@svadmin/sso 0.11.21 → 0.12.7

package/dist/auth-helpers.d.ts

@@ -1,23 +1,23 @@
 /**
- * 浏览器端 OIDC/OAuth2 认证辅助函数。
+ * Browser-side OIDC/OAuth2 authentication helpers.
  *
- * 提供 PKCE 生成、OIDC Discovery 端点解析、重定向校验、
- * 反向代理 origin 恢复等通用工具。
+ * Provides PKCE generation, OIDC Discovery endpoint resolution, redirect validation,
+ * and reverse-proxy origin recovery.
  */
-/** 生成随机的 OAuth state 值 */
+/** Generates a random OAuth state value. */
 export declare function generateState(): string;
-/** 生成 PKCE code verifier */
+/** Generates a PKCE code verifier. */
 export declare function generateVerifier(): string;
-/** 基于 code verifier 算得 code challenge (S256) */
+/** Computes the S256 code challenge from a code verifier. */
 export declare function generateChallenge(verifier: string): Promise<string>;
 /**
- * 校验 returnTo 重定向地址，防止开放重定向漏洞。
- * 只允许同源相对路径（必须以 / 开头且非 // 开头）。
+ * Validates a returnTo redirect and prevents open-redirect vulnerabilities.
+ * Allows only same-origin relative paths (starting with / but not //).
  */
 export declare function isValidReturnTo(url: string): boolean;
-/** 从反向代理头恢复公网 origin */
+/** Recovers the public origin from reverse-proxy headers. */
 export declare function getForwardedOrigin(req: Request, fallbackUrl: URL): string;
-/** 通过 OIDC Discovery 解析授权端点 URL */
+/** Resolves the authorization endpoint URL through OIDC Discovery. */
 export declare function resolveAuthorizeUrl(issuer: string, overrideUrl?: string, fetcher?: typeof fetch): Promise<string>;
-/** 通过 OIDC Discovery 解析 token 端点 URL */
+/** Resolves the token endpoint URL through OIDC Discovery. */
 export declare function resolveTokenUrl(issuer: string, overrideUrlOrFetcher?: string | typeof fetch, fetcherOverride?: typeof fetch): Promise<string>;

