@yaotoshi/auth-sdk 0.1.2 → 0.2.2

package/README.md

@@ -0,0 +1,171 @@
+# @yaotoshi/auth-sdk
+
+Browser SDK for integrating with a Yaotoshi Accounts service. Handles OAuth 2.0 + PKCE login, token management, and logout.
+
+## Install
+
+```bash
+npm install @yaotoshi/auth-sdk
+```
+
+## Quick Start
+
+```ts
+import { YaotoshiAuth } from '@yaotoshi/auth-sdk';
+
+const auth = new YaotoshiAuth({
+  clientId: 'your-client-id',
+  redirectUri: 'http://localhost:3000/callback',
+  postLogoutRedirectUri: 'http://localhost:3000',
+  accountsUrl: 'http://localhost:9999',
+});
+```
+
+### Login
+
+```ts
+// Redirects the user to the accounts service login page
+auth.login();
+```
+
+### Handle Callback
+
+On your `/callback` page:
+
+```ts
+const { accessToken, user, scope, expiresIn } = await auth.handleCallback();
+// user.email, user.sub (unique ID)
+// expiresIn: token lifetime in seconds
+```
+
+### Check Auth Status
+
+```ts
+// Returns false if no token or token is expired
+auth.isAuthenticated();
+```
+
+### Get User Info
+
+```ts
+const user = await auth.getUser();
+// { sub: 'user-id', email: 'user@example.com', email_verified: true }
+```
+
+### Get Access Token
+
+```ts
+const token = auth.getAccessToken();
+// Use in Authorization header for your own API calls
+```
+
+### Logout
+
+```ts
+// Revokes the session on the server, clears local token, redirects to postLogoutRedirectUri
+await auth.logout();
+```
+
+## Config Options
+
+| Option | Required | Default | Description |
+|--------|----------|---------|-------------|
+| `clientId` | Yes | — | OAuth client ID (from the accounts admin panel) |
+| `redirectUri` | Yes | — | Your app's callback URL (must be registered in the OAuth client) |
+| `accountsUrl` | Yes | — | Base URL of the accounts service |
+| `postLogoutRedirectUri` | No | — | Where to redirect after logout. If not set, user stays on the accounts login page |
+| `scopes` | No | `['openid', 'email']` | OAuth scopes to request |
+| `apiPathPrefix` | No | `'/api/proxy'` | API path prefix. Use `''` if connecting directly to the API |
+| `storagePrefix` | No | `'yaotoshi_auth'` | Prefix for localStorage/sessionStorage keys |
+
+## Setup
+
+Before using the SDK, you need an OAuth client registered in the accounts service:
+
+1. Open the accounts admin panel
+2. Go to **Admin > Clients**
+3. Create a new client with:
+   - **Type**: `PUBLIC`
+   - **Redirect URIs**: your callback URL (e.g. `http://localhost:3000/callback`)
+   - **Post-Logout Redirect URIs**: your app URL (e.g. `http://localhost:3000`)
+4. Copy the **Client ID**
+
+## React Example
+
+```tsx
+import { YaotoshiAuth } from '@yaotoshi/auth-sdk';
+import { useEffect, useState } from 'react';
+
+const auth = new YaotoshiAuth({
+  clientId: 'your-client-id',
+  redirectUri: 'http://localhost:3000/callback',
+  postLogoutRedirectUri: 'http://localhost:3000',
+  accountsUrl: 'http://localhost:9999',
+});
+
+function LoginPage() {
+  return <button onClick={() => auth.login()}>Sign in</button>;
+}
+
+function CallbackPage() {
+  useEffect(() => {
+    auth.handleCallback()
+      .then(() => window.location.href = '/dashboard')
+      .catch(err => console.error('Login failed:', err));
+  }, []);
+  return <p>Signing you in...</p>;
+}
+
+function Dashboard() {
+  const [user, setUser] = useState(null);
+
+  useEffect(() => {
+    if (!auth.isAuthenticated()) {
+      window.location.href = '/login';
+      return;
+    }
+    auth.getUser().then(setUser);
+  }, []);
+
+  if (!user) return <p>Loading...</p>;
+  return (
+    <div>
+      <p>Welcome, {user.email}</p>
+      <button onClick={() => auth.logout()}>Sign out</button>
+    </div>
+  );
+}
+```
+
+## Connecting Directly to the API
+
+By default, the SDK sends requests through a Next.js proxy at `/api/proxy/*`. If your app connects directly to the accounts API:
+
+```ts
+const auth = new YaotoshiAuth({
+  clientId: 'your-client-id',
+  redirectUri: 'http://localhost:3000/callback',
+  accountsUrl: 'http://localhost:9998', // direct API URL
+  apiPathPrefix: '',                     // no proxy
+});
+```
+
+## Security
+
+- Tokens are stored in `localStorage` (same approach as Auth0, Firebase)
+- PKCE (S256) is used for all OAuth flows
+- Token expiry is tracked — `isAuthenticated()` returns `false` when expired
+- Mitigate XSS risk with a strong `Content-Security-Policy` header on your app
+
+## Browser Only
+
+This SDK requires `window`, `localStorage`, `sessionStorage`, and `crypto.subtle`. It is designed for browser environments only.
