@rixl/sdk 0.36.0 → 0.37.0

package/dist/index.d.ts

@@ -14704,12 +14704,8 @@ interface AppleProviderConfig extends OAuthProviderConfig {}
 //#endregion
 //#region src/auth/providers/telegram.d.ts
 interface TelegramProviderConfig {
+  /** The bot ID, which is Telegram's OpenID Connect client ID. */
   botId: string;
-  /**
-   * Sign in with Telegram's OpenID Connect authorization code flow instead of
-   * the legacy widget redirect. The bot ID is the OIDC client ID.
-   */
-  oidc?: boolean;
   /** Must be registered in BotFather. Defaults to the page origin. */
   redirectUri?: string;
 }

package/dist/index.js

@@ -2752,6 +2752,10 @@ function getPkceVerifier(provider) {
 	sessionStorage.setItem(storagePath(provider), verifier);
 	return verifier;
 }
+/** The stored verifier, without minting one: a callback can only redeem the code it was issued for. */
+function readPkceVerifier(provider) {
+	return sessionStorage.getItem(storagePath(provider));
+}
 function clearPkceVerifier(provider) {
 	sessionStorage.removeItem(storagePath(provider));
 }
@@ -2762,58 +2766,81 @@ async function pkceChallenge(verifier) {
 }
 
 //#endregion
-//#region src/auth/providers/telegram.ts
-const TELEGRAM_AUTH_URL = "https://oauth.telegram.org/auth";
-const telegramConfig = shared("provider.telegram.config", () => atom(null));
-const telegramAuthUrl = shared("provider.telegram.authUrl", () => atom(null));
-const telegramRedirectUri = (config) => config.redirectUri ?? window.location.origin;
-const legacyAuthUrl = (config) => `${TELEGRAM_AUTH_URL}?bot_id=${encodeURIComponent(config.botId)}&origin=${encodeURIComponent(window.location.origin)}&return_to=${encodeURIComponent(window.location.origin + location.pathname)}`;
-const oidcAuthUrl = async (config) => {
+//#region src/auth/url.ts
+const urlParams = new URLSearchParams(typeof window !== "undefined" ? fromURL(window.location.href) : "");
+function fromURL(urlString) {
+	return urlString.replace(/^[^?#]*[?#]/, "").replace(/[?#]/g, "&");
+}
+
+//#endregion
+//#region src/auth/providers/authorization-code.ts
+/** Builds an authorization code request carrying the provider's state and a PKCE S256 challenge. */
+const authorizationCodeUrl = async (provider, request) => {
 	const params = new URLSearchParams({
-		client_id: config.botId,
-		redirect_uri: telegramRedirectUri(config),
+		client_id: request.clientId,
+		redirect_uri: request.redirectUri,
 		response_type: "code",
-		scope: "openid profile",
-		state: getOauthState("telegram"),
-		code_challenge: await pkceChallenge(getPkceVerifier("telegram")),
+		scope: request.scope,
+		state: getOauthState(provider),
+		code_challenge: await pkceChallenge(getPkceVerifier(provider)),
 		code_challenge_method: "S256"
 	});
-	return `${TELEGRAM_AUTH_URL}?${params.toString()}`;
+	return `${request.authUrl}?${params.toString()}`;
 };
+/** Whether the URL holds an authorization code answering this provider's state. */
+const hasAuthorizationCode = (provider) => {
+	const state = urlParams.get("state");
+	return urlParams.has("code") && !!state && validateOAuthState(provider, state);
+};
+/** The authorization code in the URL, with the verifier and redirect URI it was requested with. */
+const readAuthorizationCode = (provider, redirectUri) => {
+	const code = urlParams.get("code");
+	const codeVerifier = readPkceVerifier(provider);
+	if (!code || !codeVerifier || !hasAuthorizationCode(provider)) return void 0;
+	return { authorizationCode: {
+		code,
+		codeVerifier,
+		redirectUri
+	} };
+};
+
+//#endregion
+//#region src/auth/providers/telegram.ts
+const TELEGRAM_AUTH_URL = "https://oauth.telegram.org/auth";
+const telegramConfig = shared("provider.telegram.config", () => atom(null));
+const telegramAuthUrl = shared("provider.telegram.authUrl", () => atom(null));
+const telegramRedirectUri = (config) => config.redirectUri ?? window.location.origin;
+const authUrl = (config) => authorizationCodeUrl("telegram", {
+	authUrl: TELEGRAM_AUTH_URL,
+	clientId: config.botId,
+	redirectUri: telegramRedirectUri(config),
+	scope: "openid profile"
+});
 /**
-* Updates the Telegram authentication URL using the configured settings
+* Updates the Telegram authentication URL using the configured settings.