package/dist/auth-helpers.js

@@ -1,29 +1,29 @@
 /**
- * 浏览器端 OIDC/OAuth2 认证辅助函数。
+ * Browser-side OIDC/OAuth2 authentication helpers.
  *
- * 提供 PKCE 生成、OIDC Discovery 端点解析、重定向校验、
- * 反向代理 origin 恢复等通用工具。
+ * Provides PKCE generation, OIDC Discovery endpoint resolution, redirect validation,
+ * and reverse-proxy origin recovery.
  */
-/** 将 Uint8Array 编码为 base64url 格式 (纯 Web API) */
+/** Encodes a Uint8Array as base64url using only Web APIs. */
 function base64url(array) {
     let binary = "";
     for (const byte of array)
         binary += String.fromCharCode(byte);
     return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-/** 生成随机的 OAuth state 值 */
+/** Generates a random OAuth state value. */
 export function generateState() {
     const array = new Uint8Array(16);
     crypto.getRandomValues(array);
     return base64url(array);
 }
-/** 生成 PKCE code verifier */
+/** Generates a PKCE code verifier. */
 export function generateVerifier() {
     const array = new Uint8Array(32);
     crypto.getRandomValues(array);
     return base64url(array);
 }
-/** 基于 code verifier 算得 code challenge (S256) */
+/** Computes the S256 code challenge from a code verifier. */
 export async function generateChallenge(verifier) {
     const encoder = new TextEncoder();
     const data = encoder.encode(verifier);
@@ -31,8 +31,8 @@ export async function generateChallenge(verifier) {
     return base64url(new Uint8Array(hash));
 }
 /**
- * 校验 returnTo 重定向地址，防止开放重定向漏洞。
- * 只允许同源相对路径（必须以 / 开头且非 // 开头）。
+ * Validates a returnTo redirect and prevents open-redirect vulnerabilities.
+ * Allows only same-origin relative paths (starting with / but not //).
  */
 export function isValidReturnTo(url) {
     if (!url)
@@ -41,7 +41,7 @@ export function isValidReturnTo(url) {
         return false;
     return /^\/[^/].*/.test(url) || url === "/";
 }
-/** 从反向代理头恢复公网 origin */
+/** Recovers the public origin from reverse-proxy headers. */
 export function getForwardedOrigin(req, fallbackUrl) {
     const forwardedProto = req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
     const forwardedHost = req.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
@@ -49,7 +49,7 @@ export function getForwardedOrigin(req, fallbackUrl) {
     const protocol = (forwardedProto || fallbackUrl.protocol.replace(/:$/, "")).replace(/:$/, "");
     return `${protocol}://${host}`;
 }
-/** 通过 OIDC Discovery 解析授权端点 URL */
+/** Resolves the authorization endpoint URL through OIDC Discovery. */
 export async function resolveAuthorizeUrl(issuer, overrideUrl = "", fetcher = fetch) {
     const normalizedIssuer = issuer.replace(/\/$/, "");
     const normalizedOverride = overrideUrl.trim();
@@ -65,14 +65,14 @@ export async function resolveAuthorizeUrl(issuer, overrideUrl = "", fetcher = fe
             }
         }
         catch {
-            // 忽略 discovery 失败，走 fallback
+            // Ignore discovery failures and use the fallback.
         }
     }
     if (normalizedIssuer)
         return `${normalizedIssuer}/oauth/authorize`;
     return "";
 }
-/** 通过 OIDC Discovery 解析 token 端点 URL */
+/** Resolves the token endpoint URL through OIDC Discovery. */
 export async function resolveTokenUrl(issuer, overrideUrlOrFetcher = "", fetcherOverride = fetch) {
     const normalizedIssuer = issuer.replace(/\/$/, "");
     const fetcher = typeof overrideUrlOrFetcher === "function" ? overrideUrlOrFetcher : fetcherOverride;
@@ -91,7 +91,7 @@ export async function resolveTokenUrl(issuer, overrideUrlOrFetcher = "", fetcher
         }
     }
     catch {
-        // 忽略 discovery 失败
+        // Ignore discovery failures.
     }
     return `${normalizedIssuer}/oauth/token`;
 }