+
+## Links
+
+- [GitHub](https://github.com/onchainyaotoshi/accounts)
+- [npm](https://www.npmjs.com/package/@yaotoshi/auth-sdk)
+
+## License
+
+MIT

package/dist/index.cjs

@@ -100,24 +100,38 @@ var AuthStorage = class {
     }
   }
   clearAll() {
-    this.remove("code_verifier");
-    this.remove("state");
-    this.removePersistent("access_token");
+    try {
+      const prefix = this.prefix + "_";
+      for (const store of [sessionStorage, localStorage]) {
+        const keys = Object.keys(store).filter((k) => k.startsWith(prefix));
+        keys.forEach((k) => store.removeItem(k));
+      }
+    } catch {
+    }
   }
 };
 
 // src/client.ts
 var YaotoshiAuth = class {
   constructor(config) {
+    this.processing = false;
     this.config = {
       scopes: ["openid", "email"],
       postLogoutRedirectUri: void 0,
       storagePrefix: "yaotoshi_auth",
+      apiPathPrefix: "/api/proxy",
       ...config
     };
     this.storage = new AuthStorage(this.config.storagePrefix);
   }
+  apiUrl(path) {
+    const prefix = this.config.apiPathPrefix ?? "/api/proxy";
+    return `${this.config.accountsUrl}${prefix}${path}`;
+  }
   async login() {
+    if (typeof window === "undefined") {
+      throw new Error("login() requires a browser environment");
+    }
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = await generateCodeChallenge(codeVerifier);
     const state = generateState();
@@ -127,7 +141,7 @@ var YaotoshiAuth = class {
       response_type: "code",
       client_id: this.config.clientId,
       redirect_uri: this.config.redirectUri,
-      scope: (this.config.scopes ?? ["openid", "email"]).join(" "),
+      scope: this.config.scopes.join(" "),
       state,
       code_challenge: codeChallenge,
       code_challenge_method: "S256"
@@ -135,83 +149,118 @@ var YaotoshiAuth = class {
     window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;
   }
   async handleCallback() {
-    const params = new URLSearchParams(window.location.search);
-    const code = params.get("code");
-    const state = params.get("state");
-    const error = params.get("error");
-    if (error) {
-      throw new Error(`Authorization error: ${error}`);
-    }
-    if (!code || !state) {
-      throw new Error("Missing code or state in callback");
-    }
-    const savedState = this.storage.get("state");
-    if (state !== savedState) {
-      throw new Error("State mismatch \u2014 possible CSRF attack");
-    }
-    const codeVerifier = this.storage.get("code_verifier");
-    if (!codeVerifier) {
-      throw new Error("Missing code verifier \u2014 login flow may have been interrupted");
-    }
-    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        grant_type: "authorization_code",
-        code,
-        client_id: this.config.clientId,
-        redirect_uri: this.config.redirectUri,
-        code_verifier: codeVerifier
-      })
-    });
-    if (!tokenResponse.ok) {
-      const err = await tokenResponse.json().catch(() => ({}));
-      throw new Error(err.message || "Token exchange failed");
+    if (this.processing) {
+      throw new Error("Callback is already being processed");
+    }
+    this.processing = true;
+    try {
+      const params = new URLSearchParams(window.location.search);
+      const code = params.get("code");
+      const state = params.get("state");
+      const error = params.get("error");
+      if (error) {
+        const errorDescription = params.get("error_description");
+        throw new Error(`Authorization error: ${error}${errorDescription ? ` \u2014 ${errorDescription}` : ""}`);
+      }
+      if (!code || !state) {
+        throw new Error("Missing code or state in callback");
+      }
+      const savedState = this.storage.get("state");
+      if (state !== savedState) {
+        throw new Error("State mismatch \u2014 possible CSRF attack");
+      }
+      const codeVerifier = this.storage.get("code_verifier");
+      if (!codeVerifier) {
+        throw new Error("Missing code verifier \u2014 login flow may have been interrupted");
+      }
+      const tokenResponse = await fetch(this.apiUrl("/token"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        body: JSON.stringify({
+          grant_type: "authorization_code",
+          code,
+          client_id: this.config.clientId,
+          redirect_uri: this.config.redirectUri,
+          code_verifier: codeVerifier
+        })
+      });
+      if (!tokenResponse.ok) {
+        const err = await tokenResponse.json().catch(() => ({}));
+        const message = Array.isArray(err.message) ? err.message.join(", ") : err.message || "Token exchange failed";
+        throw new Error(message);
+      }
+      const tokenData = await tokenResponse.json();
+      this.storage.remove("code_verifier");
+      this.storage.remove("state");
+      this.storage.setPersistent("access_token", tokenData.access_token);
+      this.storage.setPersistent("token_expires_at", String(Date.now() + tokenData.expires_in * 1e3));
+      const user = await this.getUser(tokenData.access_token);
+      return {
+        accessToken: tokenData.access_token,
+        scope: tokenData.scope,
+        expiresIn: tokenData.expires_in,
+        user
+      };
+    } finally {
+      this.processing = false;
     }
-    const tokenData = await tokenResponse.json();
-    this.storage.remove("code_verifier");
-    this.storage.remove("state");
-    this.storage.setPersistent("access_token", tokenData.access_token);
-    const user = await this.getUser(tokenData.access_token);
-    return { accessToken: tokenData.access_token, user };
   }
   async getUser(token) {
     const accessToken = token || this.getAccessToken();
     if (!accessToken) {
       throw new Error("No access token available");
     }
-    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {
-      headers: { Authorization: `Bearer ${accessToken}` }
+    const response = await fetch(this.apiUrl("/me"), {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      credentials: "include"
     });
     if (!response.ok) {
       if (response.status === 401) {
         this.storage.removePersistent("access_token");
+        this.storage.removePersistent("token_expires_at");
       }
       throw new Error("Failed to fetch user info");
     }
-    return response.json();
+    const data = await response.json();
+    if (!data.sub || !data.email) {
+      throw new Error("Invalid user info response");
+    }
+    return data;
   }
-  logout() {
+  async logout() {
+    if (typeof window === "undefined") {
+      throw new Error("logout() requires a browser environment");
+    }
     const token = this.getAccessToken();
-    this.storage.clearAll();
-    const form = document.createElement("form");
-    form.method = "POST";
-    form.action = `${this.config.accountsUrl}/api/proxy/logout`;
-    const addField = (name, value) => {
-      const input = document.createElement("input");
-      input.type = "hidden";
-      input.name = name;
-      input.value = value;
-      form.appendChild(input);
-    };
-    if (token) addField("token", token);
-    if (this.config.clientId) addField("client_id", this.config.clientId);
-    if (this.config.postLogoutRedirectUri) addField("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
-    document.body.appendChild(form);
-    form.submit();
+    try {
+      await fetch(this.apiUrl("/logout"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        body: JSON.stringify({
