@logto/browser 0.2.0 → 1.0.0-alpha.0

package/lib/index.d.ts

@@ -1,10 +1,24 @@
-import { IdTokenClaims, Prompt, Requester } from '@logto/js';
-import { Nullable } from '@silverhand/essentials';
-import { Infer } from 'superstruct';
+import { NormalizeKeyPaths, Nullable } from "@silverhand/essentials";
+import { IdTokenClaims, Prompt, Requester } from "@logto/js";
+import { Infer } from "superstruct";
+declare const logtoClientErrorCodes: Readonly<{
+    sign_in_session: {
+        invalid: string;
+        not_found: string;
+    };
+    not_authenticated: string;
+    get_access_token_by_refresh_token_failed: string;
+    invalid_id_token: string;
+}>;
+export type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;
+export class LogtoClientError extends Error {
+    code: LogtoClientErrorCode;
+    data: unknown;
+    constructor(code: LogtoClientErrorCode, data?: unknown);
+}
 export type { IdTokenClaims, LogtoErrorCode } from '@logto/js';
-export { LogtoError, OidcError } from '@logto/js';
-export * from './errors';
-export declare type LogtoConfig = {
+export { LogtoError, OidcError, Prompt } from '@logto/js';
+export type LogtoConfig = {
     endpoint: string;
     appId: string;
     scopes?: string[];
@@ -12,12 +26,12 @@ export declare type LogtoConfig = {
     prompt?: Prompt;
     usingPersistStorage?: boolean;
 };
-export declare type AccessToken = {
+export type AccessToken = {
     token: string;
     scope: string;
     expiresAt: number;
 };
-export declare const LogtoSignInSessionItemSchema: import("superstruct").Struct<{
+export const LogtoSignInSessionItemSchema: import("superstruct").Struct<{
     redirectUri: string;
     codeVerifier: string;
     state: string;
@@ -26,23 +40,14 @@ export declare const LogtoSignInSessionItemSchema: import("superstruct").Struct<
     codeVerifier: import("superstruct").Struct<string, null>;
     state: import("superstruct").Struct<string, null>;
 }>;
-export declare type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;
+export type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;
 export default class LogtoClient {
     protected readonly logtoConfig: LogtoConfig;
-    protected readonly getOidcConfig: () => Promise<import("@silverhand/essentials").KeysToCamelCase<{
-        authorization_endpoint: string;
-        token_endpoint: string;
-        end_session_endpoint: string;
-        revocation_endpoint: string;
-        jwks_uri: string;
-        issuer: string;
-    }>>;
+    protected readonly getOidcConfig: () => Promise<import("@silverhand/essentials").KeysToCamelCase<import("@logto/js").OidcConfigSnakeCaseResponse>>;
     protected readonly getJwtVerifyGetKey: () => Promise<import("jose/dist/types/types").GetKeyFunction<import("jose").JWSHeaderParameters, import("jose").FlattenedJWSInput>>;
     protected readonly logtoStorageKey: string;
     protected readonly requester: Requester;
     protected readonly accessTokenMap: Map<string, AccessToken>;
-    private readonly getAccessTokenPromiseMap;
-    private _idToken;
     constructor(logtoConfig: LogtoConfig, requester?: <T>(input: RequestInfo, init?: RequestInit | undefined) => Promise<T>);
     get isAuthenticated(): boolean;
     protected get signInSession(): Nullable<LogtoSignInSessionItem>;
@@ -57,9 +62,6 @@ export default class LogtoClient {
     isSignInRedirected(url: string): boolean;
     handleSignInCallback(callbackUri: string): Promise<void>;
     signOut(postLogoutRedirectUri?: string): Promise<void>;
-    private getAccessTokenByRefreshToken;
-    private _getOidcConfig;
-    private _getJwtVerifyGetKey;
-    private verifyIdToken;
-    private saveCodeToken;
 }
+
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"mappings":";;;AAGA,QAAA,MAAM;;;;;;;;EAQJ,CAAC;AAEH,mCAAmC,kBAAkB,4BAA4B,CAAC,CAAC;AAcnF,6BAA8B,SAAQ,KAAK;IACzC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;gBAEF,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,OAAO;CAKvD;AEFD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG1D,0BAA0B;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,0BAA0B;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,OAAO,MAAM;;;;;;;;EAIX,CAAC;AAEH,qCAAqC,MAAM,mCAAmC,CAAC,CAAC;AAEhF;IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAC5C,SAAS,CAAC,QAAQ,CAAC,aAAa,mHAA6B;IAC7D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,sIAAkC;IAEvE,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAC3C,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAExC,SAAS,CAAC,QAAQ,CAAC,cAAc,2BAAkC;gBAKvD,WAAW,EAAE,WAAW,EAAE,SAAS,wEAAoB;IAWnE,IAAW,eAAe,YAEzB;IAED,SAAS,KAAK,aAAa,IAAI,SAAS,sBAAsB,CAAC,CAe9D;IAED,SAAS,KAAK,aAAa,CAAC,sBAAsB,EAAE,SAAS,sBAAsB,CAAC,EASnF;IAED,IAAI,YAAY,IAIuB,SAAS,MAAM,CAAC,CAFtD;IAED,OAAO,KAAK,YAAY,QAUvB;IAED,IAAI,OAAO,IAIkB,SAAS,MAAM,CAAC,CAF5C;IAED,OAAO,KAAK,OAAO,QAYlB;IAGY,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCxD,gBAAgB,IAAI,aAAa;IAQ3B,MAAM,CAAC,WAAW,EAAE,MAAM;IAyBhC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAYlC,oBAAoB,CAAC,WAAW,EAAE,MAAM;IA6BxC,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM;CA6GpD","sources":["packages/browser/src/src/errors.ts","packages/browser/src/src/utils/index.ts","packages/browser/src/src/index.ts","packages/browser/src/index.ts"],"sourcesContent":[null,null,null,"import {\n  CodeTokenResponse,\n  createRequester,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateCodeChallenge,\n  generateCodeVerifier,\n  generateSignInUri,\n  generateSignOutUri,\n  generateState,\n  IdTokenClaims,\n  Prompt,\n  Requester,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert, Infer, string, type } from 'superstruct';\n\nimport { LogtoClientError } from './errors';\nimport {\n  buildAccessTokenKey,\n  buildIdTokenKey,\n  buildLogtoKey,\n  buildRefreshTokenKey,\n  getDiscoveryEndpoint,\n} from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt } from '@logto/js';\nexport * from './errors';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  usingPersistStorage?: boolean;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number; // Unix Timestamp in seconds\n};\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly logtoStorageKey: string;\n  protected readonly requester: Requester;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, requester = createRequester()) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.logtoStorageKey = buildLogtoKey(logtoConfig.appId);\n    this.requester = requester;\n    this._idToken = localStorage.getItem(buildIdTokenKey(this.logtoStorageKey));\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = sessionStorage.getItem(this.logtoStorageKey);\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      sessionStorage.removeItem(this.logtoStorageKey);\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    sessionStorage.setItem(this.logtoStorageKey, jsonItem);\n  }\n\n  get refreshToken() {\n    return localStorage.getItem(buildRefreshTokenKey(this.logtoStorageKey));\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    const refreshTokenKey = buildRefreshTokenKey(this.logtoStorageKey);\n\n    if (!refreshToken) {\n      localStorage.removeItem(refreshTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(refreshTokenKey, refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    const idTokenKey = buildIdTokenKey(this.logtoStorageKey);\n\n    if (!idToken) {\n      localStorage.removeItem(idTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(idTokenKey, idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, requester } = this;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n  }\n}\n"],"names":[],"version":3,"file":"index.d.ts.map"}

