@logto/browser 1.0.0-alpha.2 → 1.0.0-beta.10

package/README.md

@@ -0,0 +1,45 @@
+# Logto JS (Core) SDK
+[![Version](https://img.shields.io/npm/v/@logto/js)](https://www.npmjs.com/package/@logto/js)
+[![Build Status](https://github.com/logto-io/js/actions/workflows/main.yml/badge.svg)](https://github.com/logto-io/js/actions/workflows/main.yml)
+[![Codecov](https://img.shields.io/codecov/c/github/logto-io/js)](https://app.codecov.io/gh/logto-io/js?branch=master)
+
+The Logto JavaScript Core SDK written in TypeScript. Check out our [docs](https://docs.logto.io/JavaScript/browser/) for more information.
+
+We also provide [文档](https://docs.logto.io/zh-cn/sdk/JavaScript/browser/) in Simplified Chinese.
+
+## Installation
+
+### Using npm
+
+```bash
+npm install @logto/browser
+```
+
+### Using yarn
+
+```bash
+yarn add @logto/browser
+```
+
+### Using pnpm
+
+```bash
+pnpm add @logto/browser
+```
+
+## What is this and how does it work?
+
+As the name suggests, Logto browser SDK is the foundation of all Logto SDKs that run in a browser environment (Vanilla, React, Vue, etc.). `@logto/browser` extends `@logto/client` and provides a browser specific implementation of the client adapters:
+
+* Implements `Storage` by using browser `localStorage` and `sessionStorage`.
+* Implements `navigate` method by using `window.location.href`.
+
+Usually you are not expected to use it directly in your application, but instead choosing a framework specific SDK that built on top of it. We have already released a set of official SDKs to accelerate your integration. [Check this out](https://docs.logto.io/docs/recipes/integrate-logto/) and get started!
+
+If Logto does not support your front-end framework and you want to create your own SDK from scratch, we recommend checking out the SDK specification first. You can also refer to our [React SDK](https://github.com/logto-io/js/tree/master/packages/react) and [Vue SDK](https://github.com/logto-io/js/tree/master/packages/react) to learn more about the implementation details.
+
+## Resources
+
+[![Website](https://img.shields.io/badge/website-logto.io-8262F8.svg)](https://logto.io/)
+[![Docs](https://img.shields.io/badge/docs-logto.io-green.svg)](https://docs.logto.io/sdk/JavaScript/browser/)
+[![Discord](https://img.shields.io/discord/965845662535147551?logo=discord&logoColor=ffffff&color=7389D8&cacheSeconds=600)](https://discord.gg/UEPaF3j5e6)

package/lib/index.d.ts

@@ -1,67 +1,8 @@
-import { NormalizeKeyPaths, Nullable } from "@silverhand/essentials";
-import { IdTokenClaims, Prompt, Requester } from "@logto/js";
-import { Infer } from "superstruct";
-declare const logtoClientErrorCodes: Readonly<{
-    sign_in_session: {
-        invalid: string;
-        not_found: string;
-    };
-    not_authenticated: string;
-    get_access_token_by_refresh_token_failed: string;
-    invalid_id_token: string;
-}>;
-export type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;
-export class LogtoClientError extends Error {
-    code: LogtoClientErrorCode;
-    data: unknown;
-    constructor(code: LogtoClientErrorCode, data?: unknown);
-}
-export type { IdTokenClaims, LogtoErrorCode } from '@logto/js';
-export { LogtoError, OidcError, Prompt } from '@logto/js';
-export type LogtoConfig = {
-    endpoint: string;
-    appId: string;
-    scopes?: string[];
-    resources?: string[];
-    prompt?: Prompt;
-    usingPersistStorage?: boolean;
-};
-export type AccessToken = {
-    token: string;
-    scope: string;
-    expiresAt: number;
-};
-export const LogtoSignInSessionItemSchema: import("superstruct").Struct<{
-    redirectUri: string;
-    codeVerifier: string;
-    state: string;
-}, {
-    redirectUri: import("superstruct").Struct<string, null>;
-    codeVerifier: import("superstruct").Struct<string, null>;
-    state: import("superstruct").Struct<string, null>;
-}>;
-export type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;
-export default class LogtoClient {
-    protected readonly logtoConfig: LogtoConfig;
-    protected readonly getOidcConfig: () => Promise<import("@silverhand/essentials").KeysToCamelCase<import("@logto/js").OidcConfigSnakeCaseResponse>>;
-    protected readonly getJwtVerifyGetKey: () => Promise<import("jose/dist/types/types").GetKeyFunction<import("jose").JWSHeaderParameters, import("jose").FlattenedJWSInput>>;
-    protected readonly logtoStorageKey: string;
-    protected readonly requester: Requester;
-    protected readonly accessTokenMap: Map<string, AccessToken>;
-    constructor(logtoConfig: LogtoConfig, requester?: <T>(input: RequestInfo, init?: RequestInit | undefined) => Promise<T>);
-    get isAuthenticated(): boolean;
-    protected get signInSession(): Nullable<LogtoSignInSessionItem>;
-    protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>);
-    get refreshToken(): Nullable<string>;
-    private set refreshToken(value);
-    get idToken(): Nullable<string>;
-    private set idToken(value);
-    getAccessToken(resource?: string): Promise<string>;
-    getIdTokenClaims(): IdTokenClaims;
-    signIn(redirectUri: string): Promise<void>;
-    isSignInRedirected(url: string): boolean;
-    handleSignInCallback(callbackUri: string): Promise<void>;
-    signOut(postLogoutRedirectUri?: string): Promise<void>;
+import BaseClient, { LogtoConfig } from "@logto/client";
+export type { IdTokenClaims, LogtoErrorCode, LogtoConfig, LogtoClientErrorCode, UserInfoResponse, } from '@logto/client';
+export { LogtoError, OidcError, Prompt, LogtoRequestError, LogtoClientError, ReservedScope, UserScope, } from '@logto/client';
+export default class LogtoClient extends BaseClient {
+    constructor(config: LogtoConfig);
 }
 
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"mappings":";;;AAGA,QAAA,MAAM;;;;;;;;EAQJ,CAAC;AAEH,mCAAmC,kBAAkB,4BAA4B,CAAC,CAAC;AAcnF,6BAA8B,SAAQ,KAAK;IACzC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;gBAEF,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,OAAO;CAKvD;AEFD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG1D,0BAA0B;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,0BAA0B;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,OAAO,MAAM;;;;;;;;EAIX,CAAC;AAEH,qCAAqC,MAAM,mCAAmC,CAAC,CAAC;AAEhF;IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAC5C,SAAS,CAAC,QAAQ,CAAC,aAAa,mHAA6B;IAC7D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,sIAAkC;IAEvE,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAC3C,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAExC,SAAS,CAAC,QAAQ,CAAC,cAAc,2BAAkC;gBAKvD,WAAW,EAAE,WAAW,EAAE,SAAS,wEAAoB;IAWnE,IAAW,eAAe,YAEzB;IAED,SAAS,KAAK,aAAa,IAAI,SAAS,sBAAsB,CAAC,CAe9D;IAED,SAAS,KAAK,aAAa,CAAC,sBAAsB,EAAE,SAAS,sBAAsB,CAAC,EASnF;IAED,IAAI,YAAY,IAIuB,SAAS,MAAM,CAAC,CAFtD;IAED,OAAO,KAAK,YAAY,QAUvB;IAED,IAAI,OAAO,IAIkB,SAAS,MAAM,CAAC,CAF5C;IAED,OAAO,KAAK,OAAO,QAYlB;IAGY,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCxD,gBAAgB,IAAI,aAAa;IAQ3B,MAAM,CAAC,WAAW,EAAE,MAAM;IAyBhC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAYlC,oBAAoB,CAAC,WAAW,EAAE,MAAM;IA6BxC,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM;CA6GpD","sources":["packages/browser/src/src/errors.ts","packages/browser/src/src/utils/index.ts","packages/browser/src/src/index.ts","packages/browser/src/index.ts"],"sourcesContent":[null,null,null,"import {\n  CodeTokenResponse,\n  createRequester,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateCodeChallenge,\n  generateCodeVerifier,\n  generateSignInUri,\n  generateSignOutUri,\n  generateState,\n  IdTokenClaims,\n  Prompt,\n  Requester,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert, Infer, string, type } from 'superstruct';\n\nimport { LogtoClientError } from './errors';\nimport {\n  buildAccessTokenKey,\n  buildIdTokenKey,\n  buildLogtoKey,\n  buildRefreshTokenKey,\n  getDiscoveryEndpoint,\n} from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt } from '@logto/js';\nexport * from './errors';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  usingPersistStorage?: boolean;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number; // Unix Timestamp in seconds\n};\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly logtoStorageKey: string;\n  protected readonly requester: Requester;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, requester = createRequester()) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.logtoStorageKey = buildLogtoKey(logtoConfig.appId);\n    this.requester = requester;\n    this._idToken = localStorage.getItem(buildIdTokenKey(this.logtoStorageKey));\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = sessionStorage.getItem(this.logtoStorageKey);\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      sessionStorage.removeItem(this.logtoStorageKey);\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    sessionStorage.setItem(this.logtoStorageKey, jsonItem);\n  }\n\n  get refreshToken() {\n    return localStorage.getItem(buildRefreshTokenKey(this.logtoStorageKey));\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    const refreshTokenKey = buildRefreshTokenKey(this.logtoStorageKey);\n\n    if (!refreshToken) {\n      localStorage.removeItem(refreshTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(refreshTokenKey, refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    const idTokenKey = buildIdTokenKey(this.logtoStorageKey);\n\n    if (!idToken) {\n      localStorage.removeItem(idTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(idTokenKey, idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, requester } = this;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n  }\n}\n"],"names":[],"version":3,"file":"index.d.ts.map"}
+{"mappings":";AEKA,YAAY,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,UAAU,EACV,SAAS,EACT,MAAM,EACN,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAMvB,gCAAiC,SAAQ,UAAU;gBACrC,MAAM,EAAE,WAAW;CAWhC","sources":["packages/browser/src/src/storage.ts","packages/browser/src/src/utils/generators.ts","packages/browser/src/src/index.ts","packages/browser/src/index.ts"],"sourcesContent":[null,null,null,"import BaseClient, { createRequester, LogtoConfig } from '@logto/client';\n\nimport { BrowserStorage } from './storage';\nimport { generateCodeChallenge, generateCodeVerifier, generateState } from './utils/generators';\n\nexport type {\n  IdTokenClaims,\n  LogtoErrorCode,\n  LogtoConfig,\n  LogtoClientErrorCode,\n  UserInfoResponse,\n} from '@logto/client';\n\nexport {\n  LogtoError,\n  OidcError,\n  Prompt,\n  LogtoRequestError,\n  LogtoClientError,\n  ReservedScope,\n  UserScope,\n} from '@logto/client';\n\nconst navigate = (url: string) => {\n  window.location.assign(url);\n};\n\nexport default class LogtoClient extends BaseClient {\n  constructor(config: LogtoConfig) {\n    const requester = createRequester(fetch);\n    super(config, {\n      requester,\n      navigate,\n      storage: new BrowserStorage(config.appId),\n      generateCodeChallenge,\n      generateCodeVerifier,\n      generateState,\n    });\n  }\n}\n"],"names":[],"version":3,"file":"index.d.ts.map"}

