@udibo/oauth2 0.1.0

package/esm/client/bff-client.js

@@ -0,0 +1,280 @@
+/**
+ * Browser client for an app fronted by a Backend-for-Frontend.
+ *
+ * The BFF holds the tokens; this client only ever talks to the BFF's
+ * `/auth/*` routes with the session cookie attached, so no token reaches the
+ * browser. Pair it with the `@udibo/oauth2/hono/bff` adapter, or any BFF
+ * serving the same four routes.
+ *
+ * @module
+ */
+import { loginContinuation as computeLoginContinuation } from "../utils/url.js";
+import { receiveJson, sendGuarded } from "./_http.js";
+import { mergedHeaders, OAuth2ClientBase, SIGNED_OUT, } from "./base.js";
+/**
+ * OAuth2 client for a browser app whose sessions live in a
+ * Backend-for-Frontend.
+ *
+ * Every method here is a same-origin call to the BFF with `credentials:
+ * "include"`, never a call to the authorization server. There is no token
+ * storage, no PKCE, and no access token to read — if you need one, the app
+ * wants a {@link DirectClient} instead.
+ *
+ * @example Same-origin BFF
+ * ```ts
+ * import { BffClient } from "@udibo/oauth2/client";
+ *
+ * const client = new BffClient();
+ *
+ * const session = await client.getSession();
+ * if (!session.isAuthenticated) {
+ *   const { url } = await client.login({ returnTo: location.pathname });
+ *   location.assign(url);
+ * }
+ *
+ * const res = await client.fetch("/api/items");
+ * ```
+ *
+ * @example BFF mounted elsewhere, with a custom CSRF header
+ * ```ts
+ * import { BffClient } from "@udibo/oauth2/client";
+ *
+ * const client = new BffClient({
+ *   endpoints: { baseUrl: "https://api.example.com", login: "/session/start" },
+ *   csrfHeader: { name: "x-requested-with", value: "spa" },
+ * });
+ * ```
+ */
+export class BffClient extends OAuth2ClientBase {
+    #endpoints;
+    #authorizePath;
+    #csrfHeader;
+    /**
+     * Builds a client against the BFF's `/auth/*` routes.
+     *
+     * @param options Endpoint overrides, the CSRF header to send, and the
+     * `fetch` to use. Every field is optional; the defaults match `HonoBff`
+     * mounted at `/auth` on the same origin.
+     */
+    constructor(options = {}) {
+        super(options);
+        const endpoints = options.endpoints ?? {};
+        this.#endpoints = {
+            baseUrl: endpoints.baseUrl ?? "",
+            login: endpoints.login ?? "/auth/login",
+            logout: endpoints.logout ?? "/auth/logout",
+            session: endpoints.session ?? "/auth/session",
+        };
+        this.#authorizePath = options.authorizePath;
+        this.#csrfHeader = options.csrfHeader === false ? {} : {
+            [options.csrfHeader?.name ?? "x-csrf"]: options.csrfHeader?.value ?? "1",
+        };
+    }
+    #url(path) {
+        const origin = typeof location !== "undefined"
+            ? location.origin
+            : "http://localhost";
+        return new URL(`${this.#endpoints.baseUrl}${path}`, origin).toString();
+    }
+    /**
+     * Builds the BFF login URL. Navigate the browser there; the BFF runs the
+     * authorization-code flow and drops the session cookie before redirecting
+     * back to `returnTo`.
+     *
+     * @param options `returnTo` is passed through as the `return_to` query
+     * parameter. The BFF is responsible for validating it against open
+     * redirects.
+     * @returns The URL to navigate to.
+     *
+     * @example
+     * ```ts
+     * import { BffClient } from "@udibo/oauth2/client";
+     *
+     * const client = new BffClient();
+     * const { url } = await client.login({ returnTo: "/dashboard" });
+     * location.assign(url);
+     * ```
+     */
+    login(options = {}) {
+        const url = new URL(this.#url(this.#endpoints.login));
+        if (options.returnTo)
+            url.searchParams.set("return_to", options.returnTo);
+        return Promise.resolve({ url: url.toString() });
+    }
+    /**
+     * Builds the BFF logout URL and emits `logged_out` so the UI can render
+     * signed-out immediately. Navigate the browser to the returned URL; the BFF
+     * destroys the session and clears the cookie.