package/dist/auth-provider.js

@@ -14,26 +14,30 @@ const REQUIRED_OIDC_ENDPOINTS = [
     'userinfo_endpoint',
 ];
 function readOIDCConfig(body) {
-    const discovery = typeof body === 'object' && body !== null && !Array.isArray(body)
-        ? body
-        : {};
+    const discovery = isUnknownRecord(body) ? body : {};
     const missingEndpoints = REQUIRED_OIDC_ENDPOINTS.filter((endpoint) => {
         const value = discovery[endpoint];
         return typeof value !== 'string' || value.length === 0;
     });
-    if (missingEndpoints.length > 0) {
+    const authorizationEndpoint = discovery['authorization_endpoint'];
+    const tokenEndpoint = discovery['token_endpoint'];
+    const userinfoEndpoint = discovery['userinfo_endpoint'];
+    if (missingEndpoints.length > 0 ||
+        typeof authorizationEndpoint !== 'string' ||
+        typeof tokenEndpoint !== 'string' ||
+        typeof userinfoEndpoint !== 'string') {
         throw new SSOAuthError(`OIDC discovery returned incomplete endpoints: missing ${missingEndpoints.join(', ')}`, 502, {
             code: 'invalid_discovery_document',
             body,
         });
     }
     return {
-        authorization_endpoint: discovery.authorization_endpoint,
-        token_endpoint: discovery.token_endpoint,
-        userinfo_endpoint: discovery.userinfo_endpoint,
-        ...(typeof discovery.end_session_endpoint === 'string'
-            && discovery.end_session_endpoint.length > 0
-            ? { end_session_endpoint: discovery.end_session_endpoint }
+        authorization_endpoint: authorizationEndpoint,
+        token_endpoint: tokenEndpoint,
+        userinfo_endpoint: userinfoEndpoint,
+        ...(typeof discovery['end_session_endpoint'] === 'string'
+            && discovery['end_session_endpoint'].length > 0
+            ? { end_session_endpoint: discovery['end_session_endpoint'] }
             : {}),
     };
 }
@@ -44,18 +48,24 @@ function decodeJwtPayload(token) {
     if (parts.length < 2)
         return null;
     const payloadStr = parts[1];
+    if (!payloadStr)
+        return null;
     const padded = payloadStr + '='.repeat((4 - (payloadStr.length % 4)) % 4);
     const binString = atob(padded.replace(/-/g, '+').replace(/_/g, '/'));
     const bytes = Uint8Array.from(binString, (value) => value.codePointAt(0) ?? 0);
-    return JSON.parse(new TextDecoder().decode(bytes));
+    const payload = JSON.parse(new TextDecoder().decode(bytes));
+    return isUnknownRecord(payload) ? payload : null;
+}
+function isUnknownRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 function getAccessTokenExpiry(data, accessToken) {
-    if (typeof data.expires_in === 'number' && Number.isFinite(data.expires_in)) {
-        return Math.floor(Date.now() / 1000) + data.expires_in;
+    if (typeof data['expires_in'] === 'number' && Number.isFinite(data['expires_in'])) {
+        return Math.floor(Date.now() / 1000) + data['expires_in'];
     }
     try {
         const payload = decodeJwtPayload(accessToken);
-        return typeof payload?.exp === 'number' ? payload.exp : undefined;
+        return typeof payload?.['exp'] === 'number' ? payload['exp'] : undefined;
     }
     catch {
         return undefined;
@@ -69,7 +79,7 @@ function createInvalidTokenResponseError(fallbackMessage, field, body) {
     });
 }
 function readTokenResponse(body, fallbackMessage) {
-    if (typeof body === 'object' && body !== null && !Array.isArray(body)) {
+    if (isUnknownRecord(body)) {
         return body;
     }
     throw createInvalidTokenResponseError(fallbackMessage, 'response body', body);
@@ -91,11 +101,14 @@ function authorizationScheme(tokenType) {
 function normalizeTokenResponse(body, defaults, fallbackMessage) {
     const response = readTokenResponse(body, fallbackMessage);
     const accessToken = requireTokenString(response, 'access_token', fallbackMessage);
+    const idToken = typeof response['id_token'] === 'string' ? response['id_token'] : defaults.idToken;
+    const refreshToken = readOptionalTokenString(response, 'refresh_token', defaults.refreshToken, fallbackMessage);
+    const expiresAt = getAccessTokenExpiry(response, accessToken);
     return {
         access_token: accessToken,
-        id_token: typeof response.id_token === 'string' ? response.id_token : defaults.idToken,
-        refresh_token: readOptionalTokenString(response, 'refresh_token', defaults.refreshToken, fallbackMessage),
-        expires_at: getAccessTokenExpiry(response, accessToken),
+        ...(idToken === undefined ? {} : { id_token: idToken }),
+        ...(refreshToken === undefined ? {} : { refresh_token: refreshToken }),
+        ...(expiresAt === undefined ? {} : { expires_at: expiresAt }),
         token_type: authorizationScheme(readOptionalTokenString(response, 'token_type', defaults.tokenType, fallbackMessage) ?? defaults.tokenType),
     };
 }
@@ -261,7 +274,8 @@ export function createSSOAuthProvider(config) {
         if (!response.ok)
             throw await createSSOAuthResponseError(response, fallbackMessage);
         try {
-            return await response.json();
+            const body = await response.json();
+            return body;
         }
         catch (error) {
