@pofsis-nbt/pofsis-auth 1.1.0 → 1.2.0

package/Documentation.md

@@ -1,6 +1,6 @@
 # POFSIS Auth Documentation
 
-This is the complete public API and integration reference for `@pofsis-nbt/pofsis-auth@1.1.0`.
+This is the complete public API and integration reference for `@pofsis-nbt/pofsis-auth@1.2.0`.
 
 The repository also includes an interactive [POFSIS Auth documentation portal](./index.html) with required environment configuration, generated setup examples, and authentication scenario links. The portal does not persist or transmit entered values and is intentionally excluded from the npm package.
 

package/dist/PofsisAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PofsisAuth.d.ts","sourceRoot":"","sources":["../src/PofsisAuth.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAGR,eAAe,EAGlB,MAAM,SAAS,CAAA;AAgMhB,wBAAgB,UAAU,CAAC,EACvB,QAAQ,EACR,OAAO,EACP,UAAU,EACV,OAAO,EACP,KAAK,EACL,YAAY,EACZ,KAAK,EACL,aAAmB,EACnB,UAAU,GACb,EAAE,eAAe,+BAiCjB"}
+{"version":3,"file":"PofsisAuth.d.ts","sourceRoot":"","sources":["../src/PofsisAuth.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAGR,eAAe,EAGlB,MAAM,SAAS,CAAA;AAiMhB,wBAAgB,UAAU,CAAC,EACvB,QAAQ,EACR,OAAO,EACP,UAAU,EACV,OAAO,EACP,KAAK,EACL,YAAY,EACZ,KAAK,EACL,aAAmB,EACnB,UAAU,GACb,EAAE,eAAe,+BAiCjB"}

package/dist/PofsisAuthClient-CRYYsJYc.cjs

@@ -0,0 +1,2 @@
+async function e(e){if(e.status===204)return null;let t=await e.text();return t?JSON.parse(t):null}async function t(t,n,r){let i=await fetch(`${t.apiBaseUrl}${n}`,{credentials:`include`,...r,headers:{Accept:`application/json`,...r?.body&&!(r.body instanceof FormData)?{"Content-Type":`application/json`}:{},...r?.headers}});if(!i.ok){let e=Error(`Auth API ${n} failed (${i.status})`);throw e.status=i.status,e}return{status:i.status,data:await e(i)}}async function n(e){let{data:n}=await t(e,`/oauth/clients/${encodeURIComponent(e.appName.toUpperCase())}?origin=${encodeURIComponent(window.location.origin)}`);return n}async function r(e,n,r,i){let{data:a}=await t(e,`/oauth/token`,{method:`POST`,body:JSON.stringify({grant_type:`authorization_code`,client_id:i.client_id,redirect_uri:i.redirect_uri,code:n,code_verifier:r})});return a}async function i(e,n){let{data:r}=await t(e,`/oauth/token`,{method:`POST`,body:JSON.stringify({grant_type:`refresh_token`,client_id:n})});return r||null}async function a(e){try{return await t(e,`/auth/session`),!0}catch{return!1}}async function o(e){await t(e,`/auth/logout`,{method:`POST`})}async function s(e,n){let{data:r}=await t(e,`/auth/profile/me`,{headers:{Authorization:`Bearer ${n}`}});return r}async function c(e,n,r){let{data:i}=await t(e,`/auth/profile/me`,{method:`PATCH`,headers:{Authorization:`Bearer ${n}`},body:JSON.stringify(r)});return i}async function l(e,n,r,i){let a=new FormData;a.append(`file`,i);let{data:o}=await t(e,`/auth/profile/me/images/${r}`,{method:`POST`,headers:{Authorization:`Bearer ${n}`},body:a});return o}async function u(e,n,r){let{data:i}=await t(e,`/auth/profile/me/images/${r}`,{method:`DELETE`,headers:{Authorization:`Bearer ${n}`}});return i}function d(e){return e.replace(/\/$/,``)}function f(e={}){let t=e.appName?.trim(),n=e.apiBaseUrl?.trim(),r=e.authUrl?.trim(),i=e.scope?.trim()||`openid profile email`,a=e.callbackPath?.trim()||`/auth/callback`,o={width:e.popup?.width??480,height:e.popup?.height??720,name:e.popup?.name?.trim()||`pofsis-auth`,timeoutMs:e.popup?.timeoutMs??3e5},s=[];if(t||s.push(`appName`),n||s.push(`apiBaseUrl`),r||s.push(`authUrl`),s.length)throw Error(`@pofsis-nbt/pofsis-auth missing config: ${s.join(`, `)}`);if(!t||!n||!r)throw Error(`@pofsis-nbt/pofsis-auth missing config`);if(!a.startsWith(`/`)||a.startsWith(`//`))throw Error(`@pofsis-nbt/pofsis-auth callbackPath must be application-relative`);if(o.width<=0||o.height<=0||o.timeoutMs<=0)throw Error(`@pofsis-nbt/pofsis-auth popup dimensions and timeout must be positive`);return{appName:t,apiBaseUrl:d(n),authUrl:d(r),scope:i,callbackPath:a,popup:o}}var p=/^[^\s@]+@[^\s@]+\.[^\s@]+$/,m=/^(?:\+63|63|0)?9\d{9}$/,h=new Set([`password`,`passkey`,`otp`]),g=new Set([`login`,`signup`,`reset`]),_=320;function v(e,t=!1){let n=typeof e==`string`?e.trim():``;if(!n||n.length>_)return;if(p.test(n))return n.toLowerCase();let r=n.replace(/[\s()-]/g,``);if(!t&&m.test(r))return`+63${r.replace(/^(?:\+63|63|0)/,``)}`}function y(e,t=`login`){let n=typeof e==`string`?{returnUrl:e}:e||{},r=n.screen===`register`?`signup`:n.screen,i=g.has(r)?r:t,a=h.has(n.method)?n.method:void 0,o=i===`login`||i===`signup`&&(a===`password`||a===`otp`)?a:void 0;return{returnUrl:n.returnUrl,screen:i,loginHint:v(n.loginHint),method:o}}function b(e){let t=new URLSearchParams(e),n=t.get(`login_hint`),r=n===null?v(t.get(`email`),!0):v(n);return y({screen:t.get(`screen`)||void 0,loginHint:r,method:t.get(`method`)||void 0})}function x({authUrl:e,appName:t,query:n,options:r}){let i=y(r),a=new URL(e);if(a.search=n.toString(),i.loginHint&&a.searchParams.set(`login_hint`,i.loginHint),i.screen===`login`&&i.method&&a.searchParams.set(`method`,i.method),i.screen===`login`)return a.toString();let o=i.screen===`signup`?`/signup`:`/forgot-password`,s=new URL(o,a);return s.searchParams.set(`app`,t),s.searchParams.set(`return_to`,`${a.pathname}${a.search}`),i.loginHint&&s.searchParams.set(`login_hint`,i.loginHint),i.screen===`signup`&&s.searchParams.set(`method`,i.method||`password`),s.toString()}var S=`pofsis-auth:callback`;function C(e){if(!e)return;let t=e.indexOf(`.`);return t>0?e.slice(0,t):void 0}function w(e=window.location.origin){let t=window.opener&&!window.opener.closed?window.opener:window.parent===window?null:window.parent;if(!t)return!1;let n=new URLSearchParams(window.location.search),r=n.get(`state`)||void 0,i={type:S,code:n.get(`code`)||void 0,state:r,error:n.get(`error`)||void 0,correlationId:C(r||null)};return t.postMessage(i,e),t===window.opener&&window.close(),!0}var T=e=>btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/,``),E=()=>T(crypto.getRandomValues(new Uint8Array(32)));async function D(e){return T(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e))))}var O=e=>e?.startsWith(`/`)&&!e.startsWith(`//`)?e:void 0,k=e=>({token_type:e.token_type,expires_in:e.expires_in,user:e.user}),A=class{config;token=null;session=null;client=null;clientPromise=null;refreshPromise=null;subscribers=new Set;attempt=null;iframeAttempt=null;listening=!1;constructor(e){this.config=f(e),this.attach()}attach(){this.listening||=(window.addEventListener(`message`,this.onPopupMessage),!0)}destroy(){window.removeEventListener(`message`,this.onPopupMessage),this.listening=!1;let e=this.finishAttempt();e&&(e.popup.close(),e.resolve({status:`cancelled`})),this.cancelIframeLogin(),this.subscribers.clear()}getUser(){return this.session?.user??null}getSession(){return this.session}getAccessToken(){return this.token}subscribe(e){return this.attach(),this.subscribers.add(e),e(this.session),()=>{this.subscribers.delete(e)}}emit(){for(let e of this.subscribers)e(this.session)}accept(e){this.token=e.access_token,this.session=k(e),this.emit()}loadClient(){return this.clientPromise||=n(this.config).then(e=>this.client=e).catch(e=>{throw this.clientPromise=null,e}),this.clientPromise}getOAuthClient(){return this.loadClient()}async refreshSession(){let e=await this.loadClient();return this.refreshPromise||=i(this.config,e.client_id).then(e=>{e?this.accept(e):this.clearSession()}).finally(()=>this.refreshPromise=null),this.refreshPromise}async isRemoteSessionActive(){return a(this.config)}clearSession(){this.token=null,this.session=null,this.emit()}replaceUser(e){this.session&&(this.session={...this.session,user:e},this.emit())}async logout(){try{await o(this.config)}finally{this.clearSession()}}signup(e={}){return this.login({...e,screen:`signup`})}resetPassword(e={}){return this.login({...e,screen:`reset`})}async login(e={}){let t=y(e),n=e.presentation??`popup`;return n===`popup`?this.openPopup({...e,...t}):n===`iframe`?this.openIframe({...e,...t}):this.startRedirect({...e,...t})}cancelIframeLogin(){this.finishIframeAttempt()?.resolve({status:`cancelled`})}openIframe(e){let t=e.target;if(!t)return Promise.reject(Error(`POFSIS Auth iframe target is required.`));this.cancelIframeLogin();let n=E(),r=`${n}.${E()}`,i=E(),a=O(e.returnUrl);return new Promise((o,s)=>{let c=setTimeout(()=>{this.finishIframeAttempt()?.reject(Error(`POFSIS Auth iframe timed out.`))},this.config.popup.timeoutMs);this.iframeAttempt={frame:t,state:r,verifier:i,correlationId:n,returnUrl:a,resolve:o,reject:s,timeout:c},this.authorizationUrl(e,r,i).then(e=>t.contentWindow?.location.replace(e)).catch(e=>{this.finishIframeAttempt()?.reject(e instanceof Error?e:Error(String(e)))})})}async authorizationUrl(e,t,n){let r=await this.loadClient(),i=new URLSearchParams({app:this.config.appName.toUpperCase(),client_id:r.client_id,redirect_uri:r.redirect_uri,response_type:`code`,scope:this.config.scope,state:t,code_challenge:await D(n),code_challenge_method:`S256`});return x({authUrl:this.config.authUrl,appName:this.config.appName.toUpperCase(),query:i,options:e})}storageKey(e){return`${this.config.appName.toLowerCase()}.auth.${e}`}async startRedirect(e){let t=E(),n=E();sessionStorage.setItem(this.storageKey(`state`),t),sessionStorage.setItem(this.storageKey(`verifier`),n);let r=O(e.returnUrl);return r?sessionStorage.setItem(this.storageKey(`return-path`),r):sessionStorage.removeItem(this.storageKey(`return-path`)),window.location.assign(await this.authorizationUrl(e,t,n)),{status:`redirecting`}}async openPopup(e){if(this.attempt&&!this.attempt.popup.closed)return this.attempt.popup.focus(),new Promise((e,t)=>{let n=this.attempt,r=n.resolve,i=n.reject;n.resolve=t=>{r(t),e(t)},n.reject=e=>{i(e),t(e)}});let{width:t,height:n,name:r,timeoutMs:i}=this.config.popup,a=Math.max(0,window.screenX+(window.outerWidth-t)/2),o=Math.max(0,window.screenY+(window.outerHeight-n)/2),s=window.open(`about:blank`,r,`popup=yes,width=${t},height=${n},left=${Math.round(a)},top=${Math.round(o)}`);if(!s)return this.startRedirect({...e,presentation:`redirect`});let c=E(),l=`${c}.${E()}`,u=E(),d=O(e.returnUrl);return new Promise((t,n)=>{let r=setInterval(()=>{s.closed&&this.finishAttempt()?.resolve({status:`cancelled`})},250),a=setTimeout(()=>{let e=this.finishAttempt();s.close(),e?.reject(Error(`POFSIS Auth popup timed out.`))},i);this.attempt={popup:s,state:l,verifier:u,correlationId:c,returnUrl:d,resolve:t,reject:n,timer:r,timeout:a},this.authorizationUrl(e,l,u).then(e=>s.location.replace(e)).catch(e=>{let t=this.finishAttempt();s.close(),t?.reject(e instanceof Error?e:Error(String(e)))})})}finishAttempt(){let e=this.attempt;return e?(clearInterval(e.timer),clearTimeout(e.timeout),this.attempt=null,e):null}finishIframeAttempt(){let e=this.iframeAttempt;return e?(clearTimeout(e.timeout),this.iframeAttempt=null,e):null}onPopupMessage=e=>{let t=this.iframeAttempt;if(t&&e.origin===window.location.origin&&e.source===t.frame.contentWindow&&e.data?.type===`pofsis-auth:callback`&&e.data.correlationId===t.correlationId&&C(e.data.state||null)===t.correlationId&&e.data.state===t.state){let t=this.finishIframeAttempt();if(e.data.error||!e.data.code){t.reject(Error(e.data.error||`POFSIS Auth callback was incomplete.`));return}this.completeCode(e.data.code,e.data.state,t.verifier).then(()=>t.resolve({status:`authenticated`,user:this.getUser()})).catch(e=>t.reject(e instanceof Error?e:Error(String(e))));return}let n=this.attempt,r=e.data;if(!n||e.origin!==window.location.origin||e.source!==n.popup||r?.type!==`pofsis-auth:callback`||r.correlationId!==n.correlationId||C(r.state||null)!==n.correlationId||r.state!==n.state)return;let i=this.finishAttempt();if(i){if(r.error||!r.code){i.popup.close(),i.reject(Error(r.error||`POFSIS Auth callback was incomplete.`));return}this.completeCode(r.code,r.state,i.verifier).then(()=>{i.popup.close(),i.returnUrl&&window.history.replaceState(null,``,i.returnUrl),i.resolve({status:`authenticated`,user:this.getUser()})}).catch(e=>{i.popup.close(),i.reject(e instanceof Error?e:Error(String(e)))})}};async completeCode(e,t,n){if(!t||!n)throw Error(`Authentication state could not be verified.`);let i=await this.loadClient();this.accept(await r(this.config,e,n,i))}async completeRedirectCallback(e,t){let n=sessionStorage.getItem(this.storageKey(`state`)),r=sessionStorage.getItem(this.storageKey(`verifier`));if(sessionStorage.removeItem(this.storageKey(`state`)),sessionStorage.removeItem(this.storageKey(`verifier`)),!n||!r||t!==n)throw Error(`Authentication state could not be verified.`);await this.completeCode(e,t,r)}};function j(e){return new A(e)}Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return b}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return j}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return A}});
+//# sourceMappingURL=PofsisAuthClient-CRYYsJYc.cjs.map