+* Resolves once the URL is set, so initClient() can finish with login() ready.
 */
-function updateTelegramAuthUrl() {
+async function updateTelegramAuthUrl() {
 	const config = telegramConfig.get();
 	if (!config) {
 		warnProviderNotConfigured("Telegram");
 		telegramAuthUrl.set(null);
 		return;
 	}
-	if (!config.oidc) {
-		telegramAuthUrl.set(legacyAuthUrl(config));
-		return;
-	}
 	telegramAuthUrl.set(null);
-	oidcAuthUrl(config).then((url) => telegramAuthUrl.set(url));
+	try {
+		const url = await authUrl(config);
+		if (telegramConfig.get() === config) telegramAuthUrl.set(url);
+	} catch (error) {
+		console.error("Telegram sign-in is unavailable: the PKCE challenge needs a secure (https) page with session storage.", error);
+	}
 }
-/** The PKCE verifier and redirect URI the backend needs to redeem a Telegram authorization code. */
-const telegramCodeExchange = () => {
+/** The authorization code Telegram sent back, when this page is its OpenID Connect callback. */
+const readTelegramCode = () => {
 	const config = telegramConfig.get();
-	if (!config) return void 0;
-	return {
-		codeVerifier: getPkceVerifier("telegram"),
-		redirectUri: telegramRedirectUri(config)
-	};
+	return config ? readAuthorizationCode("telegram", telegramRedirectUri(config)) : void 0;
 };
 
-//#endregion
-//#region src/auth/url.ts
-const urlParams = new URLSearchParams(typeof window !== "undefined" ? fromURL(window.location.href) : "");
-function fromURL(urlString) {
-	return urlString.replace(/^[^?#]*[?#]/, "").replace(/[?#]/g, "&");
-}
-
 //#endregion
 //#region src/auth/providers/utils.ts
 /**
@@ -2825,36 +2852,62 @@ function extractProviderFromState(state) {
 	const parts = state.split("_");
 	if (parts.length >= 1) return parts[0];
 }
-const OAUTH_PROVIDERS$1 = [
-	"google",
-	"apple",
-	"microsoft"
+/** Telegram's mini app puts its init data in a parameter named after the provider. */
+const tokenParam = (provider) => ({
+	provider,
+	matches: () => urlParams.has(provider),
+	read: () => {
+		const token = urlParams.get(provider);
+		return token ? { token } : void 0;
+	}
+});
+/** OpenID Connect providers that return an id_token with the state issued for them. */
+const idTokenWithState = (provider) => ({
+	provider,
+	matches: () => {
+		const state = urlParams.get("state");
+		if (!urlParams.get("id_token") || !state) return false;
+		return extractProviderFromState(state) === provider && validateOAuthState(provider, state);
+	},
+	read: () => {
+		const token = urlParams.get("id_token");
+		return token ? { token } : void 0;
+	}
+});
+const telegramCode = {
+	provider: "telegram",
+	matches: () => hasAuthorizationCode("telegram"),
+	read: readTelegramCode
+};
+const CALLBACK_READERS = [
+	tokenParam("tgWebAppData"),
+	telegramCode,
+	idTokenWithState("google"),
+	idTokenWithState("apple"),
+	idTokenWithState("microsoft")
 ];
-/**
-* Detects the authentication provider from URL parameters
-* @returns The detected authentication provider or undefined if none detected
-*/
+/** The provider whose response this page holds, if any. */
 function detectProvider() {
-	if (urlParams.has("tgWebAppData")) return "tgWebAppData";
-	const state = urlParams.get("state");
-	if (urlParams.has("code") && state && validateOAuthState("telegram", state)) return "telegram";
-	if (urlParams.has("tgAuthResult")) return "tgAuthResult";
-	if (urlParams.get("id_token") && state) {
-		const providerFromState = extractProviderFromState(state);
-		return OAUTH_PROVIDERS$1.find((p) => providerFromState === p && validateOAuthState(p, state));
-	}
+	return CALLBACK_READERS.find((reader) => reader.matches())?.provider;
 }
-/**
-* Gets the authentication token or code from the URL based on the provider
-* @param provider The authentication provider
-* @returns The token or code, or undefined if not found
-*/
-function getProviderToken(provider) {
-	if (provider === "tgWebAppData" || provider === "tgAuthResult") return urlParams.get(provider) || void 0;
-	if (provider === "telegram") return urlParams.get("code") || void 0;
-	if (provider === "google" || provider === "apple" || provider === "microsoft") return urlParams.get("id_token") || void 0;
+/** The credential a provider's response on this page carries. */