             throw new SSOAuthError(`${fallbackMessage}: invalid JSON response`, 502, {
@@ -284,7 +298,7 @@ export function createSSOAuthProvider(config) {
             refresh_token: current.refresh_token,
         }), 'Token refresh failed');
         return normalizeTokenResponse(response, {
-            idToken: current.id_token,
+            ...(current.id_token === undefined ? {} : { idToken: current.id_token }),
             refreshToken: current.refresh_token,
             tokenType: current.token_type,
         }, 'Token refresh failed');
@@ -294,9 +308,9 @@ export function createSSOAuthProvider(config) {
         storageKey,
         autoRefresh: config.autoRefresh ?? true,
         refreshBuffer,
-        refreshLock: config.refreshLock,
+        ...(config.refreshLock === undefined ? {} : { refreshLock: config.refreshLock }),
         refresh: performRefresh,
-        legacyStorageKey: config.legacyStorageKey,
+        ...(config.legacyStorageKey === undefined ? {} : { legacyStorageKey: config.legacyStorageKey }),
     });
     function assertAuthorizationExchangeCurrent(authGeneration, expectedState) {
         if (sessions.getAuthGeneration() === authGeneration
@@ -341,12 +355,26 @@ export function createSSOAuthProvider(config) {
             return session;
         });
     }
-    const mapIdentity = config.mapIdentity ?? ((userinfo) => ({
-        id: userinfo.sub ?? '',
-        name: userinfo.name ?? userinfo.preferred_username ?? '',
-        avatar: userinfo.picture ?? undefined,
-        email: userinfo.email ?? undefined,
-    }));
+    const mapIdentity = config.mapIdentity ?? ((userinfo) => {
+        const id = userinfo['sub'];
+        if (typeof id !== 'string' || !id)
+            throw new Error('Invalid userinfo subject');
+        const name = userinfo['name'];
+        const username = userinfo['preferred_username'];
+        const avatar = userinfo['picture'];
+        const email = userinfo['email'];
+        for (const value of [name, username, avatar, email]) {
+            if (value !== undefined && typeof value !== 'string') {
+                throw new Error('Invalid userinfo profile field');
+            }
+        }
+        return {
+            id,
+            ...(typeof name === 'string' ? { name } : typeof username === 'string' ? { name: username } : {}),
+            ...(typeof avatar === 'string' ? { avatar } : {}),
+            ...(typeof email === 'string' ? { email } : {}),
+        };
+    });
     const authorizationSource = {
         getAuthorizationHeader: async (options) => {
             const accessToken = await sessions.getAccessToken(options);
@@ -399,7 +427,7 @@ export function createSSOAuthProvider(config) {
                     await clearOwnedLoginState(state);
                 }
                 catch {
-                    // 保留触发失败的原始认证错误；清理失败不能掩盖根因。
+                    // Preserve the original authentication error; cleanup failures must not hide the root cause.
                 }
                 return { success: false, error: getErrorResult(error) };
             }
@@ -415,7 +443,7 @@ export function createSSOAuthProvider(config) {
             catch (error) {
                 if (!(error instanceof SSOAuthError) || error.code !== 'auth_lock_failed')
                     throw error;
-                // 无跨上下文锁时 callback commit 同样会失败；本地登出仍应清理会话。
+                // Callback commit also fails without a cross-context lock; local sign-out must still clear the session.
                 sessions.clearSession();
             }
             try {
@@ -435,7 +463,7 @@ export function createSSOAuthProvider(config) {
                 }
             }
             catch {
-                // 本地会话已清理，发现或跳转失败不能恢复为登录态。
+                // The local session is cleared; discovery or redirect failures must not restore an authenticated state.
             }
             return {
                 success: true,
@@ -469,7 +497,7 @@ export function createSSOAuthProvider(config) {
                         await clearOwnedLoginState(savedState);
                     }
                     catch {
-                        // 错误回调仍返回 IdP 的原始错误；清理失败不掩盖它。
+                        // Error callbacks still return the IdP's original error; cleanup failures must not hide it.
                     }
                 }
                 return {
@@ -499,7 +527,7 @@ export function createSSOAuthProvider(config) {
                         await clearOwnedLoginState(savedState);
                     }
                     catch {
-                        // 保留 token exchange 的原始错误。
+                        // Preserve the original token exchange error.
                     }
                     return { authenticated: false, error: getErrorResult(error) };
                 }
@@ -546,6 +574,8 @@ export function createSSOAuthProvider(config) {
                 if (!response.ok)
                     return null;
                 const userinfo = await response.json();
+                if (!isUnknownRecord(userinfo))
+                    return null;
                 if (sessions.getAuthGeneration() !== authGeneration
                     || !sessions.getSession())
                     return null;