package/dist/PofsisAuthClient-CRYYsJYc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PofsisAuthClient-CRYYsJYc.cjs","names":[],"sources":["../src/auth/api.ts","../src/auth/config.ts","../src/auth/authLaunch.ts","../src/core/popupProtocol.ts","../src/auth/pkce.ts","../src/core/PofsisAuthClient.ts"],"sourcesContent":["import type { AccountProfile, OAuthClientConfig, PofsisAuthConfig, TokenResponse } from '../types'\n\nasync function parseJson<T>(response: Response): Promise<T> {\n    if (response.status === 204) return null as T\n    const text = await response.text()\n    if (!text) return null as T\n    return JSON.parse(text) as T\n}\n\nasync function request<T>(\n    config: PofsisAuthConfig,\n    path: string,\n    init?: RequestInit,\n): Promise<{ status: number; data: T }> {\n    const response = await fetch(`${config.apiBaseUrl}${path}`, {\n        credentials: 'include',\n        ...init,\n        headers: {\n            Accept: 'application/json',\n            ...(init?.body && !(init.body instanceof FormData)\n                ? { 'Content-Type': 'application/json' }\n                : {}),\n            ...init?.headers,\n        },\n    })\n    if (!response.ok) {\n        const error = new Error(`Auth API ${path} failed (${response.status})`)\n        ;(error as Error & { status?: number }).status = response.status\n        throw error\n    }\n    return { status: response.status, data: await parseJson<T>(response) }\n}\n\nexport async function fetchOAuthClient(config: PofsisAuthConfig) {\n    const identity = encodeURIComponent(config.appName.toUpperCase())\n    const origin = encodeURIComponent(window.location.origin)\n    const { data } = await request<OAuthClientConfig>(\n        config,\n        `/oauth/clients/${identity}?origin=${origin}`,\n    )\n    return data\n}\n\nexport async function exchangeCode(\n    config: PofsisAuthConfig,\n    code: string,\n    verifier: string,\n    client: Pick<OAuthClientConfig, 'client_id' | 'redirect_uri'>,\n) {\n    const { data } = await request<TokenResponse>(config, '/oauth/token', {\n        method: 'POST',\n        body: JSON.stringify({\n            grant_type: 'authorization_code',\n            client_id: client.client_id,\n            redirect_uri: client.redirect_uri,\n            code,\n            code_verifier: verifier,\n        }),\n    })\n    return data\n}\n\nexport async function refresh(config: PofsisAuthConfig, clientId: string) {\n    const { data } = await request<TokenResponse | null>(config, '/oauth/token', {\n        method: 'POST',\n        body: JSON.stringify({\n            grant_type: 'refresh_token',\n            client_id: clientId,\n        }),\n    })\n    return data || null\n}\n\nexport async function checkSession(config: PofsisAuthConfig) {\n    try {\n        await request(config, '/auth/session')\n        return true\n    } catch {\n        return false\n    }\n}\n\nexport async function signOut(config: PofsisAuthConfig) {\n    await request(config, '/auth/logout', { method: 'POST' })\n}\n\nexport async function getAccountProfile(config: PofsisAuthConfig, accessToken: string) {\n    const { data } = await request<AccountProfile>(config, '/auth/profile/me', {\n        headers: { Authorization: `Bearer ${accessToken}` },\n    })\n    return data\n}\n\nexport async function updateAccountProfile(\n    config: PofsisAuthConfig,\n    accessToken: string,\n    profile: { firstName?: string | null; lastName?: string | null },\n) {\n    const { data } = await request<AccountProfile>(config, '/auth/profile/me', {\n        method: 'PATCH',\n        headers: { Authorization: `Bearer ${accessToken}` },\n        body: JSON.stringify(profile),\n    })\n    return data\n}\n\nexport async function uploadAccountProfileImage(\n    config: PofsisAuthConfig,\n    accessToken: string,\n    kind: 'profile' | 'cover',\n    file: File,\n) {\n    const body = new FormData()\n    body.append('file', file)\n    const { data } = await request<AccountProfile>(config, `/auth/profile/me/images/${kind}`, {\n        method: 'POST',\n        headers: { Authorization: `Bearer ${accessToken}` },\n        body,\n    })\n    return data\n}\n\nexport async function deleteAccountProfileImage(\n    config: PofsisAuthConfig,\n    accessToken: string,\n    kind: 'profile' | 'cover',\n) {\n    const { data } = await request<AccountProfile>(config, `/auth/profile/me/images/${kind}`, {\n        method: 'DELETE',\n        headers: { Authorization: `Bearer ${accessToken}` },\n    })\n    return data\n}\n","import type { PofsisAuthClientConfig, ResolvedPofsisAuthConfig } from '../types'\n\nfunction stripTrailingSlash(value: string) {\n    return value.replace(/\\/$/, '')\n}\n\nexport type ConfigOverrides = Partial<PofsisAuthClientConfig>\n\n/**\n * Validate and normalize explicitly supplied runtime configuration.\n */\nexport function resolveConfig(overrides: ConfigOverrides = {}): ResolvedPofsisAuthConfig {\n    const appName = overrides.appName?.trim()\n    const apiBaseUrl = overrides.apiBaseUrl?.trim()\n    const authUrl = overrides.authUrl?.trim()\n    const scope = overrides.scope?.trim() || 'openid profile email'\n    const callbackPath = overrides.callbackPath?.trim() || '/auth/callback'\n    const popup = {\n        width: overrides.popup?.width ?? 480,\n        height: overrides.popup?.height ?? 720,\n        name: overrides.popup?.name?.trim() || 'pofsis-auth',\n        timeoutMs: overrides.popup?.timeoutMs ?? 300_000,\n    }\n\n    const missing: string[] = []\n    if (!appName) missing.push('appName')\n    if (!apiBaseUrl) missing.push('apiBaseUrl')\n    if (!authUrl) missing.push('authUrl')\n    if (missing.length) {\n        throw new Error(`@pofsis-nbt/pofsis-auth missing config: ${missing.join(', ')}`)\n    }\n    if (!appName || !apiBaseUrl || !authUrl) {\n        throw new Error('@pofsis-nbt/pofsis-auth missing config')\n    }\n    if (!callbackPath.startsWith('/') || callbackPath.startsWith('//')) {\n        throw new Error('@pofsis-nbt/pofsis-auth callbackPath must be application-relative')\n    }\n    if (popup.width <= 0 || popup.height <= 0 || popup.timeoutMs <= 0) {\n        throw new Error('@pofsis-nbt/pofsis-auth popup dimensions and timeout must be positive')\n    }\n\n    return {\n        appName,\n        apiBaseUrl: stripTrailingSlash(apiBaseUrl),\n        authUrl: stripTrailingSlash(authUrl),\n        scope,\n        callbackPath,\n        popup,\n    }\n}\n","import type { AuthLaunchOptions, AuthMethod, AuthScreen } from '../types'\n\nconst EMAIL = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\nconst PHILIPPINE_MOBILE = /^(?:\\+63|63|0)?9\\d{9}$/\nconst METHODS = new Set<AuthMethod>(['password', 'passkey', 'otp'])\nconst SCREENS = new Set<AuthScreen>(['login', 'signup', 'reset'])\nconst MAX_HINT_LENGTH = 320\n\nfunction normalizeHint(value: unknown, emailOnly = false): string | undefined {\n    const candidate = typeof value === 'string' ? value.trim() : ''\n    if (!candidate || candidate.length > MAX_HINT_LENGTH) return undefined\n    if (EMAIL.test(candidate)) return candidate.toLowerCase()\n    const compact = candidate.replace(/[\\s()-]/g, '')\n    if (emailOnly || !PHILIPPINE_MOBILE.test(compact)) return undefined\n    return `+63${compact.replace(/^(?:\\+63|63|0)/, '')}`\n}\n\nexport function normalizeAuthLaunchOptions(\n    value?: AuthLaunchOptions | string | null,\n    defaultScreen: AuthScreen = 'login',\n) {\n    const options = typeof value === 'string' ? { returnUrl: value } : value || {}\n    const requestedScreen = options.screen === 'register' ? 'signup' : options.screen\n    const screen = SCREENS.has(requestedScreen as AuthScreen)\n        ? (requestedScreen as AuthScreen)\n        : defaultScreen\n    const requestedMethod = METHODS.has(options.method as AuthMethod)\n        ? (options.method as AuthMethod)\n        : undefined\n    const method =\n        screen === 'login' ||\n        (screen === 'signup' && (requestedMethod === 'password' || requestedMethod === 'otp'))\n            ? requestedMethod\n            : undefined\n    return {\n        returnUrl: options.returnUrl,\n        screen,\n        loginHint: normalizeHint(options.loginHint),\n        method,\n    }\n}\n\nexport function authLaunchOptionsFromSearch(search: string) {\n    const params = new URLSearchParams(search)\n    const canonicalHint = params.get('login_hint')\n    const loginHint =\n        canonicalHint !== null\n            ? normalizeHint(canonicalHint)\n            : normalizeHint(params.get('email'), true)\n    return normalizeAuthLaunchOptions({\n        screen: (params.get('screen') || undefined) as AuthLaunchOptions['screen'],\n        loginHint,\n        method: (params.get('method') || undefined) as AuthLaunchOptions['method'],\n    })\n}\n\nexport function buildAuthDestination({\n    authUrl,\n    appName,\n    query,\n    options,\n}: {\n    authUrl: string\n    appName: string\n    query: URLSearchParams\n    options?: AuthLaunchOptions\n}) {\n    const launch = normalizeAuthLaunchOptions(options)\n    const authorizationUrl = new URL(authUrl)\n    authorizationUrl.search = query.toString()\n    if (launch.loginHint) authorizationUrl.searchParams.set('login_hint', launch.loginHint)\n    if (launch.screen === 'login' && launch.method) {\n        authorizationUrl.searchParams.set('method', launch.method)\n    }\n    if (launch.screen === 'login') return authorizationUrl.toString()\n\n    const pathname = launch.screen === 'signup' ? '/signup' : '/forgot-password'\n    const destination = new URL(pathname, authorizationUrl)\n    destination.searchParams.set('app', appName)\n    destination.searchParams.set(\n        'return_to',\n        `${authorizationUrl.pathname}${authorizationUrl.search}`,\n    )\n    if (launch.loginHint) destination.searchParams.set('login_hint', launch.loginHint)\n    if (launch.screen === 'signup') {\n        destination.searchParams.set('method', launch.method || 'password')\n    }\n    return destination.toString()\n}\n","export const POPUP_MESSAGE_TYPE = 'pofsis-auth:callback'\n\nexport type PopupCallbackMessage = {\n    type: typeof POPUP_MESSAGE_TYPE\n    code?: string\n    state?: string\n    error?: string\n    correlationId?: string\n}\n\nexport function correlationFromState(state: string | null) {\n    if (!state) return undefined\n    const separator = state.indexOf('.')\n    return separator > 0 ? state.slice(0, separator) : undefined\n}\n\nexport function relayPopupCallback(targetOrigin = window.location.origin) {\n    const target =\n        window.opener && !window.opener.closed\n            ? window.opener\n            : window.parent !== window\n              ? window.parent\n              : null\n    if (!target) return false\n    const params = new URLSearchParams(window.location.search)\n    const state = params.get('state') || undefined\n    const message: PopupCallbackMessage = {\n        type: POPUP_MESSAGE_TYPE,\n        code: params.get('code') || undefined,\n        state,\n        error: params.get('error') || undefined,\n        correlationId: correlationFromState(state || null),\n    }\n    target.postMessage(message, targetOrigin)\n    if (target === window.opener) window.close()\n    return true\n}\n","const encode = (bytes: Uint8Array) =>\n    btoa(String.fromCharCode(...bytes))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '')\n\nexport const randomValue = () => encode(crypto.getRandomValues(new Uint8Array(32)))\n\nexport async function pkceChallenge(verifier: string) {\n    return encode(\n        new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))),\n    )\n}\n","import { checkSession, exchangeCode, fetchOAuthClient, refresh, signOut } from '../auth/api'\nimport { buildAuthDestination, normalizeAuthLaunchOptions } from '../auth/authLaunch'\nimport { resolveConfig } from '../auth/config'\nimport { pkceChallenge, randomValue } from '../auth/pkce'\nimport type {\n    AuthLaunchOptions,\n    AuthResult,\n    OAuthClientConfig,\n    PofsisAuthClientConfig,\n    ResolvedPofsisAuthConfig,\n    PofsisUser,\n    SessionPayload,\n} from '../types'\nimport {\n    correlationFromState,\n    POPUP_MESSAGE_TYPE,\n    type PopupCallbackMessage,\n} from './popupProtocol'\n\ntype Subscriber = (session: SessionPayload | null) => void\ntype PopupAttempt = {\n    popup: Window\n    state: string\n    verifier: string\n    correlationId: string\n    returnUrl?: string\n    resolve: (result: AuthResult) => void\n    reject: (error: Error) => void\n    timer: ReturnType<typeof setInterval>\n    timeout: ReturnType<typeof setTimeout>\n}\n\ntype IframeAttempt = Omit<PopupAttempt, 'popup' | 'timer'> & { frame: HTMLIFrameElement }\n\nconst safeLocalPath = (value?: string) =>\n    value?.startsWith('/') && !value.startsWith('//') ? value : undefined\n\nconst toSession = (result: { token_type: string; expires_in: number; user: PofsisUser }) => ({\n    token_type: result.token_type,\n    expires_in: result.expires_in,\n    user: result.user,\n})\n\nexport class PofsisAuthClient {\n    readonly config: ResolvedPofsisAuthConfig\n    private token: string | null = null\n    private session: SessionPayload | null = null\n    private client: OAuthClientConfig | null = null\n    private clientPromise: Promise<OAuthClientConfig> | null = null\n    private refreshPromise: Promise<void> | null = null\n    private subscribers = new Set<Subscriber>()\n    private attempt: PopupAttempt | null = null\n    private iframeAttempt: IframeAttempt | null = null\n    private listening = false\n\n    constructor(config: PofsisAuthClientConfig) {\n        this.config = resolveConfig(config)\n        this.attach()\n    }\n\n    private attach() {\n        if (this.listening) return\n        window.addEventListener('message', this.onPopupMessage)\n        this.listening = true\n    }\n\n    destroy() {\n        window.removeEventListener('message', this.onPopupMessage)\n        this.listening = false\n        const attempt = this.finishAttempt()\n        if (attempt) {\n            attempt.popup.close()\n            attempt.resolve({ status: 'cancelled' })\n        }\n        this.cancelIframeLogin()\n        this.subscribers.clear()\n    }\n\n    getUser() {\n        return this.session?.user ?? null\n    }\n\n    getSession() {\n        return this.session\n    }\n\n    getAccessToken() {\n        return this.token\n    }\n\n    subscribe(listener: Subscriber) {\n        this.attach()\n        this.subscribers.add(listener)\n        listener(this.session)\n        return () => {\n            this.subscribers.delete(listener)\n        }\n    }\n\n    private emit() {\n        for (const listener of this.subscribers) listener(this.session)\n    }\n\n    private accept(result: Awaited<ReturnType<typeof exchangeCode>>) {\n        this.token = result.access_token\n        this.session = toSession(result)\n        this.emit()\n    }\n\n    private loadClient() {\n        if (!this.clientPromise) {\n            this.clientPromise = fetchOAuthClient(this.config)\n                .then((client) => (this.client = client))\n                .catch((error) => {\n                    this.clientPromise = null\n                    throw error\n                })\n        }\n        return this.clientPromise\n    }\n\n    getOAuthClient() {\n        return this.loadClient()\n    }\n\n    async refreshSession() {\n        const client = await this.loadClient()\n        if (!this.refreshPromise) {\n            this.refreshPromise = refresh(this.config, client.client_id)\n                .then((result) => {\n                    if (result) this.accept(result)\n                    else this.clearSession()\n                })\n                .finally(() => (this.refreshPromise = null))\n        }\n        return this.refreshPromise\n    }\n\n    async isRemoteSessionActive() {\n        return checkSession(this.config)\n    }\n\n    clearSession() {\n        this.token = null\n        this.session = null\n        this.emit()\n    }\n\n    replaceUser(user: PofsisUser) {\n        if (!this.session) return\n        this.session = { ...this.session, user }\n        this.emit()\n    }\n\n    async logout() {\n        try {\n            await signOut(this.config)\n        } finally {\n            this.clearSession()\n        }\n    }\n\n    signup(options: Omit<AuthLaunchOptions, 'screen'> = {}) {\n        return this.login({ ...options, screen: 'signup' })\n    }\n\n    resetPassword(options: Omit<AuthLaunchOptions, 'screen'> = {}) {\n        return this.login({ ...options, screen: 'reset' })\n    }\n\n    async login(options: AuthLaunchOptions = {}): Promise<AuthResult> {\n        const launch = normalizeAuthLaunchOptions(options)\n        const presentation = options.presentation ?? 'popup'\n        if (presentation === 'popup') return this.openPopup({ ...options, ...launch })\n        if (presentation === 'iframe') return this.openIframe({ ...options, ...launch })\n        return this.startRedirect({ ...options, ...launch })\n    }\n\n    cancelIframeLogin() {\n        const attempt = this.finishIframeAttempt()\n        attempt?.resolve({ status: 'cancelled' })\n    }\n\n    private openIframe(options: AuthLaunchOptions): Promise<AuthResult> {\n        const frame = options.target\n        if (!frame) return Promise.reject(new Error('POFSIS Auth iframe target is required.'))\n        this.cancelIframeLogin()\n        const correlationId = randomValue()\n        const state = `${correlationId}.${randomValue()}`\n        const verifier = randomValue()\n        const returnUrl = safeLocalPath(options.returnUrl)\n        return new Promise<AuthResult>((resolve, reject) => {\n            const timeout = setTimeout(() => {\n                const attempt = this.finishIframeAttempt()\n                attempt?.reject(new Error('POFSIS Auth iframe timed out.'))\n            }, this.config.popup.timeoutMs)\n            this.iframeAttempt = {\n                frame,\n                state,\n                verifier,\n                correlationId,\n                returnUrl,\n                resolve,\n                reject,\n                timeout,\n            }\n            void this.authorizationUrl(options, state, verifier)\n                .then((url) => frame.contentWindow?.location.replace(url))\n                .catch((error) => {\n                    const attempt = this.finishIframeAttempt()\n                    attempt?.reject(error instanceof Error ? error : new Error(String(error)))\n                })\n        })\n    }\n\n    private async authorizationUrl(options: AuthLaunchOptions, state: string, verifier: string) {\n        const client = await this.loadClient()\n        const query = new URLSearchParams({\n            app: this.config.appName.toUpperCase(),\n            client_id: client.client_id,\n            redirect_uri: client.redirect_uri,\n            response_type: 'code',\n            scope: this.config.scope,\n            state,\n            code_challenge: await pkceChallenge(verifier),\n            code_challenge_method: 'S256',\n        })\n        return buildAuthDestination({\n            authUrl: this.config.authUrl,\n            appName: this.config.appName.toUpperCase(),\n            query,\n            options,\n        })\n    }\n\n    private storageKey(suffix: string) {\n        return `${this.config.appName.toLowerCase()}.auth.