+     *
+     * @param options `returnTo` is passed through as the `return_to` query
+     * parameter.
+     * @returns The URL to navigate to.
+     *
+     * @example
+     * ```ts
+     * import { BffClient } from "@udibo/oauth2/client";
+     *
+     * const client = new BffClient();
+     * const { url } = await client.logout({ returnTo: "/" });
+     * location.assign(url!);
+     * ```
+     */
+    logout(options = {}) {
+        const url = new URL(this.#url(this.#endpoints.logout));
+        if (options.returnTo)
+            url.searchParams.set("return_to", options.returnTo);
+        this.emit({ type: "logged_out", reason: "user" });
+        return Promise.resolve({ url: url.toString() });
+    }
+    /**
+     * Probes `GET /auth/session` and returns the full {@link SessionState} —
+     * `isAuthenticated`, `user`, plus the `sessionExpiresIn` and `logoutUrl` a
+     * SPA uses to schedule a re-probe and render a sign-out link.
+     *
+     * **Never rejects**, per {@link OAuth2ClientBase.getSession}: an
+     * unreachable BFF, a non-OK status, and a body that is not a JSON object
+     * (an HTML error page from a misrouted path is the common one) all read as
+     * signed out. A failure that was not simply "nobody is signed in" — anything
+     * other than a `401` — also emits an `error` event so a UI can tell the two
+     * apart. The read is bounded and deadlined like every other call this
+     * package makes.
+     *
+     * Only `isAuthenticated: true` carries `user` / `sessionExpiresIn` /
+     * `logoutUrl` through; an anonymous payload always reports them as `null`,
+     * whatever the BFF put in the body.
+     *
+     * @returns The session as the BFF reports it. Tokens are never included.
+     *
+     * @example
+     * ```ts
+     * import { BffClient } from "@udibo/oauth2/client";
+     *
+     * const { isAuthenticated, logoutUrl } = await new BffClient().getSession();
+     * ```
+     */
+    async getSession() {
+        return await this.#probe(false);
+    }
+    async #probe(quiet) {
+        let body;
+        try {
+            const res = await sendGuarded((input, init) => this.fetchImpl(input, init), this.#url(this.#endpoints.session), {
+                credentials: "include",
+                headers: { Accept: "application/json", ...this.#csrfHeader },
+            }, "session endpoint");
+            if (res.status === 401) {
+                await res.body?.cancel();
+                return SIGNED_OUT;
+            }
+            body = await receiveJson(res, "session endpoint");
+        }
+        catch (error) {
+            if (!quiet)
+                this.emit({ type: "error", error });
+            return SIGNED_OUT;
+        }
+        const session = body;
+        if (!session.isAuthenticated)
+            return SIGNED_OUT;
+        return {
+            isAuthenticated: true,
+            user: session.user ?? null,
+            sessionExpiresIn: session.sessionExpiresIn ?? null,
+            logoutUrl: session.logoutUrl ?? null,
+        };
+    }
+    /**
+     * The signed-in user's claims from the session probe, or `null`.
+     *
+     * @returns The `user` field of {@link getSession}.
+     */
+    async getUser() {
+        return (await this.getSession()).user;
+    }
+    /**
+     * Re-probes `GET /auth/session`.
+     *
+     * The BFF owns credential renewal — its `attachToken` middleware refreshes
+     * the access token server-side when a proxied call needs one — so this
+     * reports the current state rather than driving a refresh itself. Call it
+     * shortly before {@link SessionState.sessionExpiresIn} elapses to keep the
+     * UI honest about whether the session is still alive.
+     *
+     * Emits no `error` event, per {@link OAuth2ClientBase.renewSession}: this
+     * runs on a background timer, where a failed probe means "ask again shortly",
+     * not "show the user a problem".
+     *
+     * @returns The refreshed {@link SessionState}.
+     */
+    renewSession() {
+        return this.#probe(true);
+    }
+    /**
+     * Fetches with the session cookie and the CSRF header attached, so the BFF
+     * authenticates the call and its CSRF guard accepts it.
+     *
+     * A `401` emits `logged_out` with reason `session_expired` and is returned
+     * as-is — the BFF, not the browser, decides whether a refresh is possible.
+     *
+     * @param input Request target, as for `fetch`. A `Request` keeps the headers
+     * and body it was built with.
+     * @param init Request options. A caller-set CSRF header is left alone, and
+     * `init.headers` override same-named headers on a `Request` input.
