.
+ * @param storage - The storage backend.
+ * @param storageKey - The slot to read.
+ */
+async function restoreKeyAt(
+  storage: AuthClientStorage,
+  storageKey: string,
+): Promise<SignIdentity | PartialIdentity | null> {
+  const stored = await storage.get(storageKey);
+  if (!stored) return null;
+
+  try {
+    if (typeof stored === 'object') {
+      return await ECDSAKeyIdentity.fromKeyPair(stored);
+    }
+    return Ed25519KeyIdentity.fromJSON(stored);
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Converts a key into a format suitable for storage.
  * @param key - The key to serialize.