package/dist/authenticated-fetch.js

@@ -46,7 +46,7 @@ export function createAuthenticatedFetch(source, fetcher, options = {}) {
                 cause: error,
             });
         }
-        // 两份副本都在首次发送前创建，避免流式 body 被消费后静默丢失。
+        // Create both copies before the first send so a streamed body is not silently lost after consumption.
         const firstAttempt = cloneReplayableRequest(request);
         const retryAttempt = cloneReplayableRequest(request);
         const authorization = await source.getAuthorizationHeader();

package/dist/errors.d.ts

@@ -7,7 +7,7 @@ export interface SSOAuthErrorOptions {
 }
 export declare class SSOAuthError extends Error {
     readonly statusCode: number;
-    readonly code?: string;
+    readonly code: string | undefined;
     readonly details?: unknown;
     readonly body?: unknown;
     readonly retryable: boolean;

package/dist/errors.js

@@ -31,9 +31,10 @@ export class SSOAuthError extends Error {
     }
 }
 function asRecord(value) {
-    return typeof value === 'object' && value !== null
-        ? value
-        : null;
+    return isRecord(value) ? value : null;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 function firstString(...values) {
     return values.find((value) => typeof value === 'string');
@@ -43,7 +44,8 @@ async function readResponseBody(response) {
     if (!text)
         return undefined;
     try {
-        return JSON.parse(text);
+        const value = JSON.parse(text);
+        return value;
     }
     catch {
         return text;
@@ -52,15 +54,15 @@ async function readResponseBody(response) {
 export async function createSSOAuthResponseError(response, fallbackMessage) {
     const body = await readResponseBody(response);
     const record = asRecord(body);
-    const nestedError = asRecord(record?.error);
-    const code = firstString(record?.code, record?.error_code, nestedError?.code, nestedError?.error_code, record?.error);
-    const description = firstString(record?.error_description, nestedError?.error_description);
-    const responseMessage = firstString(record?.message, nestedError?.message);
+    const nestedError = asRecord(record?.['error']);
+    const code = firstString(record?.['code'], record?.['error_code'], nestedError?.['code'], nestedError?.['error_code'], record?.['error']);
+    const description = firstString(record?.['error_description'], nestedError?.['error_description']);
+    const responseMessage = firstString(record?.['message'], nestedError?.['message']);
     const textMessage = typeof body === 'string' ? body : undefined;
     const statusMessage = response.statusText || `HTTP ${response.status}`;
     return new SSOAuthError(description ?? responseMessage ?? textMessage ?? `${fallbackMessage}: ${statusMessage}`, response.status, {
-        code,
-        details: record?.details ?? nestedError?.details,
+        ...(code === undefined ? {} : { code }),
+        details: record?.['details'] ?? nestedError?.['details'],
         body,
     });
 }
@@ -81,6 +83,6 @@ export function createSSOAuthNetworkError(error, fallbackMessage) {
 }
 export function isTerminalSessionError(error) {
     const record = asRecord(error);
-    const code = firstString(record?.code, record?.error_code, asRecord(record?.error)?.code, asRecord(record?.error)?.error_code);
+    const code = firstString(record?.['code'], record?.['error_code'], asRecord(record?.['error'])?.['code'], asRecord(record?.['error'])?.['error_code']);
     return code !== undefined && TERMINAL_OAUTH_CODES.has(code);
 }