package/lib/index.js

@@ -1,64 +1,118 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var $2FOI4$logtojs = require("@logto/js");
+var $2FOI4$jose = require("jose");
+var $2FOI4$lodashonce = require("lodash.once");
+var $2FOI4$superstruct = require("superstruct");
+var $2FOI4$lodashget = require("lodash.get");
+
+function $parcel$interopDefault(a) {
+  return a && a.__esModule ? a.default : a;
+}
+function $parcel$defineInteropFlag(a) {
+  Object.defineProperty(a, '__esModule', {value: true, configurable: true});
+}
+function $parcel$export(e, n, v, s) {
+  Object.defineProperty(e, n, {get: v, set: s, enumerable: true, configurable: true});
+}
+function $parcel$exportWildcard(dest, source) {
+  Object.keys(source).forEach(function(key) {
+    if (key === 'default' || key === '__esModule' || dest.hasOwnProperty(key)) {
+      return;
+    }
+
+    Object.defineProperty(dest, key, {
+      enumerable: true,
+      get: function get() {
+        return source[key];
+      }
+    });
+  });
+
+  return dest;
+}
+
+$parcel$defineInteropFlag(module.exports);
+
+$parcel$export(module.exports, "LogtoSignInSessionItemSchema", () => $5a30d9203b683831$export$7b65a75f516b80e1);
+$parcel$export(module.exports, "default", () => $5a30d9203b683831$export$2e2bcd8739ae039);
+$parcel$export(module.exports, "LogtoError", () => $5a30d9203b683831$re_export$LogtoError);
+$parcel$export(module.exports, "OidcError", () => $5a30d9203b683831$re_export$OidcError);
+$parcel$export(module.exports, "Prompt", () => $2FOI4$logtojs.Prompt);
+
+
+
+
+var $91774f8557d77d78$exports = {};
+
+$parcel$export($91774f8557d77d78$exports, "LogtoClientError", () => $91774f8557d77d78$export$877962ca249b8fc8);
+
+const $91774f8557d77d78$var$logtoClientErrorCodes = Object.freeze({
+    sign_in_session: {
+        invalid: "Invalid sign-in session.",
+        not_found: "Sign-in session not found."
+    },
+    not_authenticated: "Not authenticated.",
+    get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.",
+    invalid_id_token: "Invalid id token."
+});
+const $91774f8557d77d78$var$getMessageByErrorCode = (errorCode)=>{
+    // TODO: linear issue LOG-1419
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+    const message = (0, ($parcel$interopDefault($2FOI4$lodashget)))($91774f8557d77d78$var$logtoClientErrorCodes, errorCode);
+    if (typeof message === "string") return message;
+    return errorCode;
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LogtoSignInSessionItemSchema = exports.OidcError = exports.LogtoError = void 0;
-const js_1 = require("@logto/js");
-const jose_1 = require("jose");
-const lodash_once_1 = __importDefault(require("lodash.once"));
-const superstruct_1 = require("superstruct");
-const errors_1 = require("./errors");
-const utils_1 = require("./utils");
-var js_2 = require("@logto/js");
-Object.defineProperty(exports, "LogtoError", { enumerable: true, get: function () { return js_2.LogtoError; } });
-Object.defineProperty(exports, "OidcError", { enumerable: true, get: function () { return js_2.OidcError; } });
-__exportStar(require("./errors"), exports);
-exports.LogtoSignInSessionItemSchema = (0, superstruct_1.type)({
-    redirectUri: (0, superstruct_1.string)(),
-    codeVerifier: (0, superstruct_1.string)(),
-    state: (0, superstruct_1.string)(),
+class $91774f8557d77d78$export$877962ca249b8fc8 extends Error {
+    constructor(code, data){
+        super($91774f8557d77d78$var$getMessageByErrorCode(code));
+        this.code = code;
+        this.data = data;
+    }
+}
+
+
+
+const $944e6f79cbd4667b$var$logtoStorageItemKeyPrefix = `logto`;
+const $944e6f79cbd4667b$export$bdf1d4f122e17e7b = (key)=>`${$944e6f79cbd4667b$var$logtoStorageItemKeyPrefix}:${key}`;
+const $944e6f79cbd4667b$export$79da00f3c12fcb3c = (logtoKey)=>`${logtoKey}:refreshToken`;
+const $944e6f79cbd4667b$export$cdb4d35801155147 = (logtoKey)=>`${logtoKey}:idToken`;
+const $944e6f79cbd4667b$export$8f595bd2a47bcea6 = (resource = "", scopes = [])=>`${scopes.slice().sort().join(" ")}@${resource}`;
+const $944e6f79cbd4667b$export$5d9c34f69c80822b = (endpoint)=>new URL((0, $2FOI4$logtojs.discoveryPath), endpoint).toString();
+
+
+
+
+const $5a30d9203b683831$export$7b65a75f516b80e1 = (0, $2FOI4$superstruct.type)({
+    redirectUri: (0, $2FOI4$superstruct.string)(),
+    codeVerifier: (0, $2FOI4$superstruct.string)(),
+    state: (0, $2FOI4$superstruct.string)()
 });
-class LogtoClient {
-    constructor(logtoConfig, requester = (0, js_1.createRequester)()) {
-        this.getOidcConfig = (0, lodash_once_1.default)(this._getOidcConfig);
-        this.getJwtVerifyGetKey = (0, lodash_once_1.default)(this._getJwtVerifyGetKey);
-        this.accessTokenMap = new Map();
-        this.getAccessTokenPromiseMap = new Map();
+class $5a30d9203b683831$export$2e2bcd8739ae039 {
+    getOidcConfig = (0, ($parcel$interopDefault($2FOI4$lodashonce)))(this._getOidcConfig);
+    getJwtVerifyGetKey = (0, ($parcel$interopDefault($2FOI4$lodashonce)))(this._getJwtVerifyGetKey);
+    accessTokenMap = new Map();
+    getAccessTokenPromiseMap = new Map();
+    constructor(logtoConfig, requester = (0, $2FOI4$logtojs.createRequester)()){
         this.logtoConfig = {
             ...logtoConfig,
-            prompt: logtoConfig.prompt ?? js_1.Prompt.Consent,
-            scopes: (0, js_1.withReservedScopes)(logtoConfig.scopes).split(' '),
+            prompt: logtoConfig.prompt ?? (0, $2FOI4$logtojs.Prompt).Consent,
+            scopes: (0, $2FOI4$logtojs.withReservedScopes)(logtoConfig.scopes).split(" ")
         };
-        this.logtoStorageKey = (0, utils_1.buildLogtoKey)(logtoConfig.appId);
+        this.logtoStorageKey = (0, $944e6f79cbd4667b$export$bdf1d4f122e17e7b)(logtoConfig.appId);
         this.requester = requester;
-        this._idToken = localStorage.getItem((0, utils_1.buildIdTokenKey)(this.logtoStorageKey));
+        this._idToken = localStorage.getItem((0, $944e6f79cbd4667b$export$cdb4d35801155147)(this.logtoStorageKey));
     }
     get isAuthenticated() {
         return Boolean(this.idToken);
     }
     get signInSession() {
         const jsonItem = sessionStorage.getItem(this.logtoStorageKey);
-        if (!jsonItem) {
-            return null;
-        }
+        if (!jsonItem) return null;
         try {
             const item = JSON.parse(jsonItem);
-            (0, superstruct_1.assert)(item, exports.LogtoSignInSessionItemSchema);
+            (0, $2FOI4$superstruct.assert)(item, $5a30d9203b683831$export$7b65a75f516b80e1);
             return item;
-        }
-        catch (error) {
-            throw new errors_1.LogtoClientError('sign_in_session.invalid', error);
+        } catch (error) {
+            throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("sign_in_session.invalid", error);
         }
     }
     set signInSession(logtoSignInSessionItem) {
@@ -70,10 +124,10 @@ class LogtoClient {
         sessionStorage.setItem(this.logtoStorageKey, jsonItem);
     }
     get refreshToken() {
-        return localStorage.getItem((0, utils_1.buildRefreshTokenKey)(this.logtoStorageKey));
+        return localStorage.getItem((0, $944e6f79cbd4667b$export$79da00f3c12fcb3c)(this.logtoStorageKey));
     }
     set refreshToken(refreshToken) {
-        const refreshTokenKey = (0, utils_1.buildRefreshTokenKey)(this.logtoStorageKey);
+        const refreshTokenKey = (0, $944e6f79cbd4667b$export$79da00f3c12fcb3c)(this.logtoStorageKey);
         if (!refreshToken) {
             localStorage.removeItem(refreshTokenKey);
             return;
@@ -85,7 +139,7 @@ class LogtoClient {
     }
     set idToken(idToken) {
         this._idToken = idToken;
-        const idTokenKey = (0, utils_1.buildIdTokenKey)(this.logtoStorageKey);
+        const idTokenKey = (0, $944e6f79cbd4667b$export$cdb4d35801155147)(this.logtoStorageKey);
         if (!idToken) {
             localStorage.removeItem(idTokenKey);
             return;
@@ -94,110 +148,94 @@ class LogtoClient {
     }
     // eslint-disable-next-line complexity
     async getAccessToken(resource) {
-        if (!this.idToken) {
-            throw new errors_1.LogtoClientError('not_authenticated');
-        }
-        const accessTokenKey = (0, utils_1.buildAccessTokenKey)(resource);
+        if (!this.idToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
+        const accessTokenKey = (0, $944e6f79cbd4667b$export$8f595bd2a47bcea6)(resource);
         const accessToken = this.accessTokenMap.get(accessTokenKey);
-        if (accessToken && accessToken.expiresAt > Date.now() / 1000) {
-            return accessToken.token;
-        }
+        if (accessToken && accessToken.expiresAt > Date.now() / 1000) return accessToken.token;
         // Since the access token has expired, delete it from the map.
-        if (accessToken) {
-            this.accessTokenMap.delete(accessTokenKey);
-        }
+        if (accessToken) this.accessTokenMap.delete(accessTokenKey);
         /**
-         * Need to fetch a new access token using refresh token.
-         * Reuse the cached promise if exists.
-         */
-        const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);
-        if (cachedPromise) {
-            return cachedPromise;
-        }
+     * Need to fetch a new access token using refresh token.
+     * Reuse the cached promise if exists.
+     */ const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);
+        if (cachedPromise) return cachedPromise;
         /**
-         * Create a new promise and cache in map to avoid race condition.
