@aithos/sdk 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/src/auth.d.ts

@@ -64,7 +64,31 @@ export interface DelegateInfo {
     readonly label?: string;
 }
 export interface SignInWithGoogleOptions {
+    /**
+     * Opaque state the consumer app wants to recover after the OAuth
+     * round-trip (e.g. a deep-link to resume on). Echoed back as
+     * `?app_state=` on the final redirect.
+     */
     readonly appState?: string;
+    /**
+     * App id registered in the Aithos `aithos-auth-apps` table. When set
+     * together with {@link returnTo}, the auth backend redirects the
+     * browser to {@link returnTo} (post Google + Aithos sign-in) instead
+     * of the legacy hard-coded `app.aithos.be/auth/callback`.
+     *
+     * The pair is required together: the backend rejects half-presence
+     * with `sso_app_redirect_pair_required`. Use it for any consumer app
+     * other than the canonical `app.aithos.be` (typically your own
+     * domain in prod, `http://localhost:<port>/auth/callback` in dev).
+     */
+    readonly appId?: string;
+    /**
+     * Where the auth backend should 302 the browser back to after a
+     * successful Google sign-in. MUST be on the app's
+     * `allowed_redirect_uris` allowlist (registered with Aithos out of
+     * band; see {@link appId}). Exact-match — wildcards rejected.
+     */
+    readonly returnTo?: string;
 }
 export interface SignInInput {
     readonly email: string;

package/dist/src/auth.js

@@ -445,6 +445,13 @@ export class AithosAuth {
         if (!this.#win) {
             throw new AithosSDKError("auth_no_window", "AithosAuth.signInWithGoogle requires a browser window");
         }
+        // appId + returnTo must come together — the backend rejects
+        // half-presence at /sso/google/start. Surface that as a clean SDK
+        // error before the network round-trip rather than letting the user
+        // bounce to Google and back for nothing.
+        if ((opts?.appId && !opts?.returnTo) || (!opts?.appId && opts?.returnTo)) {
+            throw new AithosSDKError("auth_sso_app_redirect_pair_required", "appId and returnTo must be provided together (or both omitted to use the legacy redirect)");
+        }
         const url = new URL(`${this.authBaseUrl}/auth/sso/google/start`);
         if (opts?.appState) {
             if (opts.appState.length > 1024) {
@@ -452,6 +459,10 @@ export class AithosAuth {
             }
             url.searchParams.set("app_state", opts.appState);
         }
+        if (opts?.appId && opts?.returnTo) {
+            url.searchParams.set("app_id", opts.appId);
+            url.searchParams.set("redirect_uri", opts.returnTo);
+        }
         this.#win.location.assign(url.toString());
         throw new AithosSDKError("auth_redirecting", "redirecting to google");
     }
@@ -468,8 +479,16 @@ export class AithosAuth {
         }
         if (!code)
             return null;
-        const session = await this.exchange(code);
+        // Strip the aithos_code from the URL SYNCHRONOUSLY, before any
+        // await. React StrictMode (dev) invokes effects twice — without
+        // this, the first call awaits exchange (microtask, code still in
+        // the URL), the second invocation reads the same code and POSTs
+        // again, hitting `auth_code_consumed: aithos_code expired or
+        // already used`. Cleaning before the await makes the second
+        // invocation read a clean URL and return null without a network
+        // round-trip.
         cleanCallbackParams(this.#win, here);
+        const session = await this.exchange(code);
         // Hydrate signers if the SSO response carried an enc_key (Google flow
         // gives us the AES-GCM key in plaintext, encrypted only in transit
         // by TLS — see auth.aithos.be design doc).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aithos/sdk",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.12",
   "description": "Aithos SDK — high-level TypeScript developer kit for building agentic apps on the Aithos protocol. Wraps @aithos/protocol-client and exposes the Aithos compute proxy and wallet (Stripe top-up) endpoints.",
   "keywords": [
     "aithos",