@ankhorage/studio 2.0.2 → 2.0.4

package/dist/host/layout/templates/auth/oauth.js

@@ -1,13 +1,6 @@
 import { escapeStringLiteral } from '../../utils/escapeStringLiteral';
 export function getAuthOAuthRuntimeTs(args) {
-    const callbackRoute = escapeStringLiteral(args.callbackRoute);
     const providers = serializeOAuthProviders(args.providers);
-    const androidScheme = args.nativeSchemes.android === undefined
-        ? 'undefined'
-        : `'${escapeStringLiteral(args.nativeSchemes.android)}'`;
-    const iosScheme = args.nativeSchemes.ios === undefined
-        ? 'undefined'
-        : `'${escapeStringLiteral(args.nativeSchemes.ios)}'`;
     return `import type {
   AuthOAuthCompletionResult,
   AuthOAuthTransportCancellationReason,
@@ -17,20 +10,19 @@ import {
   resolveExpoOAuthBrowserResult,
 } from '@ankhorage/expo-runtime/oauth-browser';
 import { resolveExpoOAuthBrowserRuntimeReadiness } from '@ankhorage/expo-runtime/oauth-browser-runtime';
-import * as Linking from 'expo-linking';
+import type { OAuthProviderIconSpec } from '@ankhorage/zora';
 import * as WebBrowser from 'expo-web-browser';
 import { Platform } from 'react-native';
 
 import { authAdapter } from './adapter';
-import { authSessionStorage, getStoredAuthSession } from './session';
+import {
+  completeOAuthCallback,
+  resolveOAuthCallbackUrl,
+  resolveOAuthRedirectUri,
+} from './oauth-completion';
+import { clearTransportAttempt, writeTransportAttempt } from './oauth-state';
 
-const OAUTH_CALLBACK_ROUTE = '${callbackRoute}';
-const OAUTH_TRANSPORT_ATTEMPT_KEY = 'ankh.auth.oauth.transport';
-const GENERATED_OAUTH_PROVIDERS = ${providers} as const;
-const GENERATED_NATIVE_SCHEMES = {
-  android: ${androidScheme},
-  ios: ${iosScheme},
-} as const;
+const GENERATED_OAUTH_PROVIDERS: readonly GeneratedOAuthProvider[] = ${providers};
 
 export const generatedOAuthProviderItems = GENERATED_OAUTH_PROVIDERS.map((provider) => ({
   id: provider.id,
@@ -39,18 +31,36 @@ export const generatedOAuthProviderItems = GENERATED_OAUTH_PROVIDERS.map((provid
 }));
 
 export type GeneratedOAuthTransportOutcome =
-  | { status: 'authenticated' }
+  | { status: 'authenticated'; completion: 'fresh' | 'already-completed' }
   | { status: 'cancelled'; message: string }
   | { status: 'error'; message: string; recoverable: boolean };
 
-interface StoredTransportAttempt {
-  attemptId: string;
+interface GeneratedOAuthProvider {
+  readonly id: 'google' | 'apple';
+  readonly label: string;
+  readonly scopes: readonly string[];
+  readonly queryParams: Readonly<Record<string, string>>;
+  readonly icon?: OAuthProviderIconSpec;
 }
 
-export type OAuthCallbackRouteParams = Readonly<Record<string, string | string[] | undefined>>;
+export { completeOAuthCallback, resolveOAuthCallbackUrl };
 
 let activeAuthorization: Promise<GeneratedOAuthTransportOutcome> | null = null;
 