${suffix}`\n    }\n\n    private async startRedirect(options: AuthLaunchOptions): Promise<AuthResult> {\n        const state = randomValue()\n        const verifier = randomValue()\n        sessionStorage.setItem(this.storageKey('state'), state)\n        sessionStorage.setItem(this.storageKey('verifier'), verifier)\n        const returnUrl = safeLocalPath(options.returnUrl)\n        if (returnUrl) sessionStorage.setItem(this.storageKey('return-path'), returnUrl)\n        else sessionStorage.removeItem(this.storageKey('return-path'))\n        window.location.assign(await this.authorizationUrl(options, state, verifier))\n        return { status: 'redirecting' }\n    }\n\n    private async openPopup(options: AuthLaunchOptions): Promise<AuthResult> {\n        if (this.attempt && !this.attempt.popup.closed) {\n            this.attempt.popup.focus()\n            return new Promise((resolve, reject) => {\n                const current = this.attempt!\n                const originalResolve = current.resolve\n                const originalReject = current.reject\n                current.resolve = (value) => {\n                    originalResolve(value)\n                    resolve(value)\n                }\n                current.reject = (error) => {\n                    originalReject(error)\n                    reject(error)\n                }\n            })\n        }\n        const { width, height, name, timeoutMs } = this.config.popup\n        const left = Math.max(0, window.screenX + (window.outerWidth - width) / 2)\n        const top = Math.max(0, window.screenY + (window.outerHeight - height) / 2)\n        const popup = window.open(\n            'about:blank',\n            name,\n            `popup=yes,width=${width},height=${height},left=${Math.round(left)},top=${Math.round(top)}`,\n        )\n        if (!popup) return this.startRedirect({ ...options, presentation: 'redirect' })\n\n        const correlationId = randomValue()\n        const state = `${correlationId}.${randomValue()}`\n        const verifier = randomValue()\n        const returnUrl = safeLocalPath(options.returnUrl)\n        return new Promise<AuthResult>((resolve, reject) => {\n            const timer = setInterval(() => {\n                if (!popup.closed) return\n                const attempt = this.finishAttempt()\n                attempt?.resolve({ status: 'cancelled' })\n            }, 250)\n            const timeout = setTimeout(() => {\n                const attempt = this.finishAttempt()\n                popup.close()\n                attempt?.reject(new Error('POFSIS Auth popup timed out.'))\n            }, timeoutMs)\n            this.attempt = {\n                popup,\n                state,\n                verifier,\n                correlationId,\n                returnUrl,\n                resolve,\n                reject,\n                timer,\n                timeout,\n            }\n            void this.authorizationUrl(options, state, verifier)\n                .then((url) => popup.location.replace(url))\n                .catch((error) => {\n                    const attempt = this.finishAttempt()\n                    popup.close()\n                    attempt?.reject(error instanceof Error ? error : new Error(String(error)))\n                })\n        })\n    }\n\n    private finishAttempt() {\n        const attempt = this.attempt\n        if (!attempt) return null\n        clearInterval(attempt.timer)\n        clearTimeout(attempt.timeout)\n        this.attempt = null\n        return attempt\n    }\n\n    private finishIframeAttempt() {\n        const attempt = this.iframeAttempt\n        if (!attempt) return null\n        clearTimeout(attempt.timeout)\n        this.iframeAttempt = null\n        return attempt\n    }\n\n    private onPopupMessage = (event: MessageEvent<PopupCallbackMessage>) => {\n        const iframeAttempt = this.iframeAttempt\n        if (\n            iframeAttempt &&\n            event.origin === window.location.origin &&\n            event.source === iframeAttempt.frame.contentWindow &&\n            event.data?.type === POPUP_MESSAGE_TYPE &&\n            event.data.correlationId === iframeAttempt.correlationId &&\n            correlationFromState(event.data.state || null) === iframeAttempt.correlationId &&\n            event.data.state === iframeAttempt.state\n        ) {\n            const completed = this.finishIframeAttempt()!\n            if (event.data.error || !event.data.code) {\n                completed.reject(\n                    new Error(event.data.error || 'POFSIS Auth callback was incomplete.'),\n                )\n                return\n            }\n            void this.completeCode(event.data.code, event.data.state, completed.verifier)\n                .then(() => completed.resolve({ status: 'authenticated', user: this.getUser()! }))\n                .catch((error) =>\n                    completed.reject(error instanceof Error ? error : new Error(String(error))),\n                )\n            return\n        }\n        const attempt = this.attempt\n        const message = event.data\n        if (\n            !attempt ||\n            event.origin !== window.location.origin ||\n            event.source !== attempt.popup ||\n            message?.type !== POPUP_MESSAGE_TYPE ||\n            message.correlationId !== attempt.correlationId ||\n            correlationFromState(message.state || null) !== attempt.correlationId ||\n            message.state !== attempt.state\n        )\n            return\n\n        const completed = this.finishAttempt()\n        if (!completed) return\n        if (message.error || !message.code) {\n            completed.popup.close()\n            completed.reject(new Error(message.error || 'POFSIS Auth callback was incomplete.'))\n            return\n        }\n        void this.completeCode(message.code, message.state, completed.verifier)\n            .then(() => {\n                completed.popup.close()\n                if (completed.returnUrl) window.history.replaceState(null, '', completed.returnUrl)\n                completed.resolve({ status: 'authenticated', user: this.getUser()! })\n            })\n            .catch((error) => {\n                completed.popup.close()\n                completed.reject(error instanceof Error ? error : new Error(String(error)))\n            })\n    }\n\n    private async completeCode(code: string, state: string, verifier: string) {\n        if (!state || !verifier) throw new Error('Authentication state could not be verified.')\n        const client = await this.loadClient()\n        this.accept(await exchangeCode(this.config, code, verifier, client))\n    }\n\n    async completeRedirectCallback(code: string, state: string) {\n        const expected = sessionStorage.getItem(this.storageKey('state'))\n        const verifier = sessionStorage.getItem(this.storageKey('verifier'))\n        sessionStorage.removeItem(this.storageKey('state'))\n        sessionStorage.removeItem(this.storageKey('verifier'))\n        if (!expected || !verifier || state !== expected) {\n            throw new Error('Authentication state could not be verified.')\n        }\n        await this.completeCode(code, state, verifier)\n    }\n}\n\nexport function createPofsisAuth(config: PofsisAuthClientConfig) {\n    return new PofsisAuthClient(config)\n}\n"],"mappings":"AAEA,eAAe,EAAa,EAAgC,CACxD,GAAI,EAAS,SAAW,IAAK,OAAO,KACpC,IAAM,EAAO,MAAM,EAAS,KAAK,EAEjC,OADK,EACE,KAAK,MAAM,CAAI,EADJ,IAEtB,CAEA,eAAe,EACX,EACA,EACA,EACoC,CACpC,IAAM,EAAW,MAAM,MAAM,GAAG,EAAO,aAAa,IAAQ,CACxD,YAAa,UACb,GAAG,EACH,QAAS,CACL,OAAQ,mBACR,GAAI,GAAM,MAAQ,EAAE,EAAK,gBAAgB,UACnC,CAAE,eAAgB,kBAAmB,EACrC,CAAC,EACP,GAAG,GAAM,OACb,CACJ,CAAC,EACD,GAAI,CAAC,EAAS,GAAI,CACd,IAAM,EAAY,MAAM,YAAY,EAAK,WAAW,EAAS,OAAO,EAAE,EAEtE,KADC,GAAuC,OAAS,EAAS,OACpD,CACV,CACA,MAAO,CAAE,OAAQ,EAAS,OAAQ,KAAM,MAAM,EAAa,CAAQ,CAAE,CACzE,CAEA,eAAsB,EAAiB,EAA0B,CAG7D,GAAM,CAAE,QAAS,MAAM,EACnB,EACA,kBAJa,mBAAmB,EAAO,QAAQ,YAAY,CAIzC,EAAS,UAHhB,mBAAmB,OAAO,SAAS,MAGT,GACzC,EACA,OAAO,CACX,CAEA,eAAsB,EAClB,EACA,EACA,EACA,EACF,CACE,GAAM,CAAE,QAAS,MAAM,EAAuB,EAAQ,eAAgB,CAClE,OAAQ,OACR,KAAM,KAAK,UAAU,CACjB,WAAY,qBACZ,UAAW,EAAO,UAClB,aAAc,EAAO,aACrB,OACA,cAAe,CACnB,CAAC,CACL,CAAC,EACD,OAAO,CACX,CAEA,eAAsB,EAAQ,EAA0B,EAAkB,CACtE,GAAM,CAAE,QAAS,MAAM,EAA8B,EAAQ,eAAgB,CACzE,OAAQ,OACR,KAAM,KAAK,UAAU,CACjB,WAAY,gBACZ,UAAW,CACf,CAAC,CACL,CAAC,EACD,OAAO,GAAQ,IACnB,CAEA,eAAsB,EAAa,EAA0B,CACzD,GAAI,CAEA,OADA,MAAM,EAAQ,EAAQ,eAAe,EAC9B,EACX,MAAQ,CACJ,MAAO,EACX,CACJ,CAEA,eAAsB,EAAQ,EAA0B,CACpD,MAAM,EAAQ,EAAQ,eAAgB,CAAE,OAAQ,MAAO,CAAC,CAC5D,CAEA,eAAsB,EAAkB,EAA0B,EAAqB,CACnF,GAAM,CAAE,QAAS,MAAM,EAAwB,EAAQ,mBAAoB,CACvE,QAAS,CAAE,cAAe,UAAU,GAAc,CACtD,CAAC,EACD,OAAO,CACX,CAEA,eAAsB,EAClB,EACA,EACA,EACF,CACE,GAAM,CAAE,QAAS,MAAM,EAAwB,EAAQ,mBAAoB,CACvE,OAAQ,QACR,QAAS,CAAE,cAAe,UAAU,GAAc,EAClD,KAAM,KAAK,UAAU,CAAO,CAChC,CAAC,EACD,OAAO,CACX,CAEA,eAAsB,EAClB,EACA,EACA,EACA,EACF,CACE,IAAM,EAAO,IAAI,SACjB,EAAK,OAAO,OAAQ,CAAI,EACxB,GAAM,CAAE,QAAS,MAAM,EAAwB,EAAQ,2BAA2B,IAAQ,CACtF,OAAQ,OACR,QAAS,CAAE,cAAe,UAAU,GAAc,EAClD,MACJ,CAAC,EACD,OAAO,CACX,CAEA,eAAsB,EAClB,EACA,EACA,EACF,CACE,GAAM,CAAE,QAAS,MAAM,EAAwB,EAAQ,2BAA2B,IAAQ,CACtF,OAAQ,SACR,QAAS,CAAE,cAAe,UAAU,GAAc,CACtD,CAAC,EACD,OAAO,CACX,CClIA,SAAS,EAAmB,EAAe,CACvC,OAAO,EAAM,QAAQ,MAAO,EAAE,CAClC,CAOA,SAAgB,EAAc,EAA6B,CAAC,EAA6B,CACrF,IAAM,EAAU,EAAU,SAAS,KAAK,EAClC,EAAa,EAAU,YAAY,KAAK,EACxC,EAAU,EAAU,SAAS,KAAK,EAClC,EAAQ,EAAU,OAAO,KAAK,GAAK,uBACnC,EAAe,EAAU,cAAc,KAAK,GAAK,iBACjD,EAAQ,CACV,MAAO,EAAU,OAAO,OAAS,IACjC,OAAQ,EAAU,OAAO,QAAU,IACnC,KAAM,EAAU,OAAO,MAAM,KAAK,GAAK,cACvC,UAAW,EAAU,OAAO,WAAa,GAC7C,EAEM,EAAoB,CAAC,EAI3B,GAHK,GAAS,EAAQ,KAAK,SAAS,EAC/B,GAAY,EAAQ,KAAK,YAAY,EACrC,GAAS,EAAQ,KAAK,SAAS,EAChC,EAAQ,OACR,MAAU,MAAM,2CAA2C,EAAQ,KAAK,IAAI,GAAG,EAEnF,GAAI,CAAC,GAAW,CAAC,GAAc,CAAC,EAC5B,MAAU,MAAM,wCAAwC,EAE5D,GAAI,CAAC,EAAa,WAAW,GAAG,GAAK,EAAa,WAAW,IAAI,EAC7D,MAAU,MAAM,mEAAmE,EAEvF,GAAI,EAAM,OAAS,GAAK,EAAM,QAAU,GAAK,EAAM,WAAa,EAC5D,MAAU,MAAM,uEAAuE,EAG3F,MAAO,CACH,UACA,WAAY,EAAmB,CAAU,EACzC,QAAS,EAAmB,CAAO,EACnC,QACA,eACA,OACJ,CACJ,CC/CA,IAAM,EAAQ,6BACR,EAAoB,yBACpB,EAAU,IAAI,IAAgB,CAAC,WAAY,UAAW,KAAK,CAAC,EAC5D,EAAU,IAAI,IAAgB,CAAC,QAAS,SAAU,OAAO,CAAC,EAC1D,EAAkB,IAExB,SAAS,EAAc,EAAgB,EAAY,GAA2B,CAC1E,IAAM,EAAY,OAAO,GAAU,SAAW,EAAM,KAAK,EAAI,GAC7D,GAAI,CAAC,GAAa,EAAU,OAAS,EAAiB,OACtD,GAAI,EAAM,KAAK,CAAS,EAAG,OAAO,EAAU,YAAY,EACxD,IAAM,EAAU,EAAU,QAAQ,WAAY,EAAE,EAChD,GAAI,IAAc,EAAkB,KAAK,CAAO,EAChD,MAAO,MAAM,EAAQ,QAAQ,iBAAkB,EAAE,GACrD,CAEA,SAAgB,EACZ,EACA,EAA4B,QAC9B,CACE,IAAM,EAAU,OAAO,GAAU,SAAW,CAAE,UAAW,CAAM,EAAI,GAAS,CAAC,EACvE,EAAkB,EAAQ,SAAW,WAAa,SAAW,EAAQ,OACrE,EAAS,EAAQ,IAAI,CAA6B,EACjD,EACD,EACA,EAAkB,EAAQ,IAAI,EAAQ,MAAoB,EACzD,EAAQ,OACT,IAAA,GACA,EACF,IAAW,SACV,IAAW,WAAa,IAAoB,YAAc,IAAoB,OACzE,EACA,IAAA,GACV,MAAO,CACH,UAAW,EAAQ,UACnB,SACA,UAAW,EAAc,EAAQ,SAAS,EAC1C,QACJ,CACJ,CAEA,SAAgB,EAA4B,EAAgB,CACxD,IAAM,EAAS,IAAI,gBAAgB,CAAM,EACnC,EAAgB,EAAO,IAAI,YAAY,EACvC,EACF,IAAkB,KAEZ,EAAc,EAAO,IAAI,OAAO,EAAG,EAAI,EADvC,EAAc,CAAa,EAErC,OAAO,EAA2B,CAC9B,OAAS,EAAO,IAAI,QAAQ,GAAK,IAAA,GACjC,YACA,OAAS,EAAO,IAAI,QAAQ,GAAK,IAAA,EACrC,CAAC,CACL,CAEA,SAAgB,EAAqB,CACjC,UACA,UACA,QACA,WAMD,CACC,IAAM,EAAS,EAA2B,CAAO,EAC3C,EAAmB,IAAI,IAAI,CAAO,EAMxC,GALA,EAAiB,OAAS,EAAM,SAAS,EACrC,EAAO,WAAW,EAAiB,aAAa,IAAI,aAAc,EAAO,SAAS,EAClF,EAAO,SAAW,SAAW,EAAO,QACpC,EAAiB,aAAa,IAAI,SAAU,EAAO,MAAM,EAEzD,EAAO,SAAW,QAAS,OAAO,EAAiB,SAAS,EAEhE,IAAM,EAAW,EAAO,SAAW,SAAW,UAAY,mBACpD,EAAc,IAAI,IAAI,EAAU,CAAgB,EAUtD,OATA,EAAY,aAAa,IAAI,MAAO,CAAO,EAC3C,EAAY,aAAa,IACrB,YACA,GAAG,EAAiB,WAAW,EAAiB,QACpD,EACI,EAAO,WAAW,EAAY,aAAa,IAAI,aAAc,EAAO,SAAS,EAC7E,EAAO,SAAW,UAClB,EAAY,aAAa,IAAI,SAAU,EAAO,QAAU,UAAU,EAE/D,EAAY,SAAS,CAChC,CCxFA,IAAa,EAAqB,uBAUlC,SAAgB,EAAqB,EAAsB,CACvD,GAAI,CAAC,EAAO,OACZ,IAAM,EAAY,EAAM,QAAQ,GAAG,EACnC,OAAO,EAAY,EAAI,EAAM,MAAM,EAAG,CAAS,EAAI,IAAA,EACvD,CAEA,SAAgB,EAAmB,EAAe,OAAO,SAAS,OAAQ,CACtE,IAAM,EACF,OAAO,QAAU,CAAC,OAAO,OAAO,OAC1B,OAAO,OACP,OAAO,SAAW,OAEhB,KADA,OAAO,OAEnB,GAAI,CAAC,EAAQ,MAAO,GACpB,IAAM,EAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM,EACnD,EAAQ,EAAO,IAAI,OAAO,GAAK,IAAA,GAC/B,EAAgC,CAClC,KAAM,EACN,KAAM,EAAO,IAAI,MAAM,GAAK,IAAA,GAC5B,QACA,MAAO,EAAO,IAAI,OAAO,GAAK,IAAA,GAC9B,cAAe,EAAqB,GAAS,IAAI,CACrD,EAGA,OAFA,EAAO,YAAY,EAAS,CAAY,EACpC,IAAW,OAAO,QAAQ,OAAO,MAAM,EACpC,EACX,CCpCA,IAAM,EAAU,GACZ,KAAK,OAAO,aAAa,GAAG,CAAK,CAAC,CAAC,CAC9B,QAAQ,MAAO,GAAG,CAAC,CACnB,QAAQ,MAAO,GAAG,CAAC,CACnB,QAAQ,MAAO,EAAE,EAEb,MAAoB,EAAO,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,EAElF,eAAsB,EAAc,EAAkB,CAClD,OAAO,EACH,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,UAAW,IAAI,YAAY,CAAC,CAAC,OAAO,CAAQ,CAAC,CAAC,CAC5F,CACJ,CCsBA,IAAM,EAAiB,GACnB,GAAO,WAAW,GAAG,GAAK,CAAC,EAAM,WAAW,IAAI,EAAI,EAAQ,IAAA,GAE1D,EAAa,IAA0E,CACzF,WAAY,EAAO,WACnB,WAAY,EAAO,WACnB,KAAM,EAAO,IACjB,GAEa,EAAb,KAA8B,CAC1B,OACA,MAA+B,KAC/B,QAAyC,KACzC,OAA2C,KAC3C,cAA2D,KAC3D,eAA+C,KAC/C,YAAsB,IAAI,IAC1B,QAAuC,KACvC,cAA8C,KAC9C,UAAoB,GAEpB,YAAY,EAAgC,CACxC,KAAK,OAAS,EAAc,CAAM,EAClC,KAAK,OAAO,CAChB,CAEA,QAAiB,CACb,AAEA,KAAK,aADL,OAAO,iBAAiB,UAAW,KAAK,cAAc,EACrC,GACrB,CAEA,SAAU,CACN,OAAO,oBAAoB,UAAW,KAAK,cAAc,EACzD,KAAK,UAAY,GACjB,IAAM,EAAU,KAAK,cAAc,EAC/B,IACA,EAAQ,MAAM,MAAM,EACpB,EAAQ,QAAQ,CAAE,OAAQ,WAAY,CAAC,GAE3C,KAAK,kBAAkB,EACvB,KAAK,YAAY,MAAM,CAC3B,CAEA,SAAU,CACN,OAAO,KAAK,SAAS,MAAQ,IACjC,CAEA,YAAa,CACT,OAAO,KAAK,OAChB,CAEA,gBAAiB,CACb,OAAO,KAAK,KAChB,CAEA,UAAU,EAAsB,CAI5B,OAHA,KAAK,OAAO,EACZ,KAAK,YAAY,IAAI,CAAQ,EAC7B,EAAS,KAAK,OAAO,MACR,CACT,KAAK,YAAY,OAAO,CAAQ,CACpC,CACJ,CAEA,MAAe,CACX,IAAK,IAAM,KAAY,KAAK,YAAa,EAAS,KAAK,OAAO,CAClE,CAEA,OAAe,EAAkD,CAC7D,KAAK,MAAQ,EAAO,aACpB,KAAK,QAAU,EAAU,CAAM,EAC/B,KAAK,KAAK,CACd,CAEA,YAAqB,CASjB,MARA,CACI,KAAK,gBAAgB,EAAiB,KAAK,MAAM,CAAC,CAC7C,KAAM,GAAY,KAAK,OAAS,CAAO,CAAC,CACxC,MAAO,GAAU,CAEd,KADA,MAAK,cAAgB,KACf,CACV,CAAC,EAEF,KAAK,aAChB,CAEA,gBAAiB,CACb,OAAO,KAAK,WAAW,CAC3B,CAEA,MAAM,gBAAiB,CACnB,IAAM,EAAS,MAAM,KAAK,WAAW,EASrC,MARA,CACI,KAAK,iBAAiB,EAAQ,KAAK,OAAQ,EAAO,SAAS,CAAC,CACvD,KAAM,GAAW,CACV,EAAQ,KAAK,OAAO,CAAM,EACzB,KAAK,aAAa,CAC3B,CAAC,CAAC,CACD,YAAe,KAAK,eAAiB,IAAK,EAE5C,KAAK,cAChB,CAEA,MAAM,uBAAwB,CAC1B,OAAO,EAAa,KAAK,MAAM,CACnC,CAEA,cAAe,CACX,KAAK,MAAQ,KACb,KAAK,QAAU,KACf,KAAK,KAAK,CACd,CAEA,YAAY,EAAkB,CACrB,KAAK,UACV,KAAK,QAAU,CAAE,GAAG,KAAK,QAAS,MAAK,EACvC,KAAK,KAAK,EACd,CAEA,MAAM,QAAS,CACX,GAAI,CACA,MAAM,EAAQ,KAAK,MAAM,CAC7B,QAAU,CACN,KAAK,aAAa,CACtB,CACJ,CAEA,OAAO,EAA6C,CAAC,EAAG,CACpD,OAAO,KAAK,MAAM,CAAE,GAAG,EAAS,OAAQ,QAAS,CAAC,CACtD,CAEA,cAAc,EAA6C,CAAC,EAAG,CAC3D,OAAO,KAAK,MAAM,CAAE,GAAG,EAAS,OAAQ,OAAQ,CAAC,CACrD,CAEA,MAAM,MAAM,EAA6B,CAAC,EAAwB,CAC9D,IAAM,EAAS,EAA2B,CAAO,EAC3C,EAAe,EAAQ,cAAgB,QAG7C,OAFI,IAAiB,QAAgB,KAAK,UAAU,CAAE,GAAG,EAAS,GAAG,CAAO,CAAC,EACzE,IAAiB,SAAiB,KAAK,WAAW,CAAE,GAAG,EAAS,GAAG,CAAO,CAAC,EACxE,KAAK,cAAc,CAAE,GAAG,EAAS,GAAG,CAAO,CAAC,CACvD,CAEA,mBAAoB,CAEhB,KADqB,oBACrB,CAAA,EAAS,QAAQ,CAAE,OAAQ,WAAY,CAAC,CAC5C,CAEA,WAAmB,EAAiD,CAChE,IAAM,EAAQ,EAAQ,OACtB,GAAI,CAAC,EAAO,OAAO,QAAQ,OAAW,MAAM,wCAAwC,CAAC,EACrF,KAAK,kBAAkB,EACvB,IAAM,EAAgB,EAAY,EAC5B,EAAQ,GAAG,EAAc,GAAG,EAAY,IACxC,EAAW,EAAY,EACvB,EAAY,EAAc,EAAQ,SAAS,EACjD,OAAO,IAAI,SAAqB,EAAS,IAAW,CAChD,IAAM,EAAU,eAAiB,CAE7B,KADqB,oBACrB,CAAA,EAAS,OAAW,MAAM,+BAA+B,CAAC,CAC9D,EAAG,KAAK,OAAO,MAAM,SAAS,EAC9B,KAAK,cAAgB,CACjB,QACA,QACA,WACA,gBACA,YACA,UACA,SACA,SACJ,EACA,KAAU,iBAAiB,EAAS,EAAO,CAAQ,CAAC,CAC/C,KAAM,GAAQ,EAAM,eAAe,SAAS,QAAQ,CAAG,CAAC,CAAC,CACzD,MAAO,GAAU,CAEd,KADqB,oBACrB,CAAA,EAAS,OAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CAC7E,CAAC,CACT,CAAC,CACL,CAEA,MAAc,iBAAiB,EAA4B,EAAe,EAAkB,CACxF,IAAM,EAAS,MAAM,KAAK,WAAW,EAC/B,EAAQ,IAAI,gBAAgB,CAC9B,IAAK,KAAK,OAAO,QAAQ,YAAY,EACrC,UAAW,EAAO,UAClB,aAAc,EAAO,aACrB,cAAe,OACf,MAAO,KAAK,OAAO,MACnB,QACA,eAAgB,MAAM,EAAc,CAAQ,EAC5C,sBAAuB,MAC3B,CAAC,EACD,OAAO,EAAqB,CACxB,QAAS,KAAK,OAAO,QACrB,QAAS,KAAK,OAAO,QAAQ,YAAY,EACzC,QACA,SACJ,CAAC,CACL,CAEA,WAAmB,EAAgB,CAC/B,MAAO,GAAG,KAAK,OAAO,QAAQ,YAAY,EAAE,QAAQ,GACxD,CAEA,MAAc,cAAc,EAAiD,CACzE,IAAM,EAAQ,EAAY,EACpB,EAAW,EAAY,EAC7B,eAAe,QAAQ,KAAK,WAAW,OAAO,EAAG,CAAK,EACtD,eAAe,QAAQ,KAAK,WAAW,UAAU,EAAG,CAAQ,EAC5D,IAAM,EAAY,EAAc,EAAQ,SAAS,EAIjD,OAHI,EAAW,eAAe,QAAQ,KAAK,WAAW,aAAa,EAAG,CAAS,EAC1E,eAAe,WAAW,KAAK,WAAW,aAAa,CAAC,EAC7D,OAAO,SAAS,OAAO,MAAM,KAAK,iBAAiB,EAAS,EAAO,CAAQ,CAAC,EACrE,CAAE,OAAQ,aAAc,CACnC,CAEA,MAAc,UAAU,EAAiD,CACrE,GAAI,KAAK,SAAW,CAAC,KAAK,QAAQ,MAAM,OAEpC,OADA,KAAK,QAAQ,MAAM,MAAM,EAClB,IAAI,SAAS,EAAS,IAAW,CACpC,IAAM,EAAU,KAAK,QACf,EAAkB,EAAQ,QAC1B,EAAiB,EAAQ,OAC/B,EAAQ,QAAW,GAAU,CACzB,EAAgB,CAAK,EACrB,EAAQ,CAAK,CACjB,EACA,EAAQ,OAAU,GAAU,CACxB,EAAe,CAAK,EACpB,EAAO,CAAK,CAChB,CACJ,CAAC,EAEL,GAAM,CAAE,QAAO,SAAQ,OAAM,aAAc,KAAK,OAAO,MACjD,EAAO,KAAK,IAAI,EAAG,OAAO,SAAW,OAAO,WAAa,GAAS,CAAC,EACnE,EAAM,KAAK,IAAI,EAAG,OAAO,SAAW,OAAO,YAAc,GAAU,CAAC,EACpE,EAAQ,OAAO,KACjB,cACA,EACA,mBAAmB,EAAM,UAAU,EAAO,QAAQ,KAAK,MAAM,CAAI,EAAE,OAAO,KAAK,MAAM,CAAG,GAC5F,EACA,GAAI,CAAC,EAAO,OAAO,KAAK,cAAc,CAAE,GAAG,EAAS,aAAc,UAAW,CAAC,EAE9E,IAAM,EAAgB,EAAY,EAC5B,EAAQ,GAAG,EAAc,GAAG,EAAY,IACxC,EAAW,EAAY,EACvB,EAAY,EAAc,EAAQ,SAAS,EACjD,OAAO,IAAI,SAAqB,EAAS,IAAW,CAChD,IAAM,EAAQ,gBAAkB,CACvB,EAAM,QAEX,KADqB,cACrB,CAAA,EAAS,QAAQ,CAAE,OAAQ,WAAY,CAAC,CAC5C,EAAG,GAAG,EACA,EAAU,eAAiB,CAC7B,IAAM,EAAU,KAAK,cAAc,EACnC,EAAM,MAAM,EACZ,GAAS,OAAW,MAAM,8BAA8B,CAAC,CAC7D,EAAG,CAAS,EACZ,KAAK,QAAU,CACX,QACA,QACA,WACA,gBACA,YACA,UACA,SACA,QACA,SACJ,EACA,KAAU,iBAAiB,EAAS,EAAO,CAAQ,CAAC,CAC/C,KAAM,GAAQ,EAAM,SAAS,QAAQ,CAAG,CAAC,CAAC,CAC1C,MAAO,GAAU,CACd,IAAM,EAAU,KAAK,cAAc,EACnC,EAAM,MAAM,EACZ,GAAS,OAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CAC7E,CAAC,CACT,CAAC,CACL,CAEA,eAAwB,CACpB,IAAM,EAAU,KAAK,QAKrB,OAJK,GACL,cAAc,EAAQ,KAAK,EAC3B,aAAa,EAAQ,OAAO,EAC5B,KAAK,QAAU,KACR,GAJc,IAKzB,CAEA,qBAA8B,CAC1B,IAAM,EAAU,KAAK,cAIrB,OAHK,GACL,aAAa,EAAQ,OAAO,EAC5B,KAAK,cAAgB,KACd,GAHc,IAIzB,CAEA,eAA0B,GAA8C,CACpE,IAAM,EAAgB,KAAK,cAC3B,GACI,GACA,EAAM,SAAW,OAAO,SAAS,QACjC,EAAM,SAAW,EAAc,MAAM,eACrC,EAAM,MAAM,OAAA,wBACZ,EAAM,KAAK,gBAAkB,EAAc,eAC3C,EAAqB,EAAM,KAAK,OAAS,IAAI,IAAM,EAAc,eACjE,EAAM,KAAK,QAAU,EAAc,MACrC,CACE,IAAM,EAAY,KAAK,oBAAoB,EAC3C,GAAI,EAAM,KAAK,OAAS,CAAC,EAAM,KAAK,KAAM,CACtC,EAAU,OACF,MAAM,EAAM,KAAK,OAAS,sCAAsC,CACxE,EACA,MACJ,CACA,KAAU,aAAa,EAAM,KAAK,KAAM,EAAM,KAAK,MAAO,EAAU,QAAQ,CAAC,CACxE,SAAW,EAAU,QAAQ,CAAE,OAAQ,gBAAiB,KAAM,KAAK,QAAQ,CAAG,CAAC,CAAC,CAAC,CACjF,MAAO,GACJ,EAAU,OAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CAC9E,EACJ,MACJ,CACA,IAAM,EAAU,KAAK,QACf,EAAU,EAAM,KACtB,GACI,CAAC,GACD,EAAM,SAAW,OAAO,SAAS,QACjC,EAAM,SAAW,EAAQ,OACzB,GAAS,OAAA,wBACT,EAAQ,gBAAkB,EAAQ,eAClC,EAAqB,EAAQ,OAAS,IAAI,IAAM,EAAQ,eACxD,EAAQ,QAAU,EAAQ,MAE1B,OAEJ,IAAM,EAAY,KAAK,cAAc,EACrC,GAAK,EACL,IAAI,EAAQ,OAAS,CAAC,EAAQ,KAAM,CAChC,EAAU,MAAM,MAAM,EACtB,EAAU,OAAW,MAAM,EAAQ,OAAS,sCAAsC,CAAC,EACnF,MACJ,CACA,KAAU,aAAa,EAAQ,KAAM,EAAQ,MAAO,EAAU,QAAQ,CAAC,CAClE,SAAW,CACR,EAAU,MAAM,MAAM,EAClB,EAAU,WAAW,OAAO,QAAQ,aAAa,KAAM,GAAI,EAAU,SAAS,EAClF,EAAU,QAAQ,CAAE,OAAQ,gBAAiB,KAAM,KAAK,QAAQ,CAAG,CAAC,CACxE,CAAC,CAAC,CACD,MAAO,GAAU,CACd,EAAU,MAAM,MAAM,EACtB,EAAU,OAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CAC9E,CAAC,CAVL,CAWJ,EAEA,MAAc,aAAa,EAAc,EAAe,EAAkB,CACtE,GAAI,CAAC,GAAS,CAAC,EAAU,MAAU,MAAM,6CAA6C,EACtF,IAAM,EAAS,MAAM,KAAK,WAAW,EACrC,KAAK,OAAO,MAAM,EAAa,KAAK,OAAQ,EAAM,EAAU,CAAM,CAAC,CACvE,CAEA,MAAM,yBAAyB,EAAc,EAAe,CACxD,IAAM,EAAW,eAAe,QAAQ,KAAK,WAAW,OAAO,CAAC,EAC1D,EAAW,eAAe,QAAQ,KAAK,WAAW,UAAU,CAAC,EAGnE,GAFA,eAAe,WAAW,KAAK,WAAW,OAAO,CAAC,EAClD,eAAe,WAAW,KAAK,WAAW,UAAU,CAAC,EACjD,CAAC,GAAY,CAAC,GAAY,IAAU,EACpC,MAAU,MAAM,6CAA6C,EAEjE,MAAM,KAAK,aAAa,EAAM,EAAO,CAAQ,CACjD,CACJ,EAEA,SAAgB,EAAiB,EAAgC,CAC7D,OAAO,IAAI,EAAiB,CAAM,CACtC"}