package/lib/index.js

@@ -1,8 +1,5 @@
-var $2FOI4$logtojs = require("@logto/js");
-var $2FOI4$jose = require("jose");
-var $2FOI4$lodashonce = require("lodash.once");
-var $2FOI4$superstruct = require("superstruct");
-var $2FOI4$lodashget = require("lodash.get");
+var $2FOI4$logtoclient = require("@logto/client");
+var $2FOI4$jsbase64 = require("js-base64");
 
 function $parcel$interopDefault(a) {
   return a && a.__esModule ? a.default : a;
@@ -13,298 +10,81 @@ function $parcel$defineInteropFlag(a) {
 function $parcel$export(e, n, v, s) {
   Object.defineProperty(e, n, {get: v, set: s, enumerable: true, configurable: true});
 }
-function $parcel$exportWildcard(dest, source) {
-  Object.keys(source).forEach(function(key) {
-    if (key === 'default' || key === '__esModule' || dest.hasOwnProperty(key)) {
-      return;
-    }
-
-    Object.defineProperty(dest, key, {
-      enumerable: true,
-      get: function get() {
-        return source[key];
-      }
-    });
-  });
-
-  return dest;
-}
 
 $parcel$defineInteropFlag(module.exports);
 
-$parcel$export(module.exports, "LogtoSignInSessionItemSchema", () => $5a30d9203b683831$export$7b65a75f516b80e1);
 $parcel$export(module.exports, "default", () => $5a30d9203b683831$export$2e2bcd8739ae039);
 $parcel$export(module.exports, "LogtoError", () => $5a30d9203b683831$re_export$LogtoError);
 $parcel$export(module.exports, "OidcError", () => $5a30d9203b683831$re_export$OidcError);
-$parcel$export(module.exports, "Prompt", () => $2FOI4$logtojs.Prompt);
-
-
-
-
-var $91774f8557d77d78$exports = {};
-
-$parcel$export($91774f8557d77d78$exports, "LogtoClientError", () => $91774f8557d77d78$export$877962ca249b8fc8);
-
-const $91774f8557d77d78$var$logtoClientErrorCodes = Object.freeze({
-    sign_in_session: {
-        invalid: "Invalid sign-in session.",
-        not_found: "Sign-in session not found."
-    },
-    not_authenticated: "Not authenticated.",
-    get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.",
-    invalid_id_token: "Invalid id token."
-});
-const $91774f8557d77d78$var$getMessageByErrorCode = (errorCode)=>{
-    // TODO: linear issue LOG-1419
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-    const message = (0, ($parcel$interopDefault($2FOI4$lodashget)))($91774f8557d77d78$var$logtoClientErrorCodes, errorCode);
-    if (typeof message === "string") return message;
-    return errorCode;
-};
-class $91774f8557d77d78$export$877962ca249b8fc8 extends Error {
-    constructor(code, data){
-        super($91774f8557d77d78$var$getMessageByErrorCode(code));
-        this.code = code;
-        this.data = data;
+$parcel$export(module.exports, "Prompt", () => $5a30d9203b683831$re_export$Prompt);
+$parcel$export(module.exports, "LogtoRequestError", () => $5a30d9203b683831$re_export$LogtoRequestError);
+$parcel$export(module.exports, "LogtoClientError", () => $5a30d9203b683831$re_export$LogtoClientError);
+$parcel$export(module.exports, "ReservedScope", () => $5a30d9203b683831$re_export$ReservedScope);
+$parcel$export(module.exports, "UserScope", () => $5a30d9203b683831$re_export$UserScope);
+
+const $5be5fc3fe8f0a1d3$export$9b5c2da5fe7b4b2b = `logto`;
+class $5be5fc3fe8f0a1d3$export$2baa60fa09b100be {
+    constructor(appId){
+        this.storageKey = `${$5be5fc3fe8f0a1d3$export$9b5c2da5fe7b4b2b}:${appId}`;
+    }
+    async getItem(key) {
+        if (key === "signInSession") return sessionStorage.getItem(this.storageKey);
+        return localStorage.getItem(`${this.storageKey}:${key}`);
+    }
+    async setItem(key, value) {
+        if (key === "signInSession") {
+            sessionStorage.setItem(this.storageKey, value);
+            return;
+        }
+        localStorage.setItem(`${this.storageKey}:${key}`, value);
+    }
+    async removeItem(key) {
+        if (key === "signInSession") {
+            sessionStorage.removeItem(this.storageKey);
+            return;
+        }
+        localStorage.removeItem(`${this.storageKey}:${key}`);
     }
 }
 
 
 
-const $944e6f79cbd4667b$var$logtoStorageItemKeyPrefix = `logto`;
-const $944e6f79cbd4667b$export$bdf1d4f122e17e7b = (key)=>`${$944e6f79cbd4667b$var$logtoStorageItemKeyPrefix}:${key}`;
-const $944e6f79cbd4667b$export$79da00f3c12fcb3c = (logtoKey)=>`${logtoKey}:refreshToken`;
-const $944e6f79cbd4667b$export$cdb4d35801155147 = (logtoKey)=>`${logtoKey}:idToken`;
-const $944e6f79cbd4667b$export$8f595bd2a47bcea6 = (resource = "", scopes = [])=>`${scopes.slice().sort().join(" ")}@${resource}`;
-const $944e6f79cbd4667b$export$5d9c34f69c80822b = (endpoint)=>new URL((0, $2FOI4$logtojs.discoveryPath), endpoint).toString();
 
+/**
+ * @param length The length of the raw random data.
+ */ const $baeb4f3d786047ef$var$generateRandomString = (length = 64)=>(0, $2FOI4$jsbase64.fromUint8Array)(crypto.getRandomValues(new Uint8Array(length)), true);
+const $baeb4f3d786047ef$export$9ccd2716e53a229b = ()=>$baeb4f3d786047ef$var$generateRandomString();
+const $baeb4f3d786047ef$export$cf1891f923f5943a = ()=>$baeb4f3d786047ef$var$generateRandomString();
+const $baeb4f3d786047ef$export$414b01b1f867308a = async (codeVerifier)=>{
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+    if (crypto.subtle === undefined) /**
+     * `crypto.subtle` is available only in secure contexts (HTTPS) in some or all supporting browsers,
+     * https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle
+     * https://www.chromium.org/blink/webcrypto/#accessing-it
+     */ throw new (0, $2FOI4$logtoclient.LogtoError)("crypto_subtle_unavailable");
+    const encodedCodeVerifier = new TextEncoder().encode(codeVerifier);
+    const codeChallenge = new Uint8Array(await crypto.subtle.digest("SHA-256", encodedCodeVerifier));
+    return (0, $2FOI4$jsbase64.fromUint8Array)(codeChallenge, true);
+};
 
 
 