+type GeneratedOAuthAdapter = NonNullable<(typeof authAdapter)['oauth']>;
+
+interface OAuthAuthorizationContext {
+  oauth: GeneratedOAuthAdapter;
+  provider: GeneratedOAuthProvider;
+  redirectUri: string;
+}
+
+interface StartedOAuthAuthorization {
+  attemptId: string;
+  authorizationUrl: string;
+  redirectUri: string;
+}
+
 export function startOAuthAuthorization(
   providerId: string,
 ): Promise<GeneratedOAuthTransportOutcome> {
@@ -61,86 +71,119 @@ export function startOAuthAuthorization(
 }
 
 async function runOAuthAuthorization(providerId: string): Promise<GeneratedOAuthTransportOutcome> {
-  const oauth = authAdapter.oauth;
+  const resolved = resolveAuthorizationContext(providerId);
+  if ('outcome' in resolved) return resolved.outcome;
+  const started = await startAuthorizationAttemptAsync(resolved.context);
+  if ('outcome' in started) return started.outcome;
+  return completeAuthorizationTransportAsync(resolved.context.oauth, started.authorization);
+}
+
+function resolveAuthorizationContext(
+  providerId: string,
+): { context: OAuthAuthorizationContext } | { outcome: GeneratedOAuthTransportOutcome } {
+  const { oauth } = authAdapter;
   if (!oauth) {
     return {
-      status: 'error',
-      message: 'OAuth is not available in this app configuration.',
-      recoverable: true,
+      outcome: {
+        status: 'error',
+        message: 'OAuth is not available in this app configuration.',
+        recoverable: true,
+      },
     };
   }
 
   const provider = GENERATED_OAUTH_PROVIDERS.find((entry) => entry.id === providerId);
   if (!provider) {
     return {
-      status: 'error',
-      message: 'This OAuth provider is not enabled.',
-      recoverable: true,
+      outcome: {
+        status: 'error',
+        message: 'This OAuth provider is not enabled.',
+        recoverable: true,
+      },
     };
   }
 
-  let redirectUri: string;
   try {
-    redirectUri = resolveOAuthRedirectUri();
+    return { context: { oauth, provider, redirectUri: resolveOAuthRedirectUri() } };
   } catch {
     return {
-      status: 'error',
-      message: 'The OAuth redirect URI could not be resolved in this environment.',
-      recoverable: true,
+      outcome: {
+        status: 'error',
+        message: 'The OAuth redirect URI could not be resolved in this environment.',
+        recoverable: true,
+      },
     };
   }
+}
 
+async function startAuthorizationAttemptAsync(
+  context: OAuthAuthorizationContext,
+): Promise<
+  { authorization: StartedOAuthAuthorization } | { outcome: GeneratedOAuthTransportOutcome }
+> {
   if (Platform.OS !== 'web') {
     const runtimeReadiness = resolveExpoOAuthBrowserRuntimeReadiness();
     if (runtimeReadiness.status !== 'ready') {
       return {
-        status: 'error',
-        message: runtimeReadiness.message,
-        recoverable: true,
+        outcome: {
+          status: 'error',
+          message: runtimeReadiness.message,
+          recoverable: true,
+        },
       };
     }
   }
 
-  const started = await oauth.startAuthorization({
-    provider: provider.id,
-    redirectUri,
-    scopes: provider.scopes,
-    queryParams: provider.queryParams,
+  const started = await context.oauth.startAuthorization({
+    provider: context.provider.id,
+    redirectUri: context.redirectUri,
+    scopes: [...context.provider.scopes],
+    queryParams: { ...context.provider.queryParams },
   });
   if (!started.ok) {
     return {
-      status: 'error',
-      message: started.error.message,
-      recoverable: started.error.recoverable,
+      outcome: {
+        status: 'error',
+        message: started.error.message,
+        recoverable: started.error.recoverable,
+      },
     };
   }
 
   try {
-    await writeTransportAttempt({
-      attemptId: started.data.attemptId,
-    });
+    await writeTransportAttempt({ attemptId: started.data.attemptId });
   } catch {
-    await cancelOAuthAttempt(started.data.attemptId, 'user_cancelled');
+    await cancelOAuthAttempt(context.oauth, started.data.attemptId, 'user_cancelled');
     await clearTransportAttempt();
     return {
-      status: 'error',
-      message: 'The OAuth authorization attempt could not be persisted.',
-      recoverable: true,
+      outcome: {
+        status: 'error',
+        message: 'The OAuth authorization attempt could not be persisted.',
+        recoverable: true,
+      },
     };
   }
 