+function getProviderCredential(provider) {
+	return CALLBACK_READERS.find((reader) => reader.provider === provider)?.read();
 }
 
+//#endregion
+//#region src/auth/providers/credential.ts
+/** The credential as the sign-in and link requests carry it. */
+const credentialFields = (credential) => {
+	if ("token" in credential) return { token: credential.token };
+	const { code, codeVerifier, redirectUri } = credential.authorizationCode;
+	return {
+		token: code,
+		code_verifier: codeVerifier,
+		redirect_uri: redirectUri
+	};
+};
+
 //#endregion
 //#region src/auth/providers/callback.ts
 /** Params that carry the credential itself — their presence marks a callback response. */
@@ -2862,7 +2915,6 @@ const CREDENTIAL_PARAMS = [
 	"id_token",
 	"code",
 	"access_token",
-	"tgAuthResult",
 	"tgWebAppData"
 ];
 /** Everything the providers append to the redirect URL, credential and bookkeeping alike. */
@@ -2972,7 +3024,7 @@ const claimsOf = (token) => {
 	}
 };
 const verdictFor = (error) => {
-	if ((typeof error.data === "object" && error.data !== null ? error.data : void 0)?.error === "invalid token type") return "CLIENT: the gateway does not accept this token_type. Expected one of Bearer, google, apple, microsoft, tgAuthResult, tgWebAppData.";
+	if ((typeof error.data === "object" && error.data !== null ? error.data : void 0)?.error === "invalid token type") return "CLIENT: the gateway does not accept this token_type. Expected one of Bearer, google, apple, microsoft, telegram, tgWebAppData.";
 	if (error.status === HTTP_STATUS.UNAUTHORIZED) return "BACKEND or CONFIG: the gateway could not verify the credential. Compare `aud` above with the client ID the gateway is configured with, and check `expired`.";
 	if (error.status === HTTP_STATUS.CONFLICT) return "EXPECTED: this email already belongs to an account created with a different provider.";
 	if (error.status === HTTP_STATUS.BAD_REQUEST) return "BACKEND: the gateway rejected the request body. Read `response.body` for its reason.";
@@ -3044,17 +3096,17 @@ const logProviderExchangeFailure = (provider, credential, error) => {
 *
 * Both go to `/auth/v1/token`, which needs no session: `token_type` is the
 * `AuthProvider` value and `refresh_token` carries the stored refresh token or
-* the provider's `id_token` / Telegram payload. `/auth/v1/providers/connect`
+* the provider's token or authorization code. `/auth/v1/providers/connect`
 * links a provider to an already signed-in user, so it cannot sign anyone in.
 */
-const refreshTokens = async (provider, token, options) => {
+const refreshTokens = async (provider, credential, options) => {
+	const { token, ...codeExchange } = credentialFields(credential);
 	const body = {
 		token_type: provider,
 		refresh_token: token,
 		country_code: options?.countryCode,
 		origin: options?.origin,
-		code_verifier: options?.codeVerifier,
-		redirect_uri: options?.redirectUri
+		...codeExchange
 	};
 	const { data } = await authV1TokenServiceRefreshToken({
 		body,
@@ -3131,6 +3183,8 @@ const encodeValue = (value) => encodeURIComponent(value).replace(/%(2[346BF]|3[A
 //#endregion
 //#region src/auth/cookie/index.ts
 const initVals = getAllCookiesStartWith(GLOBAL_PREFIX);
+/** The stored values as they are now, which other tabs may have rewritten since load. */
+const readStoreCookies = () => getAllCookiesStartWith(GLOBAL_PREFIX);
 const setStoreCookie = (key, value) => {
 	const expires = /* @__PURE__ */ new Date();
 	expires.setTime(expires.getTime() + 30 * 24 * 60 * 60 * 1e3);
@@ -3325,6 +3379,22 @@ const isTokenExpired = (expireAt) => {
 */
 const isLimitedScopeTokenResponse = (result) => "requires_action" in result && Boolean(result.requires_action);
 
+//#endregion
+//#region src/auth/session-channel.ts
+const LOGOUT = "logout";
+const channel = shared("sessionChannel", () => typeof window === "undefined" || typeof BroadcastChannel === "undefined" ? null : new BroadcastChannel(`${GLOBAL_PREFIX}_session`));
+/** Tells the other tabs on this origin that the user logged out. */
+const announceLogout = () => channel?.postMessage(LOGOUT);
+/**
+* Runs `handler` when another tab logs out. The cookie alone cannot say so:
+* a missing cookie also means the browser blocked it, as in a third-party iframe.
