@logto/client 1.0.0-beta.0 → 1.0.0-beta.10

package/README.md

@@ -0,0 +1,53 @@
+# Logto Client SDK
+[![Version](https://img.shields.io/npm/v/@logto/client)](https://www.npmjs.com/package/@logto/client)
+[![Build Status](https://github.com/logto-io/js/actions/workflows/main.yml/badge.svg)](https://github.com/logto-io/js/actions/workflows/main.yml)
+[![Codecov](https://img.shields.io/codecov/c/github/logto-io/js)](https://app.codecov.io/gh/logto-io/js?branch=master)
+
+The Logto JavaScript Client SDK written in TypeScript. Check out our [docs](https://docs.logto.io/sdk/JavaScript/client/) for more information.
+
+We also provide [文档](https://docs.logto.io/zh-cn/sdk/JavaScript/sdk/client/) in Simplified Chinese.
+
+## Installation
+
+### Using npm
+
+```bash
+npm install @logto/client
+```
+
+### Using yarn
+
+```bash
+yarn add @logto/client
+```
+
+### Using pnpm
+
+```bash
+pnpm add @logto/client
+```
+
+## What is this and how does it work?
+
+Logto JavaScript Client SDK is platformless, and is the foundation of the other platform's SDKs (Browser, Next.js, React, Vue, etc.). Usually you are not expected to use it directly in your application, as we have released a set of official SDKs to help you integrate Logto with your favorite JavaScript frameworks. [Check this out](https://docs.logto.io/docs/recipes/integrate-logto/) and get started!
+
+If Logto does not support your framework and you want to contribute by building a new SDK, we recommend checking out our [Browser SDK](https://github.com/logto-io/js/tree/master/packages/browser) and [Node.js SDK](https://github.com/logto-io/js/tree/master/packages/node) and start from there.
+
+### Adapters
+
+To implement a platform-specific SDK, you should implement the following adapters:
+
+1. requester: send http requests.
+2. storage: save tokens and other info.
+3. navigate: handle redirect.
+4. generateState: generate state.
+5. generateCodeVerifier: generate code verifier.
+6. generateCodeChallenge: generate code challenge.
+
+See the [adapters.ts](./src/adapter.ts) for more information.
+
+## Resources
+
+[![Website](https://img.shields.io/badge/website-logto.io-8262F8.svg)](https://logto.io/)
+[![Docs](https://img.shields.io/badge/docs-logto.io-green.svg)](https://docs.logto.io/sdk/JavaScript/client/)
+[![Discord](https://img.shields.io/discord/965845662535147551?logo=discord&logoColor=ffffff&color=7389D8&cacheSeconds=600)](https://discord.gg/UEPaF3j5e6)

package/lib/index.d.ts

@@ -1,12 +1,11 @@
-import { Requester, Prompt, IdTokenClaims } from "@logto/js";
+import { Requester, Prompt, IdTokenClaims, UserInfoResponse } from "@logto/js";
 import { Nullable, NormalizeKeyPaths } from "@silverhand/essentials";
-import { Infer } from "superstruct";
 export type StorageKey = 'idToken' | 'refreshToken' | 'accessToken' | 'signInSession';
-export interface Storage {
-    getItem(key: StorageKey): Nullable<string>;
-    setItem(key: StorageKey, value: string): void;
-    removeItem(key: StorageKey): void;
-}
+export type Storage = {
+    getItem(key: StorageKey): Promise<Nullable<string>>;
+    setItem(key: StorageKey, value: string): Promise<void>;
+    removeItem(key: StorageKey): Promise<void>;
+};
 type Navigate = (url: string) => void;
 export type ClientAdapter = {
     requester: Requester;
@@ -21,9 +20,10 @@ declare const logtoClientErrorCodes: Readonly<{
         invalid: string;
         not_found: string;
     };
-    not_authenticated: string;
-    get_access_token_by_refresh_token_failed: string;
-    invalid_id_token: string;
+    not_authenticated: "Not authenticated.";
+    get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.";
+    fetch_user_info_failed: "Unable to fetch user info. The access token may be invalid.";
+    invalid_id_token: "Invalid id token.";
 }>;
 export type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;
 export class LogtoClientError extends Error {
@@ -34,63 +34,46 @@ export class LogtoClientError extends Error {
 export type LogtoConfig = {
     endpoint: string;
     appId: string;
+    appSecret?: string;
     scopes?: string[];
     resources?: string[];
     prompt?: Prompt;
-    persistAccessToken?: boolean;
 };
-export const AccessTokenSchema: import("superstruct").Struct<{
+export type AccessToken = {
     token: string;
     scope: string;
     expiresAt: number;
-}, {
-    token: import("superstruct").Struct<string, null>;
-    scope: import("superstruct").Struct<string, null>;
-    expiresAt: import("superstruct").Struct<number, null>;
-}>;
-export type AccessToken = Infer<typeof AccessTokenSchema>;
-export const LogtoSignInSessionItemSchema: import("superstruct").Struct<{
+};
+export const isLogtoSignInSessionItem: (data: unknown) => data is LogtoSignInSessionItem;
+export const isLogtoAccessTokenMap: (data: unknown) => data is Record<string, AccessToken>;
+export type LogtoSignInSessionItem = {
     redirectUri: string;
     codeVerifier: string;
     state: string;
-}, {
-    redirectUri: import("superstruct").Struct<string, null>;
-    codeVerifier: import("superstruct").Struct<string, null>;
-    state: import("superstruct").Struct<string, null>;
-}>;
-export const LogtoAccessTokenMapSchema: import("superstruct").Struct<Record<string, {
-    token: string;
-    scope: string;
-    expiresAt: number;
-}>, null>;
-export type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;
+};
 export const createRequester: (fetchFunction: typeof fetch) => Requester;
-export type { IdTokenClaims, LogtoErrorCode } from '@logto/js';
+export type { IdTokenClaims, LogtoErrorCode, UserInfoResponse } from '@logto/js';
 export { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';
+export { ReservedScope, UserScope } from '@logto/core-kit';
 export default class LogtoClient {
     protected readonly logtoConfig: LogtoConfig;
     protected readonly getOidcConfig: () => Promise<import("@silverhand/essentials").KeysToCamelCase<import("@logto/js").OidcConfigSnakeCaseResponse>>;
     protected readonly getJwtVerifyGetKey: () => Promise<import("jose/dist/types/types").GetKeyFunction<import("jose").JWSHeaderParameters, import("jose").FlattenedJWSInput>>;
     protected readonly adapter: ClientAdapter;
-    protected readonly accessTokenMap: Map<string, {
-        token: string;
-        scope: string;
-        expiresAt: number;
-    }>;
+    protected readonly accessTokenMap: Map<string, AccessToken>;
     constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter);
-    get isAuthenticated(): boolean;
-    protected get signInSession(): Nullable<LogtoSignInSessionItem>;
-    protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>);
-    get refreshToken(): Nullable<string>;
-    private set refreshToken(value);
-    get idToken(): Nullable<string>;
-    private set idToken(value);
+    isAuthenticated(): Promise<boolean>;
+    getRefreshToken(): Promise<Nullable<string>>;
+    getIdToken(): Promise<Nullable<string>>;
     getAccessToken(resource?: string): Promise<string>;
-    getIdTokenClaims(): IdTokenClaims;
+    getIdTokenClaims(): Promise<IdTokenClaims>;
+    fetchUserInfo(): Promise<UserInfoResponse>;
     signIn(redirectUri: string): Promise<void>;
-    isSignInRedirected(url: string): boolean;
+    isSignInRedirected(url: string): Promise<boolean>;
     handleSignInCallback(callbackUri: string): Promise<void>;
     signOut(postLogoutRedirectUri?: string): Promise<void>;
+    protected getSignInSession(): Promise<Nullable<LogtoSignInSessionItem>>;
+    protected setSignInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>): Promise<void>;
 }
 
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"mappings":";;;AAGA,yBAAyB,SAAS,GAAG,cAAc,GAAG,aAAa,GAAG,eAAe,CAAC;AAEtF;IACE,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC;AAED,gBAAuB,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAE7C,4BAA4B;IAC1B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,MAAM,CAAC;IACnC,qBAAqB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE,CAAC;ACjBF,QAAA,MAAM;;;;;;;;EAQJ,CAAC;AAEH,mCAAmC,kBAAkB,4BAA4B,CAAC,CAAC;AAanF,6BAA8B,SAAQ,KAAK;IACzC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;gBAEF,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,OAAO;CAKvD;AChCD,0BAA0B;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,OAAO,MAAM;;;;;;;;EAIX,CAAC;AAEH,0BAA0B,MAAM,wBAAwB,CAAC,CAAC;AAE1D,OAAO,MAAM;;;;;;;;EAIX,CAAC;AAEH,OAAO,MAAM;;;;SAA+D,CAAC;AAE7E,qCAAqC,MAAM,mCAAmC,CAAC,CAAC;AC1BhF,OAAO,MAAM,iCAAkC,YAAY,KAAG,SAY7D,CAAC;AEiBF,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAM7E;IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAC5C,SAAS,CAAC,QAAQ,CAAC,aAAa,mHAA6B;IAC7D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,sIAAkC;IAEvE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAE1C,SAAS,CAAC,QAAQ,CAAC,cAAc;;;;OAAkC;gBAKvD,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa;IAc5D,IAAW,eAAe,YAEzB;IAED,SAAS,KAAK,aAAa,IAAI,SAAS,sBAAsB,CAAC,CAe9D;IAED,SAAS,KAAK,aAAa,CAAC,sBAAsB,EAAE,SAAS,sBAAsB,CAAC,EASnF;IAED,IAAI,YAAY,IAIuB,SAAS,MAAM,CAAC,CAFtD;IAED,OAAO,KAAK,YAAY,QAQvB;IAED,IAAI,OAAO,IAIkB,SAAS,MAAM,CAAC,CAF5C;IAED,OAAO,KAAK,OAAO,QAUlB;IAGY,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCxD,gBAAgB,IAAI,aAAa;IAQ3B,MAAM,CAAC,WAAW,EAAE,MAAM;IAyBhC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAYlC,oBAAoB,CAAC,WAAW,EAAE,MAAM;IA8BxC,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM;CAgJpD","sources":["packages/client/src/src/adapter.ts","packages/client/src/src/errors.ts","packages/client/src/src/types/index.ts","packages/client/src/src/utils/requester.ts","packages/client/src/src/utils/index.ts","packages/client/src/src/index.ts","packages/client/src/index.ts"],"sourcesContent":[null,null,null,null,null,null,"import {\n  CodeTokenResponse,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateSignInUri,\n  generateSignOutUri,\n  IdTokenClaims,\n  Prompt,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert } from 'superstruct';\n\nimport { ClientAdapter } from './adapter';\nimport { LogtoClientError } from './errors';\nimport {\n  AccessToken,\n  LogtoAccessTokenMapSchema,\n  LogtoConfig,\n  LogtoSignInSessionItem,\n  LogtoSignInSessionItemSchema,\n} from './types';\nimport { buildAccessTokenKey, getDiscoveryEndpoint } from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';\nexport * from './errors';\nexport type { Storage, StorageKey, ClientAdapter } from './adapter';\nexport { createRequester } from './utils';\nexport * from './types';\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly adapter: ClientAdapter;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.adapter = adapter;\n    this._idToken = this.adapter.storage.getItem('idToken');\n\n    if (this.logtoConfig.persistAccessToken) {\n      this.loadAccessTokenMap();\n    }\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = this.adapter.storage.getItem('signInSession');\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      this.adapter.storage.removeItem('signInSession');\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    this.adapter.storage.setItem('signInSession', jsonItem);\n  }\n\n  get refreshToken() {\n    return this.adapter.storage.getItem('refreshToken');\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    if (!refreshToken) {\n      this.adapter.storage.removeItem('refreshToken');\n\n      return;\n    }\n\n    this.adapter.storage.setItem('refreshToken', refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    if (!idToken) {\n      this.adapter.storage.removeItem('idToken');\n\n      return;\n    }\n\n    this.adapter.storage.setItem('idToken', idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = this.adapter.generateCodeVerifier();\n    const codeChallenge = await this.adapter.generateCodeChallenge(codeVerifier);\n    const state = this.adapter.generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    this.adapter.navigate(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, adapter } = this;\n    const { requester } = adapter;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.adapter.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    this.adapter.navigate(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.adapter.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n      this.saveAccessTokenMap();\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.adapter.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n    this.saveAccessTokenMap();\n  }\n\n  private saveAccessTokenMap() {\n    if (!this.logtoConfig.persistAccessToken) {\n      return;\n    }\n\n    const data: Record<string, AccessToken> = {};\n\n    for (const [key, accessToken] of this.accessTokenMap.entries()) {\n      // eslint-disable-next-line @silverhand/fp/no-mutation\n      data[key] = accessToken;\n    }\n\n    this.adapter.storage.setItem('accessToken', JSON.stringify(data));\n  }\n\n  private loadAccessTokenMap() {\n    const raw = this.adapter.storage.getItem('accessToken');\n\n    if (!raw) {\n      return;\n    }\n\n    try {\n      const json: unknown = JSON.parse(raw);\n      assert(json, LogtoAccessTokenMapSchema);\n      this.accessTokenMap.clear();\n\n      for (const [key, accessToken] of Object.entries(json)) {\n        this.accessTokenMap.set(key, accessToken);\n      }\n    } catch {}\n  }\n}\n"],"names":[],"version":3,"file":"index.d.ts.map"}
+{"mappings":";;AAGA,yBAAyB,SAAS,GAAG,cAAc,GAAG,aAAa,GAAG,eAAe,CAAC;AAEtF,sBAAsB;IACpB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C,CAAC;AAEF,gBAAuB,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAE7C,4BAA4B;IAC1B,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,MAAM,CAAC;IACnC,qBAAqB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE,CAAC;ACjBF,QAAA,MAAM;;;;;;;;;EASJ,CAAC;AAEH,mCAAmC,kBAAkB,4BAA4B,CAAC,CAAC;AAanF,6BAA8B,SAAQ,KAAK;IACzC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;gBAEF,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,OAAO;CAKvD;AClCD,0BAA0B;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,0BAA0B;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,OAAO,MAAM,iCAAkC,OAAO,mCAMrD,CAAC;AAEF,OAAO,MAAM,8BAA+B,OAAO,wCAgBlD,CAAC;AAEF,qCAAqC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AC7CF,OAAO,MAAM,iCAAkC,YAAY,KAAG,SAkB7D,CAAC;AEcF,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAK7E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE3D;IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAC5C,SAAS,CAAC,QAAQ,CAAC,aAAa,mHAA6B;IAC7D,SAAS,CAAC,QAAQ,CAAC,kBAAkB,sIAAkC;IACvE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAC1C,SAAS,CAAC,QAAQ,CAAC,cAAc,2BAAkC;gBAIvD,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa;IAWtD,eAAe;IAIf,eAAe;IAIf,UAAU;IAKV,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyClD,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC;IAU1C,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAW1C,MAAM,CAAC,WAAW,EAAE,MAAM;IAyB1B,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjD,oBAAoB,CAAC,WAAW,EAAE,MAAM;IA8BxC,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM;cAgC5B,gBAAgB,IAAI,OAAO,CAAC,SAAS,sBAAsB,CAAC,CAAC;cAgB7D,gBAAgB,CAAC,sBAAsB,EAAE,SAAS,sBAAsB,CAAC;CAmJ1F","sources":["packages/client/src/src/adapter.ts","packages/client/src/src/errors.ts","packages/client/src/src/types/index.ts","packages/client/src/src/utils/requester.ts","packages/client/src/src/utils/index.ts","packages/client/src/src/index.ts","packages/client/src/index.ts"],"sourcesContent":[null,null,null,null,null,null,"/* eslint-disable max-lines */\nimport { ReservedScope } from '@logto/core-kit';\nimport {\n  CodeTokenResponse,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  fetchUserInfo,\n  generateSignInUri,\n  generateSignOutUri,\n  IdTokenClaims,\n  Prompt,\n  revoke,\n  UserInfoResponse,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withDefaultScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\n\nimport { ClientAdapter } from './adapter';\nimport { LogtoClientError } from './errors';\nimport {\n  AccessToken,\n  isLogtoAccessTokenMap,\n  isLogtoSignInSessionItem,\n  LogtoConfig,\n  LogtoSignInSessionItem,\n} from './types';\nimport { buildAccessTokenKey, getDiscoveryEndpoint } from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode, UserInfoResponse } from '@logto/js';\nexport { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';\nexport * from './errors';\nexport type { Storage, StorageKey, ClientAdapter } from './adapter';\nexport { createRequester } from './utils';\nexport * from './types';\nexport { ReservedScope, UserScope } from '@logto/core-kit';\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n  protected readonly adapter: ClientAdapter;\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n\n  constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withDefaultScopes(logtoConfig.scopes).split(' '),\n    };\n    this.adapter = adapter;\n\n    void this.loadAccessTokenMap();\n  }\n\n  async isAuthenticated() {\n    return Boolean(await this.getIdToken());\n  }\n\n  async getRefreshToken() {\n    return this.adapter.storage.getItem('refreshToken');\n  }\n\n  async getIdToken() {\n    return this.adapter.storage.getItem('idToken');\n  }\n\n  // eslint-disable-next-line complexity\n  async getAccessToken(resource?: string): Promise<string> {\n    if (!(await this.getIdToken())) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  async getIdTokenClaims(): Promise<IdTokenClaims> {\n    const idToken = await this.getIdToken();\n\n    if (!idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(idToken);\n  }\n\n  async fetchUserInfo(): Promise<UserInfoResponse> {\n    const { userinfoEndpoint } = await this.getOidcConfig();\n    const accessToken = await this.getAccessToken();\n\n    if (!accessToken) {\n      throw new LogtoClientError('fetch_user_info_failed');\n    }\n\n    return fetchUserInfo(userinfoEndpoint, accessToken, this.adapter.requester);\n  }\n\n  async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = this.adapter.generateCodeVerifier();\n    const codeChallenge = await this.adapter.generateCodeChallenge(codeVerifier);\n    const state = this.adapter.generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    await this.setSignInSession({ redirectUri, codeVerifier, state });\n    await this.setRefreshToken(null);\n    await this.setIdToken(null);\n\n    this.adapter.navigate(signInUri);\n  }\n\n  async isSignInRedirected(url: string): Promise<boolean> {\n    const signInSession = await this.getSignInSession();\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  async handleSignInCallback(callbackUri: string) {\n    const { logtoConfig, adapter } = this;\n    const { requester } = adapter;\n    const signInSession = await this.getSignInSession();\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n    await this.saveCodeToken(codeTokenResponse);\n    await this.setSignInSession(null);\n  }\n\n  async signOut(postLogoutRedirectUri?: string) {\n    const idToken = await this.getIdToken();\n\n    if (!idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n    const refreshToken = await this.getRefreshToken();\n\n    if (refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, refreshToken, this.adapter.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken,\n    });\n\n    this.accessTokenMap.clear();\n    await this.setRefreshToken(null);\n    await this.setIdToken(null);\n\n    this.adapter.navigate(url);\n  }\n\n  protected async getSignInSession(): Promise<Nullable<LogtoSignInSessionItem>> {\n    const jsonItem = await this.adapter.storage.getItem('signInSession');\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    const item: unknown = JSON.parse(jsonItem);\n\n    if (!isLogtoSignInSessionItem(item)) {\n      throw new LogtoClientError('sign_in_session.invalid');\n    }\n\n    return item;\n  }\n\n  protected async setSignInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      await this.adapter.storage.removeItem('signInSession');\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    await this.adapter.storage.setItem('signInSession', jsonItem);\n  }\n\n  private async setIdToken(idToken: Nullable<string>) {\n    if (!idToken) {\n      await this.adapter.storage.removeItem('idToken');\n\n      return;\n    }\n\n    await this.adapter.storage.setItem('idToken', idToken);\n  }\n\n  private async setRefreshToken(refreshToken: Nullable<string>) {\n    if (!refreshToken) {\n      await this.adapter.storage.removeItem('refreshToken');\n\n      return;\n    }\n\n    await this.adapter.storage.setItem('refreshToken', refreshToken);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    const currentRefreshToken = await this.getRefreshToken();\n\n    if (!currentRefreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: currentRefreshToken,\n            resource,\n            scopes: resource ? [ReservedScope.OfflineAccess] : undefined, // Force remove openid scope from the request\n          },\n          this.adapter.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      await this.saveAccessTokenMap();\n      await this.setRefreshToken(refreshToken);\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        await this.setIdToken(idToken);\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.adapter.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private async saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    await this.setRefreshToken(refreshToken ?? null);\n    await this.setIdToken(idToken);\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n    await this.saveAccessTokenMap();\n  }\n\n  private async saveAccessTokenMap() {\n    const data: Record<string, AccessToken> = {};\n\n    for (const [key, accessToken] of this.accessTokenMap.entries()) {\n      // eslint-disable-next-line @silverhand/fp/no-mutation\n      data[key] = accessToken;\n    }\n\n    await this.adapter.storage.setItem('accessToken', JSON.stringify(data));\n  }\n\n  private async loadAccessTokenMap() {\n    const raw = await this.adapter.storage.getItem('accessToken');\n\n    if (!raw) {\n      return;\n    }\n\n    try {\n      const json: unknown = JSON.parse(raw);\n\n      if (!isLogtoAccessTokenMap(json)) {\n        return;\n      }\n      this.accessTokenMap.clear();\n\n      for (const [key, accessToken] of Object.entries(json)) {\n        this.accessTokenMap.set(key, accessToken);\n      }\n    } catch {}\n  }\n}\n/* eslint-enable max-lines */\n"],"names":[],"version":3,"file":"index.d.ts.map"}