-         * Since we enable "refresh token rotation" by default,
-         * it will be problematic when calling multiple `getAccessToken()` closely.
-         */
-        const promise = this.getAccessTokenByRefreshToken(resource);
+     * Create a new promise and cache in map to avoid race condition.
+     * Since we enable "refresh token rotation" by default,
+     * it will be problematic when calling multiple `getAccessToken()` closely.
+     */ const promise = this.getAccessTokenByRefreshToken(resource);
         this.getAccessTokenPromiseMap.set(accessTokenKey, promise);
         const token = await promise;
         this.getAccessTokenPromiseMap.delete(accessTokenKey);
         return token;
     }
     getIdTokenClaims() {
-        if (!this.idToken) {
-            throw new errors_1.LogtoClientError('not_authenticated');
-        }
-        return (0, js_1.decodeIdToken)(this.idToken);
+        if (!this.idToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
+        return (0, $2FOI4$logtojs.decodeIdToken)(this.idToken);
     }
     async signIn(redirectUri) {
-        const { appId: clientId, resources, scopes } = this.logtoConfig;
-        const { authorizationEndpoint } = await this.getOidcConfig();
-        const codeVerifier = (0, js_1.generateCodeVerifier)();
-        const codeChallenge = await (0, js_1.generateCodeChallenge)(codeVerifier);
-        const state = (0, js_1.generateState)();
-        const signInUri = (0, js_1.generateSignInUri)({
-            authorizationEndpoint,
-            clientId,
-            redirectUri,
-            codeChallenge,
-            state,
-            scopes,
-            resources,
+        const { appId: clientId , prompt: prompt , resources: resources , scopes: scopes  } = this.logtoConfig;
+        const { authorizationEndpoint: authorizationEndpoint  } = await this.getOidcConfig();
+        const codeVerifier = (0, $2FOI4$logtojs.generateCodeVerifier)();
+        const codeChallenge = await (0, $2FOI4$logtojs.generateCodeChallenge)(codeVerifier);
+        const state = (0, $2FOI4$logtojs.generateState)();
+        const signInUri = (0, $2FOI4$logtojs.generateSignInUri)({
+            authorizationEndpoint: authorizationEndpoint,
+            clientId: clientId,
+            redirectUri: redirectUri,
+            codeChallenge: codeChallenge,
+            state: state,
+            scopes: scopes,
+            resources: resources,
+            prompt: prompt
         });
-        this.signInSession = { redirectUri, codeVerifier, state };
+        this.signInSession = {
+            redirectUri: redirectUri,
+            codeVerifier: codeVerifier,
+            state: state
+        };
         this.refreshToken = null;
         this.idToken = null;
         window.location.assign(signInUri);
     }
     isSignInRedirected(url) {
-        const { signInSession } = this;
-        if (!signInSession) {
-            return false;
-        }
-        const { redirectUri } = signInSession;
-        const { origin, pathname } = new URL(url);
+        const { signInSession: signInSession  } = this;
+        if (!signInSession) return false;
+        const { redirectUri: redirectUri  } = signInSession;
+        const { origin: origin , pathname: pathname  } = new URL(url);
         return `${origin}${pathname}` === redirectUri;
     }
     async handleSignInCallback(callbackUri) {
-        const { signInSession, logtoConfig, requester } = this;
-        if (!signInSession) {
-            throw new errors_1.LogtoClientError('sign_in_session.not_found');
-        }
-        const { redirectUri, state, codeVerifier } = signInSession;
-        const code = (0, js_1.verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
-        const { appId: clientId } = logtoConfig;
-        const { tokenEndpoint } = await this.getOidcConfig();
-        const codeTokenResponse = await (0, js_1.fetchTokenByAuthorizationCode)({
-            clientId,
-            tokenEndpoint,
-            redirectUri,
-            codeVerifier,
-            code,
+        const { signInSession: signInSession , logtoConfig: logtoConfig , requester: requester  } = this;
+        if (!signInSession) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("sign_in_session.not_found");
+        const { redirectUri: redirectUri , state: state , codeVerifier: codeVerifier  } = signInSession;
+        const code = (0, $2FOI4$logtojs.verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
+        const { appId: clientId  } = logtoConfig;
+        const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
+        const codeTokenResponse = await (0, $2FOI4$logtojs.fetchTokenByAuthorizationCode)({
+            clientId: clientId,
+            tokenEndpoint: tokenEndpoint,
+            redirectUri: redirectUri,
+            codeVerifier: codeVerifier,
+            code: code
         }, requester);
         await this.verifyIdToken(codeTokenResponse.idToken);
         this.saveCodeToken(codeTokenResponse);
         this.signInSession = null;
     }
     async signOut(postLogoutRedirectUri) {
-        if (!this.idToken) {
-            throw new errors_1.LogtoClientError('not_authenticated');
+        if (!this.idToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
+        const { appId: clientId  } = this.logtoConfig;
+        const { endSessionEndpoint: endSessionEndpoint , revocationEndpoint: revocationEndpoint  } = await this.getOidcConfig();
+        if (this.refreshToken) try {
+            await (0, $2FOI4$logtojs.revoke)(revocationEndpoint, clientId, this.refreshToken, this.requester);
+        } catch  {
+        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
         }
-        const { appId: clientId } = this.logtoConfig;
-        const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();
-        if (this.refreshToken) {
-            try {
-                await (0, js_1.revoke)(revocationEndpoint, clientId, this.refreshToken, this.requester);
-            }
-            catch {
-                // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
-            }
-        }
-        const url = (0, js_1.generateSignOutUri)({
-            endSessionEndpoint,
-            postLogoutRedirectUri,
-            idToken: this.idToken,
+        const url = (0, $2FOI4$logtojs.generateSignOutUri)({
+            endSessionEndpoint: endSessionEndpoint,
+            postLogoutRedirectUri: postLogoutRedirectUri,
+            idToken: this.idToken
         });
         this.accessTokenMap.clear();
         this.refreshToken = null;
@@ -205,24 +243,24 @@ class LogtoClient {
         window.location.assign(url);
     }
     async getAccessTokenByRefreshToken(resource) {
-        if (!this.refreshToken) {
-            throw new errors_1.LogtoClientError('not_authenticated');
-        }
+        if (!this.refreshToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
         try {
-            const accessTokenKey = (0, utils_1.buildAccessTokenKey)(resource);
-            const { appId: clientId } = this.logtoConfig;
-            const { tokenEndpoint } = await this.getOidcConfig();
-            const { accessToken, refreshToken, idToken, scope, expiresIn } = await (0, js_1.fetchTokenByRefreshToken)({
-                clientId,
-                tokenEndpoint,
+            const accessTokenKey = (0, $944e6f79cbd4667b$export$8f595bd2a47bcea6)(resource);
+            const { appId: clientId  } = this.logtoConfig;
+            const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
+            const { accessToken: accessToken , refreshToken: refreshToken , idToken: idToken , scope: scope , expiresIn: expiresIn  } = await (0, $2FOI4$logtojs.fetchTokenByRefreshToken)({
+                clientId: clientId,
+                tokenEndpoint: tokenEndpoint,
                 refreshToken: this.refreshToken,
-                resource,
-                scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request
+                resource: resource,
+                scopes: resource ? [
+                    "offline_access"
+                ] : undefined
             }, this.requester);
             this.accessTokenMap.set(accessTokenKey, {
                 token: accessToken,
-                scope,
-                expiresAt: Math.round(Date.now() / 1000) + expiresIn,
+                scope: scope,
+                expiresAt: Math.round(Date.now() / 1000) + expiresIn
             });
             this.refreshToken = refreshToken;
             if (idToken) {
@@ -230,38 +268,43 @@ class LogtoClient {
                 this.idToken = idToken;
             }
             return accessToken;
-        }
-        catch (error) {
-            throw new errors_1.LogtoClientError('get_access_token_by_refresh_token_failed', error);
+        } catch (error) {
+            throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("get_access_token_by_refresh_token_failed", error);
         }
     }
     async _getOidcConfig() {
-        const { endpoint } = this.logtoConfig;
-        const discoveryEndpoint = (0, utils_1.getDiscoveryEndpoint)(endpoint);
-        return (0, js_1.fetchOidcConfig)(discoveryEndpoint, this.requester);
+        const { endpoint: endpoint  } = this.logtoConfig;
+        const discoveryEndpoint = (0, $944e6f79cbd4667b$export$5d9c34f69c80822b)(endpoint);
+        return (0, $2FOI4$logtojs.fetchOidcConfig)(discoveryEndpoint, this.requester);
     }
     async _getJwtVerifyGetKey() {
-        const { jwksUri } = await this.getOidcConfig();