package/dist/{PofsisAuthClient-DJSQb0qq.js → PofsisAuthClient-c9BY8iNp.js}

@@ -164,15 +164,16 @@ function C(e) {
 	return t > 0 ? e.slice(0, t) : void 0;
 }
 function w(e = window.location.origin) {
-	if (!window.opener || window.opener.closed) return !1;
-	let t = new URLSearchParams(window.location.search), n = t.get("state") || void 0, r = {
+	let t = window.opener && !window.opener.closed ? window.opener : window.parent === window ? null : window.parent;
+	if (!t) return !1;
+	let n = new URLSearchParams(window.location.search), r = n.get("state") || void 0, i = {
 		type: S,
-		code: t.get("code") || void 0,
-		state: n,
-		error: t.get("error") || void 0,
-		correlationId: C(n || null)
+		code: n.get("code") || void 0,
+		state: r,
+		error: n.get("error") || void 0,
+		correlationId: C(r || null)
 	};
-	return window.opener.postMessage(r, e), window.close(), !0;
+	return t.postMessage(i, e), t === window.opener && window.close(), !0;
 }
 //#endregion
 //#region src/auth/pkce.ts
@@ -195,6 +196,7 @@ var O = (e) => e?.startsWith("/") && !e.startsWith("//") ? e : void 0, k = (e) =
 	refreshPromise = null;
 	subscribers = /* @__PURE__ */ new Set();
 	attempt = null;
+	iframeAttempt = null;
 	listening = !1;
 	constructor(e) {
 		this.config = f(e), this.attach();
@@ -205,7 +207,7 @@ var O = (e) => e?.startsWith("/") && !e.startsWith("//") ? e : void 0, k = (e) =
 	destroy() {
 		window.removeEventListener("message", this.onPopupMessage), this.listening = !1;
 		let e = this.finishAttempt();
-		e && (e.popup.close(), e.resolve({ status: "cancelled" })), this.subscribers.clear();
+		e && (e.popup.close(), e.resolve({ status: "cancelled" })), this.cancelIframeLogin(), this.subscribers.clear();
 	}
 	getUser() {
 		return this.session?.user ?? null;
@@ -273,8 +275,11 @@ var O = (e) => e?.startsWith("/") && !e.startsWith("//") ? e : void 0, k = (e) =
 		});
 	}
 	async login(e = {}) {
-		let t = y(e);
-		return (e.presentation ?? "popup") === "popup" ? this.openPopup({
+		let t = y(e), n = e.presentation ?? "popup";
+		return n === "popup" ? this.openPopup({
+			...e,
+			...t
+		}) : n === "iframe" ? this.openIframe({
 			...e,
 			...t
 		}) : this.startRedirect({
@@ -282,6 +287,32 @@ var O = (e) => e?.startsWith("/") && !e.startsWith("//") ? e : void 0, k = (e) =
 			...t
 		});
 	}
+	cancelIframeLogin() {
+		this.finishIframeAttempt()?.resolve({ status: "cancelled" });
+	}
+	openIframe(e) {
+		let t = e.target;
+		if (!t) return Promise.reject(/* @__PURE__ */ Error("POFSIS Auth iframe target is required."));
+		this.cancelIframeLogin();
+		let n = E(), r = `${n}.${E()}`, i = E(), a = O(e.returnUrl);
+		return new Promise((o, s) => {
+			let c = setTimeout(() => {
+				this.finishIframeAttempt()?.reject(/* @__PURE__ */ Error("POFSIS Auth iframe timed out."));
+			}, this.config.popup.timeoutMs);
+			this.iframeAttempt = {
+				frame: t,
+				state: r,
+				verifier: i,
+				correlationId: n,
+				returnUrl: a,
+				resolve: o,
+				reject: s,
+				timeout: c
+			}, this.authorizationUrl(e, r, i).then((e) => t.contentWindow?.location.replace(e)).catch((e) => {
+				this.finishIframeAttempt()?.reject(e instanceof Error ? e : Error(String(e)));
+			});
+		});
+	}
 	async authorizationUrl(e, t, n) {
 		let r = await this.loadClient(), i = new URLSearchParams({
 			app: this.config.appName.toUpperCase(),
@@ -351,22 +382,39 @@ var O = (e) => e?.startsWith("/") && !e.startsWith("//") ? e : void 0, k = (e) =
 		let e = this.attempt;
 		return e ? (clearInterval(e.timer), clearTimeout(e.timeout), this.attempt = null, e) : null;
 	}
+	finishIframeAttempt() {
+		let e = this.iframeAttempt;
+		return e ? (clearTimeout(e.timeout), this.iframeAttempt = null, e) : null;
+	}
 	onPopupMessage = (e) => {
-		let t = this.attempt, n = e.data;
-		if (!t || e.origin !== window.location.origin || e.source !== t.popup || n?.type !== "pofsis-auth:callback" || n.correlationId !== t.correlationId || C(n.state || null) !== t.correlationId || n.state !== t.state) return;
-		let r = this.finishAttempt();
-		if (r) {
-			if (n.error || !n.code) {
-				r.popup.close(), r.reject(Error(n.error || "POFSIS Auth callback was incomplete."));
+		let t = this.iframeAttempt;
+		if (t && e.origin === window.location.origin && e.source === t.frame.contentWindow && e.data?.type === "pofsis-auth:callback" && e.data.correlationId === t.correlationId && C(e.data.state || null) === t.correlationId && e.data.state === t.state) {
+			let t = this.finishIframeAttempt();
+			if (e.data.error || !e.data.code) {
+				t.reject(Error(e.data.error || "POFSIS Auth callback was incomplete."));
+				return;
+			}
+			this.completeCode(e.data.code, e.data.state, t.verifier).then(() => t.resolve({
+				status: "authenticated",
+				user: this.getUser()
+			})).catch((e) => t.reject(e instanceof Error ? e : Error(String(e))));
+			return;
+		}
+		let n = this.attempt, r = e.data;
+		if (!n || e.origin !== window.location.origin || e.source !== n.popup || r?.type !== "pofsis-auth:callback" || r.correlationId !== n.correlationId || C(r.state || null) !== n.correlationId || r.state !== n.state) return;
+		let i = this.finishAttempt();
+		if (i) {
+			if (r.error || !r.code) {
+				i.popup.close(), i.reject(Error(r.error || "POFSIS Auth callback was incomplete."));
 				return;
 			}
-			this.completeCode(n.code, n.state, r.verifier).then(() => {
-				r.popup.close(), r.returnUrl && window.history.replaceState(null, "", r.returnUrl), r.resolve({
+			this.completeCode(r.code, r.state, i.verifier).then(() => {
+				i.popup.close(), i.returnUrl && window.history.replaceState(null, "", i.returnUrl), i.resolve({
 					status: "authenticated",
 					user: this.getUser()
 				});
 			}).catch((e) => {
-				r.popup.close(), r.reject(e instanceof Error ? e : Error(String(e)));
+				i.popup.close(), i.reject(e instanceof Error ? e : Error(String(e)));
 			});
 		}
 	};
@@ -387,4 +435,4 @@ function j(e) {
 //#endregion
 export { f as a, c, b as i, l, j as n, u as o, w as r, s, A as t };
 
-//# sourceMappingURL=PofsisAuthClient-DJSQb0qq.js.map
+//# sourceMappingURL=PofsisAuthClient-c9BY8iNp.js.map