+*/
+const onLogoutElsewhere = (handler) => {
+	channel?.addEventListener("message", (event) => {
+		if (event.data === LOGOUT) handler();
+	});
+};
+
 //#endregion
 //#region src/auth/authStore.ts
 const isLogged = shared("isLogged", () => atom(initVals["isLogged"] === "true"));
@@ -3350,28 +3420,83 @@ const login = async (provider) => {
 	else throw new Error(`${provider} provider is not configured. Please check your initClient configuration.`);
 };
 const refreshAccessToken = async (refresh) => {
-	const result = await refreshTokens("Bearer", refresh);
+	const result = await refreshTokens("Bearer", { token: refresh });
 	if (!isLimitedScopeTokenResponse(result)) setTokens(result.access_token, result.refresh_token, result.expires_in);
 };
-const ensureValidAccessToken = async (refresh) => {
-	if (accessToken.get() && !isTokenExpired(expireAt.get())) return;
+const hasValidAccessToken = () => !!accessToken.get() && !isTokenExpired(expireAt.get());
+/**
+* Takes up the session another tab stored after rotating the refresh token.
+* Each tab holds the tokens it read at load, and the gateway accepts a refresh
+* token only once, so presenting the stale copy would be rejected and the
+* resulting logout would clear the cookies every tab shares.
+* @returns Whether a newer session was adopted
+*/
+const adoptStoredSession = () => {
+	const stored = readStoreCookies();
+	const storedRefresh = stored["refreshToken"];
+	if (!storedRefresh || storedRefresh === refreshToken.get()) return false;
+	const storedAccess = stored["accessToken"] ?? "";
+	if (scopeOf(storedAccess) !== scopeOf(accessToken.get())) clearPermissions();
+	accessToken.set(storedAccess);
+	refreshToken.set(storedRefresh);
+	expireAt.set(Number(stored["expireAt"]));
+	isLogged.set(true);
+	return true;
+};
+/** The user and organization a token's permissions apply to. */
+const scopeOf = (token) => {
+	const claims = token ? decodeToken(token) : void 0;
+	return claims ? `${claims.id}:${claims.org_id}` : "";
+};
+const REFRESH_LOCK = `${GLOBAL_PREFIX}_refresh`;
+const REFRESH_LOCK_WAIT_MS = 1e4;
+/** Runs the refresh under a lock held across tabs, where the browser has one. */
+const acrossTabs = async (task) => {
+	if (typeof navigator === "undefined" || !navigator.locks) return task();
+	let granted = false;
 	try {
-		await refreshAccessToken(refresh);
-	} catch (refreshError) {
-		console.error("Token refresh failed in getToken:", refreshError);
-		removeTokens();
-		throw refreshError;
+		await navigator.locks.request(REFRESH_LOCK, { signal: AbortSignal.timeout(REFRESH_LOCK_WAIT_MS) }, () => {
+			granted = true;
+			return task();
+		});
+	} catch (error) {
+		if (!granted && error instanceof DOMException && error.name === "TimeoutError") return task();
+		throw error;
 	}
 };
+const ensureValidAccessToken = async () => {
+	if (hasValidAccessToken()) return;
+	await acrossTabs(async () => {
+		adoptStoredSession();
+		if (hasValidAccessToken()) return;
+		const refresh = refreshToken.get();
+		if (!refresh) return;
+		try {
+			await refreshAccessToken(refresh);
+		} catch (refreshError) {
+			console.error("Token refresh failed in getToken:", refreshError);
+			if (adoptStoredSession()) return;
+			if (isRejectedRefresh(refreshError)) removeTokens();
+			throw refreshError;
+		}
+	});
+};
+/**
+* Whether the gateway refused the refresh token itself, which ends the session.