-        return (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
+        const { jwksUri: jwksUri  } = await this.getOidcConfig();
+        return (0, $2FOI4$jose.createRemoteJWKSet)(new URL(jwksUri));
     }
     async verifyIdToken(idToken) {
-        const { appId } = this.logtoConfig;
-        const { issuer } = await this.getOidcConfig();
+        const { appId: appId  } = this.logtoConfig;
+        const { issuer: issuer  } = await this.getOidcConfig();
         const jwtVerifyGetKey = await this.getJwtVerifyGetKey();
         try {
-            await (0, js_1.verifyIdToken)(idToken, appId, issuer, jwtVerifyGetKey);
-        }
-        catch (error) {
-            throw new errors_1.LogtoClientError('invalid_id_token', error);
+            await (0, $2FOI4$logtojs.verifyIdToken)(idToken, appId, issuer, jwtVerifyGetKey);
+        } catch (error) {
+            throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("invalid_id_token", error);
         }
     }
-    saveCodeToken({ refreshToken, idToken, scope, accessToken, expiresIn, }) {
+    saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
         this.refreshToken = refreshToken ?? null;
         this.idToken = idToken;
         // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)
-        const accessTokenKey = (0, utils_1.buildAccessTokenKey)();
+        const accessTokenKey = (0, $944e6f79cbd4667b$export$8f595bd2a47bcea6)();
         const expiresAt = Date.now() / 1000 + expiresIn;
-        this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });
+        this.accessTokenMap.set(accessTokenKey, {
+            token: accessToken,
+            scope: scope,
+            expiresAt: expiresAt
+        });
     }
 }
-exports.default = LogtoClient;
+$parcel$exportWildcard(module.exports, $91774f8557d77d78$exports);
+
+
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,8BAA8B;IAC9B,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,0CAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;ACpCD;AAEA,MAAM,+CAAyB,GAAG,CAAC,KAAK,CAAC,AAAC;AACnC,MAAM,yCAAa,GAAG,CAAC,GAAW,GAAa,CAAC,EAAE,+CAAyB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,AAAC;AACrF,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,AAAC;AAC9E,MAAM,yCAAe,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,AAAC;AAEpE,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,4BAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;AF0CvC,MAAM,yCAA4B,GAAG,CAAA,GAAA,uBAAI,CAAA,CAAC;IAC/C,WAAW,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACrB,YAAY,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACtB,KAAK,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;CAChB,CAAC,AAAC;AAIY;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAKvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAG/E,YAAY,WAAwB,EAAE,SAAS,GAAG,CAAA,GAAA,8BAAe,CAAA,EAAE,CAAE;QACnE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,qBAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,iCAAkB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1D,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,CAAA,GAAA,yCAAa,CAAA,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KAC7E;IAED,IAAW,eAAe,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC9B;IAED,IAAc,aAAa,GAAqC;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAE9D,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;YAC3C,CAAA,GAAA,yBAAM,CAAA,CAAC,IAAI,EAAE,yCAA4B,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;SACb,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;SAC9D;KACF;IAED,IAAc,aAAa,CAAC,sBAAwD,EAAE;QACpF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAEhD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KACxD;IAED,IAAI,YAAY,GAAG;QACjB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KACzE;IAED,IAAY,YAAY,CAAC,YAA8B,EAAE;QACvD,MAAM,eAAe,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEnE,IAAI,CAAC,YAAY,EAAE;YACjB,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEzC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KACrD;IAED,IAAI,OAAO,GAAG;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;KACtB;IAED,IAAY,OAAO,CAAC,OAAyB,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,MAAM,UAAU,GAAG,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEzD,IAAI,CAAC,OAAO,EAAE;YACZ,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEpC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC3C;IAED,sCAAsC;IACtC,MAAa,cAAc,CAAC,QAAiB,EAAmB;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,AAAO,gBAAgB,GAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,4BAAa,CAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,MAAa,MAAM,CAAC,WAAmB,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,CAAA,GAAA,mCAAoB,CAAA,EAAE,AAAC;QAC5C,MAAM,aAAa,GAAG,MAAM,CAAA,GAAA,oCAAqB,CAAA,CAAC,YAAY,CAAC,AAAC;QAChE,MAAM,KAAK,GAAG,CAAA,GAAA,4BAAa,CAAA,EAAE,AAAC;QAE9B,MAAM,SAAS,GAAG,CAAA,GAAA,gCAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,IAAI,CAAC,aAAa,GAAG;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;KACnC;IAED,AAAO,kBAAkB,CAAC,GAAW,EAAW;QAC9C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,IAAI,AAAC;QAE/B,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAa,oBAAoB,CAAC,WAAmB,EAAE;QACrD,MAAM,iBAAE,aAAa,CAAA,eAAE,WAAW,CAAA,aAAE,SAAS,CAAA,EAAE,GAAG,IAAI,AAAC;QAEvD,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,gDAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,4CAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;KAC3B;IAED,MAAa,OAAO,CAAC,qBAA8B,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE9E,IAAI,IAAI,CAAC,YAAY,EACnB,IAAI;YACF,MAAM,CAAA,GAAA,qBAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/E,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,iCAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;KAC7B;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,EACpB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,uCAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;0BAC/B,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,gBAAgB;iBAAC,GAAG,SAAS;aAClD,EACD,IAAI,CAAC,SAAS,CACf,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YAEjC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aACxB;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,8BAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;KAC3D;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,8BAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,4BAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,AAAQ,aAAa,CAAC,gBACpB,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;KACnF;CACF","sources":["packages/browser/src/index.ts","packages/browser/src/errors.ts","packages/browser/src/utils/index.ts"],"sourcesContent":["import {\n  CodeTokenResponse,\n  createRequester,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateCodeChallenge,\n  generateCodeVerifier,\n  generateSignInUri,\n  generateSignOutUri,\n  generateState,\n  IdTokenClaims,\n  Prompt,\n  Requester,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert, Infer, string, type } from 'superstruct';\n\nimport { LogtoClientError } from './errors';\nimport {\n  buildAccessTokenKey,\n  buildIdTokenKey,\n  buildLogtoKey,\n  buildRefreshTokenKey,\n  getDiscoveryEndpoint,\n} from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt } from '@logto/js';\nexport * from './errors';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  usingPersistStorage?: boolean;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number; // Unix Timestamp in seconds\n};\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly logtoStorageKey: string;\n  protected readonly requester: Requester;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, requester = createRequester()) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.logtoStorageKey = buildLogtoKey(logtoConfig.appId);\n    this.requester = requester;\n    this._idToken = localStorage.getItem(buildIdTokenKey(this.logtoStorageKey));\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = sessionStorage.getItem(this.logtoStorageKey);\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      sessionStorage.removeItem(this.logtoStorageKey);\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    sessionStorage.setItem(this.logtoStorageKey, jsonItem);\n  }\n\n  get refreshToken() {\n    return localStorage.getItem(buildRefreshTokenKey(this.logtoStorageKey));\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    const refreshTokenKey = buildRefreshTokenKey(this.logtoStorageKey);\n\n    if (!refreshToken) {\n      localStorage.removeItem(refreshTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(refreshTokenKey, refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    const idTokenKey = buildIdTokenKey(this.logtoStorageKey);\n\n    if (!idToken) {\n      localStorage.removeItem(idTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(idTokenKey, idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, requester } = this;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n  }\n}\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // TODO: linear issue LOG-1419\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { discoveryPath } from '@logto/js';\n\nconst logtoStorageItemKeyPrefix = `logto`;\nexport const buildLogtoKey = (key: string): string => `${logtoStorageItemKeyPrefix}:${key}`;\nexport const buildRefreshTokenKey = (logtoKey: string) => `${logtoKey}:refreshToken`;\nexport const buildIdTokenKey = (logtoKey: string) => `${logtoKey}:idToken`;\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n"],"names":[],"version":3,"file":"index.js.map"}