package/dist/PofsisAuthClient-c9BY8iNp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PofsisAuthClient-c9BY8iNp.js","names":[],"sources":["../src/auth/api.ts","../src/auth/config.ts","../src/auth/authLaunch.ts","../src/core/popupProtocol.ts","../src/auth/pkce.ts","../src/core/PofsisAuthClient.ts"],"sourcesContent":["import type { AccountProfile, OAuthClientConfig, PofsisAuthConfig, TokenResponse } from '../types'\n\nasync function parseJson<T>(response: Response): Promise<T> {\n    if (response.status === 204) return null as T\n    const text = await response.text()\n    if (!text) return null as T\n    return JSON.parse(text) as T\n}\n\nasync function request<T>(\n    config: PofsisAuthConfig,\n    path: string,\n    init?: RequestInit,\n): Promise<{ status: number; data: T }> {\n    const response = await fetch(`${config.apiBaseUrl}${path}`, {\n        credentials: 'include',\n        ...init,\n        headers: {\n            Accept: 'application/json',\n            ...(init?.body && !(init.body instanceof FormData)\n                ? { 'Content-Type': 'application/json' }\n                : {}),\n            ...init?.headers,\n        },\n    })\n    if (!response.ok) {\n        const error = new Error(`Auth API ${path} failed (${response.status})`)\n        ;(error as Error & { status?: number }).status = response.status\n        throw error\n    }\n    return { status: response.status, data: await parseJson<T>(response) }\n}\n\nexport async function fetchOAuthClient(config: PofsisAuthConfig) {\n    const identity = encodeURIComponent(config.appName.toUpperCase())\n    const origin = encodeURIComponent(window.location.origin)\n    const { data } = await request<OAuthClientConfig>(\n        config,\n        `/oauth/clients/${identity}?origin=${origin}`,\n    )\n    return data\n}\n\nexport async function exchangeCode(\n    config: PofsisAuthConfig,\n    code: string,\n    verifier: string,\n    client: Pick<OAuthClientConfig, 'client_id' | 'redirect_uri'>,\n) {\n    const { data } = await request<TokenResponse>(config, '/oauth/token', {\n        method: 'POST',\n        body: JSON.stringify({\n            grant_type: 'authorization_code',\n            client_id: client.client_id,\n            redirect_uri: client.redirect_uri,\n            code,\n            code_verifier: verifier,\n        }),\n    })\n    return data\n}\n\nexport async function refresh(config: PofsisAuthConfig, clientId: string) {\n    const { data } = await request<TokenResponse | null>(config, '/oauth/token', {\n        method: 'POST',\n        body: JSON.stringify({\n            grant_type: 'refresh_token',\n            client_id: clientId,\n        }),\n    })\n    return data || null\n}\n\nexport async function checkSession(config: PofsisAuthConfig) {\n    try {\n        await request(config, '/auth/session')\n        return true\n    } catch {\n        return false\n    }\n}\n\nexport async function signOut(config: PofsisAuthConfig) {\n    await request(config, '/auth/logout', { method: 'POST' })\n}\n\nexport async function getAccountProfile(config: PofsisAuthConfig, accessToken: string) {\n    const { data } = await request<AccountProfile>(config, '/auth/profile/me', {\n        headers: { Authorization: `Bearer ${accessToken}` },\n    })\n    return data\n}\n\nexport async function updateAccountProfile(\n    config: PofsisAuthConfig,\n    accessToken: string,\n    profile: { firstName?: string | null; lastName?: string | null },\n) {\n    const { data } = await request<AccountProfile>(config, '/auth/profile/me', {\n        method: 'PATCH',\n        headers: { Authorization: `Bearer ${accessToken}` },\n        body: JSON.stringify(profile),\n    })\n    return data\n}\n\nexport async function uploadAccountProfileImage(\n    config: PofsisAuthConfig,\n    accessToken: string,\n    kind: 'profile' | 'cover',\n    file: File,\n) {\n    const body = new FormData()\n    body.append('file', file)\n    const { data } = await request<AccountProfile>(config, `/auth/profile/me/images/${kind}`, {\n        method: 'POST',\n        headers: { Authorization: `Bearer ${accessToken}` },\n        body,\n    })\n    return data\n}\n\nexport async function deleteAccountProfileImage(\n    config: PofsisAuthConfig,\n    accessToken: string,\n    kind: 'profile' | 'cover',\n) {\n    const { data } = await request<AccountProfile>(config, `/auth/profile/me/images/${kind}`, {\n        method: 'DELETE',\n        headers: { Authorization: `Bearer ${accessToken}` },\n    })\n    return data\n}\n","import type { PofsisAuthClientConfig, ResolvedPofsisAuthConfig } from '../types'\n\nfunction stripTrailingSlash(value: string) {\n    return value.replace(/\\/$/, '')\n}\n\nexport type ConfigOverrides = Partial<PofsisAuthClientConfig>\n\n/**\n * Validate and normalize explicitly supplied runtime configuration.\n */\nexport function resolveConfig(overrides: ConfigOverrides = {}): ResolvedPofsisAuthConfig {\n    const appName = overrides.appName?.trim()\n    const apiBaseUrl = overrides.apiBaseUrl?.trim()\n    const authUrl = overrides.authUrl?.trim()\n    const scope = overrides.scope?.trim() || 'openid profile email'\n    const callbackPath = overrides.callbackPath?.trim() || '/auth/callback'\n    const popup = {\n        width: overrides.popup?.width ?? 480,\n        height: overrides.popup?.height ?? 720,\n        name: overrides.popup?.name?.trim() || 'pofsis-auth',\n        timeoutMs: overrides.popup?.timeoutMs ?? 300_000,\n    }\n\n    const missing: string[] = []\n    if (!appName) missing.push('appName')\n    if (!apiBaseUrl) missing.push('apiBaseUrl')\n    if (!authUrl) missing.push('authUrl')\n    if (missing.length) {\n        throw new Error(`@pofsis-nbt/pofsis-auth missing config: ${missing.join(', ')}`)\n    }\n    if (!appName || !apiBaseUrl || !authUrl) {\n        throw new Error('@pofsis-nbt/pofsis-auth missing config')\n    }\n    if (!callbackPath.startsWith('/') || callbackPath.startsWith('//')) {\n        throw new Error('@pofsis-nbt/pofsis-auth callbackPath must be application-relative')\n    }\n    if (popup.width <= 0 || popup.height <= 0 || popup.timeoutMs <= 0) {\n        throw new Error('@pofsis-nbt/pofsis-auth popup dimensions and timeout must be positive')\n    }\n\n    return {\n        appName,\n        apiBaseUrl: stripTrailingSlash(apiBaseUrl),\n        authUrl: stripTrailingSlash(authUrl),\n        scope,\n        callbackPath,\n        popup,\n    }\n}\n","import type { AuthLaunchOptions, AuthMethod, AuthScreen } from '../types'\n\nconst EMAIL = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\nconst PHILIPPINE_MOBILE = /^(?:\\+63|63|0)?9\\d{9}$/\nconst METHODS = new Set<AuthMethod>(['password', 'passkey', 'otp'])\nconst SCREENS = new Set<AuthScreen>(['login', 'signup', 'reset'])\nconst MAX_HINT_LENGTH = 320\n\nfunction normalizeHint(value: unknown, emailOnly = false): string | undefined {\n    const candidate = typeof value === 'string' ? value.trim() : ''\n    if (!candidate || candidate.length > MAX_HINT_LENGTH) return undefined\n    if (EMAIL.test(candidate)) return candidate.toLowerCase()\n    const compact = candidate.replace(/[\\s()-]/g, '')\n    if (emailOnly || !PHILIPPINE_MOBILE.test(compact)) return undefined\n    return `+63${compact.replace(/^(?:\\+63|63|0)/, '')}`\n}\n\nexport function normalizeAuthLaunchOptions(\n    value?: AuthLaunchOptions | string | null,\n    defaultScreen: AuthScreen = 'login',\n) {\n    const options = typeof value === 'string' ? { returnUrl: value } : value || {}\n    const requestedScreen = options.screen === 'register' ? 'signup' : options.screen\n    const screen = SCREENS.has(requestedScreen as AuthScreen)\n        ? (requestedScreen as AuthScreen)\n        : defaultScreen\n    const requestedMethod = METHODS.has(options.method as AuthMethod)\n        ? (options.method as AuthMethod)\n        : undefined\n    const method =\n        screen === 'login' ||\n        (screen === 'signup' && (requestedMethod === 'password' || requestedMethod === 'otp'))\n            ? requestedMethod\n            : undefined\n    return {\n        returnUrl: options.returnUrl,\n        screen,\n        loginHint: normalizeHint(options.loginHint),\n        method,\n    }\n}\n\nexport function authLaunchOptionsFromSearch(search: string) {\n    const params = new URLSearchParams(search)\n    const canonicalHint = params.get('login_hint')\n    const loginHint =\n        canonicalHint !== null\n            ? normalizeHint(canonicalHint)\n            : normalizeHint(params.get('email'), true)\n    return normalizeAuthLaunchOptions({\n        screen: (params.get('screen') || undefined) as AuthLaunchOptions['screen'],\n        loginHint,\n        method: (params.get('method') || undefined) as AuthLaunchOptions['method'],\n    })\n}\n\nexport function buildAuthDestination({\n    authUrl,\n    appName,\n    query,\n    options,\n}: {\n    authUrl: string\n    appName: string\n    query: URLSearchParams\n    options?: AuthLaunchOptions\n}) {\n    const launch = normalizeAuthLaunchOptions(options)\n    const authorizationUrl = new URL(authUrl)\n    authorizationUrl.search = query.toString()\n    if (launch.loginHint) authorizationUrl.searchParams.set('login_hint', launch.loginHint)\n    if (launch.screen === 'login' && launch.method) {\n        authorizationUrl.searchParams.set('method', launch.method)\n    }\n    if (launch.screen === 'login') return authorizationUrl.toString()\n\n    const pathname = launch.screen === 'signup' ? '/signup' : '/forgot-password'\n    const destination = new URL(pathname, authorizationUrl)\n    destination.searchParams.set('app', appName)\n    destination.searchParams.set(\n        'return_to',\n        `${authorizationUrl.pathname}${authorizationUrl.search}`,\n    )\n    if (launch.loginHint) destination.searchParams.set('login_hint', launch.loginHint)\n    if (launch.screen === 'signup') {\n        destination.searchParams.set('method', launch.method || 'password')\n    }\n    return destination.toString()\n}\n","export const POPUP_MESSAGE_TYPE = 'pofsis-auth:callback'\n\nexport type PopupCallbackMessage = {\n    type: typeof POPUP_MESSAGE_TYPE\n    code?: string\n    state?: string\n    error?: string\n    correlationId?: string\n}\n\nexport function correlationFromState(state: string | null) {\n    if (!state) return undefined\n    const separator = state.indexOf('.')\n    return separator > 0 ? state.slice(0, separator) : undefined\n}\n\nexport function relayPopupCallback(targetOrigin = window.location.origin) {\n    const target =\n        window.opener && !window.opener.closed\n            ? window.opener\n            : window.parent !== window\n              ? window.parent\n              : null\n    if (!target) return false\n    const params = new URLSearchParams(window.location.search)\n    const state = params.get('state') || undefined\n    const message: PopupCallbackMessage = {\n        type: POPUP_MESSAGE_TYPE,\n        code: params.get('code') || undefined,\n        state,\n        error: params.get('error') || undefined,\n        correlationId: correlationFromState(state || null),\n    }\n    target.postMessage(message, targetOrigin)\n    if (target === window.opener) window.close()\n    return true\n}\n","const encode = (bytes: Uint8Array) =>\n    btoa(String.fromCharCode(...bytes))\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '')\n\nexport const randomValue = () => encode(crypto.getRandomValues(new Uint8Array(32)))\n\nexport async function pkceChallenge(verifier: string) {\n    return encode(\n        new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))),\n    )\n}\n","import { checkSession, exchangeCode, fetchOAuthClient, refresh, signOut } from '../auth/api'\nimport { buildAuthDestination, normalizeAuthLaunchOptions } from '../auth/authLaunch'\nimport { resolveConfig } from '../auth/config'\nimport { pkceChallenge, randomValue } from '../auth/pkce'\nimport type {\n    AuthLaunchOptions,\n    AuthResult,\n    OAuthClientConfig,\n    PofsisAuthClientConfig,\n    ResolvedPofsisAuthConfig,\n    PofsisUser,\n    SessionPayload,\n} from '../types'\nimport {\n    correlationFromState,\n    POPUP_MESSAGE_TYPE,\n    type PopupCallbackMessage,\n} from './popupProtocol'\n\ntype Subscriber = (session: SessionPayload | null) => void\ntype PopupAttempt = {\n    popup: Window\n    state: string\n    verifier: string\n    correlationId: string\n    returnUrl?: string\n    resolve: (result: AuthResult) => void\n    reject: (error: Error) => void\n    timer: ReturnType<typeof setInterval>\n    timeout: ReturnType<typeof setTimeout>\n}\n\ntype IframeAttempt = Omit<PopupAttempt, 'popup' | 'timer'> & { frame: HTMLIFrameElement }\n\nconst safeLocalPath = (value?: string) =>\n    value?.startsWith('/') && !value.startsWith('//') ? value : undefined\n\nconst toSession = (result: { token_type: string; expires_in: number; user: PofsisUser }) => ({\n    token_type: result.token_type,\n    expires_in: