fix: separates exports so oauth2-flows is optional

CHANGELOG.md

@@ -0,0 +1,124 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [0.7.2] - 2026-04-09
+
+### `@okta/spa-platform`
+
+#### Fixed
+- Fixes package exports to ensure `@okta/oauth2-flows` is truly an _optional_ dependency ([#28](https://github.com/okta/okta-client-javascript/pull/28))
+
+## [0.7.1] - 2026-04-06
+
+### `@okta/auth-foundation`
+
+#### Added
+- Added `invalidateToken` abstract method to `TokenOrchestrator` ([#26](https://github.com/okta/okta-client-javascript/pull/26))
+
+#### Fixed
+- `FetchClient` will now remove tokens when `401` is received (via `invalidateToken`) ([#26](https://github.com/okta/okta-client-javascript/pull/26))
+
+### `@okta/spa-platform`
+
+#### Added
+- Implements `invalidateToken` within `HostOrchestrator` and `AuthorizationCodeFlowOrchestrator` ([#26](https://github.com/okta/okta-client-javascript/pull/26))
+
+## [0.7.0] - 2026-03-19
+
+### `@okta/auth-foundation`
+
+#### Added
+- Warnings for mismatched `TaskBridge` message versions ([#21](https://github.com/okta/okta-client-javascript/pull/21))
+
+## [0.6.0] - 2026-03-18
+
+### `@okta/auth-foundation`
+
+#### Added
+- Clock synchronization with Authorization Server ([#16](https://github.com/okta/okta-client-javascript/pull/16))
+
+#### Changed
+- Refactored to `PlatformRegistry` pattern ([#18](https://github.com/okta/okta-client-javascript/pull/18))
+
+### `@okta/oauth2-flows`
+
+#### Changed
+- Refactored to `PlatformRegistry` pattern ([#18](https://github.com/okta/okta-client-javascript/pull/18))
+
+### `@okta/spa-platform`
+
+#### Changed
+- Refactored to `PlatformRegistry` pattern ([#18](https://github.com/okta/okta-client-javascript/pull/18))
+
+## [0.5.4] - 2025-12-09
+
+### `@okta/auth-foundation`
+
+#### Fixed
+- Improved `EventEmitter` typing within abstract classes ([#12](https://github.com/okta/okta-client-javascript/pull/12))
+
+### `@okta/oauth2-flows`
+
+#### Fixed
+- Improved `EventEmitter` typing within abstract classes ([#12](https://github.com/okta/okta-client-javascript/pull/12))
+
+### `@okta/spa-platform`
+
+#### Fixed
+- Improved `EventEmitter` typing within abstract classes ([#12](https://github.com/okta/okta-client-javascript/pull/12))
+
+## [0.5.3] - 2025-12-05
+
+### `@okta/auth-foundation`
+
+#### Added
+- Adds object hashing function to produce predictable cache keys ([#11](https://github.com/okta/okta-client-javascript/pull/11))
+
+### `@okta/oauth2-flows`
+
+#### Fixed
+- Added context to errors thrown in `AuthorizationCodeFlow` ([#9](https://github.com/okta/okta-client-javascript/pull/9))
+- Fixed `Token.Metadata` handling in `TokenStorage` ([#10](https://github.com/okta/okta-client-javascript/pull/10))
+
+### `@okta/spa-platform`
+
+#### Fixed
+- Improved local cache in `HostOrchestrator.SubApp` ([#11](https://github.com/okta/okta-client-javascript/pull/11))
+
+## [0.5.2] - 2025-11-25
+
+### `@okta/auth-foundation`
+
+#### Added
+- Adds defaults to Configuration classes ([#8](https://github.com/okta/okta-client-javascript/pull/8))
+
+#### Fixed
+- `APIClient` improvements ([#7](https://github.com/okta/okta-client-javascript/pull/7))
+
+## [0.5.1] - 2025-11-12
+
+### `@okta/auth-foundation`
+
+#### Added
+- Adds `TaskBridge` (bi-directional messaging) class ([#4](https://github.com/okta/okta-client-javascript/pull/4))
+
+#### Fixed
+- Upgraded TypeScript target to `es2022` ([#2](https://github.com/okta/okta-client-javascript/pull/2))
+
+### `@okta/oauth2-flows`
+
+#### Added
+- Adds `LogoutFlow` abstract class ([#1](https://github.com/okta/okta-client-javascript/pull/1))
+
+#### Fixed
+- Upgraded TypeScript target to `es2022` ([#2](https://github.com/okta/okta-client-javascript/pull/2))
+
+### `@okta/spa-platform`
+
+#### Added
+- Adds POST submit for /logout endpoint ([#1](https://github.com/okta/okta-client-javascript/pull/1))
+
+#### Fixed
+- Refactors `HostOrchestrator` to utilize `TaskBridge` ([#4](https://github.com/okta/okta-client-javascript/pull/4))
+- Upgraded TypeScript target to `es2022` ([#2](https://github.com/okta/okta-client-javascript/pull/2))