package/lib/index.js

@@ -1,7 +1,7 @@
+var $4R6L3$logtocorekit = require("@logto/core-kit");
 var $4R6L3$logtojs = require("@logto/js");
 var $4R6L3$jose = require("jose");
 var $4R6L3$lodashonce = require("lodash.once");
-var $4R6L3$superstruct = require("superstruct");
 var $4R6L3$lodashget = require("lodash.get");
 
 function $parcel$interopDefault(a) {
@@ -38,6 +38,8 @@ $parcel$export(module.exports, "OidcError", () => $f73788ae50447ce9$re_export$Oi
 $parcel$export(module.exports, "Prompt", () => $4R6L3$logtojs.Prompt);
 $parcel$export(module.exports, "LogtoRequestError", () => $f73788ae50447ce9$re_export$LogtoRequestError);
 $parcel$export(module.exports, "createRequester", () => $b455f57f80fbf6bf$export$8d54726fdbf08e0a);
+$parcel$export(module.exports, "ReservedScope", () => $4R6L3$logtocorekit.ReservedScope);
+$parcel$export(module.exports, "UserScope", () => $f73788ae50447ce9$re_export$UserScope);
 
 
 
@@ -53,6 +55,7 @@ const $9166104b36889c59$var$logtoClientErrorCodes = Object.freeze({
     },
     not_authenticated: "Not authenticated.",
     get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.",
+    fetch_user_info_failed: "Unable to fetch user info. The access token may be invalid.",
     invalid_id_token: "Invalid id token."
 });
 const $9166104b36889c59$var$getMessageByErrorCode = (errorCode)=>{
@@ -72,21 +75,24 @@ class $9166104b36889c59$export$877962ca249b8fc8 extends Error {
 
 var $6d3989f7f53311af$exports = {};
 
-$parcel$export($6d3989f7f53311af$exports, "AccessTokenSchema", () => $6d3989f7f53311af$export$77bdbaff506443f4);
-$parcel$export($6d3989f7f53311af$exports, "LogtoSignInSessionItemSchema", () => $6d3989f7f53311af$export$7b65a75f516b80e1);
-$parcel$export($6d3989f7f53311af$exports, "LogtoAccessTokenMapSchema", () => $6d3989f7f53311af$export$4ae7b9c313038df5);
+$parcel$export($6d3989f7f53311af$exports, "isLogtoSignInSessionItem", () => $6d3989f7f53311af$export$5d8adf6e063019de);
+$parcel$export($6d3989f7f53311af$exports, "isLogtoAccessTokenMap", () => $6d3989f7f53311af$export$c12fab42a9a3e2a6);
 
-const $6d3989f7f53311af$export$77bdbaff506443f4 = (0, $4R6L3$superstruct.type)({
-    token: (0, $4R6L3$superstruct.string)(),
-    scope: (0, $4R6L3$superstruct.string)(),
-    expiresAt: (0, $4R6L3$superstruct.number)()
-});
-const $6d3989f7f53311af$export$7b65a75f516b80e1 = (0, $4R6L3$superstruct.type)({
-    redirectUri: (0, $4R6L3$superstruct.string)(),
-    codeVerifier: (0, $4R6L3$superstruct.string)(),
-    state: (0, $4R6L3$superstruct.string)()
-});
-const $6d3989f7f53311af$export$4ae7b9c313038df5 = (0, $4R6L3$superstruct.record)((0, $4R6L3$superstruct.string)(), $6d3989f7f53311af$export$77bdbaff506443f4);
+const $6d3989f7f53311af$export$5d8adf6e063019de = (data)=>{
+    if (!(0, $4R6L3$logtojs.isArbitraryObject)(data)) return false;
+    return [
+        "redirectUri",
+        "codeVerifier",
+        "state"
+    ].every((key)=>typeof data[key] === "string");
+};
+const $6d3989f7f53311af$export$c12fab42a9a3e2a6 = (data)=>{
+    if (!(0, $4R6L3$logtojs.isArbitraryObject)(data)) return false;
+    return Object.values(data).every((value)=>{
+        if (!(0, $4R6L3$logtojs.isArbitraryObject)(value)) return false;
+        return typeof value.token === "string" && typeof value.scope === "string" && typeof value.expiresAt === "number";
+    });
+};
 
 
 
@@ -95,8 +101,10 @@ const $b455f57f80fbf6bf$export$8d54726fdbf08e0a = (fetchFunction)=>{
     return async (...args)=>{
         const response = await fetchFunction(...args);
         if (!response.ok) {
+            const responseJson = await response.json();
+            if (!(0, $4R6L3$logtojs.isLogtoRequestError)(responseJson)) throw new (0, $4R6L3$logtojs.LogtoError)("unexpected_response_error", responseJson);
             // Expected request error from server
-            const { code: code , message: message  } = await response.json();
+            const { code: code , message: message  } = responseJson;
             throw new (0, $4R6L3$logtojs.LogtoRequestError)(code, message);
         }
         return response.json();
@@ -112,6 +120,7 @@ const $e2aabdbdb3cc09f0$export$5d9c34f69c80822b = (endpoint)=>new URL((0, $4R6L3
 
 
 