result.expires_in,\n    user: result.user,\n})\n\nexport class PofsisAuthClient {\n    readonly config: ResolvedPofsisAuthConfig\n    private token: string | null = null\n    private session: SessionPayload | null = null\n    private client: OAuthClientConfig | null = null\n    private clientPromise: Promise<OAuthClientConfig> | null = null\n    private refreshPromise: Promise<void> | null = null\n    private subscribers = new Set<Subscriber>()\n    private attempt: PopupAttempt | null = null\n    private iframeAttempt: IframeAttempt | null = null\n    private listening = false\n\n    constructor(config: PofsisAuthClientConfig) {\n        this.config = resolveConfig(config)\n        this.attach()\n    }\n\n    private attach() {\n        if (this.listening) return\n        window.addEventListener('message', this.onPopupMessage)\n        this.listening = true\n    }\n\n    destroy() {\n        window.removeEventListener('message', this.onPopupMessage)\n        this.listening = false\n        const attempt = this.finishAttempt()\n        if (attempt) {\n            attempt.popup.close()\n            attempt.resolve({ status: 'cancelled' })\n        }\n        this.cancelIframeLogin()\n        this.subscribers.clear()\n    }\n\n    getUser() {\n        return this.session?.user ?? null\n    }\n\n    getSession() {\n        return this.session\n    }\n\n    getAccessToken() {\n        return this.token\n    }\n\n    subscribe(listener: Subscriber) {\n        this.attach()\n        this.subscribers.add(listener)\n        listener(this.session)\n        return () => {\n            this.subscribers.delete(listener)\n        }\n    }\n\n    private emit() {\n        for (const listener of this.subscribers) listener(this.session)\n    }\n\n    private accept(result: Awaited<ReturnType<typeof exchangeCode>>) {\n        this.token = result.access_token\n        this.session = toSession(result)\n        this.emit()\n    }\n\n    private loadClient() {\n        if (!this.clientPromise) {\n            this.clientPromise = fetchOAuthClient(this.config)\n                .then((client) => (this.client = client))\n                .catch((error) => {\n                    this.clientPromise = null\n                    throw error\n                })\n        }\n        return this.clientPromise\n    }\n\n    getOAuthClient() {\n        return this.loadClient()\n    }\n\n    async refreshSession() {\n        const client = await this.loadClient()\n        if (!this.refreshPromise) {\n            this.refreshPromise = refresh(this.config, client.client_id)\n                .then((result) => {\n                    if (result) this.accept(result)\n                    else this.clearSession()\n                })\n                .finally(() => (this.refreshPromise = null))\n        }\n        return this.refreshPromise\n    }\n\n    async isRemoteSessionActive() {\n        return checkSession(this.config)\n    }\n\n    clearSession() {\n        this.token = null\n        this.session = null\n        this.emit()\n    }\n\n    replaceUser(user: PofsisUser) {\n        if (!this.session) return\n        this.session = { ...this.session, user }\n        this.emit()\n    }\n\n    async logout() {\n        try {\n            await signOut(this.config)\n        } finally {\n            this.clearSession()\n        }\n    }\n\n    signup(options: Omit<AuthLaunchOptions, 'screen'> = {}) {\n        return this.login({ ...options, screen: 'signup' })\n    }\n\n    resetPassword(options: Omit<AuthLaunchOptions, 'screen'> = {}) {\n        return this.login({ ...options, screen: 'reset' })\n    }\n\n    async login(options: AuthLaunchOptions = {}): Promise<AuthResult> {\n        const launch = normalizeAuthLaunchOptions(options)\n        const presentation = options.presentation ?? 'popup'\n        if (presentation === 'popup') return this.openPopup({ ...options, ...launch })\n        if (presentation === 'iframe') return this.openIframe({ ...options, ...launch })\n        return this.startRedirect({ ...options, ...launch })\n    }\n\n    cancelIframeLogin() {\n        const attempt = this.finishIframeAttempt()\n        attempt?.resolve({ status: 'cancelled' })\n    }\n\n    private openIframe(options: AuthLaunchOptions): Promise<AuthResult> {\n        const frame = options.target\n        if (!frame) return Promise.reject(new Error('POFSIS Auth iframe target is required.'))\n        this.cancelIframeLogin()\n        const correlationId = randomValue()\n        const state = `${correlationId}.${randomValue()}`\n        const verifier = randomValue()\n        const returnUrl = safeLocalPath(options.returnUrl)\n        return new Promise<AuthResult>((resolve, reject) => {\n            const timeout = setTimeout(() => {\n                const attempt = this.finishIframeAttempt()\n                attempt?.reject(new Error('POFSIS Auth iframe timed out.'))\n            }, this.config.popup.timeoutMs)\n            this.iframeAttempt = {\n                frame,\n                state,\n                verifier,\n                correlationId,\n                returnUrl,\n                resolve,\n                reject,\n                timeout,\n            }\n            void this.authorizationUrl(options, state, verifier)\n                .then((url) => frame.contentWindow?.location.replace(url))\n                .catch((error) => {\n                    const attempt = this.finishIframeAttempt()\n                    attempt?.reject(error instanceof Error ? error : new Error(String(error)))\n                })\n        })\n    }\n\n    private async authorizationUrl(options: AuthLaunchOptions, state: string, verifier: string) {\n        const client = await this.loadClient()\n        const query = new URLSearchParams({\n            app: this.config.appName.toUpperCase(),\n            client_id: client.client_id,\n            redirect_uri: client.redirect_uri,\n            response_type: 'code',\n            scope: this.config.scope,\n            state,\n            code_challenge: await pkceChallenge(verifier),\n            code_challenge_method: 'S256',\n        })\n        return buildAuthDestination({\n            authUrl: this.config.authUrl,\n            appName: this.config.appName.toUpperCase(),\n            query,\n            options,\n        })\n    }\n\n    private storageKey(suffix: string) {\n        return `${this.config.appName.toLowerCase()}.auth.${suffix}`\n    }\n\n    private async startRedirect(options: AuthLaunchOptions): Promise<AuthResult> {\n        const state = randomValue()\n        const verifier = randomValue()\n        sessionStorage.setItem(this.storageKey('state'), state)\n        sessionStorage.setItem(this.storageKey('verifier'), verifier)\n        const returnUrl = safeLocalPath(options.returnUrl)\n        if (returnUrl) sessionStorage.setItem(this.storageKey('return-path'), returnUrl)\n        else sessionStorage.removeItem(this.storageKey('return-path'))\n        window.location.assign(await this.authorizationUrl(options, state, verifier))\n        return { status: 'redirecting' }\n    }\n\n    private async openPopup(options: AuthLaunchOptions): Promise<AuthResult> {\n        if (this.attempt && !this.attempt.popup.closed) {\n            this.attempt.popup.focus()\n            return new Promise((resolve, reject) => {\n                const current = this.attempt!\n                const originalResolve = current.resolve\n                const originalReject = current.reject\n                current.resolve = (value) => {\n                    originalResolve(value)\n                    resolve(value)\n                }\n                current.reject = (error) => {\n                    originalReject(error)\n                    reject(error)\n                }\n            })\n        }\n        const { width, height, name, timeoutMs } = this.config.popup\n        const left = Math.max(0, window.screenX + (window.outerWidth - width) / 2)\n        const top = Math.max(0, window.screenY + (window.outerHeight - height) / 2)\n        const popup = window.open(\n            'about:blank',\n            name,\n            `popup=yes,width=${width},height=${height},left=${Math.round(left)},top=${Math.round(top)}`,\n        )\n        if (!popup) return this.startRedirect({ ...options, presentation: 'redirect' })\n\n        const correlationId = randomValue()\n        const state = `${correlationId}.${randomValue()}`\n        const verifier = randomValue()\n        const returnUrl = safeLocalPath(options.returnUrl)\n        return new Promise<AuthResult>((resolve, reject) => {\n            const timer = setInterval(() => {\n                if (!popup.closed) return\n                const attempt = this.finishAttempt()\n                attempt?.resolve({ status: 'cancelled' })\n            }, 250)\n            const timeout = setTimeout(() => {\n                const attempt = this.finishAttempt()\n                popup.close()\n                attempt?.reject(new Error('POFSIS Auth popup timed out.'))\n            }, timeoutMs)\n            this.attempt = {\n                popup,\n                state,\n                verifier,\n                correlationId,\n                returnUrl,\n                resolve,\n                reject,\n                timer,\n                timeout,\n            }\n            void this.authorizationUrl(options, state, verifier)\n                .then((url) => popup.location.replace(url))\n                .catch((error) => {\n                    const attempt = this.finishAttempt()\n                    popup.close()\n                    attempt?.reject(error instanceof Error ? error : new Error(String(error)))\n                })\n        })\n    }\n\n    private finishAttempt() {\n        const attempt = this.attempt\n        if (!attempt) return null\n        clearInterval(attempt.timer)\n        clearTimeout(attempt.timeout)\n        this.attempt = null\n        return attempt\n    }\n\n    private finishIframeAttempt() {\n        const attempt = this.iframeAttempt\n        if (!attempt) return null\n        clearTimeout(attempt.timeout)\n        this.iframeAttempt = null\n        return attempt\n    }\n\n    private onPopupMessage = (event: MessageEvent<PopupCallbackMessage>) => {\n        const iframeAttempt = this.iframeAttempt\n        if (\n            iframeAttempt &&\n            event.origin === window.location.origin &&\n            event.source === iframeAttempt.frame.contentWindow &&\n            event.data?.type === POPUP_MESSAGE_TYPE &&\n            event.data.correlationId === iframeAttempt.correlationId &&\n            correlationFromState(event.data.state || null) === iframeAttempt.correlationId &&\n            event.data.state === iframeAttempt.state\n        ) {\n            const completed = this.finishIframeAttempt()!\n            if (event.data.error || !event.data.code) {\n                completed.reject(\n                    new Error(event.data.error || 'POFSIS Auth callback was incomplete.'),\n                )\n                return\n            }\n            void this.completeCode(event.data.code, event.data.state, completed.verifier)\n                .then(() => completed.resolve({ status: 'authenticated', user: this.getUser()! }))\n                .catch((error) =>\n                    completed.reject(error instanceof Error ? error : new Error(String(error))),\n                )\n            return\n        }\n        const attempt = this.attempt\n        const message = event.data\n        if (\n            !attempt ||\n            event.origin !== window.location.origin ||\n            event.source !== attempt.popup ||\n            message?.type !== POPUP_MESSAGE_TYPE ||\n            message.correlationId !== attempt.correlationId ||\n            correlationFromState(message.state || null) !== attempt.correlationId ||\n            message.state !== attempt.state\n        )\n            return\n\n        const completed = this.finishAttempt()\n        if (!completed) return\n        if (message.error || !message.code) {\n            completed.popup.close()\n            completed.reject(new Error(message.error || 'POFSIS Auth callback was incomplete.'))\n            return\n        }\n        void this.completeCode(message.code, message.state, completed.verifier)\n            .then(() => {\n                completed.popup.close()\n                if (completed.returnUrl) window.history.replaceState(null, '', completed.returnUrl)\n                completed.resolve({ status: 'authenticated', user: this.getUser()! })\n            })\n            .catch((error) => {\n                completed.popup.close()\n                completed.reject(error instanceof Error ? error : new Error(String(error)))\n            })\n    }\n\n    private async completeCode(code: string, state: string, verifier: string) {\n        if (!state || !verifier) throw new Error('Authentication state could not be verified.')