+  return { authorization: started.data };
+}
+
+async function completeAuthorizationTransportAsync(
+  oauth: GeneratedOAuthAdapter,
+  started: StartedOAuthAuthorization,
+): Promise<GeneratedOAuthTransportOutcome> {
   if (Platform.OS === 'web') {
     return redirectWebAuthorization({
-      attemptId: started.data.attemptId,
-      authorizationUrl: started.data.authorizationUrl,
+      attemptId: started.attemptId,
+      authorizationUrl: started.authorizationUrl,
+      oauth,
     });
   }
 
   let browserResponse;
   try {
     const browserResult = await WebBrowser.openAuthSessionAsync(
-      started.data.authorizationUrl,
-      started.data.redirectUri,
+      started.authorizationUrl,
+      started.redirectUri,
     );
     browserResponse = resolveExpoOAuthBrowserResult(browserResult);
   } catch {
@@ -154,7 +197,7 @@ async function runOAuthAuthorization(providerId: string): Promise<GeneratedOAuth
   let completed: AuthOAuthCompletionResult;
   try {
     completed = await oauth.completeAuthorization({
-      attemptId: started.data.attemptId,
+      attemptId: started.attemptId,
       response: browserResponse,
     });
   } catch {
@@ -172,11 +215,11 @@ async function runOAuthAuthorization(providerId: string): Promise<GeneratedOAuth
 async function redirectWebAuthorization(args: {
   attemptId: string;
   authorizationUrl: string;
+  oauth: GeneratedOAuthAdapter;
 }): Promise<GeneratedOAuthTransportOutcome> {
   const location = getBrowserLocation();
-  const assign = location ? Reflect.get(location, 'assign') : undefined;
-  if (typeof assign !== 'function') {
-    await cancelOAuthAttempt(args.attemptId, 'browser_dismissed');
+  if (!hasBrowserLocationAssign(location)) {
+    await cancelOAuthAttempt(args.oauth, args.attemptId, 'browser_dismissed');
     await clearTransportAttempt();
     return {
       status: 'error',
@@ -186,10 +229,10 @@ async function redirectWebAuthorization(args: {
   }
 
   try {
-    Reflect.apply(assign, location, [args.authorizationUrl]);
+    location.assign(args.authorizationUrl);
     return waitForFullPageNavigation();
   } catch {
-    await cancelOAuthAttempt(args.attemptId, 'browser_dismissed');
+    await cancelOAuthAttempt(args.oauth, args.attemptId, 'browser_dismissed');
     await clearTransportAttempt();
     return {
       status: 'error',
@@ -205,112 +248,20 @@ function waitForFullPageNavigation(): Promise<never> {
   });
 }
 
-export function resolveOAuthCallbackUrl(params: OAuthCallbackRouteParams): string {
-  const callbackUrl = new URL(resolveOAuthRedirectUri());
-  for (const [name, value] of Object.entries(params)) {
-    if (name === '#') continue;
-    if (Array.isArray(value)) {
-      for (const item of value) callbackUrl.searchParams.append(name, item);
-      continue;
-    }
-    if (typeof value === 'string') callbackUrl.searchParams.append(name, value);
-  }
-  return callbackUrl.toString();
+function getBrowserLocation(): Readonly<Record<string, unknown>> | null {
+  const location: unknown = Reflect.get(globalThis, 'location');
+  return isRecord(location) ? location : null;
 }
 