+     * @returns The BFF's response, unmodified.
+     *
+     * @example
+     * ```ts
+     * import { BffClient } from "@udibo/oauth2/client";
+     *
+     * const res = await new BffClient().fetch("/api/items");
+     * ```
+     */
+    async fetch(input, init = {}) {
+        const headers = mergedHeaders(input, init);
+        for (const [name, value] of Object.entries(this.#csrfHeader)) {
+            if (!headers.has(name))
+                headers.set(name, value);
+        }
+        const res = await this.fetchImpl(input, {
+            ...init,
+            credentials: "include",
+            headers,
+        });
+        if (res.status === 401) {
+            this.emit({ type: "logged_out", reason: "session_expired" });
+        }
+        return res;
+    }
+    /**
+     * Builds the URL that (re)starts sign-in toward `returnTo`, for an app whose
+     * own login surface (a sign-in form, create-account, forgot-password) hands
+     * back to the BFF flow after authenticating a user: resume an in-flight
+     * authorize URL, or start a fresh BFF login.
+     *
+     * Pure and synchronous — safe in render. The mirror of
+     * `HonoBff.loginContinuation`, so both sides of the app agree on where
+     * "sign in" goes.
+     *
+     * Recognizing an in-flight authorize URL requires `authorizePath` in the
+     * constructor options; without it every `returnTo` starts a fresh login.
+     *
+     * @param returnTo Where the user was headed. `null` / `undefined` fall back
+     * to `/`.
+     * @returns The URL to redirect to.
+     *
+     * @example
+     * ```ts
+     * import { BffClient } from "@udibo/oauth2/client";
+     *
+     * const client = new BffClient({ authorizePath: "/api/oauth2/authorize" });
+     * const href = client.loginContinuation("/api/oauth2/authorize?client_id=a");
+     * ```
+     */
+    loginContinuation(returnTo) {
+        return computeLoginContinuation(returnTo, {
+            authorizeEndpoint: this.#authorizePath,
+            loginPath: `${this.#endpoints.baseUrl}${this.#endpoints.login}`,
+            defaultReturnTo: "/",
+        });
+    }
+}

package/esm/client/browser-storage.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Browser-storage implementations of {@link RefreshTokenStorage} and
+ * {@link AuthRequestStorage}.
+ *
+ * Both ship from the `@udibo/oauth2/client` subpath alongside the
+ * `Memory*` defaults so non-React browser consumers (vanilla JS,
+ * Vue, Svelte, …) can use them too.
+ *
+ * Both implementations are **SSR-safe**: if `window` / `indexedDB` /
+ * `sessionStorage` is undefined at construction, the storage degrades
+ * to a no-op (`get` returns `null`, `set`/`clear` do nothing). The
+ * client constructs the real backing on first use in the browser.
+ *
+ * @module
+ */
+import type { AuthRequestRecord, AuthRequestStorage, RefreshTokenStorage } from "./storage.js";
+/** Options for {@link IndexedDBRefreshTokenStorage}. */
+export interface IndexedDBRefreshTokenStorageOptions {
+    /**
+     * Discriminates this client's refresh token from every other OAuth2
+     * client's on the same origin, which all share one IndexedDB namespace.
+     * Pass the `client_id` handed to the client; when one client id is
+     * registered at more than one issuer, include the issuer too so the two
+     * registrations do not share a slot.
+     */
+    clientId: string;
+    /** IndexedDB database name. Defaults to `"@udibo/oauth2"`. */
+    databaseName?: string;
+    /** Object store name. Defaults to `"refresh-token"`. */
+    storeName?: string;
+}
+/**
+ * Refresh token storage backed by IndexedDB.
+ *
+ * IndexedDB is preferred over `localStorage` because the latter is
+ * synchronously readable from any script that runs in the document
+ * (including injected XSS payloads). IndexedDB's same-origin guarantees
+ * are similar but its async API and per-database isolation make
+ * exfiltration somewhat harder. Combined with refresh-token rotation +
+ * reuse detection on the authorization server, it's the recommended
+ * default for a browser `DirectClient`.
+ *
+ * No `localStorage`-backed variant is shipped: it is synchronously
+ * readable by any in-document script (including injected XSS), which
+ * defeats the protection above.