\n        const client = await this.loadClient()\n        this.accept(await exchangeCode(this.config, code, verifier, client))\n    }\n\n    async completeRedirectCallback(code: string, state: string) {\n        const expected = sessionStorage.getItem(this.storageKey('state'))\n        const verifier = sessionStorage.getItem(this.storageKey('verifier'))\n        sessionStorage.removeItem(this.storageKey('state'))\n        sessionStorage.removeItem(this.storageKey('verifier'))\n        if (!expected || !verifier || state !== expected) {\n            throw new Error('Authentication state could not be verified.')\n        }\n        await this.completeCode(code, state, verifier)\n    }\n}\n\nexport function createPofsisAuth(config: PofsisAuthClientConfig) {\n    return new PofsisAuthClient(config)\n}\n"],"mappings":";AAEA,eAAe,EAAa,GAAgC;CACxD,IAAI,EAAS,WAAW,KAAK,OAAO;CACpC,IAAM,IAAO,MAAM,EAAS,KAAK;CAEjC,OADK,IACE,KAAK,MAAM,CAAI,IADJ;AAEtB;AAEA,eAAe,EACX,GACA,GACA,GACoC;CACpC,IAAM,IAAW,MAAM,MAAM,GAAG,EAAO,aAAa,KAAQ;EACxD,aAAa;EACb,GAAG;EACH,SAAS;GACL,QAAQ;GACR,GAAI,GAAM,QAAQ,EAAE,EAAK,gBAAgB,YACnC,EAAE,gBAAgB,mBAAmB,IACrC,CAAC;GACP,GAAG,GAAM;EACb;CACJ,CAAC;CACD,IAAI,CAAC,EAAS,IAAI;EACd,IAAM,IAAQ,gBAAI,MAAM,YAAY,EAAK,WAAW,EAAS,OAAO,EAAE;EAEtE,MADC,EAAuC,SAAS,EAAS,QACpD;CACV;CACA,OAAO;EAAE,QAAQ,EAAS;EAAQ,MAAM,MAAM,EAAa,CAAQ;CAAE;AACzE;AAEA,eAAsB,EAAiB,GAA0B;CAG7D,IAAM,EAAE,YAAS,MAAM,EACnB,GACA,kBAJa,mBAAmB,EAAO,QAAQ,YAAY,CAIzC,EAAS,UAHhB,mBAAmB,OAAO,SAAS,MAGT,GACzC;CACA,OAAO;AACX;AAEA,eAAsB,EAClB,GACA,GACA,GACA,GACF;CACE,IAAM,EAAE,YAAS,MAAM,EAAuB,GAAQ,gBAAgB;EAClE,QAAQ;EACR,MAAM,KAAK,UAAU;GACjB,YAAY;GACZ,WAAW,EAAO;GAClB,cAAc,EAAO;GACrB;GACA,eAAe;EACnB,CAAC;CACL,CAAC;CACD,OAAO;AACX;AAEA,eAAsB,EAAQ,GAA0B,GAAkB;CACtE,IAAM,EAAE,YAAS,MAAM,EAA8B,GAAQ,gBAAgB;EACzE,QAAQ;EACR,MAAM,KAAK,UAAU;GACjB,YAAY;GACZ,WAAW;EACf,CAAC;CACL,CAAC;CACD,OAAO,KAAQ;AACnB;AAEA,eAAsB,EAAa,GAA0B;CACzD,IAAI;EAEA,OADA,MAAM,EAAQ,GAAQ,eAAe,GAC9B;CACX,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,eAAsB,EAAQ,GAA0B;CACpD,MAAM,EAAQ,GAAQ,gBAAgB,EAAE,QAAQ,OAAO,CAAC;AAC5D;AAEA,eAAsB,EAAkB,GAA0B,GAAqB;CACnF,IAAM,EAAE,YAAS,MAAM,EAAwB,GAAQ,oBAAoB,EACvE,SAAS,EAAE,eAAe,UAAU,IAAc,EACtD,CAAC;CACD,OAAO;AACX;AAEA,eAAsB,EAClB,GACA,GACA,GACF;CACE,IAAM,EAAE,YAAS,MAAM,EAAwB,GAAQ,oBAAoB;EACvE,QAAQ;EACR,SAAS,EAAE,eAAe,UAAU,IAAc;EAClD,MAAM,KAAK,UAAU,CAAO;CAChC,CAAC;CACD,OAAO;AACX;AAEA,eAAsB,EAClB,GACA,GACA,GACA,GACF;CACE,IAAM,IAAO,IAAI,SAAS;CAC1B,EAAK,OAAO,QAAQ,CAAI;CACxB,IAAM,EAAE,YAAS,MAAM,EAAwB,GAAQ,2BAA2B,KAAQ;EACtF,QAAQ;EACR,SAAS,EAAE,eAAe,UAAU,IAAc;EAClD;CACJ,CAAC;CACD,OAAO;AACX;AAEA,eAAsB,EAClB,GACA,GACA,GACF;CACE,IAAM,EAAE,YAAS,MAAM,EAAwB,GAAQ,2BAA2B,KAAQ;EACtF,QAAQ;EACR,SAAS,EAAE,eAAe,UAAU,IAAc;CACtD,CAAC;CACD,OAAO;AACX;;;AClIA,SAAS,EAAmB,GAAe;CACvC,OAAO,EAAM,QAAQ,OAAO,EAAE;AAClC;AAOA,SAAgB,EAAc,IAA6B,CAAC,GAA6B;CACrF,IAAM,IAAU,EAAU,SAAS,KAAK,GAClC,IAAa,EAAU,YAAY,KAAK,GACxC,IAAU,EAAU,SAAS,KAAK,GAClC,IAAQ,EAAU,OAAO,KAAK,KAAK,wBACnC,IAAe,EAAU,cAAc,KAAK,KAAK,kBACjD,IAAQ;EACV,OAAO,EAAU,OAAO,SAAS;EACjC,QAAQ,EAAU,OAAO,UAAU;EACnC,MAAM,EAAU,OAAO,MAAM,KAAK,KAAK;EACvC,WAAW,EAAU,OAAO,aAAa;CAC7C,GAEM,IAAoB,CAAC;CAI3B,IAHK,KAAS,EAAQ,KAAK,SAAS,GAC/B,KAAY,EAAQ,KAAK,YAAY,GACrC,KAAS,EAAQ,KAAK,SAAS,GAChC,EAAQ,QACR,MAAU,MAAM,2CAA2C,EAAQ,KAAK,IAAI,GAAG;CAEnF,IAAI,CAAC,KAAW,CAAC,KAAc,CAAC,GAC5B,MAAU,MAAM,wCAAwC;CAE5D,IAAI,CAAC,EAAa,WAAW,GAAG,KAAK,EAAa,WAAW,IAAI,GAC7D,MAAU,MAAM,mEAAmE;CAEvF,IAAI,EAAM,SAAS,KAAK,EAAM,UAAU,KAAK,EAAM,aAAa,GAC5D,MAAU,MAAM,uEAAuE;CAG3F,OAAO;EACH;EACA,YAAY,EAAmB,CAAU;EACzC,SAAS,EAAmB,CAAO;EACnC;EACA;EACA;CACJ;AACJ;;;AC/CA,IAAM,IAAQ,8BACR,IAAoB,0BACpB,oBAAU,IAAI,IAAgB;CAAC;CAAY;CAAW;AAAK,CAAC,GAC5D,oBAAU,IAAI,IAAgB;CAAC;CAAS;CAAU;AAAO,CAAC,GAC1D,IAAkB;AAExB,SAAS,EAAc,GAAgB,IAAY,IAA2B;CAC1E,IAAM,IAAY,OAAO,KAAU,WAAW,EAAM,KAAK,IAAI;CAC7D,IAAI,CAAC,KAAa,EAAU,SAAS,GAAiB;CACtD,IAAI,EAAM,KAAK,CAAS,GAAG,OAAO,EAAU,YAAY;CACxD,IAAM,IAAU,EAAU,QAAQ,YAAY,EAAE;CAChD,IAAI,MAAc,EAAkB,KAAK,CAAO,GAChD,OAAO,MAAM,EAAQ,QAAQ,kBAAkB,EAAE;AACrD;AAEA,SAAgB,EACZ,GACA,IAA4B,SAC9B;CACE,IAAM,IAAU,OAAO,KAAU,WAAW,EAAE,WAAW,EAAM,IAAI,KAAS,CAAC,GACvE,IAAkB,EAAQ,WAAW,aAAa,WAAW,EAAQ,QACrE,IAAS,EAAQ,IAAI,CAA6B,IACjD,IACD,GACA,IAAkB,EAAQ,IAAI,EAAQ,MAAoB,IACzD,EAAQ,SACT,KAAA,GACA,IACF,MAAW,WACV,MAAW,aAAa,MAAoB,cAAc,MAAoB,SACzE,IACA,KAAA;CACV,OAAO;EACH,WAAW,EAAQ;EACnB;EACA,WAAW,EAAc,EAAQ,SAAS;EAC1C;CACJ;AACJ;AAEA,SAAgB,EAA4B,GAAgB;CACxD,IAAM,IAAS,IAAI,gBAAgB,CAAM,GACnC,IAAgB,EAAO,IAAI,YAAY,GACvC,IACF,MAAkB,OAEZ,EAAc,EAAO,IAAI,OAAO,GAAG,EAAI,IADvC,EAAc,CAAa;CAErC,OAAO,EAA2B;EAC9B,QAAS,EAAO,IAAI,QAAQ,KAAK,KAAA;EACjC;EACA,QAAS,EAAO,IAAI,QAAQ,KAAK,KAAA;CACrC,CAAC;AACL;AAEA,SAAgB,EAAqB,EACjC,YACA,YACA,UACA,cAMD;CACC,IAAM,IAAS,EAA2B,CAAO,GAC3C,IAAmB,IAAI,IAAI,CAAO;CAMxC,IALA,EAAiB,SAAS,EAAM,SAAS,GACrC,EAAO,aAAW,EAAiB,aAAa,IAAI,cAAc,EAAO,SAAS,GAClF,EAAO,WAAW,WAAW,EAAO,UACpC,EAAiB,aAAa,IAAI,UAAU,EAAO,MAAM,GAEzD,EAAO,WAAW,SAAS,OAAO,EAAiB,SAAS;CAEhE,IAAM,IAAW,EAAO,WAAW,WAAW,YAAY,oBACpD,IAAc,IAAI,IAAI,GAAU,CAAgB;CAUtD,OATA,EAAY,aAAa,IAAI,OAAO,CAAO,GAC3C,EAAY,aAAa,IACrB,aACA,GAAG,EAAiB,WAAW,EAAiB,QACpD,GACI,EAAO,aAAW,EAAY,aAAa,IAAI,cAAc,EAAO,SAAS,GAC7E,EAAO,WAAW,YAClB,EAAY,aAAa,IAAI,UAAU,EAAO,UAAU,UAAU,GAE/D,EAAY,SAAS;AAChC;;;ACxFA,IAAa,IAAqB;AAUlC,SAAgB,EAAqB,GAAsB;CACvD,IAAI,CAAC,GAAO;CACZ,IAAM,IAAY,EAAM,QAAQ,GAAG;CACnC,OAAO,IAAY,IAAI,EAAM,MAAM,GAAG,CAAS,IAAI,KAAA;AACvD;AAEA,SAAgB,EAAmB,IAAe,OAAO,SAAS,QAAQ;CACtE,IAAM,IACF,OAAO,UAAU,CAAC,OAAO,OAAO,SAC1B,OAAO,SACP,OAAO,WAAW,SAEhB,OADA,OAAO;CAEnB,IAAI,CAAC,GAAQ,OAAO;CACpB,IAAM,IAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM,GACnD,IAAQ,EAAO,IAAI,OAAO,KAAK,KAAA,GAC/B,IAAgC;EAClC,MAAM;EACN,MAAM,EAAO,IAAI,MAAM,KAAK,KAAA;EAC5B;EACA,OAAO,EAAO,IAAI,OAAO,KAAK,KAAA;EAC9B,eAAe,EAAqB,KAAS,IAAI;CACrD;CAGA,OAFA,EAAO,YAAY,GAAS,CAAY,GACpC,MAAW,OAAO,UAAQ,OAAO,MAAM,GACpC;AACX;;;ACpCA,IAAM,KAAU,MACZ,KAAK,OAAO,aAAa,GAAG,CAAK,CAAC,CAAC,CAC9B,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE,GAEb,UAAoB,EAAO,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAElF,eAAsB,EAAc,GAAkB;CAClD,OAAO,EACH,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,CAAQ,CAAC,CAAC,CAC5F;AACJ;;;ACsBA,IAAM,KAAiB,MACnB,GAAO,WAAW,GAAG,KAAK,CAAC,EAAM,WAAW,IAAI,IAAI,IAAQ,KAAA,GAE1D,KAAa,OAA0E;CACzF,YAAY,EAAO;CACnB,YAAY,EAAO;CACnB,MAAM,EAAO;AACjB,IAEa,IAAb,MAA8B;CAC1B;CACA,QAA+B;CAC/B,UAAyC;CACzC,SAA2C;CAC3C,gBAA2D;CAC3D,iBAA+C;CAC/C,8BAAsB,IAAI,IAAgB;CAC1C,UAAuC;CACvC,gBAA8C;CAC9C,YAAoB;CAEpB,YAAY,GAAgC;EAExC,AADA,KAAK,SAAS,EAAc,CAAM,GAClC,KAAK,OAAO;CAChB;CAEA,SAAiB;EACb,AAEA,KAAK,eADL,OAAO,iBAAiB,WAAW,KAAK,cAAc,GACrC;CACrB;CAEA,UAAU;EAEN,AADA,OAAO,oBAAoB,WAAW,KAAK,cAAc,GACzD,KAAK,YAAY;EACjB,IAAM,IAAU,KAAK,cAAc;EAMnC,AALI,MACA,EAAQ,MAAM,MAAM,GACpB,EAAQ,QAAQ,EAAE,QAAQ,YAAY,CAAC,IAE3C,KAAK,kBAAkB,GACvB,KAAK,YAAY,MAAM;CAC3B;CAEA,UAAU;EACN,OAAO,KAAK,SAAS,QAAQ;CACjC;CAEA,aAAa;EACT,OAAO,KAAK;CAChB;CAEA,iBAAiB;EACb,OAAO,KAAK;CAChB;CAEA,UAAU,GAAsB;EAI5B,OAHA,KAAK,OAAO,GACZ,KAAK,YAAY,IAAI,CAAQ,GAC7B,EAAS,KAAK,OAAO,SACR;GACT,KAAK,YAAY,OAAO,CAAQ;EACpC;CACJ;CAEA,OAAe;EACX,KAAK,IAAM,KAAY,KAAK,aAAa,EAAS,KAAK,OAAO;CAClE;CAEA,OAAe,GAAkD;EAG7D,AAFA,KAAK,QAAQ,EAAO,cACpB,KAAK,UAAU,EAAU,CAAM,GAC/B,KAAK,KAAK;CACd;CAEA,aAAqB;EASjB,OARA,AACI,KAAK,kBAAgB,EAAiB,KAAK,MAAM,CAAC,CAC7C,MAAM,MAAY,KAAK,SAAS,CAAO,CAAC,CACxC,OAAO,MAAU;GAEd,MADA,KAAK,gBAAgB,MACf;EACV,CAAC,GAEF,KAAK;CAChB;CAEA,iBAAiB;EACb,OAAO,KAAK,WAAW;CAC3B;CAEA,MAAM,iBAAiB;EACnB,IAAM,IAAS,MAAM,KAAK,WAAW;EASrC,OARA,AACI,KAAK,mBAAiB,EAAQ,KAAK,QAAQ,EAAO,SAAS,CAAC,CACvD,MAAM,MAAW;GACd,AAAI,IAAQ,KAAK,OAAO,CAAM,IACzB,KAAK,aAAa;EAC3B,CAAC,CAAC,CACD,cAAe,KAAK,iBAAiB,IAAK,GAE5C,KAAK;CAChB;CAEA,MAAM,wBAAwB;EAC1B,OAAO,EAAa,KAAK,MAAM;CACnC;CAEA,eAAe;EAGX,AAFA,KAAK,QAAQ,MACb,KAAK,UAAU,MACf,KAAK,KAAK;CACd;CAEA,YAAY,GAAkB;EAC1B,AAAK,KAAK,YACV,KAAK,UAAU;GAAE,GAAG,KAAK;GAAS;EAAK,GACvC,KAAK,KAAK;CACd;CAEA,MAAM,SAAS;EACX,IAAI;GACA,MAAM,EAAQ,KAAK,MAAM;EAC7B,UAAU;GACN,KAAK,aAAa;EACtB;CACJ;CAEA,OAAO,IAA6C,CAAC,GAAG;EACpD,OAAO,KAAK,MAAM;GAAE,GAAG;GAAS,QAAQ;EAAS,CAAC;CACtD;CAEA,cAAc,IAA6C,CAAC,GAAG;EAC3D,OAAO,KAAK,MAAM;GAAE,GAAG;GAAS,QAAQ;EAAQ,CAAC;CACrD;CAEA,MAAM,MAAM,IAA6B,CAAC,GAAwB;EAC9D,IAAM,IAAS,EAA2B,CAAO,GAC3C,IAAe,EAAQ,gBAAgB;EAG7C,OAFI,MAAiB,UAAgB,KAAK,UAAU;GAAE,GAAG;GAAS,GAAG;EAAO,CAAC,IACzE,MAAiB,WAAiB,KAAK,WAAW;GAAE,GAAG;GAAS,GAAG;EAAO,CAAC,IACxE,KAAK,cAAc;GAAE,GAAG;GAAS,GAAG;EAAO,CAAC;CACvD;CAEA,oBAAoB;EAEhB,KADqB,oBACrB,CAAA,EAAS,QAAQ,EAAE,QAAQ,YAAY,CAAC;CAC5C;CAEA,WAAmB,GAAiD;EAChE,IAAM,IAAQ,EAAQ;EACtB,IAAI,CAAC,GAAO,OAAO,QAAQ,OAAO,gBAAI,MAAM,wCAAwC,CAAC;EACrF,KAAK,kBAAkB;EACvB,IAAM,IAAgB,EAAY,GAC5B,IAAQ,GAAG,EAAc,GAAG,EAAY,KACxC,IAAW,EAAY,GACvB,IAAY,EAAc,EAAQ,SAAS;EACjD,OAAO,IAAI,SAAqB,GAAS,MAAW;GAChD,IAAM,IAAU,iBAAiB;IAE7B,KADqB,oBACrB,CAAA,EAAS,OAAO,gBAAI,MAAM,+BAA+B,CAAC;GAC9D,GAAG,KAAK,OAAO,MAAM,SAAS;GAW9B,AAVA,KAAK,gBAAgB;IACjB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACJ,GACA,KAAU,iBAAiB,GAAS,GAAO,CAAQ,CAAC,CAC/C,MAAM,MAAQ,EAAM,eAAe,SAAS,QAAQ,CAAG,CAAC,CAAC,CACzD,OAAO,MAAU;IAEd,KADqB,oBACrB,CAAA,EAAS,OAAO,aAAiB,QAAQ,IAAY,MAAM,OAAO,CAAK,CAAC,CAAC;GAC7E,CAAC;EACT,CAAC;CACL;CAEA,MAAc,iBAAiB,GAA4B,GAAe,GAAkB;EACxF,IAAM,IAAS,MAAM,KAAK,WAAW,GAC/B,IAAQ,IAAI,gBAAgB;GAC9B,KAAK,KAAK,OAAO,QAAQ,YAAY;GACrC,WAAW,EAAO;GAClB,cAAc,EAAO;GACrB,eAAe;GACf,OAAO,KAAK,OAAO;GACnB;GACA,gBAAgB,MAAM,EAAc,CAAQ;GAC5C,uBAAuB;EAC3B,CAAC;EACD,OAAO,EAAqB;GACxB,SAAS,KAAK,OAAO;GACrB,SAAS,KAAK,OAAO,QAAQ,YAAY;GACzC;GACA;EACJ,CAAC;CACL;CAEA,WAAmB,GAAgB;EAC/B,OAAO,GAAG,KAAK,OAAO,QAAQ,YAAY,EAAE,QAAQ;CACxD;CAEA,MAAc,cAAc,GAAiD;EACzE,IAAM,IAAQ,EAAY,GACpB,IAAW,EAAY;EAE7B,AADA,eAAe,QAAQ,KAAK,WAAW,OAAO,GAAG,CAAK,GACtD,eAAe,QAAQ,KAAK,WAAW,UAAU,GAAG,CAAQ;EAC5D,IAAM,IAAY,EAAc,EAAQ,SAAS;EAIjD,OAHI,IAAW,eAAe,QAAQ,KAAK,WAAW,aAAa,GAAG,CAAS,IAC1E,eAAe,WAAW,KAAK,WAAW,aAAa,CAAC,GAC7D,OAAO,SAAS,OAAO,MAAM,KAAK,iBAAiB,GAAS,GAAO,CAAQ,CAAC,GACrE,EAAE,QAAQ,cAAc;CACnC;CAEA,MAAc,UAAU,GAAiD;EACrE,IAAI,KAAK,WAAW,CAAC,KAAK,QAAQ,MAAM,QAEpC,OADA,KAAK,QAAQ,MAAM,MAAM,GAClB,IAAI,SAAS,GAAS,MAAW;GACpC,IAAM,IAAU,KAAK,SACf,IAAkB,EAAQ,SAC1B,IAAiB,EAAQ;GAK/B,AAJA,EAAQ,WAAW,MAAU;IAEzB,AADA,EAAgB,CAAK,GACrB,EAAQ,CAAK;GACjB,GACA,EAAQ,UAAU,MAAU;IAExB,AADA,EAAe,CAAK,GACpB,EAAO,CAAK;GAChB;EACJ,CAAC;EAEL,IAAM,EAAE,UAAO,WAAQ,SAAM,iBAAc,KAAK,OAAO,OACjD,IAAO,KAAK,IAAI,GAAG,OAAO,WAAW,OAAO,aAAa,KAAS,CAAC,GACnE,IAAM,KAAK,IAAI,GAAG,OAAO,WAAW,OAAO,cAAc,KAAU,CAAC,GACpE,IAAQ,OAAO,KACjB,eACA,GACA,mBAAmB,EAAM,UAAU,EAAO,QAAQ,KAAK,MAAM,CAAI,EAAE,OAAO,KAAK,MAAM,CAAG,GAC5F;EACA,IAAI,CAAC,GAAO,OAAO,KAAK,cAAc;GAAE,GAAG;GAAS,cAAc;EAAW,CAAC;EAE9E,IAAM,IAAgB,EAAY,GAC5B,IAAQ,GAAG,EAAc,GAAG,EAAY,KACxC,IAAW,EAAY,GACvB,IAAY,EAAc,EAAQ,SAAS;EACjD,OAAO,IAAI,SAAqB,GAAS,MAAW;GAChD,IAAM,IAAQ,kBAAkB;IAC5B,AAAK,EAAM,UAEX,KADqB,cACrB,CAAA,EAAS,QAAQ,EAAE,QAAQ,YAAY,CAAC;GAC5C,GAAG,GAAG,GACA,IAAU,iBAAiB;IAC7B,IAAM,IAAU,KAAK,cAAc;IAEnC,AADA,EAAM,MAAM,GACZ,GAAS,OAAO,gBAAI,MAAM,8BAA8B,CAAC;GAC7D,GAAG,CAAS;GAYZ,AAXA,KAAK,UAAU;IACX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACJ,GACA,KAAU,iBAAiB,GAAS,GAAO,CAAQ,CAAC,CAC/C,MAAM,MAAQ,EAAM,SAAS,QAAQ,CAAG,CAAC,CAAC,CAC1C,OAAO,MAAU;IACd,IAAM,IAAU,KAAK,cAAc;IAEnC,AADA,EAAM,MAAM,GACZ,GAAS,OAAO,aAAiB,QAAQ,IAAY,MAAM,OAAO,CAAK,CAAC,CAAC;GAC7E,CAAC;EACT,CAAC;CACL;CAEA,gBAAwB;EACpB,IAAM,IAAU,KAAK;EAKrB,OAJK,KACL,cAAc,EAAQ,KAAK,GAC3B,aAAa,EAAQ,OAAO,GAC5B,KAAK,UAAU,MACR,KAJc;CAKzB;CAEA,sBAA8B;EAC1B,IAAM,IAAU,KAAK;EAIrB,OAHK,KACL,aAAa,EAAQ,OAAO,GAC5B,KAAK,gBAAgB,MACd,KAHc;CAIzB;CAEA,kBAA0B,MAA8C;EACpE,IAAM,IAAgB,KAAK;EAC3B,IACI,KACA,EAAM,WAAW,OAAO,SAAS,UACjC,EAAM,WAAW,EAAc,MAAM,iBACrC,EAAM,MAAM,SAAA,0BACZ,EAAM,KAAK,kBAAkB,EAAc,iBAC3C,EAAqB,EAAM,KAAK,SAAS,IAAI,MAAM,EAAc,iBACjE,EAAM,KAAK,UAAU,EAAc,OACrC;GACE,IAAM,IAAY,KAAK,oBAAoB;GAC3C,IAAI,EAAM,KAAK,SAAS,CAAC,EAAM,KAAK,MAAM;IACtC,EAAU,OACF,MAAM,EAAM,KAAK,SAAS,sCAAsC,CACxE;IACA;GACJ;GACA,KAAU,aAAa,EAAM,KAAK,MAAM,EAAM,KAAK,OAAO,EAAU,QAAQ,CAAC,CACxE,WAAW,EAAU,QAAQ;IAAE,QAAQ;IAAiB,MAAM,KAAK,QAAQ;GAAG,CAAC,CAAC,CAAC,CACjF,OAAO,MACJ,EAAU,OAAO,aAAiB,QAAQ,IAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CAC9E;GACJ;EACJ;EACA,IAAM,IAAU,KAAK,SACf,IAAU,EAAM;EACtB,IACI,CAAC,KACD,EAAM,WAAW,OAAO,SAAS,UACjC,EAAM,WAAW,EAAQ,SACzB,GAAS,SAAA,0BACT,EAAQ,kBAAkB,EAAQ,iBAClC,EAAqB,EAAQ,SAAS,IAAI,MAAM,EAAQ,iBACxD,EAAQ,UAAU,EAAQ,OAE1B;EAEJ,IAAM,IAAY,KAAK,cAAc;EACrC,IAAK,GACL;OAAI,EAAQ,SAAS,CAAC,EAAQ,MAAM;IAEhC,AADA,EAAU,MAAM,MAAM,GACtB,EAAU,OAAW,MAAM,EAAQ,SAAS,sCAAsC,CAAC;IACnF;GACJ;GACA,KAAU,aAAa,EAAQ,MAAM,EAAQ,OAAO,EAAU,QAAQ,CAAC,CAClE,WAAW;IAGR,AAFA,EAAU,MAAM,MAAM,GAClB,EAAU,aAAW,OAAO,QAAQ,aAAa,MAAM,IAAI,EAAU,SAAS,GAClF,EAAU,QAAQ;KAAE,QAAQ;KAAiB,MAAM,KAAK,QAAQ;IAAG,CAAC;GACxE,CAAC,CAAC,CACD,OAAO,MAAU;IAEd,AADA,EAAU,MAAM,MAAM,GACtB,EAAU,OAAO,aAAiB,QAAQ,IAAY,MAAM,OAAO,CAAK,CAAC,CAAC;GAC9E,CAAC;EAVL;CAWJ;CAEA,MAAc,aAAa,GAAc,GAAe,GAAkB;EACtE,IAAI,CAAC,KAAS,CAAC,GAAU,MAAU,MAAM,6CAA6C;EACtF,IAAM,IAAS,MAAM,KAAK,WAAW;EACrC,KAAK,OAAO,MAAM,EAAa,KAAK,QAAQ,GAAM,GAAU,CAAM,CAAC;CACvE;CAEA,MAAM,yBAAyB,GAAc,GAAe;EACxD,IAAM,IAAW,eAAe,QAAQ,KAAK,WAAW,OAAO,CAAC,GAC1D,IAAW,eAAe,QAAQ,KAAK,WAAW,UAAU,CAAC;EAGnE,IAFA,eAAe,WAAW,KAAK,WAAW,OAAO,CAAC,GAClD,eAAe,WAAW,KAAK,WAAW,UAAU,CAAC,GACjD,CAAC,KAAY,CAAC,KAAY,MAAU,GACpC,MAAU,MAAM,6CAA6C;EAEjE,MAAM,KAAK,aAAa,GAAM,GAAO,CAAQ;CACjD;AACJ;AAEA,SAAgB,EAAiB,GAAgC;CAC7D,OAAO,IAAI,EAAiB,CAAM;AACtC"}