+
 class $f73788ae50447ce9$export$2e2bcd8739ae039 {
     getOidcConfig = (0, ($parcel$interopDefault($4R6L3$lodashonce)))(this._getOidcConfig);
     getJwtVerifyGetKey = (0, ($parcel$interopDefault($4R6L3$lodashonce)))(this._getJwtVerifyGetKey);
@@ -121,58 +130,23 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
         this.logtoConfig = {
             ...logtoConfig,
             prompt: logtoConfig.prompt ?? (0, $4R6L3$logtojs.Prompt).Consent,
-            scopes: (0, $4R6L3$logtojs.withReservedScopes)(logtoConfig.scopes).split(" ")
+            scopes: (0, $4R6L3$logtojs.withDefaultScopes)(logtoConfig.scopes).split(" ")
         };
         this.adapter = adapter;
-        this._idToken = this.adapter.storage.getItem("idToken");
-        if (this.logtoConfig.persistAccessToken) this.loadAccessTokenMap();
-    }
-    get isAuthenticated() {
-        return Boolean(this.idToken);
-    }
-    get signInSession() {
-        const jsonItem = this.adapter.storage.getItem("signInSession");
-        if (!jsonItem) return null;
-        try {
-            const item = JSON.parse(jsonItem);
-            (0, $4R6L3$superstruct.assert)(item, (0, $6d3989f7f53311af$export$7b65a75f516b80e1));
-            return item;
-        } catch (error) {
-            throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("sign_in_session.invalid", error);
-        }
+        this.loadAccessTokenMap();
     }
-    set signInSession(logtoSignInSessionItem) {
-        if (!logtoSignInSessionItem) {
-            this.adapter.storage.removeItem("signInSession");
-            return;
-        }
-        const jsonItem = JSON.stringify(logtoSignInSessionItem);
-        this.adapter.storage.setItem("signInSession", jsonItem);
+    async isAuthenticated() {
+        return Boolean(await this.getIdToken());
     }
-    get refreshToken() {
+    async getRefreshToken() {
         return this.adapter.storage.getItem("refreshToken");
     }
-    set refreshToken(refreshToken) {
-        if (!refreshToken) {
-            this.adapter.storage.removeItem("refreshToken");
-            return;
-        }
-        this.adapter.storage.setItem("refreshToken", refreshToken);
-    }
-    get idToken() {
-        return this._idToken;
-    }
-    set idToken(idToken) {
-        this._idToken = idToken;
-        if (!idToken) {
-            this.adapter.storage.removeItem("idToken");
-            return;
-        }
-        this.adapter.storage.setItem("idToken", idToken);
+    async getIdToken() {
+        return this.adapter.storage.getItem("idToken");
     }
     // eslint-disable-next-line complexity
     async getAccessToken(resource) {
-        if (!this.idToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
+        if (!await this.getIdToken()) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
         const accessTokenKey = (0, $e2aabdbdb3cc09f0$export$8f595bd2a47bcea6)(resource);
         const accessToken = this.accessTokenMap.get(accessTokenKey);
         if (accessToken && accessToken.expiresAt > Date.now() / 1000) return accessToken.token;
@@ -193,9 +167,16 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
         this.getAccessTokenPromiseMap.delete(accessTokenKey);
         return token;
     }
-    getIdTokenClaims() {
-        if (!this.idToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
-        return (0, $4R6L3$logtojs.decodeIdToken)(this.idToken);
+    async getIdTokenClaims() {
+        const idToken = await this.getIdToken();
+        if (!idToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
+        return (0, $4R6L3$logtojs.decodeIdToken)(idToken);
+    }
+    async fetchUserInfo() {
+        const { userinfoEndpoint: userinfoEndpoint  } = await this.getOidcConfig();
+        const accessToken = await this.getAccessToken();
+        if (!accessToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("fetch_user_info_failed");
+        return (0, $4R6L3$logtojs.fetchUserInfo)(userinfoEndpoint, accessToken, this.adapter.requester);
     }
     async signIn(redirectUri) {
         const { appId: clientId , prompt: prompt , resources: resources , scopes: scopes  } = this.logtoConfig;
@@ -213,25 +194,26 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
             resources: resources,
             prompt: prompt
         });
-        this.signInSession = {
+        await this.setSignInSession({
             redirectUri: redirectUri,
             codeVerifier: codeVerifier,
             state: state
-        };
-        this.refreshToken = null;
-        this.idToken = null;
+        });
+        await this.setRefreshToken(null);
+        await this.setIdToken(null);
         this.adapter.navigate(signInUri);
     }
-    isSignInRedirected(url) {
-        const { signInSession: signInSession  } = this;
+    async isSignInRedirected(url) {
+        const signInSession = await this.getSignInSession();
         if (!signInSession) return false;
         const { redirectUri: redirectUri  } = signInSession;
         const { origin: origin , pathname: pathname  } = new URL(url);
         return `${origin}${pathname}` === redirectUri;
     }
     async handleSignInCallback(callbackUri) {
-        const { signInSession: signInSession , logtoConfig: logtoConfig , adapter: adapter  } = this;
+        const { logtoConfig: logtoConfig , adapter: adapter  } = this;
         const { requester: requester  } = adapter;
+        const signInSession = await this.getSignInSession();
         if (!signInSession) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("sign_in_session.not_found");
         const { redirectUri: redirectUri , state: state , codeVerifier: codeVerifier  } = signInSession;
         const code = (0, $4R6L3$logtojs.verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
@@ -245,30 +227,62 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
             code: code
         }, requester);
         await this.verifyIdToken(codeTokenResponse.idToken);
-        this.saveCodeToken(codeTokenResponse);
-        this.signInSession = null;
+        await this.saveCodeToken(codeTokenResponse);
+        await this.setSignInSession(null);
     }
     async signOut(postLogoutRedirectUri) {
-        if (!this.idToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
+        const idToken = await this.getIdToken();
+        if (!idToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
         const { appId: clientId  } = this.logtoConfig;
         const { endSessionEndpoint: endSessionEndpoint , revocationEndpoint: revocationEndpoint  } = await this.getOidcConfig();
-        if (this.refreshToken) try {
-            await (0, $4R6L3$logtojs.revoke)(revocationEndpoint, clientId, this.refreshToken, this.adapter.requester);
+        const refreshToken = await this.getRefreshToken();
+        if (refreshToken) try {
+            await (0, $4R6L3$logtojs.revoke)(revocationEndpoint, clientId, refreshToken, this.adapter.requester);
         } catch  {
         // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
         }
         const url = (0, $4R6L3$logtojs.generateSignOutUri)({
             endSessionEndpoint: endSessionEndpoint,
             postLogoutRedirectUri: postLogoutRedirectUri,
-            idToken: this.idToken
+            idToken: idToken
         });
         this.accessTokenMap.clear();
-        this.refreshToken = null;
-        this.idToken = null;
+        await this.setRefreshToken(null);
+        await this.setIdToken(null);
         this.adapter.navigate(url);
     }
+    async getSignInSession() {
+        const jsonItem = await this.adapter.storage.getItem("signInSession");
+        if (!jsonItem) return null;
+        const item = JSON.parse(jsonItem);
+        if (!(0, $6d3989f7f53311af$export$5d8adf6e063019de)(item)) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("sign_in_session.invalid");
+        return item;
+    }
+    async setSignInSession(logtoSignInSessionItem) {
+        if (!logtoSignInSessionItem) {
+            await this.adapter.storage.removeItem("signInSession");
+            return;
+        }
+        const jsonItem = JSON.stringify(logtoSignInSessionItem);
+        await this.adapter.storage.setItem("signInSession", jsonItem);
+    }
+    async setIdToken(idToken) {
+        if (!idToken) {
+            await this.adapter.storage.removeItem("idToken");
+            return;
+        }
+        await this.adapter.storage.setItem("idToken", idToken);
+    }
+    async setRefreshToken(refreshToken) {
+        if (!refreshToken) {
+            await this.adapter.storage.removeItem("refreshToken");
+            return;
+        }
+        await this.adapter.storage.setItem("refreshToken", refreshToken);
+    }
     async getAccessTokenByRefreshToken(resource) {
-        if (!this.refreshToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
+        const currentRefreshToken = await this.getRefreshToken();
+        if (!currentRefreshToken) throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("not_authenticated");
         try {
             const accessTokenKey = (0, $e2aabdbdb3cc09f0$export$8f595bd2a47bcea6)(resource);
             const { appId: clientId  } = this.logtoConfig;
@@ -276,10 +290,10 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
             const { accessToken: accessToken , refreshToken: refreshToken , idToken: idToken , scope: scope , expiresIn: expiresIn  } = await (0, $4R6L3$logtojs.fetchTokenByRefreshToken)({
                 clientId: clientId,
                 tokenEndpoint: tokenEndpoint,
-                refreshToken: this.refreshToken,
+                refreshToken: currentRefreshToken,
                 resource: resource,
                 scopes: resource ? [
-                    "offline_access"
+                    (0, $4R6L3$logtocorekit.ReservedScope).OfflineAccess
                 ] : undefined
             }, this.adapter.requester);
             this.accessTokenMap.set(accessTokenKey, {
@@ -287,11 +301,11 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
                 scope: scope,
                 expiresAt: Math.round(Date.now() / 1000) + expiresIn
             });
-            this.saveAccessTokenMap();
-            this.refreshToken = refreshToken;
+            await this.saveAccessTokenMap();
+            await this.setRefreshToken(refreshToken);
             if (idToken) {
                 await this.verifyIdToken(idToken);
-                this.idToken = idToken;
+                await this.setIdToken(idToken);
             }
             return accessToken;
         } catch (error) {
@@ -317,9 +331,9 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
             throw new (0, $9166104b36889c59$export$877962ca249b8fc8)("invalid_id_token", error);
         }
     }
-    saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
-        this.refreshToken = refreshToken ?? null;
-        this.idToken = idToken;
+    async saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
+        await this.setRefreshToken(refreshToken ?? null);
+        await this.setIdToken(idToken);
         // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)
         const accessTokenKey = (0, $e2aabdbdb3cc09f0$export$8f595bd2a47bcea6)();
         const expiresAt = Date.now() / 1000 + expiresIn;
@@ -328,26 +342,25 @@ class $f73788ae50447ce9$export$2e2bcd8739ae039 {
             scope: scope,
             expiresAt: expiresAt
         });
-        this.saveAccessTokenMap();
+        await this.saveAccessTokenMap();
     }
-    saveAccessTokenMap() {
-        if (!this.logtoConfig.persistAccessToken) return;
+    async saveAccessTokenMap() {
         const data = {};
         for (const [key, accessToken] of this.accessTokenMap.entries())// eslint-disable-next-line @silverhand/fp/no-mutation
         data[key] = accessToken;
-        this.adapter.storage.setItem("accessToken", JSON.stringify(data));
+        await this.adapter.storage.setItem("accessToken", JSON.stringify(data));
     }
-    loadAccessTokenMap() {
-        const raw = this.adapter.storage.getItem("accessToken");
+    async loadAccessTokenMap() {
+        const raw = await this.adapter.storage.getItem("accessToken");
         if (!raw) return;
         try {
             const json = JSON.parse(raw);
-            (0, $4R6L3$superstruct.assert)(json, (0, $6d3989f7f53311af$export$4ae7b9c313038df5));
+            if (!(0, $6d3989f7f53311af$export$c12fab42a9a3e2a6)(json)) return;
             this.accessTokenMap.clear();
             for (const [key, accessToken] of Object.entries(json))this.accessTokenMap.set(key, accessToken);
         } catch  {}
     }
-}
+} /* eslint-enable max-lines */ 
 $parcel$exportWildcard(module.exports, $9166104b36889c59$exports);
 $parcel$exportWildcard(module.exports, $6d3989f7f53311af$exports);
 