-const $5a30d9203b683831$export$7b65a75f516b80e1 = (0, $2FOI4$superstruct.type)({
-    redirectUri: (0, $2FOI4$superstruct.string)(),
-    codeVerifier: (0, $2FOI4$superstruct.string)(),
-    state: (0, $2FOI4$superstruct.string)()
-});
-class $5a30d9203b683831$export$2e2bcd8739ae039 {
-    getOidcConfig = (0, ($parcel$interopDefault($2FOI4$lodashonce)))(this._getOidcConfig);
-    getJwtVerifyGetKey = (0, ($parcel$interopDefault($2FOI4$lodashonce)))(this._getJwtVerifyGetKey);
-    accessTokenMap = new Map();
-    getAccessTokenPromiseMap = new Map();
-    constructor(logtoConfig, requester = (0, $2FOI4$logtojs.createRequester)()){
-        this.logtoConfig = {
-            ...logtoConfig,
-            prompt: logtoConfig.prompt ?? (0, $2FOI4$logtojs.Prompt).Consent,
-            scopes: (0, $2FOI4$logtojs.withReservedScopes)(logtoConfig.scopes).split(" ")
-        };
-        this.logtoStorageKey = (0, $944e6f79cbd4667b$export$bdf1d4f122e17e7b)(logtoConfig.appId);
-        this.requester = requester;
-        this._idToken = localStorage.getItem((0, $944e6f79cbd4667b$export$cdb4d35801155147)(this.logtoStorageKey));
-    }
-    get isAuthenticated() {
-        return Boolean(this.idToken);
-    }
-    get signInSession() {
-        const jsonItem = sessionStorage.getItem(this.logtoStorageKey);
-        if (!jsonItem) return null;
-        try {
-            const item = JSON.parse(jsonItem);
-            (0, $2FOI4$superstruct.assert)(item, $5a30d9203b683831$export$7b65a75f516b80e1);
-            return item;
-        } catch (error) {
-            throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("sign_in_session.invalid", error);
-        }
-    }
-    set signInSession(logtoSignInSessionItem) {
-        if (!logtoSignInSessionItem) {
-            sessionStorage.removeItem(this.logtoStorageKey);
-            return;
-        }
-        const jsonItem = JSON.stringify(logtoSignInSessionItem);
-        sessionStorage.setItem(this.logtoStorageKey, jsonItem);
-    }
-    get refreshToken() {
-        return localStorage.getItem((0, $944e6f79cbd4667b$export$79da00f3c12fcb3c)(this.logtoStorageKey));
-    }
-    set refreshToken(refreshToken) {
-        const refreshTokenKey = (0, $944e6f79cbd4667b$export$79da00f3c12fcb3c)(this.logtoStorageKey);
-        if (!refreshToken) {
-            localStorage.removeItem(refreshTokenKey);
-            return;
-        }
-        localStorage.setItem(refreshTokenKey, refreshToken);
-    }
-    get idToken() {
-        return this._idToken;
-    }
-    set idToken(idToken) {
-        this._idToken = idToken;
-        const idTokenKey = (0, $944e6f79cbd4667b$export$cdb4d35801155147)(this.logtoStorageKey);
-        if (!idToken) {
-            localStorage.removeItem(idTokenKey);
-            return;
-        }
-        localStorage.setItem(idTokenKey, idToken);
-    }
-    // eslint-disable-next-line complexity
-    async getAccessToken(resource) {
-        if (!this.idToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
-        const accessTokenKey = (0, $944e6f79cbd4667b$export$8f595bd2a47bcea6)(resource);
-        const accessToken = this.accessTokenMap.get(accessTokenKey);
-        if (accessToken && accessToken.expiresAt > Date.now() / 1000) return accessToken.token;
-        // Since the access token has expired, delete it from the map.
-        if (accessToken) this.accessTokenMap.delete(accessTokenKey);
-        /**
-     * Need to fetch a new access token using refresh token.
-     * Reuse the cached promise if exists.
-     */ const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);
-        if (cachedPromise) return cachedPromise;
-        /**
-     * Create a new promise and cache in map to avoid race condition.
-     * Since we enable "refresh token rotation" by default,
-     * it will be problematic when calling multiple `getAccessToken()` closely.
-     */ const promise = this.getAccessTokenByRefreshToken(resource);
-        this.getAccessTokenPromiseMap.set(accessTokenKey, promise);
-        const token = await promise;
-        this.getAccessTokenPromiseMap.delete(accessTokenKey);
-        return token;
-    }
-    getIdTokenClaims() {
-        if (!this.idToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
-        return (0, $2FOI4$logtojs.decodeIdToken)(this.idToken);
-    }
-    async signIn(redirectUri) {
-        const { appId: clientId , prompt: prompt , resources: resources , scopes: scopes  } = this.logtoConfig;
-        const { authorizationEndpoint: authorizationEndpoint  } = await this.getOidcConfig();
-        const codeVerifier = (0, $2FOI4$logtojs.generateCodeVerifier)();
-        const codeChallenge = await (0, $2FOI4$logtojs.generateCodeChallenge)(codeVerifier);
-        const state = (0, $2FOI4$logtojs.generateState)();
-        const signInUri = (0, $2FOI4$logtojs.generateSignInUri)({
-            authorizationEndpoint: authorizationEndpoint,
-            clientId: clientId,
-            redirectUri: redirectUri,
-            codeChallenge: codeChallenge,
-            state: state,
-            scopes: scopes,
-            resources: resources,
-            prompt: prompt
-        });
-        this.signInSession = {
-            redirectUri: redirectUri,
-            codeVerifier: codeVerifier,
-            state: state
-        };
-        this.refreshToken = null;
-        this.idToken = null;
-        window.location.assign(signInUri);
-    }
-    isSignInRedirected(url) {
-        const { signInSession: signInSession  } = this;
-        if (!signInSession) return false;
-        const { redirectUri: redirectUri  } = signInSession;
-        const { origin: origin , pathname: pathname  } = new URL(url);
-        return `${origin}${pathname}` === redirectUri;
-    }
-    async handleSignInCallback(callbackUri) {
-        const { signInSession: signInSession , logtoConfig: logtoConfig , requester: requester  } = this;
-        if (!signInSession) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("sign_in_session.not_found");
-        const { redirectUri: redirectUri , state: state , codeVerifier: codeVerifier  } = signInSession;
-        const code = (0, $2FOI4$logtojs.verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
-        const { appId: clientId  } = logtoConfig;
-        const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
-        const codeTokenResponse = await (0, $2FOI4$logtojs.fetchTokenByAuthorizationCode)({
-            clientId: clientId,
-            tokenEndpoint: tokenEndpoint,
-            redirectUri: redirectUri,
-            codeVerifier: codeVerifier,
-            code: code
-        }, requester);
-        await this.verifyIdToken(codeTokenResponse.idToken);
-        this.saveCodeToken(codeTokenResponse);
-        this.signInSession = null;
-    }
-    async signOut(postLogoutRedirectUri) {
-        if (!this.idToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
-        const { appId: clientId  } = this.logtoConfig;
-        const { endSessionEndpoint: endSessionEndpoint , revocationEndpoint: revocationEndpoint  } = await this.getOidcConfig();
-        if (this.refreshToken) try {
-            await (0, $2FOI4$logtojs.revoke)(revocationEndpoint, clientId, this.refreshToken, this.requester);
-        } catch  {
-        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
-        }
-        const url = (0, $2FOI4$logtojs.generateSignOutUri)({
-            endSessionEndpoint: endSessionEndpoint,
-            postLogoutRedirectUri: postLogoutRedirectUri,
-            idToken: this.idToken
-        });
-        this.accessTokenMap.clear();
-        this.refreshToken = null;
-        this.idToken = null;
-        window.location.assign(url);
-    }
-    async getAccessTokenByRefreshToken(resource) {
-        if (!this.refreshToken) throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("not_authenticated");
-        try {
-            const accessTokenKey = (0, $944e6f79cbd4667b$export$8f595bd2a47bcea6)(resource);
-            const { appId: clientId  } = this.logtoConfig;
-            const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
-            const { accessToken: accessToken , refreshToken: refreshToken , idToken: idToken , scope: scope , expiresIn: expiresIn  } = await (0, $2FOI4$logtojs.fetchTokenByRefreshToken)({
-                clientId: clientId,
-                tokenEndpoint: tokenEndpoint,
-                refreshToken: this.refreshToken,
-                resource: resource,
-                scopes: resource ? [
-                    "offline_access"
-                ] : undefined
-            }, this.requester);
-            this.accessTokenMap.set(accessTokenKey, {
-                token: accessToken,
-                scope: scope,
-                expiresAt: Math.round(Date.now() / 1000) + expiresIn
-            });
-            this.refreshToken = refreshToken;
-            if (idToken) {
-                await this.verifyIdToken(idToken);
-                this.idToken = idToken;
-            }
-            return accessToken;
-        } catch (error) {
-            throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("get_access_token_by_refresh_token_failed", error);
-        }
-    }
-    async _getOidcConfig() {
-        const { endpoint: endpoint  } = this.logtoConfig;
-        const discoveryEndpoint = (0, $944e6f79cbd4667b$export$5d9c34f69c80822b)(endpoint);
-        return (0, $2FOI4$logtojs.fetchOidcConfig)(discoveryEndpoint, this.requester);
-    }
-    async _getJwtVerifyGetKey() {
-        const { jwksUri: jwksUri  } = await this.getOidcConfig();
-        return (0, $2FOI4$jose.createRemoteJWKSet)(new URL(jwksUri));
-    }
-    async verifyIdToken(idToken) {
-        const { appId: appId  } = this.logtoConfig;
-        const { issuer: issuer  } = await this.getOidcConfig();
-        const jwtVerifyGetKey = await this.getJwtVerifyGetKey();
-        try {
-            await (0, $2FOI4$logtojs.verifyIdToken)(idToken, appId, issuer, jwtVerifyGetKey);
-        } catch (error) {
-            throw new (0, $91774f8557d77d78$export$877962ca249b8fc8)("invalid_id_token", error);
-        }
-    }
-    saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
-        this.refreshToken = refreshToken ?? null;
-        this.idToken = idToken;
-        // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)
-        const accessTokenKey = (0, $944e6f79cbd4667b$export$8f595bd2a47bcea6)();
-        const expiresAt = Date.now() / 1000 + expiresIn;
-        this.accessTokenMap.set(accessTokenKey, {
-            token: accessToken,
-            scope: scope,
-            expiresAt: expiresAt
+const $5a30d9203b683831$var$navigate = (url)=>{
+    window.location.assign(url);
+};
+class $5a30d9203b683831$export$2e2bcd8739ae039 extends (0, ($parcel$interopDefault($2FOI4$logtoclient))) {
+    constructor(config){
+        const requester = (0, $2FOI4$logtoclient.createRequester)(fetch);
+        super(config, {
+            requester: requester,
+            navigate: $5a30d9203b683831$var$navigate,
+            storage: new (0, $5be5fc3fe8f0a1d3$export$2baa60fa09b100be)(config.appId),
+            generateCodeChallenge: $baeb4f3d786047ef$export$414b01b1f867308a,
+            generateCodeVerifier: $baeb4f3d786047ef$export$cf1891f923f5943a,
+            generateState: $baeb4f3d786047ef$export$9ccd2716e53a229b
         });
     }
 }
-$parcel$exportWildcard(module.exports, $91774f8557d77d78$exports);
 