package/lib/module.js

@@ -0,0 +1,280 @@
+import {createRequester as $ElS14$createRequester, Prompt as $90df2ab0e44b5eba$import$5548085c5b0a2ee3$83716a4aa1642908, withReservedScopes as $ElS14$withReservedScopes, decodeIdToken as $ElS14$decodeIdToken, generateCodeVerifier as $ElS14$generateCodeVerifier, generateCodeChallenge as $ElS14$generateCodeChallenge, generateState as $ElS14$generateState, generateSignInUri as $ElS14$generateSignInUri, verifyAndParseCodeFromCallbackUri as $ElS14$verifyAndParseCodeFromCallbackUri, fetchTokenByAuthorizationCode as $ElS14$fetchTokenByAuthorizationCode, revoke as $ElS14$revoke, generateSignOutUri as $ElS14$generateSignOutUri, fetchTokenByRefreshToken as $ElS14$fetchTokenByRefreshToken, fetchOidcConfig as $ElS14$fetchOidcConfig, verifyIdToken as $ElS14$verifyIdToken, LogtoError as $90df2ab0e44b5eba$re_export$LogtoError, OidcError as $90df2ab0e44b5eba$re_export$OidcError, discoveryPath as $ElS14$discoveryPath} from "@logto/js";
+import {createRemoteJWKSet as $ElS14$createRemoteJWKSet} from "jose";
+import $ElS14$lodashonce from "lodash.once";
+import {type as $ElS14$type, string as $ElS14$string, assert as $ElS14$assert} from "superstruct";
+import $ElS14$lodashget from "lodash.get";
+
+function $parcel$export(e, n, v, s) {
+  Object.defineProperty(e, n, {get: v, set: s, enumerable: true, configurable: true});
+}
+
+
+
+
+var $092943c955830b14$exports = {};
+
+$parcel$export($092943c955830b14$exports, "LogtoClientError", () => $092943c955830b14$export$877962ca249b8fc8);
+
+const $092943c955830b14$var$logtoClientErrorCodes = Object.freeze({
+    sign_in_session: {
+        invalid: "Invalid sign-in session.",
+        not_found: "Sign-in session not found."
+    },
+    not_authenticated: "Not authenticated.",
+    get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.",
+    invalid_id_token: "Invalid id token."
+});
+const $092943c955830b14$var$getMessageByErrorCode = (errorCode)=>{
+    // TODO: linear issue LOG-1419
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+    const message = (0, $ElS14$lodashget)($092943c955830b14$var$logtoClientErrorCodes, errorCode);
+    if (typeof message === "string") return message;
+    return errorCode;
+};
+class $092943c955830b14$export$877962ca249b8fc8 extends Error {
+    constructor(code, data){
+        super($092943c955830b14$var$getMessageByErrorCode(code));
+        this.code = code;
+        this.data = data;
+    }
+}
+
+
+
+const $2f0dba05fbbfeb85$var$logtoStorageItemKeyPrefix = `logto`;
+const $2f0dba05fbbfeb85$export$bdf1d4f122e17e7b = (key)=>`${$2f0dba05fbbfeb85$var$logtoStorageItemKeyPrefix}:${key}`;
+const $2f0dba05fbbfeb85$export$79da00f3c12fcb3c = (logtoKey)=>`${logtoKey}:refreshToken`;
+const $2f0dba05fbbfeb85$export$cdb4d35801155147 = (logtoKey)=>`${logtoKey}:idToken`;
+const $2f0dba05fbbfeb85$export$8f595bd2a47bcea6 = (resource = "", scopes = [])=>`${scopes.slice().sort().join(" ")}@${resource}`;
+const $2f0dba05fbbfeb85$export$5d9c34f69c80822b = (endpoint)=>new URL((0, $ElS14$discoveryPath), endpoint).toString();
+
+
+
+
+const $90df2ab0e44b5eba$export$7b65a75f516b80e1 = (0, $ElS14$type)({
+    redirectUri: (0, $ElS14$string)(),
+    codeVerifier: (0, $ElS14$string)(),
+    state: (0, $ElS14$string)()
+});
+class $90df2ab0e44b5eba$export$2e2bcd8739ae039 {
+    getOidcConfig = (0, $ElS14$lodashonce)(this._getOidcConfig);
+    getJwtVerifyGetKey = (0, $ElS14$lodashonce)(this._getJwtVerifyGetKey);
+    accessTokenMap = new Map();
+    getAccessTokenPromiseMap = new Map();
+    constructor(logtoConfig, requester = (0, $ElS14$createRequester)()){
+        this.logtoConfig = {
+            ...logtoConfig,
+            prompt: logtoConfig.prompt ?? (0, $90df2ab0e44b5eba$import$5548085c5b0a2ee3$83716a4aa1642908).Consent,
+            scopes: (0, $ElS14$withReservedScopes)(logtoConfig.scopes).split(" ")
+        };
+        this.logtoStorageKey = (0, $2f0dba05fbbfeb85$export$bdf1d4f122e17e7b)(logtoConfig.appId);
+        this.requester = requester;
+        this._idToken = localStorage.getItem((0, $2f0dba05fbbfeb85$export$cdb4d35801155147)(this.logtoStorageKey));
+    }
+    get isAuthenticated() {
+        return Boolean(this.idToken);
+    }
+    get signInSession() {
+        const jsonItem = sessionStorage.getItem(this.logtoStorageKey);
+        if (!jsonItem) return null;
+        try {
+            const item = JSON.parse(jsonItem);
+            (0, $ElS14$assert)(item, $90df2ab0e44b5eba$export$7b65a75f516b80e1);
+            return item;
+        } catch (error) {
+            throw new (0, $092943c955830b14$export$877962ca249b8fc8)("sign_in_session.invalid", error);
+        }
+    }
+    set signInSession(logtoSignInSessionItem) {
+        if (!logtoSignInSessionItem) {
+            sessionStorage.removeItem(this.logtoStorageKey);
+            return;
+        }
+        const jsonItem = JSON.stringify(logtoSignInSessionItem);
+        sessionStorage.setItem(this.logtoStorageKey, jsonItem);
+    }
+    get refreshToken() {
+        return localStorage.getItem((0, $2f0dba05fbbfeb85$export$79da00f3c12fcb3c)(this.logtoStorageKey));
+    }
+    set refreshToken(refreshToken) {
+        const refreshTokenKey = (0, $2f0dba05fbbfeb85$export$79da00f3c12fcb3c)(this.logtoStorageKey);
+        if (!refreshToken) {
+            localStorage.removeItem(refreshTokenKey);
+            return;
+        }
+        localStorage.setItem(refreshTokenKey, refreshToken);
+    }
+    get idToken() {
+        return this._idToken;
+    }
+    set idToken(idToken) {
+        this._idToken = idToken;
+        const idTokenKey = (0, $2f0dba05fbbfeb85$export$cdb4d35801155147)(this.logtoStorageKey);
+        if (!idToken) {
+            localStorage.removeItem(idTokenKey);
+            return;
+        }
+        localStorage.setItem(idTokenKey, idToken);
+    }
+    // eslint-disable-next-line complexity
+    async getAccessToken(resource) {
+        if (!this.idToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
+        const accessTokenKey = (0, $2f0dba05fbbfeb85$export$8f595bd2a47bcea6)(resource);
+        const accessToken = this.accessTokenMap.get(accessTokenKey);
+        if (accessToken && accessToken.expiresAt > Date.now() / 1000) return accessToken.token;
+        // Since the access token has expired, delete it from the map.
+        if (accessToken) this.accessTokenMap.delete(accessTokenKey);
+        /**
+     * Need to fetch a new access token using refresh token.
+     * Reuse the cached promise if exists.
+     */ const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);
+        if (cachedPromise) return cachedPromise;
+        /**
+     * Create a new promise and cache in map to avoid race condition.
+     * Since we enable "refresh token rotation" by default,
+     * it will be problematic when calling multiple `getAccessToken()` closely.
+     */ const promise = this.getAccessTokenByRefreshToken(resource);
+        this.getAccessTokenPromiseMap.set(accessTokenKey, promise);