-export async function completeOAuthCallback(
-  callbackUrl: string,
-): Promise<GeneratedOAuthTransportOutcome> {
-  const oauth = authAdapter.oauth;
-  if (!oauth) {
-    return {
-      status: 'error',
-      message: 'OAuth is not available in this app configuration.',
-      recoverable: true,
-    };
-  }
-
-  const attempt = await readTransportAttempt();
-  if (!attempt) {
-    return {
-      status: 'error',
-      message: 'The OAuth authorization attempt was not found or has expired.',
-      recoverable: true,
-    };
-  }
-
-  let completed: AuthOAuthCompletionResult;
-  try {
-    completed = await oauth.completeAuthorization({
-      attemptId: attempt.attemptId,
-      response: { type: 'callback', url: callbackUrl },
-    });
-  } catch {
-    await clearTransportAttempt();
-    return {
-      status: 'error',
-      message: 'The OAuth callback could not be completed.',
-      recoverable: true,
-    };
-  }
-
-  const storedSession = getStoredAuthSession();
-
-  if (
-    !completed.ok &&
-    completed.status === 'error' &&
-    completed.error.code === 'callback_already_completed' &&
-    storedSession
-  ) {
-    return { status: 'authenticated' };
-  }
-
-  const preservesCompletedAttempt =
-    completed.ok ||
-    (!completed.ok &&
-      completed.status === 'error' &&
-      completed.error.code === 'invalid_callback' &&
-      storedSession !== null);
-  if (!preservesCompletedAttempt) await clearTransportAttempt();
-
-  return toTransportOutcome(completed);
-}
-
-function resolveOAuthRedirectUri(): string {
-  let callbackPath = OAUTH_CALLBACK_ROUTE;
-  while (callbackPath.startsWith('/')) {
-    callbackPath = callbackPath.slice(1);
-  }
-  if (Platform.OS === 'web') {
-    const location = getBrowserLocation();
-    const origin = location ? Reflect.get(location, 'origin') : undefined;
-    if (typeof origin === 'string' && origin.length > 0) {
-      return new URL(\`/\${callbackPath}\`, origin).toString();
-    }
-    throw new Error('Web OAuth requires a canonical browser origin.');
-  }
-
-  const nativeScheme =
-    Platform.OS === 'android'
-      ? GENERATED_NATIVE_SCHEMES.android
-      : Platform.OS === 'ios'
-        ? GENERATED_NATIVE_SCHEMES.ios
-        : undefined;
-  if (!nativeScheme) {
-    throw new Error('Native OAuth requires a configured application scheme.');
-  }
-
-  return Linking.createURL(callbackPath, { scheme: nativeScheme });
-}
-
-function getBrowserLocation(): object | null {
-  const location = Reflect.get(globalThis, 'location');
-  return typeof location === 'object' && location !== null ? location : null;
+function hasBrowserLocationAssign(
+  location: Readonly<Record<string, unknown>> | null,
+): location is Readonly<Record<string, unknown>> & { assign: (url: string) => void } {
+  return location !== null && typeof location.assign === 'function';
 }
 
 function toTransportOutcome(result: AuthOAuthCompletionResult): GeneratedOAuthTransportOutcome {
   if (result.ok) {
-    return { status: 'authenticated' };
+    return { status: 'authenticated', completion: 'fresh' };
   }
   if (result.status === 'cancelled') {
     return {
@@ -329,11 +280,10 @@ function toTransportOutcome(result: AuthOAuthCompletionResult): GeneratedOAuthTr
 }
 
 async function cancelOAuthAttempt(
+  oauth: GeneratedOAuthAdapter,
   attemptId: string,
   reason: AuthOAuthTransportCancellationReason,
 ): Promise<void> {
-  const oauth = authAdapter.oauth;
-  if (!oauth) return;
   try {
     await oauth.completeAuthorization({
       attemptId,
@@ -344,40 +294,6 @@ async function cancelOAuthAttempt(
   }
 }
 