+ *
+ * Every instance needs a
+ * {@link IndexedDBRefreshTokenStorageOptions.clientId} — the token is stored
+ * under it, so two clients on one origin (two APIs, two issuers) keep
+ * separate refresh tokens instead of overwriting each other's.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   DirectClient,
+ *   IndexedDBRefreshTokenStorage,
+ * } from "@udibo/oauth2/client";
+ *
+ * const client = new DirectClient({
+ *   clientId: "web-app",
+ *   issuer: "https://sso.example",
+ *   refreshTokenStorage: new IndexedDBRefreshTokenStorage({
+ *     clientId: "web-app",
+ *   }),
+ * });
+ * ```
+ */
+export declare class IndexedDBRefreshTokenStorage implements RefreshTokenStorage {
+    #private;
+    /**
+     * Names the slot this instance owns.
+     *
+     * @param options Must carry `clientId`; `databaseName` and `storeName`
+     * isolate further when one client id needs more than one slot.
+     * @throws {TypeError} when `clientId` is empty, which would put every
+     * client on the origin back in one slot.
+     */
+    constructor(options: IndexedDBRefreshTokenStorageOptions);
+    /**
+     * Returns the stored refresh token, or `null` when none is stored, when
+     * `indexedDB` is unavailable (SSR / non-browser), or when another tab is
+     * blocking the store's creation.
+     *
+     * @throws {DOMException} when IndexedDB rejects the read.
+     */
+    get(): Promise<string | null>;
+    /**
+     * Persists {@linkcode value} as the refresh token. A no-op when `indexedDB`
+     * is unavailable (SSR / non-browser).
+     *
+     * @throws {DOMException} when IndexedDB rejects the write.
+     */
+    set(value: string): Promise<void>;
+    /**
+     * Discards the stored refresh token. A no-op when `indexedDB` is unavailable
+     * (SSR / non-browser).
+     *
+     * @throws {DOMException} when IndexedDB rejects the delete.
+     */
+    clear(): Promise<void>;
+}
+/** Options for {@link SessionStorageAuthRequestStorage}. */
+export interface SessionStorageAuthRequestStorageOptions {
+    /** sessionStorage key prefix. Defaults to `"oauth2:auth-req:"`. */
+    keyPrefix?: string;
+    /**
+     * Maximum age of an auth request before it's treated as expired
+     * (epoch-ms). Reads of older entries return `null` and the entry is
+     * removed. Defaults to 10 minutes — long enough for a slow
+     * authorize-redirect round-trip, short enough that stale state from a
+     * previous abandoned login doesn't accumulate.
+     */
+    ttlMs?: number;
+}
+/**
+ * Auth-request storage backed by `sessionStorage`.
+ *
+ * Survives the authorize-redirect round-trip (sessionStorage persists
+ * across navigations within the same tab) but doesn't outlive the tab,
+ * so a forgotten in-flight authorization doesn't leak across browser
+ * sessions.
+ *
+ * Stale entries past {@link SessionStorageAuthRequestStorageOptions.ttlMs}
+ * are pruned on read.
+ */
+export declare class SessionStorageAuthRequestStorage implements AuthRequestStorage {
+    #private;
+    /** Configures the key prefix and TTL; both default per option. */
+    constructor(options?: SessionStorageAuthRequestStorageOptions);
+    /**
+     * Returns the record for {@linkcode state}, or `null` when it is absent,
+     * unparseable, expired past the configured TTL, or `sessionStorage` is
+     * unavailable (SSR / non-browser). Expired or unparseable entries are pruned.
+     */
+    get(state: string): AuthRequestRecord | null;
+    /**
+     * Stores {@linkcode value} under {@linkcode state}. A no-op when
+     * `sessionStorage` is unavailable (SSR / non-browser).
+     */
+    set(state: string, value: AuthRequestRecord): void;
+    /**
+     * Removes the record for {@linkcode state}. A no-op when `sessionStorage` is
+     * unavailable (SSR / non-browser).
+     */
+    delete(state: string): void;
+    /**
+     * Removes every record under the configured key prefix, leaving unrelated
+     * `sessionStorage` entries intact. A no-op when `sessionStorage` is
+     * unavailable (SSR / non-browser).
+     */
+    clear(): void;
+}

package/esm/client/browser-storage.js

@@ -0,0 +1,246 @@
+/**
+ * Browser-storage implementations of {@link RefreshTokenStorage} and
+ * {@link AuthRequestStorage}.