package/dist/presets.d.ts

@@ -68,15 +68,13 @@ export declare function createKeycloakAuth(baseUrl: string, realm: string, clien
 export declare function createAuth0Auth(domain: string, clientId: string, opts?: PresetOptions): import("./auth-provider.js").SSOAuthProvider;
 export type { PresetOptions };
 /**
- * Supauth hosted OIDC Sign-In.
+ * Supauth OIDC Sign-In (GoTrue-compatible identity provider).
  *
- * Targets the SupAuth contract hosted by SupaCloud or SupaOAuth: OIDC endpoints
- * live below `/auth/v1`, while browser sign-out lives at the public root
- * `/logout`. Other GoTrue deployments should provide explicit endpoints or use
- * `createSSOAuthProvider()` directly.
+ * Compatible with SupaCloud, SupaOAuth, and any GoTrue-based auth backend.
+ * Uses standard OIDC Authorization Code Flow with PKCE.
  *
+ * @param issuer - Supauth issuer URL (e.g., 'https://auth.example.com')
  * @param clientId - OAuth2 Client ID
- * @param opts - SSO options. `opts.issuer` accepts a Supauth public root or `/auth/v1` issuer URL.
  */
 export declare function createSupauthAuth(clientId: string, opts?: PresetOptions & {
     issuer?: string;

package/dist/presets.js

@@ -83,10 +83,10 @@ export function createGitHubAuth(clientId, opts) {
             userinfo_endpoint: 'https://api.github.com/user',
         },
         mapIdentity: (userinfo) => ({
-            id: String(userinfo.id ?? ''),
-            name: userinfo.name ?? userinfo.login ?? '',
-            avatar: userinfo.avatar_url ?? undefined,
-            email: userinfo.email ?? undefined,
+            id: String(userinfo['id'] ?? ''),
+            name: userinfo['name'] ?? userinfo['login'] ?? '',
+            avatar: userinfo['avatar_url'] ?? undefined,
+            email: userinfo['email'] ?? undefined,
         }),
         ...opts,
     });
@@ -144,43 +144,22 @@ export function createAuth0Auth(domain, clientId, opts) {
     });
 }
 // ─── Supauth / GoTrue ────────────────────────────────────────
-function normalizeSupauthIssuer(configuredIssuer) {
-    const normalizedIssuer = configuredIssuer.replace(/\/+$/, '');
-    if (!normalizedIssuer || normalizedIssuer.endsWith('/auth/v1')) {
-        return {
-            issuer: normalizedIssuer,
-            publicRoot: normalizedIssuer.slice(0, -'/auth/v1'.length),
-        };
-    }
-    return { issuer: `${normalizedIssuer}/auth/v1`, publicRoot: normalizedIssuer };
-}
 /**
- * Supauth hosted OIDC Sign-In.
+ * Supauth OIDC Sign-In (GoTrue-compatible identity provider).
  *
- * Targets the SupAuth contract hosted by SupaCloud or SupaOAuth: OIDC endpoints
- * live below `/auth/v1`, while browser sign-out lives at the public root
- * `/logout`. Other GoTrue deployments should provide explicit endpoints or use
- * `createSSOAuthProvider()` directly.
+ * Compatible with SupaCloud, SupaOAuth, and any GoTrue-based auth backend.
+ * Uses standard OIDC Authorization Code Flow with PKCE.
  *
+ * @param issuer - Supauth issuer URL (e.g., 'https://auth.example.com')
  * @param clientId - OAuth2 Client ID
- * @param opts - SSO options. `opts.issuer` accepts a Supauth public root or `/auth/v1` issuer URL.
  */
 export function createSupauthAuth(clientId, opts) {
-    const manualLogoutEndpoint = opts?.manualEndpoints?.end_session_endpoint;
-    const { issuer: configuredIssuer = '', endSessionEndpoint: configuredLogoutEndpoint, storageKey: configuredStorageKey, ...providerOptions } = opts ?? {};
-    const { issuer, publicRoot } = normalizeSupauthIssuer(configuredIssuer);
-    const storageKey = configuredStorageKey
-        ?? `svadmin_sso:${encodeURIComponent(configuredIssuer)}:${encodeURIComponent(clientId)}`;
-    const endSessionEndpoint = configuredLogoutEndpoint
-        ?? manualLogoutEndpoint
-        ?? (publicRoot ? `${publicRoot}/logout` : undefined);
+    const issuer = opts?.issuer ?? '';
     return createSSOAuthProvider({
         issuer,
         clientId,
         scopes: ['openid', 'profile', 'email'],
         redirectUri: resolveRedirectUri(opts),
-        storageKey,
-        ...(endSessionEndpoint === undefined ? {} : { endSessionEndpoint }),
-        ...providerOptions,
+        ...opts,
     });
 }