 
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,8BAA8B;IAC9B,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,0CAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;ACpCD;AAEA,MAAM,+CAAyB,GAAG,CAAC,KAAK,CAAC,AAAC;AACnC,MAAM,yCAAa,GAAG,CAAC,GAAW,GAAa,CAAC,EAAE,+CAAyB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,AAAC;AACrF,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,AAAC;AAC9E,MAAM,yCAAe,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,AAAC;AAEpE,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,4BAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;AF0CvC,MAAM,yCAA4B,GAAG,CAAA,GAAA,uBAAI,CAAA,CAAC;IAC/C,WAAW,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACrB,YAAY,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACtB,KAAK,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;CAChB,CAAC,AAAC;AAIY;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAKvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAG/E,YAAY,WAAwB,EAAE,SAAS,GAAG,CAAA,GAAA,8BAAe,CAAA,EAAE,CAAE;QACnE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,qBAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,iCAAkB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1D,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,CAAA,GAAA,yCAAa,CAAA,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KAC7E;IAED,IAAW,eAAe,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC9B;IAED,IAAc,aAAa,GAAqC;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAE9D,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;YAC3C,CAAA,GAAA,yBAAM,CAAA,CAAC,IAAI,EAAE,yCAA4B,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;SACb,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;SAC9D;KACF;IAED,IAAc,aAAa,CAAC,sBAAwD,EAAE;QACpF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAEhD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KACxD;IAED,IAAI,YAAY,GAAG;QACjB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KACzE;IAED,IAAY,YAAY,CAAC,YAA8B,EAAE;QACvD,MAAM,eAAe,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEnE,IAAI,CAAC,YAAY,EAAE;YACjB,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEzC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KACrD;IAED,IAAI,OAAO,GAAG;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;KACtB;IAED,IAAY,OAAO,CAAC,OAAyB,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,MAAM,UAAU,GAAG,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEzD,IAAI,CAAC,OAAO,EAAE;YACZ,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEpC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC3C;IAED,sCAAsC;IACtC,MAAa,cAAc,CAAC,QAAiB,EAAmB;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,AAAO,gBAAgB,GAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,4BAAa,CAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,MAAa,MAAM,CAAC,WAAmB,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,CAAA,GAAA,mCAAoB,CAAA,EAAE,AAAC;QAC5C,MAAM,aAAa,GAAG,MAAM,CAAA,GAAA,oCAAqB,CAAA,CAAC,YAAY,CAAC,AAAC;QAChE,MAAM,KAAK,GAAG,CAAA,GAAA,4BAAa,CAAA,EAAE,AAAC;QAE9B,MAAM,SAAS,GAAG,CAAA,GAAA,gCAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,IAAI,CAAC,aAAa,GAAG;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;KACnC;IAED,AAAO,kBAAkB,CAAC,GAAW,EAAW;QAC9C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,IAAI,AAAC;QAE/B,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAa,oBAAoB,CAAC,WAAmB,EAAE;QACrD,MAAM,iBAAE,aAAa,CAAA,eAAE,WAAW,CAAA,aAAE,SAAS,CAAA,EAAE,GAAG,IAAI,AAAC;QAEvD,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,gDAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,4CAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;KAC3B;IAED,MAAa,OAAO,CAAC,qBAA8B,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE9E,IAAI,IAAI,CAAC,YAAY,EACnB,IAAI;YACF,MAAM,CAAA,GAAA,qBAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/E,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,iCAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;KAC7B;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,EACpB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,uCAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;0BAC/B,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,gBAAgB;iBAAC,GAAG,SAAS;aAClD,EACD,IAAI,CAAC,SAAS,CACf,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YAEjC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aACxB;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,8BAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;KAC3D;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,8BAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,4BAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,AAAQ,aAAa,CAAC,gBACpB,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;KACnF;CACF","sources":["packages/browser/src/index.ts","packages/browser/src/errors.ts","packages/browser/src/utils/index.ts"],"sourcesContent":["import {\n  CodeTokenResponse,\n  createRequester,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateCodeChallenge,\n  generateCodeVerifier,\n  generateSignInUri,\n  generateSignOutUri,\n  generateState,\n  IdTokenClaims,\n  Prompt,\n  Requester,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert, Infer, string, type } from 'superstruct';\n\nimport { LogtoClientError } from './errors';\nimport {\n  buildAccessTokenKey,\n  buildIdTokenKey,\n  buildLogtoKey,\n  buildRefreshTokenKey,\n  getDiscoveryEndpoint,\n} from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt } from '@logto/js';\nexport * from './errors';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  usingPersistStorage?: boolean;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number; // Unix Timestamp in seconds\n};\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly logtoStorageKey: string;\n  protected readonly requester: Requester;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, requester = createRequester()) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.logtoStorageKey = buildLogtoKey(logtoConfig.appId);\n    this.requester = requester;\n    this._idToken = localStorage.getItem(buildIdTokenKey(this.logtoStorageKey));\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = sessionStorage.getItem(this.logtoStorageKey);\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      sessionStorage.removeItem(this.logtoStorageKey);\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    sessionStorage.setItem(this.logtoStorageKey, jsonItem);\n  }\n\n  get refreshToken() {\n    return localStorage.getItem(buildRefreshTokenKey(this.logtoStorageKey));\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    const refreshTokenKey = buildRefreshTokenKey(this.logtoStorageKey);\n\n    if (!refreshToken) {\n      localStorage.removeItem(refreshTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(refreshTokenKey, refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    const idTokenKey = buildIdTokenKey(this.logtoStorageKey);\n\n    if (!idToken) {\n      localStorage.removeItem(idTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(idTokenKey, idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, requester } = this;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n  }\n}\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // TODO: linear issue LOG-1419\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { discoveryPath } from '@logto/js';\n\nconst logtoStorageItemKeyPrefix = `logto`;\nexport const buildLogtoKey = (key: string): string => `${logtoStorageItemKeyPrefix}:${key}`;\nexport const buildRefreshTokenKey = (logtoKey: string) => `${logtoKey}:refreshToken`;\nexport const buildIdTokenKey = (logtoKey: string) => `${logtoKey}:idToken`;\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n"],"names":[],"version":3,"file":"index.js.map"}
+{"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA;ACGO,MAAM,yCAAyB,GAAG,CAAC,KAAK,CAAC,AAAC;AAE1C,MAAM,yCAAc;IAGzB,YAAY,KAAa,CAAE;QACzB,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,yCAAyB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;KAC3D;IAED,MAAM,OAAO,CAAC,GAAe,EAA6B;QACxD,IAAI,GAAG,KAAK,eAAe,EACzB,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAGjD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;KAC1D;IAED,MAAM,OAAO,CAAC,GAAe,EAAE,KAAa,EAAiB;QAC3D,IAAI,GAAG,KAAK,eAAe,EAAE;YAC3B,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE/C,OAAO;SACR;QACD,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;KAC1D;IAED,MAAM,UAAU,CAAC,GAAe,EAAiB;QAC/C,IAAI,GAAG,KAAK,eAAe,EAAE;YAC3B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,OAAO;SACR;QACD,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;KACtD;CACF;;;ACnCD;;AAGA;;GAEG,CACH,MAAM,0CAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,GACvC,CAAA,GAAA,8BAAc,CAAA,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,AAAC;AAKhE,MAAM,yCAAa,GAAG,IAAM,0CAAoB,EAAE,AAAC;AAOnD,MAAM,yCAAoB,GAAG,IAAM,0CAAoB,EAAE,AAAC;AAQ1D,MAAM,yCAAqB,GAAG,OAAO,YAAoB,GAAsB;IACpF,uEAAuE;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAC7B;;;;OAIG,CACH,MAAM,IAAI,CAAA,GAAA,6BAAU,CAAA,CAAC,2BAA2B,CAAC,CAAC;IAGpD,MAAM,mBAAmB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,AAAC;IACnE,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,AAAC;IAEjG,OAAO,CAAA,GAAA,8BAAc,CAAA,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;CAC5C,AAAC;;;;AFrBF,MAAM,8BAAQ,GAAG,CAAC,GAAW,GAAK;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;CAC7B,AAAC;AAEa,uDAA0B,CAAA,GAAA,4CAAU,CAAA;IACjD,YAAY,MAAmB,CAAE;QAC/B,MAAM,SAAS,GAAG,CAAA,GAAA,kCAAe,CAAA,CAAC,KAAK,CAAC,AAAC;QACzC,KAAK,CAAC,MAAM,EAAE;uBACZ,SAAS;sBACT,8BAAQ;YACR,OAAO,EAAE,IAAI,CAAA,GAAA,yCAAc,CAAA,CAAC,MAAM,CAAC,KAAK,CAAC;mCACzC,yCAAqB;kCACrB,yCAAoB;2BACpB,yCAAa;SACd,CAAC,CAAC;KACJ;CACF","sources":["packages/browser/src/index.ts","packages/browser/src/storage.ts","packages/browser/src/utils/generators.ts"],"sourcesContent":["import BaseClient, { createRequester, LogtoConfig } from '@logto/client';\n\nimport { BrowserStorage } from './storage';\nimport { generateCodeChallenge, generateCodeVerifier, generateState } from './utils/generators';\n\nexport type {\n  IdTokenClaims,\n  LogtoErrorCode,\n  LogtoConfig,\n  LogtoClientErrorCode,\n  UserInfoResponse,\n} from '@logto/client';\n\nexport {\n  LogtoError,\n  OidcError,\n  Prompt,\n  LogtoRequestError,\n  LogtoClientError,\n  ReservedScope,\n  UserScope,\n} from '@logto/client';\n\nconst navigate = (url: string) => {\n  window.location.assign(url);\n};\n\nexport default class LogtoClient extends BaseClient {\n  constructor(config: LogtoConfig) {\n    const requester = createRequester(fetch);\n    super(config, {\n      requester,\n      navigate,\n      storage: new BrowserStorage(config.appId),\n      generateCodeChallenge,\n      generateCodeVerifier,\n      generateState,\n    });\n  }\n}\n","import { Storage, StorageKey } from '@logto/client';\nimport { Nullable } from '@silverhand/essentials';\n\nexport const logtoStorageItemKeyPrefix = `logto`;\n\nexport class BrowserStorage implements Storage {\n  private readonly storageKey: string;\n\n  constructor(appId: string) {\n    this.storageKey = `${logtoStorageItemKeyPrefix}:${appId}`;\n  }\n\n  async getItem(key: StorageKey): Promise<Nullable<string>> {\n    if (key === 'signInSession') {\n      return sessionStorage.getItem(this.storageKey);\n    }\n\n    return localStorage.getItem(`${this.storageKey}:${key}`);\n  }\n\n  async setItem(key: StorageKey, value: string): Promise<void> {\n    if (key === 'signInSession') {\n      sessionStorage.setItem(this.storageKey, value);\n\n      return;\n    }\n    localStorage.setItem(`${this.storageKey}:${key}`, value);\n  }\n\n  async removeItem(key: StorageKey): Promise<void> {\n    if (key === 'signInSession') {\n      sessionStorage.removeItem(this.storageKey);\n\n      return;\n    }\n    localStorage.removeItem(`${this.storageKey}:${key}`);\n  }\n}\n","/** @link [Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) */\n\nimport { LogtoError } from '@logto/client';\nimport { fromUint8Array } from 'js-base64';\n\n/**\n * @param length The length of the raw random data.\n */\nconst generateRandomString = (length = 64) =>\n  fromUint8Array(crypto.getRandomValues(new Uint8Array(length)), true);\n\n/**\n * Generates random string for state and encodes them in url safe base64\n */\nexport const generateState = () => generateRandomString();\n\n/**\n * Generates code verifier\n *\n * @link [Client Creates a Code Verifier](https://datatracker.ietf.org/doc/html/rfc7636#section-4.1)\n */\nexport const generateCodeVerifier = () => generateRandomString();\n\n/**\n * Calculates the S256 PKCE code challenge for an arbitrary code verifier and encodes it in url safe base64\n *\n * @param {String} codeVerifier Code verifier to calculate the S256 code challenge for\n * @link [Client Creates the Code Challenge](https://datatracker.ietf.org/doc/html/rfc7636#section-4.2)\n */\nexport const generateCodeChallenge = async (codeVerifier: string): Promise<string> => {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n  if (crypto.subtle === undefined) {\n    /**\n     * `crypto.subtle` is available only in secure contexts (HTTPS) in some or all supporting browsers,\n     * https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle\n     * https://www.chromium.org/blink/webcrypto/#accessing-it\n     */\n    throw new LogtoError('crypto_subtle_unavailable');\n  }\n\n  const encodedCodeVerifier = new TextEncoder().encode(codeVerifier);\n  const codeChallenge = new Uint8Array(await crypto.subtle.digest('SHA-256', encodedCodeVerifier));\n\n  return fromUint8Array(codeChallenge, true);\n};\n"],"names":[],"version":3,"file":"index.js.map"}