-async function writeTransportAttempt(attempt: StoredTransportAttempt): Promise<void> {
-  await authSessionStorage.setItem(OAUTH_TRANSPORT_ATTEMPT_KEY, JSON.stringify(attempt));
-}
-
-async function readTransportAttempt(): Promise<StoredTransportAttempt | null> {
-  const raw = await authSessionStorage.getItem(OAUTH_TRANSPORT_ATTEMPT_KEY);
-  if (!raw) return null;
-  try {
-    const value: unknown = JSON.parse(raw);
-    if (isRecord(value)) {
-      const attemptId = Reflect.get(value, 'attemptId');
-      if (typeof attemptId === 'string' && attemptId.trim().length > 0) {
-        return { attemptId };
-      }
-    }
-  } catch {
-    // Invalid transport state is cleaned below without exposing its contents.
-  }
-  await clearTransportAttempt();
-  return null;
-}
-
-async function clearTransportAttempt(): Promise<void> {
-  await safeRemoveTransportItem(OAUTH_TRANSPORT_ATTEMPT_KEY);
-}
-
-async function safeRemoveTransportItem(key: string): Promise<void> {
-  try {
-    await authSessionStorage.removeItem(key);
-  } catch {
-    // Cleanup failures are intentionally not surfaced with persisted state.
-  }
-}
-
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }

package/dist/host/layout/templates/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAMtE,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;QACtC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7D,MAAM,SAAS,GACb,IAAI,CAAC,aAAa,CAAC,GAAG,KAAK,SAAS;QAClC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;IAEzD,OAAO;;;;;;;;;;;;;;;;gCAgBuB,aAAa;;oCAET,SAAS;;aAEhC,aAAa;SACjB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgWjB,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA2C;IAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5F,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;aACrD,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACzB,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAC9E;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO;WACA,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;cAC7B,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC;eAClC,MAAM;mBACF,qBAAqB,GAAG,IAAI;IAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAmE;IAC7F,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QAChE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GACd,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC;QAChF,OAAO,CAAC,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAC/C,OAAO,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAMtE,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE1D,OAAO;;;;;;;;;;;;;;;;;;;;;uEAqB8D,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmR/E,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA2C;IAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5F,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;aACrD,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACzB,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAC9E;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO;WACA,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;cAC7B,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC;eAClC,MAAM;mBACF,qBAAqB,GAAG,IAAI;IAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAmE;IAC7F,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QAChE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GACd,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC;QAChF,OAAO,CAAC,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAC/C,OAAO,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAC5F,CAAC"}

package/dist/host/layout/templates/auth/oauthCompletion.d.ts

@@ -0,0 +1,6 @@
+import type { ExpoRuntimeNativeSchemeMap } from '@ankhorage/expo-runtime/planning';
+export declare function getAuthOAuthCompletionTs(args: {
+    callbackRoute: string;
+    nativeSchemes: ExpoRuntimeNativeSchemeMap;
+}): string;
+//# sourceMappingURL=oauthCompletion.d.ts.map

package/dist/host/layout/templates/auth/oauthCompletion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCompletion.d.ts","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauthCompletion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAInF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,0BAA0B,CAAC;CAC3C,UA8IA"}