+          ...token && { token },
+          ...this.config.clientId && { client_id: this.config.clientId },
+          ...this.config.postLogoutRedirectUri && { post_logout_redirect_uri: this.config.postLogoutRedirectUri }
+        })
+      });
+    } finally {
+      this.storage.clearAll();
+    }
+    if (this.config.postLogoutRedirectUri) {
+      window.location.href = this.config.postLogoutRedirectUri;
+    }
   }
   isAuthenticated() {
-    return !!this.getAccessToken();
+    const token = this.getAccessToken();
+    if (!token) return false;
+    const expiresAt = this.storage.getPersistent("token_expires_at");
+    if (expiresAt && Date.now() > Number(expiresAt)) {
+      this.storage.removePersistent("access_token");
+      this.storage.removePersistent("token_expires_at");
+      return false;
+    }
+    return true;
   }
   getAccessToken() {
     return this.storage.getPersistent("access_token");

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { YaotoshiAuth } from './client';\nexport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n","function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    this.remove('code_verifier');\n    this.remove('state');\n    this.removePersistent('access_token');\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  async login(): Promise<void> {\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: (this.config.scopes ?? ['openid', 'email']).join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    const error = params.get('error');\n\n    if (error) {\n      throw new Error(`Authorization error: ${error}`);\n    }\n\n    if (!code || !state) {\n      throw new Error('Missing code or state in callback');\n    }\n\n    const savedState = this.storage.get('state');\n    if (state !== savedState) {\n      throw new Error('State mismatch — possible CSRF attack');\n    }\n\n    const codeVerifier = this.storage.get('code_verifier');\n    if (!codeVerifier) {\n      throw new Error('Missing code verifier — login flow may have been interrupted');\n    }\n\n    // Exchange code for token\n    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: codeVerifier,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const err = await tokenResponse.json().catch(() => ({}));\n      throw new Error(err.message || 'Token exchange failed');\n    }\n\n    const tokenData: TokenResponse = await tokenResponse.json();\n\n    // Clean up PKCE state\n    this.storage.remove('code_verifier');\n    this.storage.remove('state');\n\n    // Persist the access token\n    this.storage.setPersistent('access_token', tokenData.access_token);\n\n    // Fetch user info\n    const user = await this.getUser(tokenData.access_token);\n\n    return { accessToken: tokenData.access_token, user };\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    return response.json();\n  }\n\n  logout(): void {\n    const token = this.getAccessToken();\n    this.storage.clearAll();\n\n    const form = document.createElement('form');\n    form.method = 'POST';\n    form.action = `${this.config.accountsUrl}/api/proxy/logout`;\n\n    const addField = (name: string, value: string) => {\n      const input = document.createElement('input');\n      input.type = 'hidden';\n      input.name = name;\n      input.value = value;\n      form.appendChild(input);\n    };\n\n    if (token) addField('token', token);\n    if (this.config.clientId) addField('client_id', this.config.clientId);\n    if (this.config.postLogoutRedirectUri) addField('post_logout_redirect_uri', this.config.postLogoutRedirectUri);\n\n    document.body.appendChild(form);\n    form.submit();\n  }\n\n  isAuthenticated(): boolean {\n    return !!this.getAccessToken();\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO,eAAe;AAC3B,SAAK,OAAO,OAAO;AACnB,SAAK,iBAAiB,cAAc;AAAA,EACtC;AACF;;;AC5DO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO,UAAU,CAAC,UAAU,OAAO,GAAG,KAAK,GAAG;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,UAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,QAAI,OAAO;AACT,YAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AAAA,IACjD;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,QAAI,UAAU,YAAY;AACxB,YAAM,IAAI,MAAM,4CAAuC;AAAA,IACzD;AAEA,UAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,mEAA8D;AAAA,IAChF;AAGA,UAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,oBAAoB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,YAAM,IAAI,MAAM,IAAI,WAAW,uBAAuB;AAAA,IACxD;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,SAAK,QAAQ,OAAO,eAAe;AACnC,SAAK,QAAQ,OAAO,OAAO;AAG3B,SAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AAGjE,UAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,WAAO,EAAE,aAAa,UAAU,cAAc,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,iBAAiB;AAAA,MACtE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAAA,MAC9C;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,SAAe;AACb,UAAM,QAAQ,KAAK,eAAe;AAClC,SAAK,QAAQ,SAAS;AAEtB,UAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,SAAK,SAAS;AACd,SAAK,SAAS,GAAG,KAAK,OAAO,WAAW;AAExC,UAAM,WAAW,CAAC,MAAc,UAAkB;AAChD,YAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,YAAM,OAAO;AACb,YAAM,OAAO;AACb,YAAM,QAAQ;AACd,WAAK,YAAY,KAAK;AAAA,IACxB;AAEA,QAAI,MAAO,UAAS,SAAS,KAAK;AAClC,QAAI,KAAK,OAAO,SAAU,UAAS,aAAa,KAAK,OAAO,QAAQ;AACpE,QAAI,KAAK,OAAO,sBAAuB,UAAS,4BAA4B,KAAK,OAAO,qBAAqB;AAE7G,aAAS,KAAK,YAAY,IAAI;AAC9B,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { YaotoshiAuth } from './client';\nexport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n","function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    try {\n      const prefix = this.prefix + '_';\n      for (const store of [sessionStorage, localStorage]) {\n        const keys = Object.keys(store).filter(k => k.startsWith(prefix));\n        keys.forEach(k => store.removeItem(k));\n      }\n    } catch {\n      // Storage unavailable\n    }\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n  private processing = false;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      apiPathPrefix: '/api/proxy',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  private apiUrl(path: string): string {\n    const prefix = this.config.apiPathPrefix ?? '/api/proxy';\n    return `${this.config.accountsUrl}${prefix}${path}`;\n  }\n\n  async login(): Promise<void> {\n    if (typeof window === 'undefined') {\n      throw new Error('login() requires a browser environment');\n    }\n\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: this.config.scopes!.join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    if (this.processing) {\n      throw new Error('Callback is already being processed');\n    }\n    this.processing = true;\n\n    try {\n      const params = new URLSearchParams(window.location.search);\n      const code = params.get('code');\n      const state = params.get('state');\n      const error = params.get('error');\n\n      if (error) {\n        const errorDescription = params.get('error_description');\n        throw new Error(`Authorization error: ${error}${errorDescription ? ` — ${errorDescription}` : ''}`);\n      }\n\n      if (!code || !state) {\n        throw new Error('Missing code or state in callback');\n      }\n\n      const savedState = this.storage.get('state');\n      if (state !