+* It answers 400 for an expired, invalid or already-used token and 401 for an
+* inactive account. A network failure, 429 or 5xx means the token could not be
+* checked, so the session is kept for the next getToken() to retry.
+*/
+const isRejectedRefresh = (error) => error instanceof ApiError && (error.status === HTTP_STATUS.BAD_REQUEST || error.status === HTTP_STATUS.UNAUTHORIZED || error.status === HTTP_STATUS.FORBIDDEN);
 const getToken = async () => {
 	if (inFlight.promise) return inFlight.promise;
 	inFlight.promise = (async () => {
 		try {
 			await initDeferred.promise;
 			if (requiresAction.get()) return void 0;
-			const currentRefreshToken = refreshToken.get();
-			if (!currentRefreshToken) return void 0;
-			await ensureValidAccessToken(currentRefreshToken);
+			adoptStoredSession();
+			if (!refreshToken.get()) return void 0;
+			await ensureValidAccessToken();
 			const token = accessToken.get();
 			if (token) decodeAndSetUser(token);
 			return token;
@@ -3445,6 +3570,7 @@ refreshToken.subscribe((value) => setStoreCookie("refreshToken", value));
 expireAt.subscribe((value) => setStoreCookie("expireAt", value));
 requiresAction.subscribe((value) => setStoreCookie("requiresAction", value));
 limitedAccessToken.subscribe((value) => setStoreCookie("limitedAccessToken", value));
+onLogoutElsewhere(removeTokens);
 
 //#endregion
 //#region src/auth/api-url.ts
@@ -3574,6 +3700,16 @@ const publicRoutes = [
 		path: "/platform/auth/v1/refresh"
 	}
 ];
+/**
+* The request's path below the configured API URL, which may carry its own path
+* (`https://example.com/api`). Matched against the full path instead, a public
+* route behind such a prefix would ask for a token, and the refresh request
+* would wait on the very getToken() call that sent it.
+*/
+function routePath(pathname) {
+	const base = new URL(apiURL.get() || "/", "http://base").pathname.replace(/\/+$/, "");
+	return base && pathname.startsWith(`${base}/`) ? pathname.slice(base.length) : pathname;
+}
 function isPublicRoute(method, pathname) {
 	const match = method.toUpperCase();
 	return publicRoutes.some(({ method: m, path, prefix }) => match === m && (prefix ? pathname.startsWith(path) : pathname === path));
@@ -3589,7 +3725,7 @@ function configureSdkClient() {
 		client.interceptors.request.use(async (request) => {
 			if (request.headers.has("Authorization")) return request;
 			const { pathname } = new URL(request.url);
-			if (isPublicRoute(request.method, pathname)) return request;
+			if (isPublicRoute(request.method, routePath(pathname))) return request;
 			const token = await state.tokenResolver();
 			if (!token) throw new ApiError("No access token available for an authenticated request", HTTP_STATUS.UNAUTHORIZED, pathname);
 			request.headers.set("Authorization", `Bearer ${token}`);
@@ -3631,6 +3767,12 @@ function hasSocialConnectAttempt(provider) {
 function clearSocialConnectAttempt(provider) {
 	sessionStorage.removeItem(socialStoragePath(provider));
 }
+/** Clears every provider's pending connection flag, so none outlives the session it was set in. */
+function clearSocialConnectAttempts() {
+	try {
+		Array.from({ length: sessionStorage.length }, (_, i) => sessionStorage.key(i)).filter((key) => key?.startsWith(SOCIAL_CONNECT_KEY_PREFIX)).forEach((key) => sessionStorage.removeItem(key));
+	} catch {}
+}
 
 //#endregion
 //#region src/auth/api/error-handlers.ts
@@ -3782,7 +3924,7 @@ const PROVIDER_FROM_PROTO = {
 	EXTERNAL_ACCOUNT_PROVIDER_FACEBOOK: "facebook",
 	EXTERNAL_ACCOUNT_PROVIDER_TELEGRAM: "telegram"
 };
-const normalizeProviderType = (provider) => provider === "tgAuthResult" || provider === "tgWebAppData" ? "telegram" : provider;
+const normalizeProviderType = (provider) => provider === "tgWebAppData" ? "telegram" : provider;
 const toProtoProvider = (provider) => {
 	const proto = PROVIDER_TO_PROTO[provider];
 	if (!proto) throw new Error(`Unknown provider: ${provider}`);
@@ -3805,20 +3947,20 @@ const listSocials = async () => {
 		});
 	}, { [HTTP_STATUS.UNAUTHORIZED]: () => /* @__PURE__ */ new Error("User is not authorized to list providers!") });