+        const token = await promise;
+        this.getAccessTokenPromiseMap.delete(accessTokenKey);
+        return token;
+    }
+    getIdTokenClaims() {
+        if (!this.idToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
+        return (0, $ElS14$decodeIdToken)(this.idToken);
+    }
+    async signIn(redirectUri) {
+        const { appId: clientId , prompt: prompt , resources: resources , scopes: scopes  } = this.logtoConfig;
+        const { authorizationEndpoint: authorizationEndpoint  } = await this.getOidcConfig();
+        const codeVerifier = (0, $ElS14$generateCodeVerifier)();
+        const codeChallenge = await (0, $ElS14$generateCodeChallenge)(codeVerifier);
+        const state = (0, $ElS14$generateState)();
+        const signInUri = (0, $ElS14$generateSignInUri)({
+            authorizationEndpoint: authorizationEndpoint,
+            clientId: clientId,
+            redirectUri: redirectUri,
+            codeChallenge: codeChallenge,
+            state: state,
+            scopes: scopes,
+            resources: resources,
+            prompt: prompt
+        });
+        this.signInSession = {
+            redirectUri: redirectUri,
+            codeVerifier: codeVerifier,
+            state: state
+        };
+        this.refreshToken = null;
+        this.idToken = null;
+        window.location.assign(signInUri);
+    }
+    isSignInRedirected(url) {
+        const { signInSession: signInSession  } = this;
+        if (!signInSession) return false;
+        const { redirectUri: redirectUri  } = signInSession;
+        const { origin: origin , pathname: pathname  } = new URL(url);
+        return `${origin}${pathname}` === redirectUri;
+    }
+    async handleSignInCallback(callbackUri) {
+        const { signInSession: signInSession , logtoConfig: logtoConfig , requester: requester  } = this;
+        if (!signInSession) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("sign_in_session.not_found");
+        const { redirectUri: redirectUri , state: state , codeVerifier: codeVerifier  } = signInSession;
+        const code = (0, $ElS14$verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
+        const { appId: clientId  } = logtoConfig;
+        const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
+        const codeTokenResponse = await (0, $ElS14$fetchTokenByAuthorizationCode)({
+            clientId: clientId,
+            tokenEndpoint: tokenEndpoint,
+            redirectUri: redirectUri,
+            codeVerifier: codeVerifier,
+            code: code
+        }, requester);
+        await this.verifyIdToken(codeTokenResponse.idToken);
+        this.saveCodeToken(codeTokenResponse);
+        this.signInSession = null;
+    }
+    async signOut(postLogoutRedirectUri) {
+        if (!this.idToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
+        const { appId: clientId  } = this.logtoConfig;
+        const { endSessionEndpoint: endSessionEndpoint , revocationEndpoint: revocationEndpoint  } = await this.getOidcConfig();
+        if (this.refreshToken) try {
+            await (0, $ElS14$revoke)(revocationEndpoint, clientId, this.refreshToken, this.requester);
+        } catch  {
+        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
+        }
+        const url = (0, $ElS14$generateSignOutUri)({
+            endSessionEndpoint: endSessionEndpoint,
+            postLogoutRedirectUri: postLogoutRedirectUri,
+            idToken: this.idToken
+        });
+        this.accessTokenMap.clear();
+        this.refreshToken = null;
+        this.idToken = null;
+        window.location.assign(url);
+    }
+    async getAccessTokenByRefreshToken(resource) {
+        if (!this.refreshToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
+        try {
+            const accessTokenKey = (0, $2f0dba05fbbfeb85$export$8f595bd2a47bcea6)(resource);
+            const { appId: clientId  } = this.logtoConfig;
+            const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
+            const { accessToken: accessToken , refreshToken: refreshToken , idToken: idToken , scope: scope , expiresIn: expiresIn  } = await (0, $ElS14$fetchTokenByRefreshToken)({
+                clientId: clientId,
+                tokenEndpoint: tokenEndpoint,
+                refreshToken: this.refreshToken,
+                resource: resource,
+                scopes: resource ? [
+                    "offline_access"
+                ] : undefined
+            }, this.requester);
+            this.accessTokenMap.set(accessTokenKey, {
+                token: accessToken,
+                scope: scope,
+                expiresAt: Math.round(Date.now() / 1000) + expiresIn
+            });
+            this.refreshToken = refreshToken;
+            if (idToken) {
+                await this.verifyIdToken(idToken);
+                this.idToken = idToken;
+            }
+            return accessToken;
+        } catch (error) {
+            throw new (0, $092943c955830b14$export$877962ca249b8fc8)("get_access_token_by_refresh_token_failed", error);
+        }
+    }
+    async _getOidcConfig() {
+        const { endpoint: endpoint  } = this.logtoConfig;
+        const discoveryEndpoint = (0, $2f0dba05fbbfeb85$export$5d9c34f69c80822b)(endpoint);
+        return (0, $ElS14$fetchOidcConfig)(discoveryEndpoint, this.requester);
+    }
+    async _getJwtVerifyGetKey() {
+        const { jwksUri: jwksUri  } = await this.getOidcConfig();
+        return (0, $ElS14$createRemoteJWKSet)(new URL(jwksUri));
+    }
+    async verifyIdToken(idToken) {
+        const { appId: appId  } = this.logtoConfig;
+        const { issuer: issuer  } = await this.getOidcConfig();
+        const jwtVerifyGetKey = await this.getJwtVerifyGetKey();
+        try {
+            await (0, $ElS14$verifyIdToken)(idToken, appId, issuer, jwtVerifyGetKey);
+        } catch (error) {
+            throw new (0, $092943c955830b14$export$877962ca249b8fc8)("invalid_id_token", error);
+        }
+    }
+    saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
+        this.refreshToken = refreshToken ?? null;
+        this.idToken = idToken;
+        // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)
+        const accessTokenKey = (0, $2f0dba05fbbfeb85$export$8f595bd2a47bcea6)();
+        const expiresAt = Date.now() / 1000 + expiresIn;
+        this.accessTokenMap.set(accessTokenKey, {
+            token: accessToken,
+            scope: scope,
+            expiresAt: expiresAt
+        });
+    }
+}
+
+
+export {$90df2ab0e44b5eba$export$7b65a75f516b80e1 as LogtoSignInSessionItemSchema, $90df2ab0e44b5eba$export$2e2bcd8739ae039 as default, $90df2ab0e44b5eba$re_export$LogtoError as LogtoError, $90df2ab0e44b5eba$re_export$OidcError as OidcError, $90df2ab0e44b5eba$import$5548085c5b0a2ee3$83716a4aa1642908 as Prompt, $092943c955830b14$export$877962ca249b8fc8 as LogtoClientError};
+//# sourceMappingURL=module.js.map