== savedState) {\n        throw new Error('State mismatch — possible CSRF attack');\n      }\n\n      const codeVerifier = this.storage.get('code_verifier');\n      if (!codeVerifier) {\n        throw new Error('Missing code verifier — login flow may have been interrupted');\n      }\n\n      const tokenResponse = await fetch(this.apiUrl('/token'), {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        credentials: 'include',\n        body: JSON.stringify({\n          grant_type: 'authorization_code',\n          code,\n          client_id: this.config.clientId,\n          redirect_uri: this.config.redirectUri,\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!tokenResponse.ok) {\n        const err = await tokenResponse.json().catch(() => ({}));\n        const message = Array.isArray(err.message) ? err.message.join(', ') : (err.message || 'Token exchange failed');\n        throw new Error(message);\n      }\n\n      const tokenData: TokenResponse = await tokenResponse.json();\n\n      // Clean up PKCE state\n      this.storage.remove('code_verifier');\n      this.storage.remove('state');\n\n      // Persist the access token\n      this.storage.setPersistent('access_token', tokenData.access_token);\n      this.storage.setPersistent('token_expires_at', String(Date.now() + tokenData.expires_in * 1000));\n\n      // Fetch user info\n      const user = await this.getUser(tokenData.access_token);\n\n      return {\n        accessToken: tokenData.access_token,\n        scope: tokenData.scope,\n        expiresIn: tokenData.expires_in,\n        user,\n      };\n    } finally {\n      this.processing = false;\n    }\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(this.apiUrl('/me'), {\n      headers: { Authorization: `Bearer ${accessToken}` },\n      credentials: 'include',\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n        this.storage.removePersistent('token_expires_at');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    const data = await response.json();\n    if (!data.sub || !data.email) {\n      throw new Error('Invalid user info response');\n    }\n\n    return data;\n  }\n\n  async logout(): Promise<void> {\n    if (typeof window === 'undefined') {\n      throw new Error('logout() requires a browser environment');\n    }\n\n    const token = this.getAccessToken();\n\n    try {\n      await fetch(this.apiUrl('/logout'), {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        credentials: 'include',\n        body: JSON.stringify({\n          ...(token && { token }),\n          ...(this.config.clientId && { client_id: this.config.clientId }),\n          ...(this.config.postLogoutRedirectUri && { post_logout_redirect_uri: this.config.postLogoutRedirectUri }),\n        }),\n      });\n    } finally {\n      // Clear local state regardless of server response\n      this.storage.clearAll();\n    }\n\n    // Redirect after successful logout\n    if (this.config.postLogoutRedirectUri) {\n      window.location.href = this.config.postLogoutRedirectUri;\n    }\n  }\n\n  isAuthenticated(): boolean {\n    const token = this.getAccessToken();\n    if (!token) return false;\n\n    const expiresAt = this.storage.getPersistent('token_expires_at');\n    if (expiresAt && Date.now() > Number(expiresAt)) {\n      this.storage.removePersistent('access_token');\n      this.storage.removePersistent('token_expires_at');\n      return false;\n    }\n\n    return true;\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,QAAI;AACF,YAAM,SAAS,KAAK,SAAS;AAC7B,iBAAW,SAAS,CAAC,gBAAgB,YAAY,GAAG;AAClD,cAAM,OAAO,OAAO,KAAK,KAAK,EAAE,OAAO,OAAK,EAAE,WAAW,MAAM,CAAC;AAChE,aAAK,QAAQ,OAAK,MAAM,WAAW,CAAC,CAAC;AAAA,MACvC;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AClEO,IAAM,eAAN,MAAmB;AAAA,EAMxB,YAAY,QAA4B;AAFxC,SAAQ,aAAa;AAGnB,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEQ,OAAO,MAAsB;AACnC,UAAM,SAAS,KAAK,OAAO,iBAAiB;AAC5C,WAAO,GAAG,KAAK,OAAO,WAAW,GAAG,MAAM,GAAG,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AAEA,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,OAAO,KAAK,OAAO,OAAQ,KAAK,GAAG;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AACA,SAAK,aAAa;AAElB,QAAI;AACF,YAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,YAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,YAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,YAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,UAAI,OAAO;AACT,cAAM,mBAAmB,OAAO,IAAI,mBAAmB;AACvD,cAAM,IAAI,MAAM,wBAAwB,KAAK,GAAG,mBAAmB,WAAM,gBAAgB,KAAK,EAAE,EAAE;AAAA,MACpG;AAEA,UAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,cAAM,IAAI,MAAM,mCAAmC;AAAA,MACrD;AAEA,YAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,UAAI,UAAU,YAAY;AACxB,cAAM,IAAI,MAAM,4CAAuC;AAAA,MACzD;AAEA,YAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,MAAM,mEAA8D;AAAA,MAChF;AAEA,YAAM,gBAAgB,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG;AAAA,QACvD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,UACZ;AAAA,UACA,WAAW,KAAK,OAAO;AAAA,UACvB,cAAc,KAAK,OAAO;AAAA,UAC1B,eAAe;AAAA,QACjB,CAAC;AAAA,MACH,CAAC;AAED,UAAI,CAAC,cAAc,IAAI;AACrB,cAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,cAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,KAAK,IAAI,IAAK,IAAI,WAAW;AACtF,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AAEA,YAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,WAAK,QAAQ,OAAO,eAAe;AACnC,WAAK,QAAQ,OAAO,OAAO;AAG3B,WAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AACjE,WAAK,QAAQ,cAAc,oBAAoB,OAAO,KAAK,IAAI,IAAI,UAAU,aAAa,GAAI,CAAC;AAG/F,YAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,aAAO;AAAA,QACL,aAAa,UAAU;AAAA,QACvB,OAAO,UAAU;AAAA,QACjB,WAAW,UAAU;AAAA,QACrB;AAAA,MACF;AAAA,IACF,UAAE;AACA,WAAK,aAAa;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,KAAK,OAAO,KAAK,GAAG;AAAA,MAC/C,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,MAClD,aAAa;AAAA,IACf,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAC5C,aAAK,QAAQ,iBAAiB,kBAAkB;AAAA,MAClD;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,KAAK,OAAO,CAAC,KAAK,OAAO;AAC5B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAwB;AAC5B,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,QAAQ,KAAK,eAAe;AAElC,QAAI;AACF,YAAM,MAAM,KAAK,OAAO,SAAS,GAAG;AAAA,QAClC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,GAAI,SAAS,EAAE,MAAM;AAAA,UACrB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,OAAO,SAAS;AAAA,UAC9D,GAAI,KAAK,OAAO,yBAAyB,EAAE,0BAA0B,KAAK,OAAO,sBAAsB;AAAA,QACzG,CAAC;AAAA,MACH,CAAC;AAAA,IACH,UAAE;AAEA,WAAK,QAAQ,SAAS;AAAA,IACxB;AAGA,QAAI,KAAK,OAAO,uBAAuB;AACrC,aAAO,SAAS,OAAO,KAAK,OAAO;AAAA,IACrC;AAAA,EACF;AAAA,EAEA,kBAA2B;AACzB,UAAM,QAAQ,KAAK,eAAe;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,UAAM,YAAY,KAAK,QAAQ,cAAc,kBAAkB;AAC/D,QAAI,aAAa,KAAK,IAAI,IAAI,OAAO,SAAS,GAAG;AAC/C,WAAK,QAAQ,iBAAiB,cAAc;AAC5C,WAAK,QAAQ,iBAAiB,kBAAkB;AAChD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,11 +1,22 @@
 /** Configuration options for the YaotoshiAuth client. */
 interface YaotoshiAuthConfig {
+    /** OAuth client ID */
     clientId: string;
+    /** OAuth redirect URI for callback */
     redirectUri: string;
+    /** URI to redirect to after logout */
     postLogoutRedirectUri?: string;
+    /** Base URL of the accounts service (e.g., "https://accounts.example.com") */
     accountsUrl: string;
+    /** OAuth scopes to request (default: ['openid', 'email']) */
     scopes?: string[];
+    /** Prefix for storage keys (default: 'yaotoshi_auth') */
     storagePrefix?: string;
+    /**
+     * API path prefix. Set to '/api/proxy' when using the Next.js proxy (default),
+     * or '' when connecting directly to the API.