package/lib/index.js.map

@@ -1 +1 @@
-{"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,0CAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;;;;;;ACnCD;AAYO,MAAM,yCAAiB,GAAG,CAAA,GAAA,uBAAI,CAAA,CAAC;IACpC,KAAK,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACf,KAAK,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACf,SAAS,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;CACpB,CAAC,AAAC;AAII,MAAM,yCAA4B,GAAG,CAAA,GAAA,uBAAI,CAAA,CAAC;IAC/C,WAAW,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACrB,YAAY,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;IACtB,KAAK,EAAE,CAAA,GAAA,yBAAM,CAAA,EAAE;CAChB,CAAC,AAAC;AAEI,MAAM,yCAAyB,GAAG,CAAA,GAAA,yBAAM,CAAA,CAAC,CAAA,GAAA,yBAAM,CAAA,EAAE,EAAE,yCAAiB,CAAC,AAAC;;;AC1B7E;ACAA;AAEO,MAAM,yCAAe,GAAG,CAAC,aAA2B,GAAgB;IACzE,OAAO,OAAU,GAAG,IAAI,AAA0B,GAAiB;QACjE,MAAM,QAAQ,GAAG,MAAM,aAAa,IAAI,IAAI,CAAC,AAAC;QAE9C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,qCAAqC;YACrC,MAAM,QAAE,IAAI,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,AAAC;YACvE,MAAM,IAAI,CAAA,GAAA,gCAAiB,CAAA,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;SAC5C;QAED,OAAO,QAAQ,CAAC,IAAI,EAAK,CAAC;KAC3B,CAAC;CACH,AAAC;;;ADVK,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,4BAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;;;AH8B/B;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAIvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAG/E,YAAY,WAAwB,EAAE,OAAsB,CAAE;QAC5D,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,qBAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,iCAAkB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1D,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,WAAW,CAAC,kBAAkB,EACrC,IAAI,CAAC,kBAAkB,EAAE,CAAC;KAE7B;IAED,IAAW,eAAe,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC9B;IAED,IAAc,aAAa,GAAqC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,AAAC;QAE/D,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;YAC3C,CAAA,GAAA,yBAAM,CAAA,CAAC,IAAI,EAAE,CAAA,GAAA,yCAA4B,CAAA,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;SACb,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;SAC9D;KACF;IAED,IAAc,aAAa,CAAC,sBAAwD,EAAE;QACpF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEjD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KACzD;IAED,IAAI,YAAY,GAAG;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;KACrD;IAED,IAAY,YAAY,CAAC,YAA8B,EAAE;QACvD,IAAI,CAAC,YAAY,EAAE;YACjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAEhD,OAAO;SACR;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;KAC5D;IAED,IAAI,OAAO,GAAG;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;KACtB;IAED,IAAY,OAAO,CAAC,OAAyB,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,IAAI,CAAC,OAAO,EAAE;YACZ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAE3C,OAAO;SACR;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;KAClD;IAED,sCAAsC;IACtC,MAAa,cAAc,CAAC,QAAiB,EAAmB;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,AAAO,gBAAgB,GAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,4BAAa,CAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,MAAa,MAAM,CAAC,WAAmB,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,AAAC;QACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,AAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,AAAC;QAE3C,MAAM,SAAS,GAAG,CAAA,GAAA,gCAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,IAAI,CAAC,aAAa,GAAG;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;KAClC;IAED,AAAO,kBAAkB,CAAC,GAAW,EAAW;QAC9C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,IAAI,AAAC;QAE/B,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAa,oBAAoB,CAAC,WAAmB,EAAE;QACrD,MAAM,iBAAE,aAAa,CAAA,eAAE,WAAW,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,IAAI,AAAC;QACrD,MAAM,aAAE,SAAS,CAAA,EAAE,GAAG,OAAO,AAAC;QAE9B,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,gDAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,4CAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;KAC3B;IAED,MAAa,OAAO,CAAC,qBAA8B,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE9E,IAAI,IAAI,CAAC,YAAY,EACnB,IAAI;YACF,MAAM,CAAA,GAAA,qBAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;SACvF,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,iCAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KAC5B;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,EACpB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,uCAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;0BAC/B,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,gBAAgB;iBAAC,GAAG,SAAS;aAClD,EACD,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAE1B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YAEjC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aACxB;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,8BAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KACnE;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,8BAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,4BAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,AAAQ,aAAa,CAAC,gBACpB,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,EAAE,CAAC;KAC3B;IAED,AAAQ,kBAAkB,GAAG;QAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,kBAAkB,EACtC,OAAO;QAGT,MAAM,IAAI,GAAgC,EAAE,AAAC;QAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAC5D,sDAAsD;QACtD,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;QAG1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;KACnE;IAED,AAAQ,kBAAkB,GAAG;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,AAAC;QAExD,IAAI,CAAC,GAAG,EACN,OAAO;QAGT,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,AAAC;YACtC,CAAA,GAAA,yBAAM,CAAA,CAAC,IAAI,EAAE,CAAA,GAAA,yCAAyB,CAAA,CAAC,CAAC;YACxC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;SAE7C,CAAC,OAAM,EAAE;KACX;CACF","sources":["packages/client/src/index.ts","packages/client/src/errors.ts","packages/client/src/types/index.ts","packages/client/src/utils/index.ts","packages/client/src/utils/requester.ts"],"sourcesContent":["import {\n  CodeTokenResponse,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateSignInUri,\n  generateSignOutUri,\n  IdTokenClaims,\n  Prompt,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert } from 'superstruct';\n\nimport { ClientAdapter } from './adapter';\nimport { LogtoClientError } from './errors';\nimport {\n  AccessToken,\n  LogtoAccessTokenMapSchema,\n  LogtoConfig,\n  LogtoSignInSessionItem,\n  LogtoSignInSessionItemSchema,\n} from './types';\nimport { buildAccessTokenKey, getDiscoveryEndpoint } from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';\nexport * from './errors';\nexport type { Storage, StorageKey, ClientAdapter } from './adapter';\nexport { createRequester } from './utils';\nexport * from './types';\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly adapter: ClientAdapter;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.adapter = adapter;\n    this._idToken = this.adapter.storage.getItem('idToken');\n\n    if (this.logtoConfig.persistAccessToken) {\n      this.loadAccessTokenMap();\n    }\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = this.adapter.storage.getItem('signInSession');\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      this.adapter.storage.removeItem('signInSession');\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    this.adapter.storage.setItem('signInSession', jsonItem);\n  }\n\n  get refreshToken() {\n    return this.adapter.storage.getItem('refreshToken');\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    if (!refreshToken) {\n      this.adapter.storage.removeItem('refreshToken');\n\n      return;\n    }\n\n    this.adapter.storage.setItem('refreshToken', refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    if (!idToken) {\n      this.adapter.storage.removeItem('idToken');\n\n      return;\n    }\n\n    this.adapter.storage.setItem('idToken', idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = this.adapter.generateCodeVerifier();\n    const codeChallenge = await this.adapter.generateCodeChallenge(codeVerifier);\n    const state = this.adapter.generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    this.adapter.navigate(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, adapter } = this;\n    const { requester } = adapter;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.adapter.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    this.adapter.navigate(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.adapter.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n      this.saveAccessTokenMap();\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.adapter.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n    this.saveAccessTokenMap();\n  }\n\n  private saveAccessTokenMap() {\n    if (!this.logtoConfig.persistAccessToken) {\n      return;\n    }\n\n    const data: Record<string, AccessToken> = {};\n\n    for (const [key, accessToken] of this.accessTokenMap.entries()) {\n      // eslint-disable-next-line @silverhand/fp/no-mutation\n      data[key] = accessToken;\n    }\n\n    this.adapter.storage.setItem('accessToken', JSON.stringify(data));\n  }\n\n  private loadAccessTokenMap() {\n    const raw = this.adapter.storage.getItem('accessToken');\n\n    if (!raw) {\n      return;\n    }\n\n    try {\n      const json: unknown = JSON.parse(raw);\n      assert(json, LogtoAccessTokenMapSchema);\n      this.accessTokenMap.clear();\n\n      for (const [key, accessToken] of Object.entries(json)) {\n        this.accessTokenMap.set(key, accessToken);\n      }\n    } catch {}\n  }\n}\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { Prompt } from '@logto/js';\nimport { Infer, number, record, string, type } from 'superstruct';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  persistAccessToken?: boolean;\n};\n\nexport const AccessTokenSchema = type({\n  token: string(),\n  scope: string(),\n  expiresAt: number(),\n});\n\nexport type AccessToken = Infer<typeof AccessTokenSchema>;\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport const LogtoAccessTokenMapSchema = record(string(), AccessTokenSchema);\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n","import { discoveryPath } from '@logto/js';\n\nexport * from './requester';\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n","import { LogtoRequestError, LogtoRequestErrorBody, Requester } from '@logto/js';\n\nexport const createRequester = (fetchFunction: typeof fetch): Requester => {\n  return async <T>(...args: Parameters<typeof fetch>): Promise<T> => {\n    const response = await fetchFunction(...args);\n\n    if (!response.ok) {\n      // Expected request error from server\n      const { code, message } = await response.json<LogtoRequestErrorBody>();\n      throw new LogtoRequestError(code, message);\n    }\n\n    return response.json<T>();\n  };\n};\n"],"names":[],"version":3,"file":"index.js.map"}
+{"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA;;;;;;;ACDA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,sBAAsB,EAAE,6DAA6D;IACrF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,0CAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;;;;;ACpCD;AAiBO,MAAM,yCAAwB,GAAG,CAAC,IAAa,GAAqC;IACzF,IAAI,CAAC,CAAA,GAAA,gCAAiB,CAAA,CAAC,IAAI,CAAC,EAC1B,OAAO,KAAK,CAAC;IAGf,OAAO;QAAC,aAAa;QAAE,cAAc;QAAE,OAAO;KAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;CAC/F,AAAC;AAEK,MAAM,yCAAqB,GAAG,CAAC,IAAa,GAA0C;IAC3F,IAAI,CAAC,CAAA,GAAA,gCAAiB,CAAA,CAAC,IAAI,CAAC,EAC1B,OAAO,KAAK,CAAC;IAGf,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAK;QAC1C,IAAI,CAAC,CAAA,GAAA,gCAAiB,CAAA,CAAC,KAAK,CAAC,EAC3B,OAAO,KAAK,CAAC;QAGf,OACE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAC/B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACnC;KACH,CAAC,CAAC;CACJ,AAAC;;;ACzCF;ACAA;AAEO,MAAM,yCAAe,GAAG,CAAC,aAA2B,GAAgB;IACzE,OAAO,OAAU,GAAG,IAAI,AAA0B,GAAiB;QACjE,MAAM,QAAQ,GAAG,MAAM,aAAa,IAAI,IAAI,CAAC,AAAC;QAE9C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,AAAC;YAE3C,IAAI,CAAC,CAAA,GAAA,kCAAmB,CAAA,CAAC,YAAY,CAAC,EACpC,MAAM,IAAI,CAAA,GAAA,yBAAU,CAAA,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;YAGlE,qCAAqC;YACrC,MAAM,QAAE,IAAI,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,YAAY,AAAC;YACvC,MAAM,IAAI,CAAA,GAAA,gCAAiB,CAAA,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;SAC5C;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;KACxB,CAAC;CACH,AAAC;;;ADhBK,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,4BAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;;;;AHkC/B;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,2CAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/E,YAAY,WAAwB,EAAE,OAAsB,CAAE;QAC5D,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,qBAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,gCAAiB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SACzD,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAElB,IAAI,CAAC,kBAAkB,EAAE,CAAC;KAChC;IAED,MAAM,eAAe,GAAG;QACtB,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;KACzC;IAED,MAAM,eAAe,GAAG;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;KACrD;IAED,MAAM,UAAU,GAAG;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KAChD;IAED,sCAAsC;IACtC,MAAM,cAAc,CAAC,QAAiB,EAAmB;QACvD,IAAI,CAAE,MAAM,IAAI,CAAC,UAAU,EAAE,AAAC,EAC5B,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,gBAAgB,GAA2B;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,AAAC;QAExC,IAAI,CAAC,OAAO,EACV,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,4BAAa,CAAA,CAAC,OAAO,CAAC,CAAC;KAC/B;IAED,MAAM,aAAa,GAA8B;QAC/C,MAAM,oBAAE,gBAAgB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACxD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,AAAC;QAEhD,IAAI,CAAC,WAAW,EACd,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,wBAAwB,CAAC,CAAC;QAGvD,OAAO,CAAA,GAAA,4BAAa,CAAA,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KAC7E;IAED,MAAM,MAAM,CAAC,WAAmB,EAAE;QAChC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,AAAC;QACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,AAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,AAAC;QAE3C,MAAM,SAAS,GAAG,CAAA,GAAA,gCAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;KAClC;IAED,MAAM,kBAAkB,CAAC,GAAW,EAAoB;QACtD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,AAAC;QAEpD,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAM,oBAAoB,CAAC,WAAmB,EAAE;QAC9C,MAAM,eAAE,WAAW,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,IAAI,AAAC;QACtC,MAAM,aAAE,SAAS,CAAA,EAAE,GAAG,OAAO,AAAC;QAC9B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,AAAC;QAEpD,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,gDAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,4CAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;KACnC;IAED,MAAM,OAAO,CAAC,qBAA8B,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,AAAC;QAExC,IAAI,CAAC,OAAO,EACV,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,AAAC;QAElD,IAAI,YAAY,EACd,IAAI;YACF,MAAM,CAAA,GAAA,qBAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;SAClF,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,iCAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;qBACrB,OAAO;SACR,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KAC5B;IAED,MAAgB,gBAAgB,GAA8C;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,AAAC;QAErE,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;QAE3C,IAAI,CAAC,CAAA,GAAA,yCAAwB,CAAA,CAAC,IAAI,CAAC,EACjC,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,CAAC,CAAC;QAGxD,OAAO,IAAI,CAAC;KACb;IAED,MAAgB,gBAAgB,CAAC,sBAAwD,EAAE;QACzF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEvD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KAC/D;IAED,MAAc,UAAU,CAAC,OAAyB,EAAE;QAClD,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAEjD,OAAO;SACR;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;KACxD;IAED,MAAc,eAAe,CAAC,YAA8B,EAAE;QAC5D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAEtD,OAAO;SACR;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;KAClE;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,AAAC;QAEzD,IAAI,CAAC,mBAAmB,EACtB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,uCAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,mBAAmB;0BACjC,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,CAAA,GAAA,iCAAa,CAAA,CAAC,aAAa;iBAAC,GAAG,SAAS;aAC7D,EACD,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAEzC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAChC;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,8BAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KACnE;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,8BAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,4BAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,MAAc,aAAa,CAAC,gBAC1B,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE/B,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;KACjC;IAED,MAAc,kBAAkB,GAAG;QACjC,MAAM,IAAI,GAAgC,EAAE,AAAC;QAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAC5D,sDAAsD;QACtD,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;QAG1B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;KACzE;IAED,MAAc,kBAAkB,GAAG;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,AAAC;QAE9D,IAAI,CAAC,GAAG,EACN,OAAO;QAGT,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,AAAC;YAEtC,IAAI,CAAC,CAAA,GAAA,yCAAqB,CAAA,CAAC,IAAI,CAAC,EAC9B,OAAO;YAET,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;SAE7C,CAAC,OAAM,EAAE;KACX;CACF,CACD,6BAA6B","sources":["packages/client/src/index.ts","packages/client/src/errors.ts","packages/client/src/types/index.ts","packages/client/src/utils/index.ts","packages/client/src/utils/requester.ts"],"sourcesContent":["/* eslint-disable max-lines */\nimport { ReservedScope } from '@logto/core-kit';\nimport {\n  CodeTokenResponse,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  fetchUserInfo,\n  generateSignInUri,\n  generateSignOutUri,\n  IdTokenClaims,\n  Prompt,\n  revoke,\n  UserInfoResponse,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withDefaultScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\n\nimport { ClientAdapter } from './adapter';\nimport { LogtoClientError } from './errors';\nimport {\n  AccessToken,\n  isLogtoAccessTokenMap,\n  isLogtoSignInSessionItem,\n  LogtoConfig,\n  LogtoSignInSessionItem,\n} from './types';\nimport { buildAccessTokenKey, getDiscoveryEndpoint } from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode, UserInfoResponse } from '@logto/js';\nexport { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';\nexport * from './errors';\nexport type { Storage, StorageKey, ClientAdapter } from './adapter';\nexport { createRequester } from './utils';\nexport * from './types';\nexport { ReservedScope, UserScope } from '@logto/core-kit';\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n  protected readonly adapter: ClientAdapter;\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n\n  constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withDefaultScopes(logtoConfig.scopes).split(' '),\n    };\n    this.adapter = adapter;\n\n    void this.loadAccessTokenMap();\n  }\n\n  async isAuthenticated() {\n    return Boolean(await this.getIdToken());\n  }\n\n  async getRefreshToken() {\n    return this.adapter.storage.getItem('refreshToken');\n  }\n\n  async getIdToken() {\n    return this.adapter.storage.getItem('idToken');\n  }\n\n  // eslint-disable-next-line complexity\n  async getAccessToken(resource?: string): Promise<string> {\n    if (!(await this.getIdToken())) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  async getIdTokenClaims(): Promise<IdTokenClaims> {\n    const idToken = await this.getIdToken();\n\n    if (!idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(idToken);\n  }\n\n  async fetchUserInfo(): Promise<UserInfoResponse> {\n    const { userinfoEndpoint } = await this.getOidcConfig();\n    const accessToken = await this.getAccessToken();\n\n    if (!accessToken) {\n      throw new LogtoClientError('fetch_user_info_failed');\n    }\n\n    return fetchUserInfo(userinfoEndpoint, accessToken, this.adapter.requester);\n  }\n\n  async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = this.adapter.generateCodeVerifier();\n    const codeChallenge = await this.adapter.generateCodeChallenge(codeVerifier);\n    const state = this.adapter.generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    await this.setSignInSession({ redirectUri, codeVerifier, state });\n    await this.setRefreshToken(null);\n    await this.setIdToken(null);\n\n    this.adapter.navigate(signInUri);\n  }\n\n  async isSignInRedirected(url: string): Promise<boolean> {\n    const signInSession = await this.getSignInSession();\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  async handleSignInCallback(callbackUri: string) {\n    const { logtoConfig, adapter } = this;\n    const { requester } = adapter;\n    const signInSession = await this.getSignInSession();\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n    await this.saveCodeToken(codeTokenResponse);\n    await this.setSignInSession(null);\n  }\n\n  async signOut(postLogoutRedirectUri?: string) {\n    const idToken = await this.getIdToken();\n\n    if (!idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n    const refreshToken = await this.getRefreshToken();\n\n    if (refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, refreshToken, this.adapter.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken,\n    });\n\n    this.accessTokenMap.clear();\n    await this.setRefreshToken(null);\n    await this.setIdToken(null);\n\n    this.adapter.navigate(url);\n  }\n\n  protected async getSignInSession(): Promise<Nullable<LogtoSignInSessionItem>> {\n    const jsonItem = await this.adapter.storage.getItem('signInSession');\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    const item: unknown = JSON.parse(jsonItem);\n\n    if (!isLogtoSignInSessionItem(item)) {\n      throw new LogtoClientError('sign_in_session.invalid');\n    }\n\n    return item;\n  }\n\n  protected async setSignInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      await this.adapter.storage.removeItem('signInSession');\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    await this.adapter.storage.setItem('signInSession', jsonItem);\n  }\n\n  private async setIdToken(idToken: Nullable<string>) {\n    if (!idToken) {\n      await this.adapter.storage.removeItem('idToken');\n\n      return;\n    }\n\n    await this.adapter.storage.setItem('idToken', idToken);\n  }\n\n  private async setRefreshToken(refreshToken: Nullable<string>) {\n    if (!refreshToken) {\n      await this.adapter.storage.removeItem('refreshToken');\n\n      return;\n    }\n\n    await this.adapter.storage.setItem('refreshToken', refreshToken);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    const currentRefreshToken = await this.getRefreshToken();\n\n    if (!currentRefreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: currentRefreshToken,\n            resource,\n            scopes: resource ? [ReservedScope.OfflineAccess] : undefined, // Force remove openid scope from the request\n          },\n          this.adapter.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      await this.saveAccessTokenMap();\n      await this.setRefreshToken(refreshToken);\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        await this.setIdToken(idToken);\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.adapter.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private async saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    await this.setRefreshToken(refreshToken ?? null);\n    await this.setIdToken(idToken);\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n    await this.saveAccessTokenMap();\n  }\n\n  private async saveAccessTokenMap() {\n    const data: Record<string, AccessToken> = {};\n\n    for (const [key, accessToken] of this.accessTokenMap.entries()) {\n      // eslint-disable-next-line @silverhand/fp/no-mutation\n      data[key] = accessToken;\n    }\n\n    await this.adapter.storage.setItem('accessToken', JSON.stringify(data));\n  }\n\n  private async loadAccessTokenMap() {\n    const raw = await this.adapter.storage.getItem('accessToken');\n\n    if (!raw) {\n      return;\n    }\n\n    try {\n      const json: unknown = JSON.parse(raw);\n\n      if (!isLogtoAccessTokenMap(json)) {\n        return;\n      }\n      this.accessTokenMap.clear();\n\n      for (const [key, accessToken] of Object.entries(json)) {\n        this.accessTokenMap.set(key, accessToken);\n      }\n    } catch {}\n  }\n}\n/* eslint-enable max-lines */\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  fetch_user_info_failed: 'Unable to fetch user info. The access token may be invalid.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { isArbitraryObject, Prompt } from '@logto/js';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  appSecret?: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number;\n};\n\nexport const isLogtoSignInSessionItem = (data: unknown): data is LogtoSignInSessionItem => {\n  if (!isArbitraryObject(data)) {\n    return false;\n  }\n\n  return ['redirectUri', 'codeVerifier', 'state'].every((key) => typeof data[key] === 'string');\n};\n\nexport const isLogtoAccessTokenMap = (data: unknown): data is Record<string, AccessToken> => {\n  if (!isArbitraryObject(data)) {\n    return false;\n  }\n\n  return Object.values(data).every((value) => {\n    if (!isArbitraryObject(value)) {\n      return false;\n    }\n\n    return (\n      typeof value.token === 'string' &&\n      typeof value.scope === 'string' &&\n      typeof value.expiresAt === 'number'\n    );\n  });\n};\n\nexport type LogtoSignInSessionItem = {\n  redirectUri: string;\n  codeVerifier: string;\n  state: string;\n};\n","import { discoveryPath } from '@logto/js';\n\nexport * from './requester';\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n","import { LogtoError, LogtoRequestError, isLogtoRequestError, Requester } from '@logto/js';\n\nexport const createRequester = (fetchFunction: typeof fetch): Requester => {\n  return async <T>(...args: Parameters<typeof fetch>): Promise<T> => {\n    const response = await fetchFunction(...args);\n\n    if (!response.ok) {\n      const responseJson = await response.json();\n\n      if (!isLogtoRequestError(responseJson)) {\n        throw new LogtoError('unexpected_response_error', responseJson);\n      }\n\n      // Expected request error from server\n      const { code, message } = responseJson;\n      throw new LogtoRequestError(code, message);\n    }\n\n    return response.json();\n  };\n};\n"],"names":[],"version":3,"file":"index.js.map"}