package/dist/session-manager.js

@@ -239,7 +239,7 @@ export function createSessionManager(options) {
     function saveSession(session, event) {
         const raw = JSON.stringify(session);
         try {
-            // 单次 setItem 写入完整 token set，避免轮换只落盘一半。
+            // Write the complete token set in one setItem call to avoid partial rotation persistence.
             options.storage.setItem(keys.tokens, raw);
         }
         catch (error) {
@@ -286,8 +286,8 @@ export function createSessionManager(options) {
     }
     function clearTokenSession() {
         const persistenceFailure = clearStorageValue(options.storage, keys.tokens);
-        // 仅 token 失效不能取消已经持有 PKCE/state 的新认证尝试。
-        // 显式 logout 会走 clearSession()，仍会清理完整状态并推进 generation。
+        // Token invalidation alone must not cancel a new authentication attempt holding PKCE/state.
+        // Explicit logout calls clearSession(), which clears all state and advances the generation.
         const preservesAuthAttempt = hasPendingAuthAttempt();
         if (!preservesAuthAttempt) {
             authGeneration += 1;
@@ -417,8 +417,8 @@ export function createSessionManager(options) {
                 }
                 throw error;
             }
-            // 网络请求只持有 refresh 锁；最终 CAS 与写入再短暂持有 auth 锁，
-            // 使跨标签页 logout/callback commit 与 token rotation 线性化。
+            // The network request holds only the refresh lock; final CAS and persistence briefly hold the auth lock,
+            // linearizing cross-tab logout/callback commits with token rotation.
             return runAuthMutation(async () => {
                 const writeRace = resolveRefreshRace(initialRaw);
                 if (writeRace.changed)
@@ -477,7 +477,7 @@ export function createSessionManager(options) {
         if (!force && raw === lastObservedRaw)
             return;
         if (raw === null) {
-            // token-only 失效可与新 callback 并发；共享 state 存在时不能把它误判为 logout。
+            // Token-only invalidation may race with a new callback; shared state means it must not be treated as logout.
             const shouldPreserveAuthAttempt = preserveAuthAttempt && hasPendingAuthAttempt();
             if (!shouldPreserveAuthAttempt) {
                 authGeneration += 1;
@@ -494,7 +494,7 @@ export function createSessionManager(options) {
             syncRemoteChange('SIGNED_OUT', null);
             return;
         }
-        // 一次明确的本地登出只有当前上下文的新登录才能撤销；远端刷新不能复活它。
+        // Only a new login in the current context can undo an explicit local sign-out; remote refresh must not resurrect it.
         if (locallySignedOut)
             return;
         authGeneration += 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.21",
+  "version": "0.12.7",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -18,7 +18,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/vibeunion/svadmin",
+    "url": "git+https://github.com/vibeunion/svadmin.git",
     "directory": "packages/sso"
   },
   "sideEffects": false,
@@ -34,7 +34,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.50.0"
+    "@svadmin/core": "^0.53.0"
   },
   "devDependencies": {
     "typescript": "^7.0.2"