+     */
+    apiPathPrefix?: string;
 }
 interface TokenResponse {
     access_token: string;
@@ -13,6 +24,7 @@ interface TokenResponse {
     expires_in: number;
     scope: string;
 }
+/** User info returned by the /me endpoint. `sub` is the user's unique ID (cuid). */
 interface UserInfo {
     sub: string;
     email: string;
@@ -20,17 +32,23 @@ interface UserInfo {
 }
 interface AuthResult {
     accessToken: string;
+    /** Granted scopes (may differ from requested scopes) */
+    scope: string;
+    /** Token lifetime in seconds */
+    expiresIn: number;
     user: UserInfo;
 }
 
 declare class YaotoshiAuth {
     private config;
     private storage;
+    private processing;
     constructor(config: YaotoshiAuthConfig);
+    private apiUrl;
     login(): Promise<void>;
     handleCallback(): Promise<AuthResult>;
     getUser(token?: string): Promise<UserInfo>;
-    logout(): void;
+    logout(): Promise<void>;
     isAuthenticated(): boolean;
     getAccessToken(): string | null;
 }

package/dist/index.d.ts

@@ -1,11 +1,22 @@
 /** Configuration options for the YaotoshiAuth client. */
 interface YaotoshiAuthConfig {
+    /** OAuth client ID */
     clientId: string;
+    /** OAuth redirect URI for callback */
     redirectUri: string;
+    /** URI to redirect to after logout */
     postLogoutRedirectUri?: string;
+    /** Base URL of the accounts service (e.g., "https://accounts.example.com") */
     accountsUrl: string;
+    /** OAuth scopes to request (default: ['openid', 'email']) */
     scopes?: string[];
+    /** Prefix for storage keys (default: 'yaotoshi_auth') */
     storagePrefix?: string;
+    /**
+     * API path prefix. Set to '/api/proxy' when using the Next.js proxy (default),
+     * or '' when connecting directly to the API.
+     */
+    apiPathPrefix?: string;
 }
 interface TokenResponse {
     access_token: string;
@@ -13,6 +24,7 @@ interface TokenResponse {
     expires_in: number;
     scope: string;
 }
+/** User info returned by the /me endpoint. `sub` is the user's unique ID (cuid). */
 interface UserInfo {
     sub: string;
     email: string;
@@ -20,17 +32,23 @@ interface UserInfo {
 }
 interface AuthResult {
     accessToken: string;
+    /** Granted scopes (may differ from requested scopes) */
+    scope: string;
+    /** Token lifetime in seconds */
+    expiresIn: number;
     user: UserInfo;
 }
 
 declare class YaotoshiAuth {
     private config;
     private storage;
+    private processing;
     constructor(config: YaotoshiAuthConfig);
+    private apiUrl;
     login(): Promise<void>;
     handleCallback(): Promise<AuthResult>;
     getUser(token?: string): Promise<UserInfo>;
-    logout(): void;
+    logout(): Promise<void>;
     isAuthenticated(): boolean;
     getAccessToken(): string | null;
 }

package/dist/index.js

@@ -74,24 +74,38 @@ var AuthStorage = class {
     }
   }
   clearAll() {
-    this.remove("code_verifier");
-    this.remove("state");
-    this.removePersistent("access_token");
+    try {
+      const prefix = this.prefix + "_";
+      for (const store of [sessionStorage, localStorage]) {
+        const keys = Object.keys(store).filter((k) => k.startsWith(prefix));
+        keys.forEach((k) => store.removeItem(k));
+      }
+    } catch {
+    }
   }
 };
 
 // src/client.ts
 var YaotoshiAuth = class {
   constructor(config) {
+    this.processing = false;
     this.config = {
       scopes: ["openid", "email"],
       postLogoutRedirectUri: void 0,
       storagePrefix: "yaotoshi_auth",
+      apiPathPrefix: "/api/proxy",
       ...config
     };
     this.storage = new AuthStorage(this.config.storagePrefix);
   }
+  apiUrl(path) {
+    const prefix = this.config.apiPathPrefix ?? "/api/proxy";
+    return `${this.config.accountsUrl}${prefix}${path}`;
+  }
   async login() {
+    if (typeof window === "undefined") {
+      throw new Error("login() requires a browser environment");
+    }
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = await generateCodeChallenge(codeVerifier);
     const state = generateState();
@@ -101,7 +115,7 @@ var YaotoshiAuth = class {
       response_type: "code",
       client_id: this.config.clientId,
       redirect_uri: this.config.redirectUri,
-      scope: (this.config.scopes ?? ["openid", "email"]).join(" "),
+      scope: this.config.scopes.join(" "),
       state,
       code_challenge: codeChallenge,
       code_challenge_method: "S256"
@@ -109,83 +123,118 @@ var YaotoshiAuth = class {
     window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;
   }
   async handleCallback() {
-    const params = new URLSearchParams(window.location.search);
-    const code = params.get("code");
-    const state = params.get("state");
-    const error = params.get("error");
-    if (error) {
-      throw new Error(`Authorization error: ${error}`);
-    }
-    if (!code || !state) {
-      throw new Error("Missing code or state in callback");
-    }
-    const savedState = this.storage.get("state");
-    if (state !== savedState) {
-      throw new Error("State mismatch \u2014 possible CSRF attack");
-    }
-    const codeVerifier = this.storage.get("code_verifier");
-    if (!codeVerifier) {
-      throw new Error("Missing code verifier \u2014 login flow may have been interrupted");
-    }
-    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        grant_type: "authorization_code",
-        code,
-        client_id: this.config.clientId,
-        redirect_uri: this.config.redirectUri,
-        code_verifier: codeVerifier
-      })
-    });
-    if (!tokenResponse.ok) {
-      const err = await tokenResponse.json().catch(() => ({}));
-      throw new Error(err.message || "Token exchange failed");
+    if (this.processing) {
+      throw new Error("Callback is already being processed");
+    }
+    this.processing = true;
+    try {
+      const params = new URLSearchParams(window.location.search);
+      const code = params.get("code");
+      const state = params.get("state");
+      const error = params.get("error");
+      if (error) {
+        const errorDescription = params.get("error_description");