 };
-const connectSocialInternal = async (provider, token) => {
+const connectSocialInternal = async (provider, credential) => {
 	return apiCall(async () => {
+		const { token, ...codeExchange } = credentialFields(credential);
 		const requestBody = validateInput(ConnectProviderSchema, {
 			provider,
 			token
 		});
 		const sessionToken = await getToken();
 		const headers = sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {};
-		const exchange = provider === "telegram" ? telegramCodeExchange() : void 0;
 		const body = {
 			provider: toProtoProvider(normalizeProviderType(requestBody.provider)),
 			token: requestBody.token,
-			code_verifier: exchange?.codeVerifier,
-			redirect_uri: exchange?.redirectUri
+			origin: window.location.origin,
+			...codeExchange
 		};
 		const { data } = await authV1ProvidersServiceConnectProvider({
 			body,
@@ -3894,7 +4036,7 @@ const initConfig = async (config) => {
 	}
 	if (config.telegramProvider) {
 		telegramConfig.set(config.telegramProvider);
-		updateTelegramAuthUrl();
+		await updateTelegramAuthUrl();
 	}
 };
 const applyTokenExchangeResult = (result) => {
@@ -3934,27 +4076,33 @@ const handleInitPageApiError = (error) => {
 	}
 	setAuthErrorAndClear("provider_exchange_failed", info.error || info.description, info.email);
 };
-const exchangeProviderToken = async (provider, token) => {
-	const options = provider === "telegram" ? telegramCodeExchange() : void 0;
-	const result = await refreshTokens(provider, token, options);
-	applyTokenExchangeResult(result);
-};
 const initPage = async () => {
 	const provider = detectProvider();
 	if (!provider) {
 		if (hasProviderResponse()) logUnusableProviderResponse();
 		return;
 	}
-	if (provider === "telegram" && hasSocialConnectAttempt(provider)) return void 0;
-	const token = getProviderToken(provider);
-	if (!token) return void 0;
-	await loginWithProviderToken(provider, token);
+	if (isLinkAttempt(provider)) return void 0;
+	const credential = getProviderCredential(provider);
+	if (!credential) return void 0;
+	await loginWithProviderCredential(provider, credential);
+};
+/**
+* Whether this callback answers a link rather than a sign-in. Only a signed-in
+* user can link, so a flag left by an abandoned link is dropped instead of
+* swallowing the sign-in that follows it.
+*/
+const isLinkAttempt = (provider) => {
+	if (!hasSocialConnectAttempt(provider)) return false;
+	if (refreshToken.get()) return true;
+	clearSocialConnectAttempt(provider);
+	return false;
 };
-const loginWithProviderToken = async (provider, token) => {
+const loginWithProviderCredential = async (provider, credential) => {
 	try {
-		await exchangeProviderToken(provider, token);
+		applyTokenExchangeResult(await refreshTokens(provider, credential, { origin: window.location.origin }));
 	} catch (error) {
-		logProviderExchangeFailure(provider, token, error);
+		logProviderExchangeFailure(provider, credentialFields(credential).token, error);
 		if (!(error instanceof ApiError)) throw error;
 		handleInitPageApiError(error);
 	}
@@ -3962,10 +4110,10 @@ const loginWithProviderToken = async (provider, token) => {
 const initSocials = async () => {
 	const provider = detectProvider();
 	if (!provider) return void 0;
-	const token = getProviderToken(provider);
-	if (!token) return void 0;
+	const credential = getProviderCredential(provider);
+	if (!credential) return void 0;
 	try {
-		if (hasSocialConnectAttempt(provider)) await connectSocialInternal(provider, token);
+		if (hasSocialConnectAttempt(provider)) await connectSocialInternal(provider, credential);
 	} finally {
 		clearSocialConnectAttempt(provider);
 	}
@@ -4056,12 +4204,18 @@ const connect = async (config) => {
 //#region src/auth/auth/logout.ts
 const logout = async () => {
 	try {
+		const body = {
+			token: accessToken.get(),
+			refresh_token: refreshToken.get()
+		};
 		await authV1TokenServiceLogout({
-			body: { token: refreshToken.get() },
+			body,
 			throwOnError: true
 		});
 	} catch {} finally {
 		removeTokens();
+		clearSocialConnectAttempts();
+		announceLogout();
 	}
 };