e2e/apps/redirect-model/src/apps/orchestrators/pages/ProxyHost.tsx

@@ -1,9 +1,11 @@
 import {
-  AuthorizationCodeFlow,
-  AuthorizationCodeFlowOrchestrator,
   HostOrchestrator,
   FetchClient
 } from '@okta/spa-platform';
+import {
+  AuthorizationCodeFlow,
+  AuthorizationCodeFlowOrchestrator
+} from '@okta/spa-platform/flows';
 import { client } from '@/auth';
 import { createMessageComponent } from '../createMessageComponent';
 

e2e/apps/redirect-model/src/apps/orchestrators/pages/Redirect.tsx

@@ -1,10 +1,10 @@
 import { useEffect, useState } from 'react';
 import { useNavigate } from 'react-router';
+import { FetchClient } from '@okta/spa-platform';
 import {
   AuthorizationCodeFlow,
-  AuthorizationCodeFlowOrchestrator,
-  FetchClient
-} from '@okta/spa-platform';
+  AuthorizationCodeFlowOrchestrator
+} from '@okta/spa-platform/flows';
 import { client } from '@/auth';
 import { Loading } from '@/component/Loading';
 import { createMessageComponent } from '../createMessageComponent';

e2e/apps/redirect-model/src/apps/orchestrators/pages/Silent.tsx

@@ -1,8 +1,8 @@
+import { FetchClient } from '@okta/spa-platform';
 import {
   AuthorizationCodeFlow,
-  AuthorizationCodeFlowOrchestrator,
-  FetchClient
-} from '@okta/spa-platform';
+  AuthorizationCodeFlowOrchestrator
+} from '@okta/spa-platform/flows';
 import { client } from '@/auth';
 import { createMessageComponent } from '../createMessageComponent';
 

e2e/apps/redirect-model/src/auth.tsx

@@ -2,9 +2,8 @@ import {
   Credential,
   OAuth2Client,
   clearDPoPKeyPairs,
-  AuthorizationCodeFlow,
-  SessionLogoutFlow
 } from '@okta/spa-platform';
+import { AuthorizationCodeFlow, SessionLogoutFlow } from '@okta/spa-platform/flows';
 
 
 const USE_DPOP = __USE_DPOP__ === "true";

e2e/apps/token-broker/src/auth.tsx

@@ -2,12 +2,11 @@ import {
   Credential,
   OAuth2Client,
   clearDPoPKeyPairs,
-  AuthorizationCodeFlow,
-  SessionLogoutFlow,
   type AcrValues,
   type JsonRecord,
   isOAuth2ErrorResponse,
 } from '@okta/spa-platform';
+import { AuthorizationCodeFlow, SessionLogoutFlow } from '@okta/spa-platform/flows';
 
 
 const ADMIN_SPA_REFRESH_TOKEN_TAG = 'admin-spa:mordor-token';

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okta/okta-client-js",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "private": true,
   "packageManager": "yarn@1.22.19",
   "engines": {

packages/auth-foundation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okta/auth-foundation",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "dist/esm/index.js",
   "module": "dist/esm/index.js",

packages/oauth2-flows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okta/oauth2-flows",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "dist/esm/index.js",
   "module": "dist/esm/index.js",

packages/spa-platform/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@okta/spa-platform",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "dist/esm/index.js",
   "module": "dist/esm/index.js",
@@ -18,6 +18,10 @@
       "types": "./dist/types/index.d.ts",
       "import": "./dist/esm/index.js"
     },
+    "./flows" : {
+      "types": "./dist/types/flows.d.ts",
+      "import": "./dist/esm/flows.js"
+    },
     "./package.json": "./package.json"
   },
   "scripts": {

packages/spa-platform/rollup.config.mjs

@@ -6,6 +6,7 @@ const base = baseConfig(ts, pkg);
 
