@naylence/agent-sdk 0.3.4-test.722 → 0.3.4-test.724

package/dist/browser/index.js

@@ -15671,12 +15671,12 @@
     // --- END ENV SHIM ---
 
     // This file is auto-generated during build - do not edit manually
-    // Generated from package.json version: 0.3.5-test.924
+    // Generated from package.json version: 0.3.5-test.926
     /**
      * The package version, injected at build time.
      * @internal
      */
-    const VERSION$1 = '0.3.5-test.924';
+    const VERSION$1 = '0.3.5-test.926';
 
     /**
      * Fame protocol specific error classes with WebSocket close codes and proper inheritance.
@@ -48842,7 +48842,7 @@
             }
             if (!certificateManager) {
                 certificateManager =
-                    await DefaultSecurityManagerFactory.createCertificateManagerFromConfig(config, policy);
+                    await DefaultSecurityManagerFactory.createCertificateManagerFromConfig(config, policy, trustStoreProvider);
             }
             return new DefaultSecurityManager(policy, envelopeSigner, envelopeVerifier, encryptionManager, keyManager, authorizer, certificateManager, secureChannelManager, keyValidator ?? null);
         }
@@ -49098,7 +49098,7 @@
                 throw error instanceof Error ? error : new Error(String(error));
             }
         }
-        static async createCertificateManagerFromConfig(config, policy) {
+        static async createCertificateManagerFromConfig(config, policy, trustStoreProvider) {
             const certificateConfig = config.certificate_manager ?? null;
             if (certificateConfig &&
                 DefaultSecurityManagerFactory.isConfigLike(certificateConfig)) {
@@ -49111,8 +49111,12 @@
                     return null;
                 }
                 const signing = policy.signing ?? null;
+                const trustStorePem = trustStoreProvider
+                    ? async () => await trustStoreProvider.getTrustStorePem()
+                    : null;
                 return await CertificateManagerFactory.createCertificateManager(null, {
                     signing: signing ?? null,
+                    factoryArgs: trustStorePem ? [trustStorePem] : [],
                 });
             }
             catch (error) {
@@ -52955,14 +52959,18 @@
         }
         return Math.max(1, Math.floor(value));
     }
+    /**
+     * In-memory token cache for PKCE tokens.
+     *
+     * Tokens are intentionally NOT persisted to localStorage or sessionStorage to avoid
+     * stale-token issues when the OAuth2 server restarts and generates new signing keys.
+     * Each fresh page load triggers a new PKCE flow when a token is needed.
+     */
+    let inMemoryTokenCache = new Map();
     const STORAGE_NAMESPACE = 'naylence.oauth2_pkce.';
-    const TOKEN_STORAGE_SUFFIX = '.token';
     function getStorageKey(clientId) {
         return `${STORAGE_NAMESPACE}${clientId}`;
     }
-    function getTokenStorageKey(clientId) {
-        return `${STORAGE_NAMESPACE}${clientId}${TOKEN_STORAGE_SUFFIX}`;
-    }
     function isBrowserEnvironment() {
         return (typeof window !== 'undefined' &&
             typeof window.location !== 'undefined' &&
@@ -53014,57 +53022,23 @@
         }
         return [...scopes].sort().join(' ');
     }
+    /**
+     * Read token from in-memory cache.
+     * Returns null if no cached token exists for the given clientId.
+     */
     function readPersistedToken(clientId) {
-        if (!isBrowserEnvironment()) {
-            return null;
-        }
-        try {
-            const raw = window.sessionStorage.getItem(getTokenStorageKey(clientId));
-            if (!raw) {
-                return null;
-            }
-            const parsed = JSON.parse(raw);
-            const value = coerceString(parsed.value);
-            if (!value) {
-                return null;
-            }
-            const expiresAt = coerceNumber(parsed.expiresAt);
-            const scopes = normalizeScopes(parsed.scopes);
-            const audience = coerceString(parsed.audience);
-            const record = {
-                value,
-                scopes,
-                audience,
-            };
-            if (typeof expiresAt === 'number') {
-                record.expiresAt = expiresAt;
-            }
-            return record;
-        }
-        catch (error) {
-            logger$r.debug('pkce_token_storage_read_failed', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            return null;
-        }
+        return inMemoryTokenCache.get(clientId) ?? null;
     }
+    /**
+     * Write token to in-memory cache.
+     * If token is null, removes the cached token for the given clientId.
+     */
     function writePersistedToken(clientId, token) {
-        if (!isBrowserEnvironment()) {
+        if (!token) {
+            inMemoryTokenCache.delete(clientId);
             return;
         }
-        const key = getTokenStorageKey(clientId);
-        try {
-            if (!token) {
-                window.sessionStorage.removeItem(key);
-                return;
-            }
-            window.sessionStorage.setItem(key, JSON.stringify(token));
-        }
-        catch (error) {
-            logger$r.debug('pkce_token_storage_write_failed', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-        }
+        inMemoryTokenCache.set(clientId, token);
     }
     function clearOAuthParamsFromUrl(url) {
         if (!isBrowserEnvironment()) {
@@ -53365,6 +53339,17 @@
             });
             return token;
         }
+        /**
+         * Clear the cached token for this provider instance.
+         * This clears both the instance cache and the in-memory module cache.
+         */
+        clearToken() {
+            this.cachedToken = undefined;
+            writePersistedToken(this.options.clientId, null);
+            logger$r.debug('oauth2_pkce_token_cleared', {
+                authorize_url: this.options.authorizeUrl,
+            });
+        }
     }
 
     var oauth2PkceTokenProvider = /*#__PURE__*/Object.freeze({