+        throw new Error(`Authorization error: ${error}${errorDescription ? ` \u2014 ${errorDescription}` : ""}`);
+      }
+      if (!code || !state) {
+        throw new Error("Missing code or state in callback");
+      }
+      const savedState = this.storage.get("state");
+      if (state !== savedState) {
+        throw new Error("State mismatch \u2014 possible CSRF attack");
+      }
+      const codeVerifier = this.storage.get("code_verifier");
+      if (!codeVerifier) {
+        throw new Error("Missing code verifier \u2014 login flow may have been interrupted");
+      }
+      const tokenResponse = await fetch(this.apiUrl("/token"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        body: JSON.stringify({
+          grant_type: "authorization_code",
+          code,
+          client_id: this.config.clientId,
+          redirect_uri: this.config.redirectUri,
+          code_verifier: codeVerifier
+        })
+      });
+      if (!tokenResponse.ok) {
+        const err = await tokenResponse.json().catch(() => ({}));
+        const message = Array.isArray(err.message) ? err.message.join(", ") : err.message || "Token exchange failed";
+        throw new Error(message);
+      }
+      const tokenData = await tokenResponse.json();
+      this.storage.remove("code_verifier");
+      this.storage.remove("state");
+      this.storage.setPersistent("access_token", tokenData.access_token);
+      this.storage.setPersistent("token_expires_at", String(Date.now() + tokenData.expires_in * 1e3));
+      const user = await this.getUser(tokenData.access_token);
+      return {
+        accessToken: tokenData.access_token,
+        scope: tokenData.scope,
+        expiresIn: tokenData.expires_in,
+        user
+      };
+    } finally {
+      this.processing = false;
     }
-    const tokenData = await tokenResponse.json();
-    this.storage.remove("code_verifier");
-    this.storage.remove("state");
-    this.storage.setPersistent("access_token", tokenData.access_token);
-    const user = await this.getUser(tokenData.access_token);
-    return { accessToken: tokenData.access_token, user };
   }
   async getUser(token) {
     const accessToken = token || this.getAccessToken();
     if (!accessToken) {
       throw new Error("No access token available");
     }
-    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {
-      headers: { Authorization: `Bearer ${accessToken}` }
+    const response = await fetch(this.apiUrl("/me"), {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      credentials: "include"
     });
     if (!response.ok) {
       if (response.status === 401) {
         this.storage.removePersistent("access_token");
+        this.storage.removePersistent("token_expires_at");
       }
       throw new Error("Failed to fetch user info");
     }
-    return response.json();
+    const data = await response.json();
+    if (!data.sub || !data.email) {
+      throw new Error("Invalid user info response");
+    }
+    return data;
   }
-  logout() {
+  async logout() {
+    if (typeof window === "undefined") {
+      throw new Error("logout() requires a browser environment");
+    }
     const token = this.getAccessToken();
-    this.storage.clearAll();
-    const form = document.createElement("form");
-    form.method = "POST";
-    form.action = `${this.config.accountsUrl}/api/proxy/logout`;
-    const addField = (name, value) => {
-      const input = document.createElement("input");
-      input.type = "hidden";
-      input.name = name;
-      input.value = value;
-      form.appendChild(input);
-    };
-    if (token) addField("token", token);
-    if (this.config.clientId) addField("client_id", this.config.clientId);
-    if (this.config.postLogoutRedirectUri) addField("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
-    document.body.appendChild(form);
-    form.submit();
+    try {
+      await fetch(this.apiUrl("/logout"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        body: JSON.stringify({
+          ...token && { token },
+          ...this.config.clientId && { client_id: this.config.clientId },
+          ...this.config.postLogoutRedirectUri && { post_logout_redirect_uri: this.config.postLogoutRedirectUri }
+        })
+      });
+    } finally {
+      this.storage.clearAll();
+    }
+    if (this.config.postLogoutRedirectUri) {
+      window.location.href = this.config.postLogoutRedirectUri;
+    }
   }
   isAuthenticated() {
-    return !!this.getAccessToken();
+    const token = this.getAccessToken();
+    if (!token) return false;
+    const expiresAt = this.storage.getPersistent("token_expires_at");
+    if (expiresAt && Date.now() > Number(expiresAt)) {
+      this.storage.removePersistent("access_token");
+      this.storage.removePersistent("token_expires_at");
+      return false;
+    }
+    return true;
   }
   getAccessToken() {
     return this.storage.getPersistent("access_token");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    this.remove('code_verifier');\n    this.remove('state');\n    this.removePersistent('access_token');\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  async login(): Promise<void> {\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: (this.config.scopes ?? ['openid', 'email']).join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    const error = params.get('error');\n\n    if (error) {\n      throw new Error(`Authorization error: ${error}`);\n    }\n\n    if (!code || !state) {\n      throw new Error('Missing code or state in callback');\n    }\n\n    const savedState = this.storage.get('state');\n    if (state !