package/lib/module.js

@@ -1,280 +1,71 @@
-import {createRequester as $ElS14$createRequester, Prompt as $90df2ab0e44b5eba$import$5548085c5b0a2ee3$83716a4aa1642908, withReservedScopes as $ElS14$withReservedScopes, decodeIdToken as $ElS14$decodeIdToken, generateCodeVerifier as $ElS14$generateCodeVerifier, generateCodeChallenge as $ElS14$generateCodeChallenge, generateState as $ElS14$generateState, generateSignInUri as $ElS14$generateSignInUri, verifyAndParseCodeFromCallbackUri as $ElS14$verifyAndParseCodeFromCallbackUri, fetchTokenByAuthorizationCode as $ElS14$fetchTokenByAuthorizationCode, revoke as $ElS14$revoke, generateSignOutUri as $ElS14$generateSignOutUri, fetchTokenByRefreshToken as $ElS14$fetchTokenByRefreshToken, fetchOidcConfig as $ElS14$fetchOidcConfig, verifyIdToken as $ElS14$verifyIdToken, LogtoError as $90df2ab0e44b5eba$re_export$LogtoError, OidcError as $90df2ab0e44b5eba$re_export$OidcError, discoveryPath as $ElS14$discoveryPath} from "@logto/js";
-import {createRemoteJWKSet as $ElS14$createRemoteJWKSet} from "jose";
-import $ElS14$lodashonce from "lodash.once";
-import {type as $ElS14$type, string as $ElS14$string, assert as $ElS14$assert} from "superstruct";
-import $ElS14$lodashget from "lodash.get";
+import $ElS14$logtoclient, {createRequester as $ElS14$createRequester, LogtoError as $90df2ab0e44b5eba$re_export$LogtoError, OidcError as $90df2ab0e44b5eba$re_export$OidcError, Prompt as $90df2ab0e44b5eba$re_export$Prompt, LogtoRequestError as $90df2ab0e44b5eba$re_export$LogtoRequestError, LogtoClientError as $90df2ab0e44b5eba$re_export$LogtoClientError, ReservedScope as $90df2ab0e44b5eba$re_export$ReservedScope, UserScope as $90df2ab0e44b5eba$re_export$UserScope} from "@logto/client";
+import {fromUint8Array as $ElS14$fromUint8Array} from "js-base64";
 
-function $parcel$export(e, n, v, s) {
-  Object.defineProperty(e, n, {get: v, set: s, enumerable: true, configurable: true});
-}
-
-
-
-
-var $092943c955830b14$exports = {};
-
-$parcel$export($092943c955830b14$exports, "LogtoClientError", () => $092943c955830b14$export$877962ca249b8fc8);
 
-const $092943c955830b14$var$logtoClientErrorCodes = Object.freeze({
-    sign_in_session: {
-        invalid: "Invalid sign-in session.",
-        not_found: "Sign-in session not found."
-    },
-    not_authenticated: "Not authenticated.",
-    get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.",
-    invalid_id_token: "Invalid id token."
-});
-const $092943c955830b14$var$getMessageByErrorCode = (errorCode)=>{
-    // TODO: linear issue LOG-1419
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-    const message = (0, $ElS14$lodashget)($092943c955830b14$var$logtoClientErrorCodes, errorCode);
-    if (typeof message === "string") return message;
-    return errorCode;
-};
-class $092943c955830b14$export$877962ca249b8fc8 extends Error {
-    constructor(code, data){
-        super($092943c955830b14$var$getMessageByErrorCode(code));
-        this.code = code;
-        this.data = data;
+const $283691d41cf73b69$export$9b5c2da5fe7b4b2b = `logto`;
+class $283691d41cf73b69$export$2baa60fa09b100be {
+    constructor(appId){
+        this.storageKey = `${$283691d41cf73b69$export$9b5c2da5fe7b4b2b}:${appId}`;
+    }
+    async getItem(key) {
+        if (key === "signInSession") return sessionStorage.getItem(this.storageKey);
+        return localStorage.getItem(`${this.storageKey}:${key}`);
+    }
+    async setItem(key, value) {
+        if (key === "signInSession") {
+            sessionStorage.setItem(this.storageKey, value);
+            return;
+        }
+        localStorage.setItem(`${this.storageKey}:${key}`, value);
+    }
+    async removeItem(key) {
+        if (key === "signInSession") {
+            sessionStorage.removeItem(this.storageKey);
+            return;
+        }
+        localStorage.removeItem(`${this.storageKey}:${key}`);
     }
 }
 
 
 
-const $2f0dba05fbbfeb85$var$logtoStorageItemKeyPrefix = `logto`;
-const $2f0dba05fbbfeb85$export$bdf1d4f122e17e7b = (key)=>`${$2f0dba05fbbfeb85$var$logtoStorageItemKeyPrefix}:${key}`;
-const $2f0dba05fbbfeb85$export$79da00f3c12fcb3c = (logtoKey)=>`${logtoKey}:refreshToken`;
-const $2f0dba05fbbfeb85$export$cdb4d35801155147 = (logtoKey)=>`${logtoKey}:idToken`;
-const $2f0dba05fbbfeb85$export$8f595bd2a47bcea6 = (resource = "", scopes = [])=>`${scopes.slice().sort().join(" ")}@${resource}`;
-const $2f0dba05fbbfeb85$export$5d9c34f69c80822b = (endpoint)=>new URL((0, $ElS14$discoveryPath), endpoint).toString();
 