package/lib/module.js

@@ -1,7 +1,7 @@
-import {Prompt as $19775a679e2952df$import$5548085c5b0a2ee3$83716a4aa1642908, withReservedScopes as $kqBTI$withReservedScopes, decodeIdToken as $kqBTI$decodeIdToken, generateSignInUri as $kqBTI$generateSignInUri, verifyAndParseCodeFromCallbackUri as $kqBTI$verifyAndParseCodeFromCallbackUri, fetchTokenByAuthorizationCode as $kqBTI$fetchTokenByAuthorizationCode, revoke as $kqBTI$revoke, generateSignOutUri as $kqBTI$generateSignOutUri, fetchTokenByRefreshToken as $kqBTI$fetchTokenByRefreshToken, fetchOidcConfig as $kqBTI$fetchOidcConfig, verifyIdToken as $kqBTI$verifyIdToken, LogtoError as $19775a679e2952df$re_export$LogtoError, OidcError as $19775a679e2952df$re_export$OidcError, LogtoRequestError as $19775a679e2952df$re_export$LogtoRequestError, discoveryPath as $kqBTI$discoveryPath} from "@logto/js";
+import {ReservedScope as $19775a679e2952df$import$2bf383245f9cd522$1d2e82cebfd4b08, UserScope as $19775a679e2952df$re_export$UserScope} from "@logto/core-kit";
+import {Prompt as $19775a679e2952df$import$5548085c5b0a2ee3$83716a4aa1642908, withDefaultScopes as $kqBTI$withDefaultScopes, decodeIdToken as $kqBTI$decodeIdToken, fetchUserInfo as $kqBTI$fetchUserInfo, generateSignInUri as $kqBTI$generateSignInUri, verifyAndParseCodeFromCallbackUri as $kqBTI$verifyAndParseCodeFromCallbackUri, fetchTokenByAuthorizationCode as $kqBTI$fetchTokenByAuthorizationCode, revoke as $kqBTI$revoke, generateSignOutUri as $kqBTI$generateSignOutUri, fetchTokenByRefreshToken as $kqBTI$fetchTokenByRefreshToken, fetchOidcConfig as $kqBTI$fetchOidcConfig, verifyIdToken as $kqBTI$verifyIdToken, LogtoError as $19775a679e2952df$re_export$LogtoError, OidcError as $19775a679e2952df$re_export$OidcError, LogtoRequestError as $19775a679e2952df$re_export$LogtoRequestError, isArbitraryObject as $kqBTI$isArbitraryObject, discoveryPath as $kqBTI$discoveryPath, isLogtoRequestError as $kqBTI$isLogtoRequestError} from "@logto/js";
 import {createRemoteJWKSet as $kqBTI$createRemoteJWKSet} from "jose";
 import $kqBTI$lodashonce from "lodash.once";
-import {assert as $kqBTI$assert, type as $kqBTI$type, string as $kqBTI$string, number as $kqBTI$number, record as $kqBTI$record} from "superstruct";
 import $kqBTI$lodashget from "lodash.get";
 
 function $parcel$export(e, n, v, s) {
@@ -22,6 +22,7 @@ const $4ec05cedcef20733$var$logtoClientErrorCodes = Object.freeze({
     },
     not_authenticated: "Not authenticated.",
     get_access_token_by_refresh_token_failed: "Failed to get access token by refresh token.",
+    fetch_user_info_failed: "Unable to fetch user info. The access token may be invalid.",
     invalid_id_token: "Invalid id token."
 });
 const $4ec05cedcef20733$var$getMessageByErrorCode = (errorCode)=>{
@@ -41,21 +42,24 @@ class $4ec05cedcef20733$export$877962ca249b8fc8 extends Error {
 
 var $50f2bb780a45e70c$exports = {};
 
-$parcel$export($50f2bb780a45e70c$exports, "AccessTokenSchema", () => $50f2bb780a45e70c$export$77bdbaff506443f4);
-$parcel$export($50f2bb780a45e70c$exports, "LogtoSignInSessionItemSchema", () => $50f2bb780a45e70c$export$7b65a75f516b80e1);
-$parcel$export($50f2bb780a45e70c$exports, "LogtoAccessTokenMapSchema", () => $50f2bb780a45e70c$export$4ae7b9c313038df5);
+$parcel$export($50f2bb780a45e70c$exports, "isLogtoSignInSessionItem", () => $50f2bb780a45e70c$export$5d8adf6e063019de);
+$parcel$export($50f2bb780a45e70c$exports, "isLogtoAccessTokenMap", () => $50f2bb780a45e70c$export$c12fab42a9a3e2a6);
 
-const $50f2bb780a45e70c$export$77bdbaff506443f4 = (0, $kqBTI$type)({
-    token: (0, $kqBTI$string)(),
-    scope: (0, $kqBTI$string)(),
-    expiresAt: (0, $kqBTI$number)()
-});
-const $50f2bb780a45e70c$export$7b65a75f516b80e1 = (0, $kqBTI$type)({
-    redirectUri: (0, $kqBTI$string)(),
-    codeVerifier: (0, $kqBTI$string)(),
-    state: (0, $kqBTI$string)()
-});
-const $50f2bb780a45e70c$export$4ae7b9c313038df5 = (0, $kqBTI$record)((0, $kqBTI$string)(), $50f2bb780a45e70c$export$77bdbaff506443f4);
+const $50f2bb780a45e70c$export$5d8adf6e063019de = (data)=>{
+    if (!(0, $kqBTI$isArbitraryObject)(data)) return false;
+    return [
+        "redirectUri",
+        "codeVerifier",
+        "state"
+    ].every((key)=>typeof data[key] === "string");
+};
+const $50f2bb780a45e70c$export$c12fab42a9a3e2a6 = (data)=>{
+    if (!(0, $kqBTI$isArbitraryObject)(data)) return false;
+    return Object.values(data).every((value)=>{
+        if (!(0, $kqBTI$isArbitraryObject)(value)) return false;
+        return typeof value.token === "string" && typeof value.scope === "string" && typeof value.expiresAt === "number";
+    });
+};
 
 
 
@@ -64,8 +68,10 @@ const $8449a5dbad0d6387$export$8d54726fdbf08e0a = (fetchFunction)=>{
     return async (...args)=>{
         const response = await fetchFunction(...args);
         if (!response.ok) {
+            const responseJson = await response.json();
+            if (!(0, $kqBTI$isLogtoRequestError)(responseJson)) throw new (0, $19775a679e2952df$re_export$LogtoError)("unexpected_response_error", responseJson);
             // Expected request error from server
-            const { code: code , message: message  } = await response.json();
+            const { code: code , message: message  } = responseJson;
             throw new (0, $19775a679e2952df$re_export$LogtoRequestError)(code, message);
         }
         return response.json();
@@ -81,6 +87,7 @@ const $dcfd5d64758ae70b$export$5d9c34f69c80822b = (endpoint)=>new URL((0, $kqBTI
 
 
 
+
 class $19775a679e2952df$export$2e2bcd8739ae039 {
     getOidcConfig = (0, $kqBTI$lodashonce)(this._getOidcConfig);
     getJwtVerifyGetKey = (0, $kqBTI$lodashonce)(this._getJwtVerifyGetKey);
@@ -90,58 +97,23 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
         this.logtoConfig = {
             ...logtoConfig,
             prompt: logtoConfig.prompt ?? (0, $19775a679e2952df$import$5548085c5b0a2ee3$83716a4aa1642908).Consent,
-            scopes: (0, $kqBTI$withReservedScopes)(logtoConfig.scopes).split(" ")
+            scopes: (0, $kqBTI$withDefaultScopes)(logtoConfig.scopes).split(" ")
         };
         this.adapter = adapter;
-        this._idToken = this.adapter.storage.getItem("idToken");
-        if (this.logtoConfig.persistAccessToken) this.loadAccessTokenMap();
+        this.loadAccessTokenMap();
     }
-    get isAuthenticated() {
-        return Boolean(this.idToken);
+    async isAuthenticated() {
+        return Boolean(await this.getIdToken());
     }
-    get signInSession() {
-        const jsonItem = this.adapter.storage.getItem("signInSession");
-        if (!jsonItem) return null;
-        try {
-            const item = JSON.parse(jsonItem);
-            (0, $kqBTI$assert)(item, (0, $50f2bb780a45e70c$export$7b65a75f516b80e1));
-            return item;
-        } catch (error) {
-            throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("sign_in_session.invalid", error);
-        }
-    }
-    set signInSession(logtoSignInSessionItem) {
-        if (!logtoSignInSessionItem) {
-            this.adapter.storage.removeItem("signInSession");
-            return;
-        }
-        const jsonItem = JSON.stringify(logtoSignInSessionItem);
-        this.adapter.storage.setItem("signInSession", jsonItem);
-    }
-    get refreshToken() {
+    async getRefreshToken() {
         return this.adapter.storage.getItem("refreshToken");
     }
-    set refreshToken(refreshToken) {
-        if (!refreshToken) {
-            this.adapter.storage.removeItem("refreshToken");
-            return;
-        }
-        this.adapter.storage.setItem("refreshToken", refreshToken);
-    }
-    get idToken() {
-        return this._idToken;
-    }
-    set idToken(idToken) {
-        this._idToken = idToken;
-        if (!idToken) {
-            this.adapter.storage.removeItem("idToken");
-            return;
-        }
-        this.adapter.storage.setItem("idToken", idToken);
+    async getIdToken() {
+        return this.adapter.storage.getItem("idToken");
     }
     // eslint-disable-next-line complexity
     async getAccessToken(resource) {
-        if (!this.idToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
+        if (!await this.getIdToken()) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
         const accessTokenKey = (0, $dcfd5d64758ae70b$export$8f595bd2a47bcea6)(resource);
         const accessToken = this.accessTokenMap.get(accessTokenKey);
         if (accessToken && accessToken.expiresAt > Date.now() / 1000) return accessToken.token;
@@ -162,9 +134,16 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
         this.getAccessTokenPromiseMap.delete(accessTokenKey);
         return token;
     }
-    getIdTokenClaims() {
-        if (!this.idToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
-        return (0, $kqBTI$decodeIdToken)(this.idToken);
+    async getIdTokenClaims() {
+        const idToken = await this.getIdToken();
+        if (!idToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
+        return (0, $kqBTI$decodeIdToken)(idToken);
+    }
+    async fetchUserInfo() {
+        const { userinfoEndpoint: userinfoEndpoint  } = await this.getOidcConfig();
+        const accessToken = await this.getAccessToken();
+        if (!accessToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("fetch_user_info_failed");
+        return (0, $kqBTI$fetchUserInfo)(userinfoEndpoint, accessToken, this.adapter.requester);
     }
     async signIn(redirectUri) {
         const { appId: clientId , prompt: prompt , resources: resources , scopes: scopes  } = this.logtoConfig;
@@ -182,25 +161,26 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
             resources: resources,
             prompt: prompt
         });
-        this.signInSession = {
+        await this.setSignInSession({
             redirectUri: redirectUri,
             codeVerifier: codeVerifier,
             state: state
-        };
-        this.refreshToken = null;
-        this.idToken = null;
+        });
+        await this.setRefreshToken(null);
+        await this.setIdToken(null);
         this.adapter.navigate(signInUri);
     }
-    isSignInRedirected(url) {
-        const { signInSession: signInSession  } = this;
+    async isSignInRedirected(url) {
+        const signInSession = await this.getSignInSession();
         if (!signInSession) return false;
         const { redirectUri: redirectUri  } = signInSession;
         const { origin: origin , pathname: pathname  } = new URL(url);
         return `${origin}${pathname}` === redirectUri;
     }
     async handleSignInCallback(callbackUri) {
-        const { signInSession: signInSession , logtoConfig: logtoConfig , adapter: adapter  } = this;
+        const { logtoConfig: logtoConfig , adapter: adapter  } = this;
         const { requester: requester  } = adapter;
+        const signInSession = await this.getSignInSession();
         if (!signInSession) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("sign_in_session.not_found");
         const { redirectUri: redirectUri , state: state , codeVerifier: codeVerifier  } = signInSession;
         const code = (0, $kqBTI$verifyAndParseCodeFromCallbackUri)(callbackUri, redirectUri, state);
@@ -214,30 +194,62 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
             code: code
         }, requester);
         await this.verifyIdToken(codeTokenResponse.idToken);
-        this.saveCodeToken(codeTokenResponse);
-        this.signInSession = null;
+        await this.saveCodeToken(codeTokenResponse);
+        await this.setSignInSession(null);
     }
     async signOut(postLogoutRedirectUri) {
-        if (!this.idToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
+        const idToken = await this.getIdToken();
+        if (!idToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
         const { appId: clientId  } = this.logtoConfig;
         const { endSessionEndpoint: endSessionEndpoint , revocationEndpoint: revocationEndpoint  } = await this.getOidcConfig();
-        if (this.refreshToken) try {
-            await (0, $kqBTI$revoke)(revocationEndpoint, clientId, this.refreshToken, this.adapter.requester);
+        const refreshToken = await this.getRefreshToken();
+        if (refreshToken) try {
+            await (0, $kqBTI$revoke)(revocationEndpoint, clientId, refreshToken, this.adapter.requester);
         } catch  {
         // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed
         }
         const url = (0, $kqBTI$generateSignOutUri)({
             endSessionEndpoint: endSessionEndpoint,
             postLogoutRedirectUri: postLogoutRedirectUri,
-            idToken: this.idToken
+            idToken: idToken
         });
         this.accessTokenMap.clear();
-        this.refreshToken = null;
-        this.idToken = null;
+        await this.setRefreshToken(null);
+        await this.setIdToken(null);
         this.adapter.navigate(url);
     }
+    async getSignInSession() {
+        const jsonItem = await this.adapter.storage.getItem("signInSession");
+        if (!jsonItem) return null;
+        const item = JSON.parse(jsonItem);
+        if (!(0, $50f2bb780a45e70c$export$5d8adf6e063019de)(item)) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("sign_in_session.invalid");
+        return item;
+    }
+    async setSignInSession(logtoSignInSessionItem) {
+        if (!logtoSignInSessionItem) {
+            await this.adapter.storage.removeItem("signInSession");
+            return;
+        }
+        const jsonItem = JSON.stringify(logtoSignInSessionItem);
+        await this.adapter.storage.setItem("signInSession", jsonItem);
+    }
+    async setIdToken(idToken) {
+        if (!idToken) {
+            await this.adapter.storage.removeItem("idToken");
+            return;
+        }
+        await this.adapter.storage.setItem("idToken", idToken);
+    }
+    async setRefreshToken(refreshToken) {
+        if (!refreshToken) {
+            await this.adapter.storage.removeItem("refreshToken");
+            return;
+        }
+        await this.adapter.storage.setItem("refreshToken", refreshToken);
+    }
     async getAccessTokenByRefreshToken(resource) {
-        if (!this.refreshToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
+        const currentRefreshToken = await this.getRefreshToken();
+        if (!currentRefreshToken) throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("not_authenticated");
         try {
             const accessTokenKey = (0, $dcfd5d64758ae70b$export$8f595bd2a47bcea6)(resource);
             const { appId: clientId  } = this.logtoConfig;
@@ -245,10 +257,10 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
             const { accessToken: accessToken , refreshToken: refreshToken , idToken: idToken , scope: scope , expiresIn: expiresIn  } = await (0, $kqBTI$fetchTokenByRefreshToken)({
                 clientId: clientId,
                 tokenEndpoint: tokenEndpoint,
-                refreshToken: this.refreshToken,
+                refreshToken: currentRefreshToken,
                 resource: resource,
                 scopes: resource ? [
-                    "offline_access"
+                    (0, $19775a679e2952df$import$2bf383245f9cd522$1d2e82cebfd4b08).OfflineAccess
                 ] : undefined
             }, this.adapter.requester);
             this.accessTokenMap.set(accessTokenKey, {
@@ -256,11 +268,11 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
                 scope: scope,
                 expiresAt: Math.round(Date.now() / 1000) + expiresIn
             });
-            this.saveAccessTokenMap();
-            this.refreshToken = refreshToken;
+            await this.saveAccessTokenMap();
+            await this.setRefreshToken(refreshToken);
             if (idToken) {
                 await this.verifyIdToken(idToken);
-                this.idToken = idToken;
+                await this.setIdToken(idToken);
             }
             return accessToken;
         } catch (error) {
@@ -286,9 +298,9 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
             throw new (0, $4ec05cedcef20733$export$877962ca249b8fc8)("invalid_id_token", error);
         }
     }
-    saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
-        this.refreshToken = refreshToken ?? null;
-        this.idToken = idToken;
+    async saveCodeToken({ refreshToken: refreshToken , idToken: idToken , scope: scope , accessToken: accessToken , expiresIn: expiresIn  }) {
+        await this.setRefreshToken(refreshToken ?? null);
+        await this.setIdToken(idToken);
         // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)
         const accessTokenKey = (0, $dcfd5d64758ae70b$export$8f595bd2a47bcea6)();
         const expiresAt = Date.now() / 1000 + expiresIn;
@@ -297,27 +309,26 @@ class $19775a679e2952df$export$2e2bcd8739ae039 {
             scope: scope,
             expiresAt: expiresAt
         });
-        this.saveAccessTokenMap();
+        await this.saveAccessTokenMap();
     }
-    saveAccessTokenMap() {
-        if (!this.logtoConfig.persistAccessToken) return;
+    async saveAccessTokenMap() {
         const data = {};
         for (const [key, accessToken] of this.accessTokenMap.entries())// eslint-disable-next-line @silverhand/fp/no-mutation
         data[key] = accessToken;
-        this.adapter.storage.setItem("accessToken", JSON.stringify(data));
+        await this.adapter.storage.setItem("accessToken", JSON.stringify(data));
     }
-    loadAccessTokenMap() {
-        const raw = this.adapter.storage.getItem("accessToken");
+    async loadAccessTokenMap() {
+        const raw = await this.adapter.storage.getItem("accessToken");
         if (!raw) return;
         try {
             const json = JSON.parse(raw);
-            (0, $kqBTI$assert)(json, (0, $50f2bb780a45e70c$export$4ae7b9c313038df5));
+            if (!(0, $50f2bb780a45e70c$export$c12fab42a9a3e2a6)(json)) return;
             this.accessTokenMap.clear();
             for (const [key, accessToken] of Object.entries(json))this.accessTokenMap.set(key, accessToken);
         } catch  {}
     }
-}
+} /* eslint-enable max-lines */ 
 