package/lib/module.js.map

@@ -0,0 +1 @@
+{"mappings":";;;;;;;;;AAAA;;;;;;;ACAA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,8BAA8B;IAC9B,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,gBAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;ACpCD;AAEA,MAAM,+CAAyB,GAAG,CAAC,KAAK,CAAC,AAAC;AACnC,MAAM,yCAAa,GAAG,CAAC,GAAW,GAAa,CAAC,EAAE,+CAAyB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,AAAC;AACrF,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,AAAC;AAC9E,MAAM,yCAAe,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,AAAC;AAEpE,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,oBAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;AF0CvC,MAAM,yCAA4B,GAAG,CAAA,GAAA,WAAI,CAAA,CAAC;IAC/C,WAAW,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACrB,YAAY,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACtB,KAAK,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;CAChB,CAAC,AAAC;AAIY;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAKvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAG/E,YAAY,WAAwB,EAAE,SAAS,GAAG,CAAA,GAAA,sBAAe,CAAA,EAAE,CAAE;QACnE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,0DAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,yBAAkB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1D,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,CAAA,GAAA,yCAAa,CAAA,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KAC7E;IAED,IAAW,eAAe,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC9B;IAED,IAAc,aAAa,GAAqC;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAE9D,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;YAC3C,CAAA,GAAA,aAAM,CAAA,CAAC,IAAI,EAAE,yCAA4B,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;SACb,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;SAC9D;KACF;IAED,IAAc,aAAa,CAAC,sBAAwD,EAAE;QACpF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAEhD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KACxD;IAED,IAAI,YAAY,GAAG;QACjB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KACzE;IAED,IAAY,YAAY,CAAC,YAA8B,EAAE;QACvD,MAAM,eAAe,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEnE,IAAI,CAAC,YAAY,EAAE;YACjB,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEzC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KACrD;IAED,IAAI,OAAO,GAAG;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;KACtB;IAED,IAAY,OAAO,CAAC,OAAyB,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,MAAM,UAAU,GAAG,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEzD,IAAI,CAAC,OAAO,EAAE;YACZ,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEpC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC3C;IAED,sCAAsC;IACtC,MAAa,cAAc,CAAC,QAAiB,EAAmB;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,AAAO,gBAAgB,GAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,oBAAa,CAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,MAAa,MAAM,CAAC,WAAmB,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,CAAA,GAAA,2BAAoB,CAAA,EAAE,AAAC;QAC5C,MAAM,aAAa,GAAG,MAAM,CAAA,GAAA,4BAAqB,CAAA,CAAC,YAAY,CAAC,AAAC;QAChE,MAAM,KAAK,GAAG,CAAA,GAAA,oBAAa,CAAA,EAAE,AAAC;QAE9B,MAAM,SAAS,GAAG,CAAA,GAAA,wBAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,IAAI,CAAC,aAAa,GAAG;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;KACnC;IAED,AAAO,kBAAkB,CAAC,GAAW,EAAW;QAC9C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,IAAI,AAAC;QAE/B,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAa,oBAAoB,CAAC,WAAmB,EAAE;QACrD,MAAM,iBAAE,aAAa,CAAA,eAAE,WAAW,CAAA,aAAE,SAAS,CAAA,EAAE,GAAG,IAAI,AAAC;QAEvD,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,wCAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,oCAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;KAC3B;IAED,MAAa,OAAO,CAAC,qBAA8B,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE9E,IAAI,IAAI,CAAC,YAAY,EACnB,IAAI;YACF,MAAM,CAAA,GAAA,aAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/E,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,yBAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;KAC7B;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,EACpB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,+BAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;0BAC/B,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,gBAAgB;iBAAC,GAAG,SAAS;aAClD,EACD,IAAI,CAAC,SAAS,CACf,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YAEjC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aACxB;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,sBAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;KAC3D;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,yBAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,oBAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,AAAQ,aAAa,CAAC,gBACpB,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;KACnF;CACF","sources":["packages/browser/src/index.ts","packages/browser/src/errors.ts","packages/browser/src/utils/index.ts"],"sourcesContent":["import {\n  CodeTokenResponse,\n  createRequester,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateCodeChallenge,\n  generateCodeVerifier,\n  generateSignInUri,\n  generateSignOutUri,\n  generateState,\n  IdTokenClaims,\n  Prompt,\n  Requester,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert, Infer, string, type } from 'superstruct';\n\nimport { LogtoClientError } from './errors';\nimport {\n  buildAccessTokenKey,\n  buildIdTokenKey,\n  buildLogtoKey,\n  buildRefreshTokenKey,\n  getDiscoveryEndpoint,\n} from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt } from '@logto/js';\nexport * from './errors';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  usingPersistStorage?: boolean;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number; // Unix Timestamp in seconds\n};\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly logtoStorageKey: string;\n  protected readonly requester: Requester;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, requester = createRequester()) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.logtoStorageKey = buildLogtoKey(logtoConfig.appId);\n    this.requester = requester;\n    this._idToken = localStorage.getItem(buildIdTokenKey(this.logtoStorageKey));\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = sessionStorage.getItem(this.logtoStorageKey);\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      sessionStorage.removeItem(this.logtoStorageKey);\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    sessionStorage.setItem(this.logtoStorageKey, jsonItem);\n  }\n\n  get refreshToken() {\n    return localStorage.getItem(buildRefreshTokenKey(this.logtoStorageKey));\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    const refreshTokenKey = buildRefreshTokenKey(this.logtoStorageKey);\n\n    if (!refreshToken) {\n      localStorage.removeItem(refreshTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(refreshTokenKey, refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    const idTokenKey = buildIdTokenKey(this.logtoStorageKey);\n\n    if (!idToken) {\n      localStorage.removeItem(idTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(idTokenKey, idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, requester } = this;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n  }\n}\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // TODO: linear issue LOG-1419\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { discoveryPath } from '@logto/js';\n\nconst logtoStorageItemKeyPrefix = `logto`;\nexport const buildLogtoKey = (key: string): string => `${logtoStorageItemKeyPrefix}:${key}`;\nexport const buildRefreshTokenKey = (logtoKey: string) => `${logtoKey}:refreshToken`;\nexport const buildIdTokenKey = (logtoKey: string) => `${logtoKey}:idToken`;\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n"],"names":[],"version":3,"file":"module.js.map"}