+/**
+ * @param length The length of the raw random data.
+ */ const $7faa35338215c9c1$var$generateRandomString = (length = 64)=>(0, $ElS14$fromUint8Array)(crypto.getRandomValues(new Uint8Array(length)), true);
+const $7faa35338215c9c1$export$9ccd2716e53a229b = ()=>$7faa35338215c9c1$var$generateRandomString();
+const $7faa35338215c9c1$export$cf1891f923f5943a = ()=>$7faa35338215c9c1$var$generateRandomString();
+const $7faa35338215c9c1$export$414b01b1f867308a = async (codeVerifier)=>{
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+    if (crypto.subtle === undefined) /**
+     * `crypto.subtle` is available only in secure contexts (HTTPS) in some or all supporting browsers,
+     * https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle
+     * https://www.chromium.org/blink/webcrypto/#accessing-it
+     */ throw new (0, $90df2ab0e44b5eba$re_export$LogtoError)("crypto_subtle_unavailable");
+    const encodedCodeVerifier = new TextEncoder().encode(codeVerifier);
+    const codeChallenge = new Uint8Array(await crypto.subtle.digest("SHA-256", encodedCodeVerifier));
+    return (0, $ElS14$fromUint8Array)(codeChallenge, true);
+};
 
 
 
-const $90df2ab0e44b5eba$export$7b65a75f516b80e1 = (0, $ElS14$type)({
-    redirectUri: (0, $ElS14$string)(),
-    codeVerifier: (0, $ElS14$string)(),
-    state: (0, $ElS14$string)()
-});
-class $90df2ab0e44b5eba$export$2e2bcd8739ae039 {
-    getOidcConfig = (0, $ElS14$lodashonce)(this._getOidcConfig);
-    getJwtVerifyGetKey = (0, $ElS14$lodashonce)(this._getJwtVerifyGetKey);
-    accessTokenMap = new Map();
-    getAccessTokenPromiseMap = new Map();
-    constructor(logtoConfig, requester = (0, $ElS14$createRequester)()){
-        this.logtoConfig = {
-            ...logtoConfig,
-            prompt: logtoConfig.prompt ?? (0, $90df2ab0e44b5eba$import$5548085c5b0a2ee3$83716a4aa1642908).Consent,
-            scopes: (0, $ElS14$withReservedScopes)(logtoConfig.scopes).split(" ")
-        };
-        this.logtoStorageKey = (0, $2f0dba05fbbfeb85$export$bdf1d4f122e17e7b)(logtoConfig.appId);
-        this.requester = requester;
-        this._idToken = localStorage.getItem((0, $2f0dba05fbbfeb85$export$cdb4d35801155147)(this.logtoStorageKey));
-    }
-    get isAuthenticated() {
-        return Boolean(this.idToken);
-    }
-    get signInSession() {
-        const jsonItem = sessionStorage.getItem(this.logtoStorageKey);
-        if (!jsonItem) return null;
-        try {
-            const item = JSON.parse(jsonItem);
-            (0, $ElS14$assert)(item, $90df2ab0e44b5eba$export$7b65a75f516b80e1);
-            return item;
-        } catch (error) {
-            throw new (0, $092943c955830b14$export$877962ca249b8fc8)("sign_in_session.invalid", error);
-        }
-    }
-    set signInSession(logtoSignInSessionItem) {
-        if (!logtoSignInSessionItem) {
-            sessionStorage.removeItem(this.logtoStorageKey);
-            return;
-        }
-        const jsonItem = JSON.stringify(logtoSignInSessionItem);
-        sessionStorage.setItem(this.logtoStorageKey, jsonItem);
-    }
-    get refreshToken() {
-        return localStorage.getItem((0, $2f0dba05fbbfeb85$export$79da00f3c12fcb3c)(this.logtoStorageKey));
-    }
-    set refreshToken(refreshToken) {
-        const refreshTokenKey = (0, $2f0dba05fbbfeb85$export$79da00f3c12fcb3c)(this.logtoStorageKey);
-        if (!refreshToken) {
-            localStorage.removeItem(refreshTokenKey);
-            return;
-        }
-        localStorage.setItem(refreshTokenKey, refreshToken);
-    }
-    get idToken() {
-        return this._idToken;
-    }
-    set idToken(idToken) {
-        this._idToken = idToken;
-        const idTokenKey = (0, $2f0dba05fbbfeb85$export$cdb4d35801155147)(this.logtoStorageKey);
-        if (!idToken) {
-            localStorage.removeItem(idTokenKey);
-            return;
-        }
-        localStorage.setItem(idTokenKey, idToken);
-    }
-    // eslint-disable-next-line complexity
-    async getAccessToken(resource) {
-        if (!this.idToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
-        const accessTokenKey = (0, $2f0dba05fbbfeb85$export$8f595bd2a47bcea6)(resource);
-        const accessToken = this.accessTokenMap.get(accessTokenKey);
-        if (accessToken && accessToken.expiresAt > Date.now() / 1000) return accessToken.token;
-        // Since the access token has expired, delete it from the map.
-        if (accessToken) this.accessTokenMap.delete(accessTokenKey);
-        /**
-     * Need to fetch a new access token using refresh token.
-     * Reuse the cached promise if exists.
-     */ const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);
-        if (cachedPromise) return cachedPromise;
-        /**
-     * Create a new promise and cache in map to avoid race condition.
-     * Since we enable "refresh token rotation" by default,
-     * it will be problematic when calling multiple `getAccessToken()` closely.
-     */ const promise = this.getAccessTokenByRefreshToken(resource);
-        this.getAccessTokenPromiseMap.set(accessTokenKey, promise);
-        const token = await promise;
-        this.getAccessTokenPromiseMap.delete(accessTokenKey);
-        return token;
-    }
-    getIdTokenClaims() {
-        if (!this.idToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
-        return (0, $ElS14$decodeIdToken)(this.idToken);
-    }
-    async signIn(redirectUri) {
-        const { appId: clientId , prompt: prompt , resources: resources , scopes: scopes  } = this.logtoConfig;
-        const { authorizationEndpoint: authorizationEndpoint  } = await this.getOidcConfig();
-        const codeVerifier = (0, $ElS14$generateCodeVerifier)();
-        const codeChallenge = await (0, $ElS14$generateCodeChallenge)(codeVerifier);
-        const state = (0, $ElS14$generateState)();
-        const signInUri = (0, $ElS14$generateSignInUri)({
-            authorizationEndpoint: authorizationEndpoint,
-            clientId: clientId,
-            redirectUri: redirectUri,
-            codeChallenge: codeChallenge,
-            state: state,
-            scopes: scopes,
-            resources: resources,
-            prompt: prompt
-        });
-        this.signInSession = {
-            redirectUri: redirectUri,
-            codeVerifier: codeVerifier,
-            state: state
-        };
-        this.refreshToken = null;
-        this.idToken = null;
-        window.location.assign(signInUri);
-    }
-    isSignInRedirected(url) {
-        const { signInSession: signInSession  } = this;
-        if (!signInSession) return false;
-        const { redirectUri: redirectUri  } = signInSession;
-        const { origin: origin , pathname: pathname  } = new URL(url);
-        return `${origin}${pathname}` === redirectUri;
-    }
-    async handleSignInCallback(callbackUri) {
-        const { signInSession: signInSession , logtoConfig: logtoConfig , requester: requester  } = this;
-        if (!signInSession) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("sign_in_session.not_found");
-        const { redirectUri: redirectUri , state: state , codeVerifier: codeVerifier  } = signInSession;
-        const code = (0, $ElS14$verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
-        const { appId: clientId  } = logtoConfig;
-        const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
-        const codeTokenResponse = await (0, $ElS14$fetchTokenByAuthorizationCode)({
-            clientId: clientId,
-            tokenEndpoint: tokenEndpoint,
-            redirectUri: redirectUri,
-            codeVerifier: codeVerifier,
-            code: code
-        }, requester);
-        await this.verifyIdToken(codeTokenResponse.idToken);
-        this.saveCodeToken(codeTokenResponse);
-        this.signInSession = null;
-    }
-    async signOut(postLogoutRedirectUri) {
-        if (!this.idToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
-        const { appId: clientId  } = this.logtoConfig;
-        const { endSessionEndpoint: endSessionEndpoint , revocationEndpoint: revocationEndpoint  } = await this.getOidcConfig();
-        if (this.refreshToken) try {
-            await (0, $ElS14$revoke)(revocationEndpoint, clientId, this.refreshToken, this.requester);
-        } catch  {
-        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
-        }
-        const url = (0, $ElS14$generateSignOutUri)({
-            endSessionEndpoint: endSessionEndpoint,
-            postLogoutRedirectUri: postLogoutRedirectUri,
-            idToken: this.idToken
-        });
-        this.accessTokenMap.clear();
-        this.refreshToken = null;
-        this.idToken = null;
-        window.location.assign(url);
-    }
-    async getAccessTokenByRefreshToken(resource) {
-        if (!this.refreshToken) throw new (0, $092943c955830b14$export$877962ca249b8fc8)("not_authenticated");
-        try {
-            const accessTokenKey = (0, $2f0dba05fbbfeb85$export$8f595bd2a47bcea6)(resource);
-            const { appId: clientId  } = this.logtoConfig;
-            const { tokenEndpoint: tokenEndpoint  } = await this.getOidcConfig();
-            const { accessToken: accessToken , refreshToken: refreshToken , idToken: idToken , scope: scope , expiresIn: expiresIn  } = await (0, $ElS14$fetchTokenByRefreshToken)({
-                clientId: clientId,
-                tokenEndpoint: tokenEndpoint,
-                refreshToken: this.refreshToken,
-                resource: resource,
-                scopes: resource ? [
-                    "offline_access"
-                ] : undefined
-            }, this.requester);
-            this.accessTokenMap.set(accessTokenKey, {
-                token: accessToken,
-                scope: scope,
-                expiresAt: Math.round(Date.now() / 1000) + expiresIn
-            });
-            this.refreshToken = refreshToken;
-            if (idToken) {
-                await this.verifyIdToken(idToken);
-                this.idToken = idToken;
-            }
-            return accessToken;
-        } catch (error) {
-            throw new (0, $092943c955830b14$export$877962ca249b8fc8)("get_access_token_by_refresh_token_failed", error);
-        }
-    }
-    async _getOidcConfig() {
-        const { endpoint: endpoint  } = this.logtoConfig;
-        const discoveryEndpoint = (0, $2f0dba05fbbfeb85$export$5d9c34f69c80822b)(endpoint);
-        return (0, $ElS14$fetchOidcConfig)(discoveryEndpoint, this.requester);
-    }
-    async _getJwtVerifyGetKey() {
-        const { jwksUri: jwksUri  } = await this.getOidcConfig();
-        return (0, $ElS14$createRemoteJWKSet)(new URL(jwksUri));
-    }
-    async verifyIdToken(idToken) {
-        const { appId: appId  } = this.logtoConfig;
-        const { issuer: issuer  } = await this.getOidcConfig();
-        const jwtVerifyGetKey = await this.getJwtVerifyGetKey();
-        try {
-            await (0, $ElS14$verifyIdToken)(idToken, appId, issuer, jwtVerifyGetKey);
-        } catch (error) {
-            throw new (0, $092943c955830b14$export$877962ca249b8fc8)("invalid_id_token", error);
-        }
-    }
-    saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
-        this.refreshToken = refreshToken ?? null;
-        this.idToken = idToken;
-        // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)
-        const accessTokenKey = (0, $2f0dba05fbbfeb85$export$8f595bd2a47bcea6)();
-        const expiresAt = Date.now() / 1000 + expiresIn;
-        this.accessTokenMap.set(accessTokenKey, {
-            token: accessToken,
-            scope: scope,
-            expiresAt: expiresAt
+const $90df2ab0e44b5eba$var$navigate = (url)=>{
+    window.location.assign(url);
+};
+class $90df2ab0e44b5eba$export$2e2bcd8739ae039 extends (0, $ElS14$logtoclient) {
+    constructor(config){
+        const requester = (0, $ElS14$createRequester)(fetch);
+        super(config, {
+            requester: requester,
+            navigate: $90df2ab0e44b5eba$var$navigate,
+            storage: new (0, $283691d41cf73b69$export$2baa60fa09b100be)(config.appId),
+            generateCodeChallenge: $7faa35338215c9c1$export$414b01b1f867308a,
+            generateCodeVerifier: $7faa35338215c9c1$export$cf1891f923f5943a,
+            generateState: $7faa35338215c9c1$export$9ccd2716e53a229b
         });
     }
 }
 