 
-export {$19775a679e2952df$export$2e2bcd8739ae039 as default, $19775a679e2952df$re_export$LogtoError as LogtoError, $19775a679e2952df$re_export$OidcError as OidcError, $19775a679e2952df$import$5548085c5b0a2ee3$83716a4aa1642908 as Prompt, $19775a679e2952df$re_export$LogtoRequestError as LogtoRequestError, $8449a5dbad0d6387$export$8d54726fdbf08e0a as createRequester, $4ec05cedcef20733$export$877962ca249b8fc8 as LogtoClientError, $50f2bb780a45e70c$export$77bdbaff506443f4 as AccessTokenSchema, $50f2bb780a45e70c$export$7b65a75f516b80e1 as LogtoSignInSessionItemSchema, $50f2bb780a45e70c$export$4ae7b9c313038df5 as LogtoAccessTokenMapSchema};
+export {$19775a679e2952df$export$2e2bcd8739ae039 as default, $19775a679e2952df$re_export$LogtoError as LogtoError, $19775a679e2952df$re_export$OidcError as OidcError, $19775a679e2952df$import$5548085c5b0a2ee3$83716a4aa1642908 as Prompt, $19775a679e2952df$re_export$LogtoRequestError as LogtoRequestError, $8449a5dbad0d6387$export$8d54726fdbf08e0a as createRequester, $19775a679e2952df$import$2bf383245f9cd522$1d2e82cebfd4b08 as ReservedScope, $19775a679e2952df$re_export$UserScope as UserScope, $4ec05cedcef20733$export$877962ca249b8fc8 as LogtoClientError, $50f2bb780a45e70c$export$5d8adf6e063019de as isLogtoSignInSessionItem, $50f2bb780a45e70c$export$c12fab42a9a3e2a6 as isLogtoAccessTokenMap};
 //# sourceMappingURL=module.js.map