 export default {
   ...base,
+  input: [base.input, 'src/flows.ts'],
   external: [
     ...Object.keys(pkg.peerDependencies),
     '@okta/auth-foundation/core',

packages/spa-platform/src/core.ts

@@ -0,0 +1,53 @@
+/**
+ * @packageDocumentation
+ * @internal
+ * 
+ * NOTE: DO NOT INCLUDE ANY FILES WHICH DEPEND ON `@okta/oauth2-flows`
+ */
+
+// MARK - Update UA
+
+import { addEnv } from '@okta/auth-foundation/internal';
+
+// defined in rollup.config.js
+declare const __PKG_NAME__: string;
+declare const __PKG_VERSION__: string;
+
+addEnv(`${__PKG_NAME__}/${__PKG_VERSION__}`);
+
+// MARK - Re-export auth-foundation
+
+export * from '@okta/auth-foundation/core';
+
+// MARK - Provide browser platform defaults
+
+// eslint-disable-next-line no-restricted-imports
+export * from './platform/defaults.ts';
+
+import { Platform } from '@okta/auth-foundation/core';
+// eslint-disable-next-line no-restricted-imports
+import { PlatformDefaults } from './platform/defaults.ts';
+
+Platform.registerDefaultsLoader(() => PlatformDefaults);
+
+// MARK - Provide browser-specific class overrides
+
+export { Credential } from './Credential/Credential.ts';
+export { CredentialCoordinatorImpl } from './Credential/CredentialCoordinator.ts';
+export { BrowserTokenStorage } from './Credential/TokenStorage.ts';
+export { DefaultCredentialDataSource } from './Credential/CredentialDataSource.ts';
+
+export { FetchClient } from './FetchClient/index.ts';
+
+// MARK - Export orchestrators
+
+export * from './orchestrators/HostOrchestrator/index.ts';
+
+// MARK - Export platform defaults individually
+
+export { DefaultSigningAuthority } from './platform/dpop/authority.ts';
+export { clearDPoPKeyPairs } from './platform/index.ts';
+export { PersistentCache } from './platform/dpop/nonceCache.ts';
+export { OAuth2Client } from './platform/OAuth2Client.ts';
+
+export * from './utils/isModernBrowser.ts';

packages/spa-platform/src/flows.ts

@@ -0,0 +1,13 @@
+/**
+ * @packageDocumentation
+ * @internal
+ *
+ * Separate entry point when include `@okta/oauth2-flows`
+ */
+
+// Include all core exports
+export * from './core.ts';
+
+// Include exports which also depend on `@okta/oauth2-flows`
+export * from './orchestrators/AuthorizationCodeFlowOrchestrator.ts';
+export * from './flows/index.ts';

packages/spa-platform/src/index.ts

@@ -3,39 +3,4 @@
  * @internal
  */
 
-import { addEnv } from '@okta/auth-foundation/internal';
-
-// defined in rollup.config.js
-declare const __PKG_NAME__: string;
-declare const __PKG_VERSION__: string;
-
-addEnv(`${__PKG_NAME__}/${__PKG_VERSION__}`);
-
-// eslint-disable-next-line no-restricted-imports
-export * from './platform/defaults.ts';
-
-export * from '@okta/auth-foundation/core';
-
-import { Platform } from '@okta/auth-foundation/core';
-// eslint-disable-next-line no-restricted-imports
-import { PlatformDefaults } from './platform/defaults.ts';
-
-Platform.registerDefaultsLoader(() => PlatformDefaults);
-
-export { Credential } from './Credential/Credential.ts';
-export { CredentialCoordinatorImpl } from './Credential/CredentialCoordinator.ts';
-export { BrowserTokenStorage } from './Credential/TokenStorage.ts';
-export { DefaultCredentialDataSource } from './Credential/CredentialDataSource.ts';
-
-export { FetchClient } from './FetchClient/index.ts';
-
-export * from './orchestrators/index.ts';
-
-export * from './flows/index.ts';
-
-export { DefaultSigningAuthority } from './platform/dpop/authority.ts';
-export { clearDPoPKeyPairs } from './platform/index.ts';
-export { PersistentCache } from './platform/dpop/nonceCache.ts';
-export { OAuth2Client } from './platform/OAuth2Client.ts';
-
-export * from './utils/isModernBrowser.ts';
+export * from './core.ts';