 
-export {$90df2ab0e44b5eba$export$7b65a75f516b80e1 as LogtoSignInSessionItemSchema, $90df2ab0e44b5eba$export$2e2bcd8739ae039 as default, $90df2ab0e44b5eba$re_export$LogtoError as LogtoError, $90df2ab0e44b5eba$re_export$OidcError as OidcError, $90df2ab0e44b5eba$import$5548085c5b0a2ee3$83716a4aa1642908 as Prompt, $092943c955830b14$export$877962ca249b8fc8 as LogtoClientError};
+export {$90df2ab0e44b5eba$export$2e2bcd8739ae039 as default, $90df2ab0e44b5eba$re_export$LogtoError as LogtoError, $90df2ab0e44b5eba$re_export$OidcError as OidcError, $90df2ab0e44b5eba$re_export$Prompt as Prompt, $90df2ab0e44b5eba$re_export$LogtoRequestError as LogtoRequestError, $90df2ab0e44b5eba$re_export$LogtoClientError as LogtoClientError, $90df2ab0e44b5eba$re_export$ReservedScope as ReservedScope, $90df2ab0e44b5eba$re_export$UserScope as UserScope};
 //# sourceMappingURL=module.js.map

package/lib/module.js.map

@@ -1 +1 @@
-{"mappings":";;;;;;;;;AAAA;;;;;;;ACAA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,8BAA8B;IAC9B,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,gBAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;ACpCD;AAEA,MAAM,+CAAyB,GAAG,CAAC,KAAK,CAAC,AAAC;AACnC,MAAM,yCAAa,GAAG,CAAC,GAAW,GAAa,CAAC,EAAE,+CAAyB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,AAAC;AACrF,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,AAAC;AAC9E,MAAM,yCAAe,GAAG,CAAC,QAAgB,GAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,AAAC;AAEpE,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,oBAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;AF0CvC,MAAM,yCAA4B,GAAG,CAAA,GAAA,WAAI,CAAA,CAAC;IAC/C,WAAW,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACrB,YAAY,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACtB,KAAK,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;CAChB,CAAC,AAAC;AAIY;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAKvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAG/E,YAAY,WAAwB,EAAE,SAAS,GAAG,CAAA,GAAA,sBAAe,CAAA,EAAE,CAAE;QACnE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,0DAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,yBAAkB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1D,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,CAAA,GAAA,yCAAa,CAAA,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KAC7E;IAED,IAAW,eAAe,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC9B;IAED,IAAc,aAAa,GAAqC;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAE9D,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;YAC3C,CAAA,GAAA,aAAM,CAAA,CAAC,IAAI,EAAE,yCAA4B,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;SACb,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;SAC9D;KACF;IAED,IAAc,aAAa,CAAC,sBAAwD,EAAE;QACpF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAEhD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KACxD;IAED,IAAI,YAAY,GAAG;QACjB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;KACzE;IAED,IAAY,YAAY,CAAC,YAA8B,EAAE;QACvD,MAAM,eAAe,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEnE,IAAI,CAAC,YAAY,EAAE;YACjB,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEzC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KACrD;IAED,IAAI,OAAO,GAAG;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;KACtB;IAED,IAAY,OAAO,CAAC,OAAyB,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,MAAM,UAAU,GAAG,CAAA,GAAA,yCAAe,CAAA,CAAC,IAAI,CAAC,eAAe,CAAC,AAAC;QAEzD,IAAI,CAAC,OAAO,EAAE;YACZ,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEpC,OAAO;SACR;QAED,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC3C;IAED,sCAAsC;IACtC,MAAa,cAAc,CAAC,QAAiB,EAAmB;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,AAAO,gBAAgB,GAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,oBAAa,CAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,MAAa,MAAM,CAAC,WAAmB,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,CAAA,GAAA,2BAAoB,CAAA,EAAE,AAAC;QAC5C,MAAM,aAAa,GAAG,MAAM,CAAA,GAAA,4BAAqB,CAAA,CAAC,YAAY,CAAC,AAAC;QAChE,MAAM,KAAK,GAAG,CAAA,GAAA,oBAAa,CAAA,EAAE,AAAC;QAE9B,MAAM,SAAS,GAAG,CAAA,GAAA,wBAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,IAAI,CAAC,aAAa,GAAG;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;KACnC;IAED,AAAO,kBAAkB,CAAC,GAAW,EAAW;QAC9C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,IAAI,AAAC;QAE/B,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAa,oBAAoB,CAAC,WAAmB,EAAE;QACrD,MAAM,iBAAE,aAAa,CAAA,eAAE,WAAW,CAAA,aAAE,SAAS,CAAA,EAAE,GAAG,IAAI,AAAC;QAEvD,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,wCAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,oCAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;KAC3B;IAED,MAAa,OAAO,CAAC,qBAA8B,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE9E,IAAI,IAAI,CAAC,YAAY,EACnB,IAAI;YACF,MAAM,CAAA,GAAA,aAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;SAC/E,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,yBAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;KAC7B;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,EACpB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,+BAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;0BAC/B,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,gBAAgB;iBAAC,GAAG,SAAS;aAClD,EACD,IAAI,CAAC,SAAS,CACf,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YAEjC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aACxB;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,sBAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;KAC3D;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,yBAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,oBAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,AAAQ,aAAa,CAAC,gBACpB,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;KACnF;CACF","sources":["packages/browser/src/index.ts","packages/browser/src/errors.ts","packages/browser/src/utils/index.ts"],"sourcesContent":["import {\n  CodeTokenResponse,\n  createRequester,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateCodeChallenge,\n  generateCodeVerifier,\n  generateSignInUri,\n  generateSignOutUri,\n  generateState,\n  IdTokenClaims,\n  Prompt,\n  Requester,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert, Infer, string, type } from 'superstruct';\n\nimport { LogtoClientError } from './errors';\nimport {\n  buildAccessTokenKey,\n  buildIdTokenKey,\n  buildLogtoKey,\n  buildRefreshTokenKey,\n  getDiscoveryEndpoint,\n} from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt } from '@logto/js';\nexport * from './errors';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  usingPersistStorage?: boolean;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number; // Unix Timestamp in seconds\n};\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly logtoStorageKey: string;\n  protected readonly requester: Requester;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, requester = createRequester()) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.logtoStorageKey = buildLogtoKey(logtoConfig.appId);\n    this.requester = requester;\n    this._idToken = localStorage.getItem(buildIdTokenKey(this.logtoStorageKey));\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = sessionStorage.getItem(this.logtoStorageKey);\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      sessionStorage.removeItem(this.logtoStorageKey);\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    sessionStorage.setItem(this.logtoStorageKey, jsonItem);\n  }\n\n  get refreshToken() {\n    return localStorage.getItem(buildRefreshTokenKey(this.logtoStorageKey));\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    const refreshTokenKey = buildRefreshTokenKey(this.logtoStorageKey);\n\n    if (!refreshToken) {\n      localStorage.removeItem(refreshTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(refreshTokenKey, refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    const idTokenKey = buildIdTokenKey(this.logtoStorageKey);\n\n    if (!idToken) {\n      localStorage.removeItem(idTokenKey);\n\n      return;\n    }\n\n    localStorage.setItem(idTokenKey, idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, requester } = this;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    window.location.assign(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n  }\n}\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // TODO: linear issue LOG-1419\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { discoveryPath } from '@logto/js';\n\nconst logtoStorageItemKeyPrefix = `logto`;\nexport const buildLogtoKey = (key: string): string => `${logtoStorageItemKeyPrefix}:${key}`;\nexport const buildRefreshTokenKey = (logtoKey: string) => `${logtoKey}:refreshToken`;\nexport const buildIdTokenKey = (logtoKey: string) => `${logtoKey}:idToken`;\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n"],"names":[],"version":3,"file":"module.js.map"}