package/lib/module.js.map

@@ -1 +1 @@
-{"mappings":";;;;;;;;;AAAA;;;;;;;ACAA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,gBAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;;;;;;ACnCD;AAYO,MAAM,yCAAiB,GAAG,CAAA,GAAA,WAAI,CAAA,CAAC;IACpC,KAAK,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACf,KAAK,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACf,SAAS,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;CACpB,CAAC,AAAC;AAII,MAAM,yCAA4B,GAAG,CAAA,GAAA,WAAI,CAAA,CAAC;IAC/C,WAAW,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACrB,YAAY,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;IACtB,KAAK,EAAE,CAAA,GAAA,aAAM,CAAA,EAAE;CAChB,CAAC,AAAC;AAEI,MAAM,yCAAyB,GAAG,CAAA,GAAA,aAAM,CAAA,CAAC,CAAA,GAAA,aAAM,CAAA,EAAE,EAAE,yCAAiB,CAAC,AAAC;;;AC1B7E;ACAA;AAEO,MAAM,yCAAe,GAAG,CAAC,aAA2B,GAAgB;IACzE,OAAO,OAAU,GAAG,IAAI,AAA0B,GAAiB;QACjE,MAAM,QAAQ,GAAG,MAAM,aAAa,IAAI,IAAI,CAAC,AAAC;QAE9C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,qCAAqC;YACrC,MAAM,QAAE,IAAI,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,AAAC;YACvE,MAAM,IAAI,CAAA,GAAA,6CAAiB,CAAA,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;SAC5C;QAED,OAAO,QAAQ,CAAC,IAAI,EAAK,CAAC;KAC3B,CAAC;CACH,AAAC;;;ADVK,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,oBAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;;;AH8B/B;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAIvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAG/E,YAAY,WAAwB,EAAE,OAAsB,CAAE;QAC5D,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,0DAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,yBAAkB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1D,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,WAAW,CAAC,kBAAkB,EACrC,IAAI,CAAC,kBAAkB,EAAE,CAAC;KAE7B;IAED,IAAW,eAAe,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAC9B;IAED,IAAc,aAAa,GAAqC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,AAAC;QAE/D,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;YAC3C,CAAA,GAAA,aAAM,CAAA,CAAC,IAAI,EAAE,CAAA,GAAA,yCAA4B,CAAA,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC;SACb,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;SAC9D;KACF;IAED,IAAc,aAAa,CAAC,sBAAwD,EAAE;QACpF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEjD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KACzD;IAED,IAAI,YAAY,GAAG;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;KACrD;IAED,IAAY,YAAY,CAAC,YAA8B,EAAE;QACvD,IAAI,CAAC,YAAY,EAAE;YACjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAEhD,OAAO;SACR;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;KAC5D;IAED,IAAI,OAAO,GAAG;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;KACtB;IAED,IAAY,OAAO,CAAC,OAAyB,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,IAAI,CAAC,OAAO,EAAE;YACZ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAE3C,OAAO;SACR;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;KAClD;IAED,sCAAsC;IACtC,MAAa,cAAc,CAAC,QAAiB,EAAmB;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,AAAO,gBAAgB,GAAkB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,oBAAa,CAAA,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,MAAa,MAAM,CAAC,WAAmB,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,AAAC;QACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,AAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,AAAC;QAE3C,MAAM,SAAS,GAAG,CAAA,GAAA,wBAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,IAAI,CAAC,aAAa,GAAG;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;KAClC;IAED,AAAO,kBAAkB,CAAC,GAAW,EAAW;QAC9C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,IAAI,AAAC;QAE/B,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAa,oBAAoB,CAAC,WAAmB,EAAE;QACrD,MAAM,iBAAE,aAAa,CAAA,eAAE,WAAW,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,IAAI,AAAC;QACrD,MAAM,aAAE,SAAS,CAAA,EAAE,GAAG,OAAO,AAAC;QAE9B,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,wCAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,oCAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;KAC3B;IAED,MAAa,OAAO,CAAC,qBAA8B,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EACf,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE9E,IAAI,IAAI,CAAC,YAAY,EACnB,IAAI;YACF,MAAM,CAAA,GAAA,aAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;SACvF,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,yBAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KAC5B;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,YAAY,EACpB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,+BAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY;0BAC/B,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,gBAAgB;iBAAC,GAAG,SAAS;aAClD,EACD,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAE1B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YAEjC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aACxB;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,sBAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KACnE;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,yBAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,oBAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,AAAQ,aAAa,CAAC,gBACpB,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAEvB,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,EAAE,CAAC;KAC3B;IAED,AAAQ,kBAAkB,GAAG;QAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,kBAAkB,EACtC,OAAO;QAGT,MAAM,IAAI,GAAgC,EAAE,AAAC;QAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAC5D,sDAAsD;QACtD,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;QAG1B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;KACnE;IAED,AAAQ,kBAAkB,GAAG;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,AAAC;QAExD,IAAI,CAAC,GAAG,EACN,OAAO;QAGT,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,AAAC;YACtC,CAAA,GAAA,aAAM,CAAA,CAAC,IAAI,EAAE,CAAA,GAAA,yCAAyB,CAAA,CAAC,CAAC;YACxC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;SAE7C,CAAC,OAAM,EAAE;KACX;CACF","sources":["packages/client/src/index.ts","packages/client/src/errors.ts","packages/client/src/types/index.ts","packages/client/src/utils/index.ts","packages/client/src/utils/requester.ts"],"sourcesContent":["import {\n  CodeTokenResponse,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  generateSignInUri,\n  generateSignOutUri,\n  IdTokenClaims,\n  Prompt,\n  revoke,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withReservedScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\nimport { assert } from 'superstruct';\n\nimport { ClientAdapter } from './adapter';\nimport { LogtoClientError } from './errors';\nimport {\n  AccessToken,\n  LogtoAccessTokenMapSchema,\n  LogtoConfig,\n  LogtoSignInSessionItem,\n  LogtoSignInSessionItemSchema,\n} from './types';\nimport { buildAccessTokenKey, getDiscoveryEndpoint } from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode } from '@logto/js';\nexport { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';\nexport * from './errors';\nexport type { Storage, StorageKey, ClientAdapter } from './adapter';\nexport { createRequester } from './utils';\nexport * from './types';\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n\n  protected readonly adapter: ClientAdapter;\n\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n  private _idToken: Nullable<string>;\n\n  constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withReservedScopes(logtoConfig.scopes).split(' '),\n    };\n    this.adapter = adapter;\n    this._idToken = this.adapter.storage.getItem('idToken');\n\n    if (this.logtoConfig.persistAccessToken) {\n      this.loadAccessTokenMap();\n    }\n  }\n\n  public get isAuthenticated() {\n    return Boolean(this.idToken);\n  }\n\n  protected get signInSession(): Nullable<LogtoSignInSessionItem> {\n    const jsonItem = this.adapter.storage.getItem('signInSession');\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    try {\n      const item: unknown = JSON.parse(jsonItem);\n      assert(item, LogtoSignInSessionItemSchema);\n\n      return item;\n    } catch (error: unknown) {\n      throw new LogtoClientError('sign_in_session.invalid', error);\n    }\n  }\n\n  protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      this.adapter.storage.removeItem('signInSession');\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    this.adapter.storage.setItem('signInSession', jsonItem);\n  }\n\n  get refreshToken() {\n    return this.adapter.storage.getItem('refreshToken');\n  }\n\n  private set refreshToken(refreshToken: Nullable<string>) {\n    if (!refreshToken) {\n      this.adapter.storage.removeItem('refreshToken');\n\n      return;\n    }\n\n    this.adapter.storage.setItem('refreshToken', refreshToken);\n  }\n\n  get idToken() {\n    return this._idToken;\n  }\n\n  private set idToken(idToken: Nullable<string>) {\n    this._idToken = idToken;\n\n    if (!idToken) {\n      this.adapter.storage.removeItem('idToken');\n\n      return;\n    }\n\n    this.adapter.storage.setItem('idToken', idToken);\n  }\n\n  // eslint-disable-next-line complexity\n  public async getAccessToken(resource?: string): Promise<string> {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  public getIdTokenClaims(): IdTokenClaims {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(this.idToken);\n  }\n\n  public async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = this.adapter.generateCodeVerifier();\n    const codeChallenge = await this.adapter.generateCodeChallenge(codeVerifier);\n    const state = this.adapter.generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    this.signInSession = { redirectUri, codeVerifier, state };\n    this.refreshToken = null;\n    this.idToken = null;\n\n    this.adapter.navigate(signInUri);\n  }\n\n  public isSignInRedirected(url: string): boolean {\n    const { signInSession } = this;\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  public async handleSignInCallback(callbackUri: string) {\n    const { signInSession, logtoConfig, adapter } = this;\n    const { requester } = adapter;\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n\n    this.saveCodeToken(codeTokenResponse);\n    this.signInSession = null;\n  }\n\n  public async signOut(postLogoutRedirectUri?: string) {\n    if (!this.idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n\n    if (this.refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, this.refreshToken, this.adapter.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken: this.idToken,\n    });\n\n    this.accessTokenMap.clear();\n    this.refreshToken = null;\n    this.idToken = null;\n\n    this.adapter.navigate(url);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    if (!this.refreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: this.refreshToken,\n            resource,\n            scopes: resource ? ['offline_access'] : undefined, // Force remove openid scope from the request\n          },\n          this.adapter.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n      this.saveAccessTokenMap();\n\n      this.refreshToken = refreshToken;\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        this.idToken = idToken;\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.adapter.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    this.refreshToken = refreshToken ?? null;\n    this.idToken = idToken;\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n    this.saveAccessTokenMap();\n  }\n\n  private saveAccessTokenMap() {\n    if (!this.logtoConfig.persistAccessToken) {\n      return;\n    }\n\n    const data: Record<string, AccessToken> = {};\n\n    for (const [key, accessToken] of this.accessTokenMap.entries()) {\n      // eslint-disable-next-line @silverhand/fp/no-mutation\n      data[key] = accessToken;\n    }\n\n    this.adapter.storage.setItem('accessToken', JSON.stringify(data));\n  }\n\n  private loadAccessTokenMap() {\n    const raw = this.adapter.storage.getItem('accessToken');\n\n    if (!raw) {\n      return;\n    }\n\n    try {\n      const json: unknown = JSON.parse(raw);\n      assert(json, LogtoAccessTokenMapSchema);\n      this.accessTokenMap.clear();\n\n      for (const [key, accessToken] of Object.entries(json)) {\n        this.accessTokenMap.set(key, accessToken);\n      }\n    } catch {}\n  }\n}\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { Prompt } from '@logto/js';\nimport { Infer, number, record, string, type } from 'superstruct';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n  persistAccessToken?: boolean;\n};\n\nexport const AccessTokenSchema = type({\n  token: string(),\n  scope: string(),\n  expiresAt: number(),\n});\n\nexport type AccessToken = Infer<typeof AccessTokenSchema>;\n\nexport const LogtoSignInSessionItemSchema = type({\n  redirectUri: string(),\n  codeVerifier: string(),\n  state: string(),\n});\n\nexport const LogtoAccessTokenMapSchema = record(string(), AccessTokenSchema);\n\nexport type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;\n","import { discoveryPath } from '@logto/js';\n\nexport * from './requester';\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n","import { LogtoRequestError, LogtoRequestErrorBody, Requester } from '@logto/js';\n\nexport const createRequester = (fetchFunction: typeof fetch): Requester => {\n  return async <T>(...args: Parameters<typeof fetch>): Promise<T> => {\n    const response = await fetchFunction(...args);\n\n    if (!response.ok) {\n      // Expected request error from server\n      const { code, message } = await response.json<LogtoRequestErrorBody>();\n      throw new LogtoRequestError(code, message);\n    }\n\n    return response.json<T>();\n  };\n};\n"],"names":[],"version":3,"file":"module.js.map"}
+{"mappings":";;;;;;;;;AACA;;;;;;;ACDA;AAGA,MAAM,2CAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE;QACf,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,4BAA4B;KACxC;IACD,iBAAiB,EAAE,oBAAoB;IACvC,wCAAwC,EAAE,8CAA8C;IACxF,sBAAsB,EAAE,6DAA6D;IACrF,gBAAgB,EAAE,mBAAmB;CACtC,CAAC,AAAC;AAIH,MAAM,2CAAqB,GAAG,CAAC,SAA+B,GAAa;IACzE,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAA,GAAA,gBAAG,CAAA,CAAC,2CAAqB,EAAE,SAAS,CAAC,AAAC;IAEtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAC7B,OAAO,OAAO,CAAC;IAGjB,OAAO,SAAS,CAAC;CAClB,AAAC;AAEK,MAAM,yCAAgB,SAAS,KAAK;IAIzC,YAAY,IAA0B,EAAE,IAAc,CAAE;QACtD,KAAK,CAAC,2CAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;KAClB;CACF;;;;;;;ACpCD;AAiBO,MAAM,yCAAwB,GAAG,CAAC,IAAa,GAAqC;IACzF,IAAI,CAAC,CAAA,GAAA,wBAAiB,CAAA,CAAC,IAAI,CAAC,EAC1B,OAAO,KAAK,CAAC;IAGf,OAAO;QAAC,aAAa;QAAE,cAAc;QAAE,OAAO;KAAC,CAAC,KAAK,CAAC,CAAC,GAAG,GAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;CAC/F,AAAC;AAEK,MAAM,yCAAqB,GAAG,CAAC,IAAa,GAA0C;IAC3F,IAAI,CAAC,CAAA,GAAA,wBAAiB,CAAA,CAAC,IAAI,CAAC,EAC1B,OAAO,KAAK,CAAC;IAGf,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAK;QAC1C,IAAI,CAAC,CAAA,GAAA,wBAAiB,CAAA,CAAC,KAAK,CAAC,EAC3B,OAAO,KAAK,CAAC;QAGf,OACE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAC/B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACnC;KACH,CAAC,CAAC;CACJ,AAAC;;;ACzCF;ACAA;AAEO,MAAM,yCAAe,GAAG,CAAC,aAA2B,GAAgB;IACzE,OAAO,OAAU,GAAG,IAAI,AAA0B,GAAiB;QACjE,MAAM,QAAQ,GAAG,MAAM,aAAa,IAAI,IAAI,CAAC,AAAC;QAE9C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,AAAC;YAE3C,IAAI,CAAC,CAAA,GAAA,0BAAmB,CAAA,CAAC,YAAY,CAAC,EACpC,MAAM,IAAI,CAAA,GAAA,sCAAU,CAAA,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;YAGlE,qCAAqC;YACrC,MAAM,QAAE,IAAI,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,YAAY,AAAC;YACvC,MAAM,IAAI,CAAA,GAAA,6CAAiB,CAAA,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;SAC5C;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;KACxB,CAAC;CACH,AAAC;;;ADhBK,MAAM,yCAAmB,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAgB,GAAG,EAAE,GACtE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,AAAC;AAE5C,MAAM,yCAAoB,GAAG,CAAC,QAAgB,GACnD,IAAI,GAAG,CAAC,CAAA,GAAA,oBAAa,CAAA,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,AAAC;;;;;;;;AHkC/B;IAEb,AAAmB,aAAa,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,AAAmB,kBAAkB,GAAG,CAAA,GAAA,iBAAI,CAAA,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEvE,AAAmB,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,AAAiB,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/E,YAAY,WAAwB,EAAE,OAAsB,CAAE;QAC5D,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,WAAW;YACd,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAA,GAAA,0DAAM,CAAA,CAAC,OAAO;YAC5C,MAAM,EAAE,CAAA,GAAA,wBAAiB,CAAA,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;SACzD,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAElB,IAAI,CAAC,kBAAkB,EAAE,CAAC;KAChC;IAED,MAAM,eAAe,GAAG;QACtB,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;KACzC;IAED,MAAM,eAAe,GAAG;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;KACrD;IAED,MAAM,UAAU,GAAG;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KAChD;IAED,sCAAsC;IACtC,MAAM,cAAc,CAAC,QAAiB,EAAmB;QACvD,IAAI,CAAE,MAAM,IAAI,CAAC,UAAU,EAAE,AAAC,EAC5B,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAE5D,IAAI,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAC1D,OAAO,WAAW,CAAC,KAAK,CAAC;QAG3B,8DAA8D;QAC9D,IAAI,WAAW,EACb,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAG7C;;;OAGG,CACH,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,AAAC;QAExE,IAAI,aAAa,EACf,OAAO,aAAa,CAAC;QAGvB;;;;OAIG,CACH,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,AAAC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,MAAM,OAAO,AAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,KAAK,CAAC;KACd;IAED,MAAM,gBAAgB,GAA2B;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,AAAC;QAExC,IAAI,CAAC,OAAO,EACV,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,OAAO,CAAA,GAAA,oBAAa,CAAA,CAAC,OAAO,CAAC,CAAC;KAC/B;IAED,MAAM,aAAa,GAA8B;QAC/C,MAAM,oBAAE,gBAAgB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACxD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,AAAC;QAEhD,IAAI,CAAC,WAAW,EACd,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,wBAAwB,CAAC,CAAC;QAGvD,OAAO,CAAA,GAAA,oBAAa,CAAA,CAAC,gBAAgB,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KAC7E;IAED,MAAM,MAAM,CAAC,WAAmB,EAAE;QAChC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,UAAE,MAAM,CAAA,aAAE,SAAS,CAAA,UAAE,MAAM,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACxE,MAAM,yBAAE,qBAAqB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,AAAC;QACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,AAAC;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,AAAC;QAE3C,MAAM,SAAS,GAAG,CAAA,GAAA,wBAAiB,CAAA,CAAC;mCAClC,qBAAqB;sBACrB,QAAQ;yBACR,WAAW;2BACX,aAAa;mBACb,KAAK;oBACL,MAAM;uBACN,SAAS;oBACT,MAAM;SACP,CAAC,AAAC;QAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC;yBAAE,WAAW;0BAAE,YAAY;mBAAE,KAAK;SAAE,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;KAClC;IAED,MAAM,kBAAkB,CAAC,GAAW,EAAoB;QACtD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,AAAC;QAEpD,IAAI,CAAC,aAAa,EAChB,OAAO,KAAK,CAAC;QAEf,MAAM,eAAE,WAAW,CAAA,EAAE,GAAG,aAAa,AAAC;QACtC,MAAM,UAAE,MAAM,CAAA,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,AAAC;QAE1C,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW,CAAC;KAC/C;IAED,MAAM,oBAAoB,CAAC,WAAmB,EAAE;QAC9C,MAAM,eAAE,WAAW,CAAA,WAAE,OAAO,CAAA,EAAE,GAAG,IAAI,AAAC;QACtC,MAAM,aAAE,SAAS,CAAA,EAAE,GAAG,OAAO,AAAC;QAC9B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,AAAC;QAEpD,IAAI,CAAC,aAAa,EAChB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,2BAA2B,CAAC,CAAC;QAG1D,MAAM,eAAE,WAAW,CAAA,SAAE,KAAK,CAAA,gBAAE,YAAY,CAAA,EAAE,GAAG,aAAa,AAAC;QAC3D,MAAM,IAAI,GAAG,CAAA,GAAA,wCAAiC,CAAA,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,AAAC;QAEhF,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,WAAW,AAAC;QACxC,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAA,GAAA,oCAA6B,CAAA,CAC3D;sBACE,QAAQ;2BACR,aAAa;yBACb,WAAW;0BACX,YAAY;kBACZ,IAAI;SACL,EACD,SAAS,CACV,AAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;KACnC;IAED,MAAM,OAAO,CAAC,qBAA8B,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,AAAC;QAExC,IAAI,CAAC,OAAO,EACV,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QAC7C,MAAM,sBAAE,kBAAkB,CAAA,sBAAE,kBAAkB,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,AAAC;QAElD,IAAI,YAAY,EACd,IAAI;YACF,MAAM,CAAA,GAAA,aAAM,CAAA,CAAC,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;SAClF,CAAC,OAAM;QACN,yGAAyG;SAC1G;QAGH,MAAM,GAAG,GAAG,CAAA,GAAA,yBAAkB,CAAA,CAAC;gCAC7B,kBAAkB;mCAClB,qBAAqB;qBACrB,OAAO;SACR,CAAC,AAAC;QAEH,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KAC5B;IAED,MAAgB,gBAAgB,GAA8C;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,AAAC;QAErE,IAAI,CAAC,QAAQ,EACX,OAAO,IAAI,CAAC;QAGd,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,AAAC;QAE3C,IAAI,CAAC,CAAA,GAAA,yCAAwB,CAAA,CAAC,IAAI,CAAC,EACjC,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,yBAAyB,CAAC,CAAC;QAGxD,OAAO,IAAI,CAAC;KACb;IAED,MAAgB,gBAAgB,CAAC,sBAAwD,EAAE;QACzF,IAAI,CAAC,sBAAsB,EAAE;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAEvD,OAAO;SACR;