package/dist/{RequireAuth-BFjNqM_v.js → PofsisAuthModal-DGbtRZ4f.js}

@@ -1,4 +1,4 @@
-import { a as e, c as t, i as n, l as r, o as i, r as a, s as o, t as s } from "./PofsisAuthClient-DJSQb0qq.js";
+import { a as e, c as t, i as n, l as r, o as i, r as a, s as o, t as s } from "./PofsisAuthClient-c9BY8iNp.js";
 import { createContext as c, useCallback as l, useContext as u, useEffect as d, useMemo as f, useRef as p, useState as m } from "react";
 import { Fragment as h, jsx as g, jsxs as _ } from "react/jsx-runtime";
 //#region src/assets/auth-error-illustration.png
@@ -293,6 +293,7 @@ function z({ children: e, client: n, postLoginPath: a, components: s }) {
 		login: n.login.bind(n),
 		signup: n.signup.bind(n),
 		resetPassword: n.resetPassword.bind(n),
+		cancelIframeLogin: () => n.cancelIframeLogin(),
 		logout: v,
 		refreshSession: () => n.refreshSession(),
 		getAccessToken: () => n.getAccessToken(),
@@ -398,6 +399,97 @@ function U({ children: e, fallback: t, onUnauthenticated: n }) {
 	]), r || !i ? /* @__PURE__ */ g(h, { children: t ?? (o ? /* @__PURE__ */ g(o, {}) : null) }) : /* @__PURE__ */ g(h, { children: e });
 }
 //#endregion
-export { A as a, B as i, H as n, E as o, V as r, U as t };
+//#region src/components/PofsisAuthModal.tsx
+function W({ open: e, screen: t = "login", method: n, loginHint: r, returnUrl: i, title: a = t === "signup" ? "Create your account" : "Sign in", onClose: o, onAuthenticated: s, onError: c }) {
+	let l = H(), u = p(null);
+	return d(() => {
+		if (!e || !u.current) return;
+		let a = !0;
+		return l.login({
+			presentation: "iframe",
+			target: u.current,
+			screen: t,
+			method: n,
+			loginHint: r,
+			returnUrl: i
+		}).then((e) => {
+			a && e.status === "authenticated" && s?.(e.user);
+		}).catch((e) => {
+			a && c?.(e instanceof Error ? e : Error(String(e)));
+		}), () => {
+			a = !1, l.cancelIframeLogin();
+		};
+	}, [
+		l,
+		r,
+		n,
+		s,
+		c,
+		e,
+		i,
+		t
+	]), e ? /* @__PURE__ */ g("div", {
+		role: "presentation",
+		style: G,
+		children: /* @__PURE__ */ _("section", {
+			role: "dialog",
+			"aria-modal": "true",
+			"aria-label": a,
+			style: K,
+			children: [/* @__PURE__ */ _("div", {
+				style: q,
+				children: [/* @__PURE__ */ g("strong", { children: a }), /* @__PURE__ */ g("button", {
+					type: "button",
+					onClick: o,
+					"aria-label": "Close authentication",
+					style: J,
+					children: "×"
+				})]
+			}), /* @__PURE__ */ g("iframe", {
+				ref: u,
+				title: a,
+				allow: "publickey-credentials-get; publickey-credentials-create",
+				style: Y
+			})]
+		})
+	}) : null;
+}
+var G = {
+	position: "fixed",
+	inset: 0,
+	zIndex: 1400,
+	display: "grid",
+	placeItems: "center",
+	padding: 16,
+	background: "rgba(10, 10, 10, 0.45)"
+}, K = {
+	width: "min(560px, 100%)",
+	height: "min(780px, calc(100dvh - 32px))",
+	background: "#fff",
+	borderRadius: 12,
+	overflow: "hidden",
+	boxShadow: "0 24px 64px rgba(0,0,0,.24)",
+	display: "flex",
+	flexDirection: "column"
+}, q = {
+	height: 48,
+	padding: "0 12px 0 18px",
+	display: "flex",
+	alignItems: "center",
+	justifyContent: "space-between",
+	fontFamily: "Inter, sans-serif"
+}, J = {
+	border: 0,
+	background: "transparent",
+	fontSize: 28,
+	lineHeight: 1,
+	cursor: "pointer"
+}, Y = {
+	width: "100%",
+	flex: 1,
+	border: 0
+};
+//#endregion
+export { B as a, V as i, U as n, A as o, H as r, E as s, W as t };
 
-//# sourceMappingURL=RequireAuth-BFjNqM_v.js.map
+//# sourceMappingURL=PofsisAuthModal-DGbtRZ4f.js.map