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@logto/browser",
-  "version": "0.2.0",
+  "version": "1.0.0-alpha.0",
+  "source": "./src/index.ts",
   "main": "./lib/index.js",
-  "exports": "./lib/index.js",
-  "typings": "./lib/index.d.ts",
+  "exports": {
+    "require": "./lib/index.js",
+    "import": "./lib/module.js"
+  },
+  "module": "./lib/module.js",
+  "types": "./lib/index.d.ts",
   "files": [
     "lib"
   ],
@@ -16,14 +21,15 @@
   "scripts": {
     "dev:tsc": "tsc -p tsconfig.build.json -w --preserveWatchOutput",
     "precommit": "lint-staged",
-    "build": "rm -rf lib/ && tsc -p tsconfig.build.json",
+    "check": "tsc --noEmit",
+    "build": "rm -rf lib/ && pnpm check && parcel build",
     "lint": "eslint --ext .ts src",
     "test": "jest",
     "test:coverage": "jest --silent --coverage",
     "prepack": "pnpm test"
   },
   "dependencies": {
-    "@logto/js": "^0.2.0",
+    "@logto/js": "^1.0.0-alpha.0",
     "@silverhand/essentials": "^1.1.6",
     "jose": "^4.5.0",
     "lodash.get": "^4.4.2",
@@ -32,6 +38,9 @@
   },
   "devDependencies": {
     "@jest/types": "^27.5.1",
+    "@parcel/core": "^2.6.2",
+    "@parcel/packager-ts": "^2.6.2",
+    "@parcel/transformer-typescript-types": "^2.6.2",
     "@silverhand/eslint-config": "^0.14.0",
     "@silverhand/ts-config": "^0.14.0",
     "@types/jest": "^27.4.0",
@@ -42,6 +51,7 @@
     "jest-location-mock": "^1.0.9",
     "jest-matcher-specific-error": "^1.0.0",
     "lint-staged": "^13.0.0",
+    "parcel": "^2.6.2",
     "prettier": "^2.3.2",
     "text-encoder": "^0.0.4",
     "ts-jest": "^27.0.4",
@@ -54,5 +64,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "5166ae926de86816f29229f18bc756f3b17fb57b"
+  "gitHead": "e7bebf027d400960ac6ef1d63ed84656aa6d1c62"
 }

package/lib/errors.d.ts

@@ -1,17 +0,0 @@
-import { NormalizeKeyPaths } from '@silverhand/essentials';
-declare const logtoClientErrorCodes: Readonly<{
-    sign_in_session: {
-        invalid: string;
-        not_found: string;
-    };
-    not_authenticated: string;
-    get_access_token_by_refresh_token_failed: string;
-    invalid_id_token: string;
-}>;
-export declare type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;
-export declare class LogtoClientError extends Error {
-    code: LogtoClientErrorCode;
-    data: unknown;
-    constructor(code: LogtoClientErrorCode, data?: unknown);
-}
-export {};

package/lib/errors.js

@@ -1,33 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LogtoClientError = void 0;
-const lodash_get_1 = __importDefault(require("lodash.get"));
-const logtoClientErrorCodes = Object.freeze({
-    sign_in_session: {
-        invalid: 'Invalid sign-in session.',
-        not_found: 'Sign-in session not found.',
-    },
-    not_authenticated: 'Not authenticated.',
-    get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',
-    invalid_id_token: 'Invalid id token.',
-});
-const getMessageByErrorCode = (errorCode) => {
-    // TODO: linear issue LOG-1419
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-    const message = (0, lodash_get_1.default)(logtoClientErrorCodes, errorCode);
-    if (typeof message === 'string') {
-        return message;
-    }
-    return errorCode;
-};
-class LogtoClientError extends Error {
-    constructor(code, data) {
-        super(getMessageByErrorCode(code));
-        this.code = code;
-        this.data = data;
-    }
-}
-exports.LogtoClientError = LogtoClientError;

package/lib/utils/index.d.ts

@@ -1,5 +0,0 @@
-export declare const buildLogtoKey: (key: string) => string;
-export declare const buildRefreshTokenKey: (logtoKey: string) => string;
-export declare const buildIdTokenKey: (logtoKey: string) => string;
-export declare const buildAccessTokenKey: (resource?: string, scopes?: string[]) => string;
-export declare const getDiscoveryEndpoint: (endpoint: string) => string;

package/lib/utils/index.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getDiscoveryEndpoint = exports.buildAccessTokenKey = exports.buildIdTokenKey = exports.buildRefreshTokenKey = exports.buildLogtoKey = void 0;
-const js_1 = require("@logto/js");
-const logtoStorageItemKeyPrefix = `logto`;
-const buildLogtoKey = (key) => `${logtoStorageItemKeyPrefix}:${key}`;
-exports.buildLogtoKey = buildLogtoKey;
-const buildRefreshTokenKey = (logtoKey) => `${logtoKey}:refreshToken`;
-exports.buildRefreshTokenKey = buildRefreshTokenKey;
-const buildIdTokenKey = (logtoKey) => `${logtoKey}:idToken`;
-exports.buildIdTokenKey = buildIdTokenKey;
-const buildAccessTokenKey = (resource = '', scopes = []) => `${scopes.slice().sort().join(' ')}@${resource}`;
-exports.buildAccessTokenKey = buildAccessTokenKey;
-const getDiscoveryEndpoint = (endpoint) => new URL(js_1.discoveryPath, endpoint).toString();
-exports.getDiscoveryEndpoint = getDiscoveryEndpoint;