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,AAAC;QACxD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;KAC/D;IAED,MAAc,UAAU,CAAC,OAAyB,EAAE;QAClD,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAEjD,OAAO;SACR;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;KACxD;IAED,MAAc,eAAe,CAAC,YAA8B,EAAE;QAC5D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAEtD,OAAO;SACR;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;KAClE;IAED,MAAc,4BAA4B,CAAC,QAAiB,EAAmB;QAC7E,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,AAAC;QAEzD,IAAI,CAAC,mBAAmB,EACtB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,mBAAmB,CAAC,CAAC;QAGlD,IAAI;YACF,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,CAAC,QAAQ,CAAC,AAAC;YACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;YAC7C,MAAM,iBAAE,aAAa,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;YACrD,MAAM,eAAE,WAAW,CAAA,gBAAE,YAAY,CAAA,WAAE,OAAO,CAAA,SAAE,KAAK,CAAA,aAAE,SAAS,CAAA,EAAE,GAC5D,MAAM,CAAA,GAAA,+BAAwB,CAAA,CAC5B;0BACE,QAAQ;+BACR,aAAa;gBACb,YAAY,EAAE,mBAAmB;0BACjC,QAAQ;gBACR,MAAM,EAAE,QAAQ,GAAG;oBAAC,CAAA,GAAA,yDAAa,CAAA,CAAC,aAAa;iBAAC,GAAG,SAAS;aAC7D,EACD,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,AAAC;YAEJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtC,KAAK,EAAE,WAAW;uBAClB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS;aACrD,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;YAEzC,IAAI,OAAO,EAAE;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aAChC;YAED,OAAO,WAAW,CAAC;SACpB,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;SAC/E;KACF;IAED,MAAc,cAAc,GAAG;QAC7B,MAAM,YAAE,QAAQ,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACtC,MAAM,iBAAiB,GAAG,CAAA,GAAA,yCAAoB,CAAA,CAAC,QAAQ,CAAC,AAAC;QAEzD,OAAO,CAAA,GAAA,sBAAe,CAAA,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;KACnE;IAED,MAAc,mBAAmB,GAAG;QAClC,MAAM,WAAE,OAAO,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAE/C,OAAO,CAAA,GAAA,yBAAkB,CAAA,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC7C;IAED,MAAc,aAAa,CAAC,OAAe,EAAE;QAC3C,MAAM,SAAE,KAAK,CAAA,EAAE,GAAG,IAAI,CAAC,WAAW,AAAC;QACnC,MAAM,UAAE,MAAM,CAAA,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,AAAC;QAC9C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,AAAC;QAExD,IAAI;YACF,MAAM,CAAA,GAAA,oBAAa,CAAA,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;SAC9D,CAAC,OAAO,KAAK,EAAW;YACvB,MAAM,IAAI,CAAA,GAAA,yCAAgB,CAAA,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;SACvD;KACF;IAED,MAAc,aAAa,CAAC,gBAC1B,YAAY,CAAA,WACZ,OAAO,CAAA,SACP,KAAK,CAAA,eACL,WAAW,CAAA,aACX,SAAS,CAAA,EACS,EAAE;QACpB,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE/B,8EAA8E;QAC9E,MAAM,cAAc,GAAG,CAAA,GAAA,yCAAmB,CAAA,EAAE,AAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,AAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE;YAAE,KAAK,EAAE,WAAW;mBAAE,KAAK;uBAAE,SAAS;SAAE,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;KACjC;IAED,MAAc,kBAAkB,GAAG;QACjC,MAAM,IAAI,GAAgC,EAAE,AAAC;QAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAC5D,sDAAsD;QACtD,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;QAG1B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;KACzE;IAED,MAAc,kBAAkB,GAAG;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,AAAC;QAE9D,IAAI,CAAC,GAAG,EACN,OAAO;QAGT,IAAI;YACF,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,AAAC;YAEtC,IAAI,CAAC,CAAA,GAAA,yCAAqB,CAAA,CAAC,IAAI,CAAC,EAC9B,OAAO;YAET,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;SAE7C,CAAC,OAAM,EAAE;KACX;CACF,CACD,6BAA6B","sources":["packages/client/src/index.ts","packages/client/src/errors.ts","packages/client/src/types/index.ts","packages/client/src/utils/index.ts","packages/client/src/utils/requester.ts"],"sourcesContent":["/* eslint-disable max-lines */\nimport { ReservedScope } from '@logto/core-kit';\nimport {\n  CodeTokenResponse,\n  decodeIdToken,\n  fetchOidcConfig,\n  fetchTokenByAuthorizationCode,\n  fetchTokenByRefreshToken,\n  fetchUserInfo,\n  generateSignInUri,\n  generateSignOutUri,\n  IdTokenClaims,\n  Prompt,\n  revoke,\n  UserInfoResponse,\n  verifyAndParseCodeFromCallbackUri,\n  verifyIdToken,\n  withDefaultScopes,\n} from '@logto/js';\nimport { Nullable } from '@silverhand/essentials';\nimport { createRemoteJWKSet } from 'jose';\nimport once from 'lodash.once';\n\nimport { ClientAdapter } from './adapter';\nimport { LogtoClientError } from './errors';\nimport {\n  AccessToken,\n  isLogtoAccessTokenMap,\n  isLogtoSignInSessionItem,\n  LogtoConfig,\n  LogtoSignInSessionItem,\n} from './types';\nimport { buildAccessTokenKey, getDiscoveryEndpoint } from './utils';\n\nexport type { IdTokenClaims, LogtoErrorCode, UserInfoResponse } from '@logto/js';\nexport { LogtoError, OidcError, Prompt, LogtoRequestError } from '@logto/js';\nexport * from './errors';\nexport type { Storage, StorageKey, ClientAdapter } from './adapter';\nexport { createRequester } from './utils';\nexport * from './types';\nexport { ReservedScope, UserScope } from '@logto/core-kit';\n\nexport default class LogtoClient {\n  protected readonly logtoConfig: LogtoConfig;\n  protected readonly getOidcConfig = once(this._getOidcConfig);\n  protected readonly getJwtVerifyGetKey = once(this._getJwtVerifyGetKey);\n  protected readonly adapter: ClientAdapter;\n  protected readonly accessTokenMap = new Map<string, AccessToken>();\n\n  private readonly getAccessTokenPromiseMap = new Map<string, Promise<string>>();\n\n  constructor(logtoConfig: LogtoConfig, adapter: ClientAdapter) {\n    this.logtoConfig = {\n      ...logtoConfig,\n      prompt: logtoConfig.prompt ?? Prompt.Consent,\n      scopes: withDefaultScopes(logtoConfig.scopes).split(' '),\n    };\n    this.adapter = adapter;\n\n    void this.loadAccessTokenMap();\n  }\n\n  async isAuthenticated() {\n    return Boolean(await this.getIdToken());\n  }\n\n  async getRefreshToken() {\n    return this.adapter.storage.getItem('refreshToken');\n  }\n\n  async getIdToken() {\n    return this.adapter.storage.getItem('idToken');\n  }\n\n  // eslint-disable-next-line complexity\n  async getAccessToken(resource?: string): Promise<string> {\n    if (!(await this.getIdToken())) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const accessTokenKey = buildAccessTokenKey(resource);\n    const accessToken = this.accessTokenMap.get(accessTokenKey);\n\n    if (accessToken && accessToken.expiresAt > Date.now() / 1000) {\n      return accessToken.token;\n    }\n\n    // Since the access token has expired, delete it from the map.\n    if (accessToken) {\n      this.accessTokenMap.delete(accessTokenKey);\n    }\n\n    /**\n     * Need to fetch a new access token using refresh token.\n     * Reuse the cached promise if exists.\n     */\n    const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);\n\n    if (cachedPromise) {\n      return cachedPromise;\n    }\n\n    /**\n     * Create a new promise and cache in map to avoid race condition.\n     * Since we enable \"refresh token rotation\" by default,\n     * it will be problematic when calling multiple `getAccessToken()` closely.\n     */\n    const promise = this.getAccessTokenByRefreshToken(resource);\n    this.getAccessTokenPromiseMap.set(accessTokenKey, promise);\n\n    const token = await promise;\n    this.getAccessTokenPromiseMap.delete(accessTokenKey);\n\n    return token;\n  }\n\n  async getIdTokenClaims(): Promise<IdTokenClaims> {\n    const idToken = await this.getIdToken();\n\n    if (!idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    return decodeIdToken(idToken);\n  }\n\n  async fetchUserInfo(): Promise<UserInfoResponse> {\n    const { userinfoEndpoint } = await this.getOidcConfig();\n    const accessToken = await this.getAccessToken();\n\n    if (!accessToken) {\n      throw new LogtoClientError('fetch_user_info_failed');\n    }\n\n    return fetchUserInfo(userinfoEndpoint, accessToken, this.adapter.requester);\n  }\n\n  async signIn(redirectUri: string) {\n    const { appId: clientId, prompt, resources, scopes } = this.logtoConfig;\n    const { authorizationEndpoint } = await this.getOidcConfig();\n    const codeVerifier = this.adapter.generateCodeVerifier();\n    const codeChallenge = await this.adapter.generateCodeChallenge(codeVerifier);\n    const state = this.adapter.generateState();\n\n    const signInUri = generateSignInUri({\n      authorizationEndpoint,\n      clientId,\n      redirectUri,\n      codeChallenge,\n      state,\n      scopes,\n      resources,\n      prompt,\n    });\n\n    await this.setSignInSession({ redirectUri, codeVerifier, state });\n    await this.setRefreshToken(null);\n    await this.setIdToken(null);\n\n    this.adapter.navigate(signInUri);\n  }\n\n  async isSignInRedirected(url: string): Promise<boolean> {\n    const signInSession = await this.getSignInSession();\n\n    if (!signInSession) {\n      return false;\n    }\n    const { redirectUri } = signInSession;\n    const { origin, pathname } = new URL(url);\n\n    return `${origin}${pathname}` === redirectUri;\n  }\n\n  async handleSignInCallback(callbackUri: string) {\n    const { logtoConfig, adapter } = this;\n    const { requester } = adapter;\n    const signInSession = await this.getSignInSession();\n\n    if (!signInSession) {\n      throw new LogtoClientError('sign_in_session.not_found');\n    }\n\n    const { redirectUri, state, codeVerifier } = signInSession;\n    const code = verifyAndParseCodeFromCallbackUri(callbackUri, redirectUri, state);\n\n    const { appId: clientId } = logtoConfig;\n    const { tokenEndpoint } = await this.getOidcConfig();\n    const codeTokenResponse = await fetchTokenByAuthorizationCode(\n      {\n        clientId,\n        tokenEndpoint,\n        redirectUri,\n        codeVerifier,\n        code,\n      },\n      requester\n    );\n\n    await this.verifyIdToken(codeTokenResponse.idToken);\n    await this.saveCodeToken(codeTokenResponse);\n    await this.setSignInSession(null);\n  }\n\n  async signOut(postLogoutRedirectUri?: string) {\n    const idToken = await this.getIdToken();\n\n    if (!idToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    const { appId: clientId } = this.logtoConfig;\n    const { endSessionEndpoint, revocationEndpoint } = await this.getOidcConfig();\n    const refreshToken = await this.getRefreshToken();\n\n    if (refreshToken) {\n      try {\n        await revoke(revocationEndpoint, clientId, refreshToken, this.adapter.requester);\n      } catch {\n        // Do nothing at this point, as we don't want to break the sign-out flow even if the revocation is failed\n      }\n    }\n\n    const url = generateSignOutUri({\n      endSessionEndpoint,\n      postLogoutRedirectUri,\n      idToken,\n    });\n\n    this.accessTokenMap.clear();\n    await this.setRefreshToken(null);\n    await this.setIdToken(null);\n\n    this.adapter.navigate(url);\n  }\n\n  protected async getSignInSession(): Promise<Nullable<LogtoSignInSessionItem>> {\n    const jsonItem = await this.adapter.storage.getItem('signInSession');\n\n    if (!jsonItem) {\n      return null;\n    }\n\n    const item: unknown = JSON.parse(jsonItem);\n\n    if (!isLogtoSignInSessionItem(item)) {\n      throw new LogtoClientError('sign_in_session.invalid');\n    }\n\n    return item;\n  }\n\n  protected async setSignInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>) {\n    if (!logtoSignInSessionItem) {\n      await this.adapter.storage.removeItem('signInSession');\n\n      return;\n    }\n\n    const jsonItem = JSON.stringify(logtoSignInSessionItem);\n    await this.adapter.storage.setItem('signInSession', jsonItem);\n  }\n\n  private async setIdToken(idToken: Nullable<string>) {\n    if (!idToken) {\n      await this.adapter.storage.removeItem('idToken');\n\n      return;\n    }\n\n    await this.adapter.storage.setItem('idToken', idToken);\n  }\n\n  private async setRefreshToken(refreshToken: Nullable<string>) {\n    if (!refreshToken) {\n      await this.adapter.storage.removeItem('refreshToken');\n\n      return;\n    }\n\n    await this.adapter.storage.setItem('refreshToken', refreshToken);\n  }\n\n  private async getAccessTokenByRefreshToken(resource?: string): Promise<string> {\n    const currentRefreshToken = await this.getRefreshToken();\n\n    if (!currentRefreshToken) {\n      throw new LogtoClientError('not_authenticated');\n    }\n\n    try {\n      const accessTokenKey = buildAccessTokenKey(resource);\n      const { appId: clientId } = this.logtoConfig;\n      const { tokenEndpoint } = await this.getOidcConfig();\n      const { accessToken, refreshToken, idToken, scope, expiresIn } =\n        await fetchTokenByRefreshToken(\n          {\n            clientId,\n            tokenEndpoint,\n            refreshToken: currentRefreshToken,\n            resource,\n            scopes: resource ? [ReservedScope.OfflineAccess] : undefined, // Force remove openid scope from the request\n          },\n          this.adapter.requester\n        );\n\n      this.accessTokenMap.set(accessTokenKey, {\n        token: accessToken,\n        scope,\n        expiresAt: Math.round(Date.now() / 1000) + expiresIn,\n      });\n\n      await this.saveAccessTokenMap();\n      await this.setRefreshToken(refreshToken);\n\n      if (idToken) {\n        await this.verifyIdToken(idToken);\n        await this.setIdToken(idToken);\n      }\n\n      return accessToken;\n    } catch (error: unknown) {\n      throw new LogtoClientError('get_access_token_by_refresh_token_failed', error);\n    }\n  }\n\n  private async _getOidcConfig() {\n    const { endpoint } = this.logtoConfig;\n    const discoveryEndpoint = getDiscoveryEndpoint(endpoint);\n\n    return fetchOidcConfig(discoveryEndpoint, this.adapter.requester);\n  }\n\n  private async _getJwtVerifyGetKey() {\n    const { jwksUri } = await this.getOidcConfig();\n\n    return createRemoteJWKSet(new URL(jwksUri));\n  }\n\n  private async verifyIdToken(idToken: string) {\n    const { appId } = this.logtoConfig;\n    const { issuer } = await this.getOidcConfig();\n    const jwtVerifyGetKey = await this.getJwtVerifyGetKey();\n\n    try {\n      await verifyIdToken(idToken, appId, issuer, jwtVerifyGetKey);\n    } catch (error: unknown) {\n      throw new LogtoClientError('invalid_id_token', error);\n    }\n  }\n\n  private async saveCodeToken({\n    refreshToken,\n    idToken,\n    scope,\n    accessToken,\n    expiresIn,\n  }: CodeTokenResponse) {\n    await this.setRefreshToken(refreshToken ?? null);\n    await this.setIdToken(idToken);\n\n    // NOTE: Will add scope to accessTokenKey when needed. (Linear issue LOG-1589)\n    const accessTokenKey = buildAccessTokenKey();\n    const expiresAt = Date.now() / 1000 + expiresIn;\n    this.accessTokenMap.set(accessTokenKey, { token: accessToken, scope, expiresAt });\n    await this.saveAccessTokenMap();\n  }\n\n  private async saveAccessTokenMap() {\n    const data: Record<string, AccessToken> = {};\n\n    for (const [key, accessToken] of this.accessTokenMap.entries()) {\n      // eslint-disable-next-line @silverhand/fp/no-mutation\n      data[key] = accessToken;\n    }\n\n    await this.adapter.storage.setItem('accessToken', JSON.stringify(data));\n  }\n\n  private async loadAccessTokenMap() {\n    const raw = await this.adapter.storage.getItem('accessToken');\n\n    if (!raw) {\n      return;\n    }\n\n    try {\n      const json: unknown = JSON.parse(raw);\n\n      if (!isLogtoAccessTokenMap(json)) {\n        return;\n      }\n      this.accessTokenMap.clear();\n\n      for (const [key, accessToken] of Object.entries(json)) {\n        this.accessTokenMap.set(key, accessToken);\n      }\n    } catch {}\n  }\n}\n/* eslint-enable max-lines */\n","import { NormalizeKeyPaths } from '@silverhand/essentials';\nimport get from 'lodash.get';\n\nconst logtoClientErrorCodes = Object.freeze({\n  sign_in_session: {\n    invalid: 'Invalid sign-in session.',\n    not_found: 'Sign-in session not found.',\n  },\n  not_authenticated: 'Not authenticated.',\n  get_access_token_by_refresh_token_failed: 'Failed to get access token by refresh token.',\n  fetch_user_info_failed: 'Unable to fetch user info. The access token may be invalid.',\n  invalid_id_token: 'Invalid id token.',\n});\n\nexport type LogtoClientErrorCode = NormalizeKeyPaths<typeof logtoClientErrorCodes>;\n\nconst getMessageByErrorCode = (errorCode: LogtoClientErrorCode): string => {\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment\n  const message = get(logtoClientErrorCodes, errorCode);\n\n  if (typeof message === 'string') {\n    return message;\n  }\n\n  return errorCode;\n};\n\nexport class LogtoClientError extends Error {\n  code: LogtoClientErrorCode;\n  data: unknown;\n\n  constructor(code: LogtoClientErrorCode, data?: unknown) {\n    super(getMessageByErrorCode(code));\n    this.code = code;\n    this.data = data;\n  }\n}\n","import { isArbitraryObject, Prompt } from '@logto/js';\n\nexport type LogtoConfig = {\n  endpoint: string;\n  appId: string;\n  appSecret?: string;\n  scopes?: string[];\n  resources?: string[];\n  prompt?: Prompt;\n};\n\nexport type AccessToken = {\n  token: string;\n  scope: string;\n  expiresAt: number;\n};\n\nexport const isLogtoSignInSessionItem = (data: unknown): data is LogtoSignInSessionItem => {\n  if (!isArbitraryObject(data)) {\n    return false;\n  }\n\n  return ['redirectUri', 'codeVerifier', 'state'].every((key) => typeof data[key] === 'string');\n};\n\nexport const isLogtoAccessTokenMap = (data: unknown): data is Record<string, AccessToken> => {\n  if (!isArbitraryObject(data)) {\n    return false;\n  }\n\n  return Object.values(data).every((value) => {\n    if (!isArbitraryObject(value)) {\n      return false;\n    }\n\n    return (\n      typeof value.token === 'string' &&\n      typeof value.scope === 'string' &&\n      typeof value.expiresAt === 'number'\n    );\n  });\n};\n\nexport type LogtoSignInSessionItem = {\n  redirectUri: string;\n  codeVerifier: string;\n  state: string;\n};\n","import { discoveryPath } from '@logto/js';\n\nexport * from './requester';\n\nexport const buildAccessTokenKey = (resource = '', scopes: string[] = []): string =>\n  `${scopes.slice().sort().join(' ')}@${resource}`;\n\nexport const getDiscoveryEndpoint = (endpoint: string): string =>\n  new URL(discoveryPath, endpoint).toString();\n","import { LogtoError, LogtoRequestError, isLogtoRequestError, Requester } from '@logto/js';\n\nexport const createRequester = (fetchFunction: typeof fetch): Requester => {\n  return async <T>(...args: Parameters<typeof fetch>): Promise<T> => {\n    const response = await fetchFunction(...args);\n\n    if (!response.ok) {\n      const responseJson = await response.json();\n\n      if (!isLogtoRequestError(responseJson)) {\n        throw new LogtoError('unexpected_response_error', responseJson);\n      }\n\n      // Expected request error from server\n      const { code, message } = responseJson;\n      throw new LogtoRequestError(code, message);\n    }\n\n    return response.json();\n  };\n};\n"],"names":[],"version":3,"file":"module.js.map"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/client",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0-beta.10",
   "source": "./src/index.ts",
   "main": "./lib/index.js",
   "exports": {
@@ -29,36 +29,36 @@
     "prepack": "pnpm test"
   },
   "dependencies": {
-    "@logto/js": "^1.0.0-beta.0",
-    "@silverhand/essentials": "^1.1.6",
+    "@logto/core-kit": "1.0.0-beta.19",
+    "@logto/js": "^1.0.0-beta.10",
+    "@silverhand/essentials": "^1.2.1",
     "camelcase-keys": "^7.0.1",
     "jose": "^4.3.8",
     "lodash.get": "^4.4.2",
-    "lodash.once": "^4.1.1",
-    "superstruct": "^0.16.0"
+    "lodash.once": "^4.1.1"
   },
   "devDependencies": {
     "@jest/types": "^27.5.1",
-    "@parcel/core": "^2.6.2",
-    "@parcel/packager-ts": "^2.6.2",
-    "@parcel/transformer-typescript-types": "^2.6.2",
-    "@silverhand/eslint-config": "^0.17.0",
-    "@silverhand/ts-config": "^0.17.0",
+    "@parcel/core": "^2.7.0",
+    "@parcel/packager-ts": "^2.7.0",
+    "@parcel/transformer-typescript-types": "^2.7.0",
+    "@silverhand/eslint-config": "^1.0.0",
+    "@silverhand/ts-config": "^1.0.0",
     "@types/jest": "^27.4.1",
     "@types/lodash.get": "^4.4.6",
     "@types/lodash.once": "^4.1.7",
     "@types/node": "^17.0.19",
-    "eslint": "^8.9.0",
+    "eslint": "^8.23.0",
     "jest": "^27.5.1",
     "jest-matcher-specific-error": "^1.0.0",
     "lint-staged": "^13.0.0",
     "nock": "^13.1.3",
-    "parcel": "^2.6.2",
-    "prettier": "^2.3.2",
+    "parcel": "^2.7.0",
+    "prettier": "^2.7.1",
     "text-encoder": "^0.0.4",
     "ts-jest": "^27.0.4",
-    "type-fest": "^2.10.0",
-    "typescript": "^4.5.5"
+    "type-fest": "^3.0.0",
+    "typescript": "4.7.4"
   },
   "eslintConfig": {
     "extends": "@silverhand"
@@ -67,5 +67,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "f0f78e6f0b97174de98588b35d1d12c8396206ba"
+  "gitHead": "c79c3759b7f15c44bf5b476dcebd82e9c96e9dd8"
 }