+ *
+ * Both ship from the `@udibo/oauth2/client` subpath alongside the
+ * `Memory*` defaults so non-React browser consumers (vanilla JS,
+ * Vue, Svelte, …) can use them too.
+ *
+ * Both implementations are **SSR-safe**: if `window` / `indexedDB` /
+ * `sessionStorage` is undefined at construction, the storage degrades
+ * to a no-op (`get` returns `null`, `set`/`clear` do nothing). The
+ * client constructs the real backing on first use in the browser.
+ *
+ * @module
+ */
+/**
+ * Refresh token storage backed by IndexedDB.
+ *
+ * IndexedDB is preferred over `localStorage` because the latter is
+ * synchronously readable from any script that runs in the document
+ * (including injected XSS payloads). IndexedDB's same-origin guarantees
+ * are similar but its async API and per-database isolation make
+ * exfiltration somewhat harder. Combined with refresh-token rotation +
+ * reuse detection on the authorization server, it's the recommended
+ * default for a browser `DirectClient`.
+ *
+ * No `localStorage`-backed variant is shipped: it is synchronously
+ * readable by any in-document script (including injected XSS), which
+ * defeats the protection above.
+ *
+ * Every instance needs a
+ * {@link IndexedDBRefreshTokenStorageOptions.clientId} — the token is stored
+ * under it, so two clients on one origin (two APIs, two issuers) keep
+ * separate refresh tokens instead of overwriting each other's.
+ *
+ * @example
+ * ```ts
+ * import {
+ *   DirectClient,
+ *   IndexedDBRefreshTokenStorage,
+ * } from "@udibo/oauth2/client";
+ *
+ * const client = new DirectClient({
+ *   clientId: "web-app",
+ *   issuer: "https://sso.example",
+ *   refreshTokenStorage: new IndexedDBRefreshTokenStorage({
+ *     clientId: "web-app",
+ *   }),
+ * });
+ * ```
+ */
+export class IndexedDBRefreshTokenStorage {
+    #databaseName;
+    #storeName;
+    #key;
+    /**
+     * Names the slot this instance owns.
+     *
+     * @param options Must carry `clientId`; `databaseName` and `storeName`
+     * isolate further when one client id needs more than one slot.
+     * @throws {TypeError} when `clientId` is empty, which would put every
+     * client on the origin back in one slot.
+     */
+    constructor(options) {
+        if (!options.clientId) {
+            throw new TypeError("`clientId` is required so clients on one origin do not share a " +
+                "refresh token slot");
+        }
+        this.#databaseName = options.databaseName ?? "@udibo/oauth2";
+        this.#storeName = options.storeName ?? "refresh-token";
+        this.#key = options.clientId;
+    }
+    /**
+     * Returns the stored refresh token, or `null` when none is stored, when
+     * `indexedDB` is unavailable (SSR / non-browser), or when another tab is
+     * blocking the store's creation.
+     *
+     * @throws {DOMException} when IndexedDB rejects the read.
+     */
+    async get() {
+        const db = await this.#openDb();
+        if (!db)
+            return null;
+        return await new Promise((resolve, reject) => {
+            const tx = db.transaction(this.#storeName, "readonly");
+            const req = tx.objectStore(this.#storeName).get(this.#key);
+            req.onsuccess = () => resolve(req.result ?? null);
+            req.onerror = () => reject(req.error);
+            tx.oncomplete = () => db.close();
+        });
+    }
+    /**
+     * Persists {@linkcode value} as the refresh token. A no-op when `indexedDB`
+     * is unavailable (SSR / non-browser).
+     *
+     * @throws {DOMException} when IndexedDB rejects the write.
+     */
+    async set(value) {
+        const db = await this.#openDb();
+        if (!db)
+            return;
+        await new Promise((resolve, reject) => {
+            const tx = db.transaction(this.#storeName, "readwrite");
+            const req = tx.objectStore(this.#storeName).put(value, this.#key);
+            req.onerror = () => reject(req.error);
+            tx.oncomplete = () => {
+                db.close();
+                resolve();
+            };
+        });
+    }
+    /**
+     * Discards the stored refresh token. A no-op when `indexedDB` is unavailable
+     * (SSR / non-browser).
+     *
+     * @throws {DOMException} when IndexedDB rejects the delete.