+{"mappings":";;;AAAA;ACGO,MAAM,yCAAyB,GAAG,CAAC,KAAK,CAAC,AAAC;AAE1C,MAAM,yCAAc;IAGzB,YAAY,KAAa,CAAE;QACzB,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,yCAAyB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;KAC3D;IAED,MAAM,OAAO,CAAC,GAAe,EAA6B;QACxD,IAAI,GAAG,KAAK,eAAe,EACzB,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAGjD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;KAC1D;IAED,MAAM,OAAO,CAAC,GAAe,EAAE,KAAa,EAAiB;QAC3D,IAAI,GAAG,KAAK,eAAe,EAAE;YAC3B,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE/C,OAAO;SACR;QACD,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;KAC1D;IAED,MAAM,UAAU,CAAC,GAAe,EAAiB;QAC/C,IAAI,GAAG,KAAK,eAAe,EAAE;YAC3B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE3C,OAAO;SACR;QACD,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;KACtD;CACF;;;ACnCD;;AAGA;;GAEG,CACH,MAAM,0CAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,GACvC,CAAA,GAAA,qBAAc,CAAA,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,AAAC;AAKhE,MAAM,yCAAa,GAAG,IAAM,0CAAoB,EAAE,AAAC;AAOnD,MAAM,yCAAoB,GAAG,IAAM,0CAAoB,EAAE,AAAC;AAQ1D,MAAM,yCAAqB,GAAG,OAAO,YAAoB,GAAsB;IACpF,uEAAuE;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAC7B;;;;OAIG,CACH,MAAM,IAAI,CAAA,GAAA,sCAAU,CAAA,CAAC,2BAA2B,CAAC,CAAC;IAGpD,MAAM,mBAAmB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,AAAC;IACnE,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,AAAC;IAEjG,OAAO,CAAA,GAAA,qBAAc,CAAA,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;CAC5C,AAAC;;;;AFrBF,MAAM,8BAAQ,GAAG,CAAC,GAAW,GAAK;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;CAC7B,AAAC;AAEa,uDAA0B,CAAA,GAAA,kBAAU,CAAA;IACjD,YAAY,MAAmB,CAAE;QAC/B,MAAM,SAAS,GAAG,CAAA,GAAA,sBAAe,CAAA,CAAC,KAAK,CAAC,AAAC;QACzC,KAAK,CAAC,MAAM,EAAE;uBACZ,SAAS;sBACT,8BAAQ;YACR,OAAO,EAAE,IAAI,CAAA,GAAA,yCAAc,CAAA,CAAC,MAAM,CAAC,KAAK,CAAC;mCACzC,yCAAqB;kCACrB,yCAAoB;2BACpB,yCAAa;SACd,CAAC,CAAC;KACJ;CACF","sources":["packages/browser/src/index.ts","packages/browser/src/storage.ts","packages/browser/src/utils/generators.ts"],"sourcesContent":["import BaseClient, { createRequester, LogtoConfig } from '@logto/client';\n\nimport { BrowserStorage } from './storage';\nimport { generateCodeChallenge, generateCodeVerifier, generateState } from './utils/generators';\n\nexport type {\n  IdTokenClaims,\n  LogtoErrorCode,\n  LogtoConfig,\n  LogtoClientErrorCode,\n  UserInfoResponse,\n} from '@logto/client';\n\nexport {\n  LogtoError,\n  OidcError,\n  Prompt,\n  LogtoRequestError,\n  LogtoClientError,\n  ReservedScope,\n  UserScope,\n} from '@logto/client';\n\nconst navigate = (url: string) => {\n  window.location.assign(url);\n};\n\nexport default class LogtoClient extends BaseClient {\n  constructor(config: LogtoConfig) {\n    const requester = createRequester(fetch);\n    super(config, {\n      requester,\n      navigate,\n      storage: new BrowserStorage(config.appId),\n      generateCodeChallenge,\n      generateCodeVerifier,\n      generateState,\n    });\n  }\n}\n","import { Storage, StorageKey } from '@logto/client';\nimport { Nullable } from '@silverhand/essentials';\n\nexport const logtoStorageItemKeyPrefix = `logto`;\n\nexport class BrowserStorage implements Storage {\n  private readonly storageKey: string;\n\n  constructor(appId: string) {\n    this.storageKey = `${logtoStorageItemKeyPrefix}:${appId}`;\n  }\n\n  async getItem(key: StorageKey): Promise<Nullable<string>> {\n    if (key === 'signInSession') {\n      return sessionStorage.getItem(this.storageKey);\n    }\n\n    return localStorage.getItem(`${this.storageKey}:${key}`);\n  }\n\n  async setItem(key: StorageKey, value: string): Promise<void> {\n    if (key === 'signInSession') {\n      sessionStorage.setItem(this.storageKey, value);\n\n      return;\n    }\n    localStorage.setItem(`${this.storageKey}:${key}`, value);\n  }\n\n  async removeItem(key: StorageKey): Promise<void> {\n    if (key === 'signInSession') {\n      sessionStorage.removeItem(this.storageKey);\n\n      return;\n    }\n    localStorage.removeItem(`${this.storageKey}:${key}`);\n  }\n}\n","/** @link [Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636) */\n\nimport { LogtoError } from '@logto/client';\nimport { fromUint8Array } from 'js-base64';\n\n/**\n * @param length The length of the raw random data.\n */\nconst generateRandomString = (length = 64) =>\n  fromUint8Array(crypto.getRandomValues(new Uint8Array(length)), true);\n\n/**\n * Generates random string for state and encodes them in url safe base64\n */\nexport const generateState = () => generateRandomString();\n\n/**\n * Generates code verifier\n *\n * @link [Client Creates a Code Verifier](https://datatracker.ietf.org/doc/html/rfc7636#section-4.1)\n */\nexport const generateCodeVerifier = () => generateRandomString();\n\n/**\n * Calculates the S256 PKCE code challenge for an arbitrary code verifier and encodes it in url safe base64\n *\n * @param {String} codeVerifier Code verifier to calculate the S256 code challenge for\n * @link [Client Creates the Code Challenge](https://datatracker.ietf.org/doc/html/rfc7636#section-4.2)\n */\nexport const generateCodeChallenge = async (codeVerifier: string): Promise<string> => {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n  if (crypto.subtle === undefined) {\n    /**\n     * `crypto.subtle` is available only in secure contexts (HTTPS) in some or all supporting browsers,\n     * https://developer.mozilla.org/en-US/docs/Web/API/Crypto/subtle\n     * https://www.chromium.org/blink/webcrypto/#accessing-it\n     */\n    throw new LogtoError('crypto_subtle_unavailable');\n  }\n\n  const encodedCodeVerifier = new TextEncoder().encode(codeVerifier);\n  const codeChallenge = new Uint8Array(await crypto.subtle.digest('SHA-256', encodedCodeVerifier));\n\n  return fromUint8Array(codeChallenge, true);\n};\n"],"names":[],"version":3,"file":"module.js.map"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/browser",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-beta.10",
   "source": "./src/index.ts",
   "main": "./lib/index.js",
   "exports": {
@@ -29,33 +29,29 @@
     "prepack": "pnpm test"
   },
   "dependencies": {
-    "@logto/js": "^1.0.0-alpha.2",
-    "@silverhand/essentials": "^1.1.6",
-    "jose": "^4.5.0",
-    "lodash.get": "^4.4.2",
-    "lodash.once": "^4.1.1",
-    "superstruct": "^0.16.0"
+    "@logto/client": "^1.0.0-beta.10",
+    "@silverhand/essentials": "^1.2.1",
+    "js-base64": "^3.7.2"
   },
   "devDependencies": {
     "@jest/types": "^27.5.1",
-    "@parcel/core": "^2.6.2",
-    "@parcel/packager-ts": "^2.6.2",
-    "@parcel/transformer-typescript-types": "^2.6.2",
-    "@silverhand/eslint-config": "^0.14.0",
-    "@silverhand/ts-config": "^0.14.0",
+    "@parcel/core": "^2.7.0",
+    "@parcel/packager-ts": "^2.7.0",
+    "@parcel/transformer-typescript-types": "^2.7.0",
+    "@silverhand/eslint-config": "^1.0.0",
+    "@silverhand/ts-config": "^1.0.0",
     "@types/jest": "^27.4.0",
-    "@types/lodash.get": "^4.4.6",
-    "@types/lodash.once": "^4.1.6",
-    "eslint": "^8.9.0",
+    "eslint": "^8.23.0",
     "jest": "^27.5.1",
     "jest-location-mock": "^1.0.9",
     "jest-matcher-specific-error": "^1.0.0",
     "lint-staged": "^13.0.0",
-    "parcel": "^2.6.2",
-    "prettier": "^2.3.2",
+    "node-fetch": "^2.6.7",
+    "parcel": "^2.7.0",
+    "prettier": "^2.7.1",
     "text-encoder": "^0.0.4",
     "ts-jest": "^27.0.4",
-    "typescript": "^4.5.5"
+    "typescript": "4.7.4"
   },
   "eslintConfig": {
     "extends": "@silverhand"
@@ -64,5 +60,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "d50109fcc1867aa0a7985dfea1e3899c66d18d35"
+  "gitHead": "c79c3759b7f15c44bf5b476dcebd82e9c96e9dd8"
 }