== savedState) {\n      throw new Error('State mismatch — possible CSRF attack');\n    }\n\n    const codeVerifier = this.storage.get('code_verifier');\n    if (!codeVerifier) {\n      throw new Error('Missing code verifier — login flow may have been interrupted');\n    }\n\n    // Exchange code for token\n    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: codeVerifier,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const err = await tokenResponse.json().catch(() => ({}));\n      throw new Error(err.message || 'Token exchange failed');\n    }\n\n    const tokenData: TokenResponse = await tokenResponse.json();\n\n    // Clean up PKCE state\n    this.storage.remove('code_verifier');\n    this.storage.remove('state');\n\n    // Persist the access token\n    this.storage.setPersistent('access_token', tokenData.access_token);\n\n    // Fetch user info\n    const user = await this.getUser(tokenData.access_token);\n\n    return { accessToken: tokenData.access_token, user };\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    return response.json();\n  }\n\n  logout(): void {\n    const token = this.getAccessToken();\n    this.storage.clearAll();\n\n    const form = document.createElement('form');\n    form.method = 'POST';\n    form.action = `${this.config.accountsUrl}/api/proxy/logout`;\n\n    const addField = (name: string, value: string) => {\n      const input = document.createElement('input');\n      input.type = 'hidden';\n      input.name = name;\n      input.value = value;\n      form.appendChild(input);\n    };\n\n    if (token) addField('token', token);\n    if (this.config.clientId) addField('client_id', this.config.clientId);\n    if (this.config.postLogoutRedirectUri) addField('post_logout_redirect_uri', this.config.postLogoutRedirectUri);\n\n    document.body.appendChild(form);\n    form.submit();\n  }\n\n  isAuthenticated(): boolean {\n    return !!this.getAccessToken();\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";AAAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO,eAAe;AAC3B,SAAK,OAAO,OAAO;AACnB,SAAK,iBAAiB,cAAc;AAAA,EACtC;AACF;;;AC5DO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO,UAAU,CAAC,UAAU,OAAO,GAAG,KAAK,GAAG;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,UAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,QAAI,OAAO;AACT,YAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AAAA,IACjD;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,QAAI,UAAU,YAAY;AACxB,YAAM,IAAI,MAAM,4CAAuC;AAAA,IACzD;AAEA,UAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,mEAA8D;AAAA,IAChF;AAGA,UAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,oBAAoB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,YAAM,IAAI,MAAM,IAAI,WAAW,uBAAuB;AAAA,IACxD;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,SAAK,QAAQ,OAAO,eAAe;AACnC,SAAK,QAAQ,OAAO,OAAO;AAG3B,SAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AAGjE,UAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,WAAO,EAAE,aAAa,UAAU,cAAc,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,iBAAiB;AAAA,MACtE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAAA,MAC9C;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,SAAe;AACb,UAAM,QAAQ,KAAK,eAAe;AAClC,SAAK,QAAQ,SAAS;AAEtB,UAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,SAAK,SAAS;AACd,SAAK,SAAS,GAAG,KAAK,OAAO,WAAW;AAExC,UAAM,WAAW,CAAC,MAAc,UAAkB;AAChD,YAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,YAAM,OAAO;AACb,YAAM,OAAO;AACb,YAAM,QAAQ;AACd,WAAK,YAAY,KAAK;AAAA,IACxB;AAEA,QAAI,MAAO,UAAS,SAAS,KAAK;AAClC,QAAI,KAAK,OAAO,SAAU,UAAS,aAAa,KAAK,OAAO,QAAQ;AACpE,QAAI,KAAK,OAAO,sBAAuB,UAAS,4BAA4B,KAAK,OAAO,qBAAqB;AAE7G,aAAS,KAAK,YAAY,IAAI;AAC9B,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}
+{"version":3,"sources":["../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    try {\n      const prefix = this.prefix + '_';\n      for (const store of [sessionStorage, localStorage]) {\n        const keys = Object.keys(store).filter(k => k.startsWith(prefix));\n        keys.forEach(k => store.removeItem(k));\n      }\n    } catch {\n      // Storage unavailable\n    }\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n  private processing = false;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      apiPathPrefix: '/api/proxy',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  private apiUrl(path: string): string {\n    const prefix = this.config.apiPathPrefix ?? '/api/proxy';\n    return `${this.config.accountsUrl}${prefix}${path}`;\n  }\n\n  async login(): Promise<void> {\n    if (typeof window === 'undefined') {\n      throw new Error('login() requires a browser environment');\n    }\n\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: this.config.scopes!.join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    if (this.processing) {\n      throw new Error('Callback is already being processed');\n    }\n    this.processing = true;\n\n    try {\n      const params = new URLSearchParams(window.location.search);\n      const code = params.get('code');\n      const state = params.get('state');\n      const error = params.get('error');\n\n      if (error) {\n        const errorDescription = params.get('error_description');\n        throw new Error(`Authorization error: ${error}${errorDescription ? ` — ${errorDescription}` : ''}`);\n      }\n\n      if (!code || !state) {\n        throw new Error('Missing code or state in callback');\n      }\n\n      const savedState = this.storage.get('state');\n      if (state !== savedState) {\n        throw new Error('State mismatch — possible CSRF attack');\n      }\n\n      const codeVerifier = this.storage.get('code_verifier');\n      if (!codeVerifier) {\n        throw new Error('Missing code verifier — login flow may have been interrupted');\n      }\n\n      const tokenResponse = await fetch(this.apiUrl('/token'), {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        credentials: 'include',\n        body: JSON.stringify({\n          grant_type: 'authorization_code',\n          code,\n          client_id: this.config.clientId,\n          redirect_uri: this.config.redirectUri,\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!tokenResponse.ok) {\n        const err = await tokenResponse.json().catch(() => ({}));\n        const message = Array.isArray(err.message) ? err.message.join(', ') : (err.message || 'Token exchange failed');\n        throw new Error(message);\n      }\n\n      const tokenData: TokenResponse = await tokenResponse.json();\n\n      // Clean up PKCE state\n      this.storage.remove('code_verifier');\n      this.storage.remove('state');\n\n      // Persist the access token\n      this.storage.setPersistent('access_token', tokenData.access_token);\n      