+     */
+    async clear() {
+        const db = await this.#openDb();
+        if (!db)
+            return;
+        await new Promise((resolve, reject) => {
+            const tx = db.transaction(this.#storeName, "readwrite");
+            const req = tx.objectStore(this.#storeName).delete(this.#key);
+            req.onerror = () => reject(req.error);
+            tx.oncomplete = () => {
+                db.close();
+                resolve();
+            };
+        });
+    }
+    async #openDb() {
+        if (typeof indexedDB === "undefined")
+            return null;
+        const db = await this.#open();
+        if (!db || db.objectStoreNames.contains(this.#storeName))
+            return db;
+        const nextVersion = db.version + 1;
+        db.close();
+        return await this.#open(nextVersion);
+    }
+    #open(version) {
+        return new Promise((resolve, reject) => {
+            const req = version === undefined
+                ? indexedDB.open(this.#databaseName)
+                : indexedDB.open(this.#databaseName, version);
+            req.onupgradeneeded = () => {
+                const db = req.result;
+                if (!db.objectStoreNames.contains(this.#storeName)) {
+                    db.createObjectStore(this.#storeName);
+                }
+            };
+            req.onsuccess = () => resolve(req.result);
+            req.onerror = () => reject(req.error);
+            req.onblocked = () => resolve(null);
+        });
+    }
+}
+/**
+ * Auth-request storage backed by `sessionStorage`.
+ *
+ * Survives the authorize-redirect round-trip (sessionStorage persists
+ * across navigations within the same tab) but doesn't outlive the tab,
+ * so a forgotten in-flight authorization doesn't leak across browser
+ * sessions.
+ *
+ * Stale entries past {@link SessionStorageAuthRequestStorageOptions.ttlMs}
+ * are pruned on read.
+ */
+export class SessionStorageAuthRequestStorage {
+    #keyPrefix;
+    #ttlMs;
+    /** Configures the key prefix and TTL; both default per option. */
+    constructor(options = {}) {
+        this.#keyPrefix = options.keyPrefix ?? "oauth2:auth-req:";
+        this.#ttlMs = options.ttlMs ?? 10 * 60 * 1000;
+    }
+    /**
+     * Returns the record for {@linkcode state}, or `null` when it is absent,
+     * unparseable, expired past the configured TTL, or `sessionStorage` is
+     * unavailable (SSR / non-browser). Expired or unparseable entries are pruned.
+     */
+    get(state) {
+        const storage = this.#storage();
+        if (!storage)
+            return null;
+        const raw = storage.getItem(this.#keyPrefix + state);
+        if (!raw)
+            return null;
+        try {
+            const parsed = JSON.parse(raw);
+            if (Date.now() - parsed.createdAt > this.#ttlMs) {
+                storage.removeItem(this.#keyPrefix + state);
+                return null;
+            }
+            return parsed;
+        }
+        catch {
+            storage.removeItem(this.#keyPrefix + state);
+            return null;
+        }
+    }
+    /**
+     * Stores {@linkcode value} under {@linkcode state}. A no-op when
+     * `sessionStorage` is unavailable (SSR / non-browser).
+     */
+    set(state, value) {
+        const storage = this.#storage();
+        if (!storage)
+            return;
+        storage.setItem(this.#keyPrefix + state, JSON.stringify(value));
+    }
+    /**
+     * Removes the record for {@linkcode state}. A no-op when `sessionStorage` is
+     * unavailable (SSR / non-browser).
+     */
+    delete(state) {
+        const storage = this.#storage();
+        if (!storage)
+            return;
+        storage.removeItem(this.#keyPrefix + state);
+    }
+    /**
+     * Removes every record under the configured key prefix, leaving unrelated
+     * `sessionStorage` entries intact. A no-op when `sessionStorage` is
+     * unavailable (SSR / non-browser).
+     */
+    clear() {
+        const storage = this.#storage();
+        if (!storage)
+            return;
+        const keysToRemove = [];
+        for (let i = 0; i < storage.length; i++) {
+            const key = storage.key(i);
+            if (key && key.startsWith(this.#keyPrefix))
+                keysToRemove.push(key);
+        }
+        for (const key of keysToRemove)
+            storage.removeItem(key);
+    }
+    #storage() {
+        if (typeof sessionStorage === "undefined")
+            return null;
+        return sessionStorage;
+    }
+}