this.storage.setPersistent('token_expires_at', String(Date.now() + tokenData.expires_in * 1000));\n\n      // Fetch user info\n      const user = await this.getUser(tokenData.access_token);\n\n      return {\n        accessToken: tokenData.access_token,\n        scope: tokenData.scope,\n        expiresIn: tokenData.expires_in,\n        user,\n      };\n    } finally {\n      this.processing = false;\n    }\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(this.apiUrl('/me'), {\n      headers: { Authorization: `Bearer ${accessToken}` },\n      credentials: 'include',\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n        this.storage.removePersistent('token_expires_at');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    const data = await response.json();\n    if (!data.sub || !data.email) {\n      throw new Error('Invalid user info response');\n    }\n\n    return data;\n  }\n\n  async logout(): Promise<void> {\n    if (typeof window === 'undefined') {\n      throw new Error('logout() requires a browser environment');\n    }\n\n    const token = this.getAccessToken();\n\n    try {\n      await fetch(this.apiUrl('/logout'), {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        credentials: 'include',\n        body: JSON.stringify({\n          ...(token && { token }),\n          ...(this.config.clientId && { client_id: this.config.clientId }),\n          ...(this.config.postLogoutRedirectUri && { post_logout_redirect_uri: this.config.postLogoutRedirectUri }),\n        }),\n      });\n    } finally {\n      // Clear local state regardless of server response\n      this.storage.clearAll();\n    }\n\n    // Redirect after successful logout\n    if (this.config.postLogoutRedirectUri) {\n      window.location.href = this.config.postLogoutRedirectUri;\n    }\n  }\n\n  isAuthenticated(): boolean {\n    const token = this.getAccessToken();\n    if (!token) return false;\n\n    const expiresAt = this.storage.getPersistent('token_expires_at');\n    if (expiresAt && Date.now() > Number(expiresAt)) {\n      this.storage.removePersistent('access_token');\n      this.storage.removePersistent('token_expires_at');\n      return false;\n    }\n\n    return true;\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";AAAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,QAAI;AACF,YAAM,SAAS,KAAK,SAAS;AAC7B,iBAAW,SAAS,CAAC,gBAAgB,YAAY,GAAG;AAClD,cAAM,OAAO,OAAO,KAAK,KAAK,EAAE,OAAO,OAAK,EAAE,WAAW,MAAM,CAAC;AAChE,aAAK,QAAQ,OAAK,MAAM,WAAW,CAAC,CAAC;AAAA,MACvC;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AClEO,IAAM,eAAN,MAAmB;AAAA,EAMxB,YAAY,QAA4B;AAFxC,SAAQ,aAAa;AAGnB,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEQ,OAAO,MAAsB;AACnC,UAAM,SAAS,KAAK,OAAO,iBAAiB;AAC5C,WAAO,GAAG,KAAK,OAAO,WAAW,GAAG,MAAM,GAAG,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,QAAuB;AAC3B,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AAEA,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,OAAO,KAAK,OAAO,OAAQ,KAAK,GAAG;AAAA,MACnC;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AACA,SAAK,aAAa;AAElB,QAAI;AACF,YAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,YAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,YAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,YAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,UAAI,OAAO;AACT,cAAM,mBAAmB,OAAO,IAAI,mBAAmB;AACvD,cAAM,IAAI,MAAM,wBAAwB,KAAK,GAAG,mBAAmB,WAAM,gBAAgB,KAAK,EAAE,EAAE;AAAA,MACpG;AAEA,UAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,cAAM,IAAI,MAAM,mCAAmC;AAAA,MACrD;AAEA,YAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,UAAI,UAAU,YAAY;AACxB,cAAM,IAAI,MAAM,4CAAuC;AAAA,MACzD;AAEA,YAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,MAAM,mEAA8D;AAAA,MAChF;AAEA,YAAM,gBAAgB,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG;AAAA,QACvD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,YAAY;AAAA,UACZ;AAAA,UACA,WAAW,KAAK,OAAO;AAAA,UACvB,cAAc,KAAK,OAAO;AAAA,UAC1B,eAAe;AAAA,QACjB,CAAC;AAAA,MACH,CAAC;AAED,UAAI,CAAC,cAAc,IAAI;AACrB,cAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,cAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,QAAQ,KAAK,IAAI,IAAK,IAAI,WAAW;AACtF,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AAEA,YAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,WAAK,QAAQ,OAAO,eAAe;AACnC,WAAK,QAAQ,OAAO,OAAO;AAG3B,WAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AACjE,WAAK,QAAQ,cAAc,oBAAoB,OAAO,KAAK,IAAI,IAAI,UAAU,aAAa,GAAI,CAAC;AAG/F,YAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,aAAO;AAAA,QACL,aAAa,UAAU;AAAA,QACvB,OAAO,UAAU;AAAA,QACjB,WAAW,UAAU;AAAA,QACrB;AAAA,MACF;AAAA,IACF,UAAE;AACA,WAAK,aAAa;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,KAAK,OAAO,KAAK,GAAG;AAAA,MAC/C,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,MAClD,aAAa;AAAA,IACf,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAC5C,aAAK,QAAQ,iBAAiB,kBAAkB;AAAA,MAClD;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,KAAK,OAAO,CAAC,KAAK,OAAO;AAC5B,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAwB;AAC5B,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,QAAQ,KAAK,eAAe;AAElC,QAAI;AACF,YAAM,MAAM,KAAK,OAAO,SAAS,GAAG;AAAA,QAClC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,GAAI,SAAS,EAAE,MAAM;AAAA,UACrB,GAAI,KAAK,OAAO,YAAY,EAAE,WAAW,KAAK,OAAO,SAAS;AAAA,UAC9D,GAAI,KAAK,OAAO,yBAAyB,EAAE,0BAA0B,KAAK,OAAO,sBAAsB;AAAA,QACzG,CAAC;AAAA,MACH,CAAC;AAAA,IACH,UAAE;AAEA,WAAK,QAAQ,SAAS;AAAA,IACxB;AAGA,QAAI,KAAK,OAAO,uBAAuB;AACrC,aAAO,SAAS,OAAO,KAAK,OAAO;AAAA,IACrC;AAAA,EACF;AAAA,EAEA,kBAA2B;AACzB,UAAM,QAAQ,KAAK,eAAe;AAClC,QAAI,CAAC,MAAO,QAAO;AAEnB,UAAM,YAAY,KAAK,QAAQ,cAAc,kBAAkB;AAC/D,QAAI,aAAa,KAAK,IAAI,IAAI,OAAO,SAAS,GAAG;AAC/C,WAAK,QAAQ,iBAAiB,cAAc;AAC5C,WAAK,QAAQ,iBAAiB,kBAAkB;AAChD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "@yaotoshi/auth-sdk",
-  "version": "0.1.2",
+  "version": "0.2.2",
   "description": "Authentication SDK for Yaotoshi ecosystem apps",
   "license": "MIT",
   "type": "module",
+  "browser": "./dist/index.js",
+  "sideEffects": false,
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,7 +17,8 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "README.md"
   ],
   "scripts": {
     "build": "tsup",