package/dist/host/layout/templates/auth/oauthCompletion.js

@@ -0,0 +1,147 @@
+import { escapeStringLiteral } from '../../utils/escapeStringLiteral';
+export function getAuthOAuthCompletionTs(args) {
+    const callbackRoute = escapeStringLiteral(args.callbackRoute);
+    const androidScheme = serializeOptionalScheme(args.nativeSchemes.android);
+    const iosScheme = serializeOptionalScheme(args.nativeSchemes.ios);
+    return `import type { AuthOAuthCompletionResult } from '@ankhorage/contracts/auth';
+import * as Linking from 'expo-linking';
+import { Platform } from 'react-native';
+
+import { authAdapter } from './adapter';
+import type { GeneratedOAuthTransportOutcome } from './oauth';
+import { clearTransportAttempt, readTransportAttempt } from './oauth-state';
+import { getStoredAuthSession } from './session';
+
+const OAUTH_CALLBACK_ROUTE = '${callbackRoute}';
+const GENERATED_NATIVE_SCHEMES = {
+  android: ${androidScheme},
+  ios: ${iosScheme},
+} as const;
+
+export type OAuthCallbackRouteParams = Readonly<Record<string, string | string[] | undefined>>;
+
+export function resolveOAuthCallbackUrl(params: OAuthCallbackRouteParams): string {
+  const callbackUrl = new URL(resolveOAuthRedirectUri());
+  for (const [name, value] of Object.entries(params)) {
+    if (name === '#') continue;
+    if (Array.isArray(value)) {
+      for (const item of value) callbackUrl.searchParams.append(name, item);
+      continue;
+    }
+    if (typeof value === 'string') callbackUrl.searchParams.append(name, value);
+  }
+  return callbackUrl.toString();
+}
+
+export async function completeOAuthCallback(
+  callbackUrl: string,
+): Promise<GeneratedOAuthTransportOutcome> {
+  const { oauth } = authAdapter;
+  if (!oauth) return createUnavailableOAuthOutcome();
+  const attempt = await readTransportAttempt();
+  if (!attempt) {
+    return {
+      status: 'error',
+      message: 'The OAuth authorization attempt was not found or has expired.',
+      recoverable: true,
+    };
+  }
+
+  let completed: AuthOAuthCompletionResult;
+  try {
+    completed = await oauth.completeAuthorization({
+      attemptId: attempt.attemptId,
+      response: { type: 'callback', url: callbackUrl },
+    });
+  } catch {
+    await clearTransportAttempt();
+    return {
+      status: 'error',
+      message: 'The OAuth callback could not be completed.',
+      recoverable: true,
+    };
+  }
+  return resolveCompletedOAuthOutcome(completed);
+}
+
+export function resolveOAuthRedirectUri(): string {
+  let callbackPath = OAUTH_CALLBACK_ROUTE;
+  while (callbackPath.startsWith('/')) callbackPath = callbackPath.slice(1);
+  if (Platform.OS === 'web') return resolveWebOAuthRedirectUri(callbackPath);
+  const nativeScheme =
+    Platform.OS === 'android'
+      ? GENERATED_NATIVE_SCHEMES.android
+      : Platform.OS === 'ios'
+        ? GENERATED_NATIVE_SCHEMES.ios
+        : undefined;
+  if (!nativeScheme) throw new Error('Native OAuth requires a configured application scheme.');
+  return Linking.createURL(callbackPath, { scheme: nativeScheme });
+}
+
+function createUnavailableOAuthOutcome(): GeneratedOAuthTransportOutcome {
+  return {
+    status: 'error',
+    message: 'OAuth is not available in this app configuration.',
+    recoverable: true,
+  };
+}
+
+function getBrowserLocation(): Readonly<Record<string, unknown>> | null {
+  const location: unknown = Reflect.get(globalThis, 'location');
+  return isRecord(location) ? location : null;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+async function resolveCompletedOAuthOutcome(
+  completed: AuthOAuthCompletionResult,
+): Promise<GeneratedOAuthTransportOutcome> {
+  const hasStoredSession = getStoredAuthSession() !== null;
+  if (
+    !completed.ok &&
+    completed.status === 'error' &&
+    completed.error.code === 'callback_already_completed' &&
+    hasStoredSession
+  ) {
+    return { status: 'authenticated', completion: 'already-completed' };
+  }
+  if (completed.ok) return toTransportOutcome(completed);
+  const preservesAttempt =
+    completed.status === 'error' && completed.error.code === 'invalid_callback' && hasStoredSession;
+  if (!preservesAttempt) await clearTransportAttempt();
+  return toTransportOutcome(completed);
+}
+
+function resolveWebOAuthRedirectUri(callbackPath: string): string {
+  const origin = getBrowserLocation()?.origin;
+  if (typeof origin !== 'string' || origin.length === 0) {
+    throw new Error('Web OAuth requires a canonical browser origin.');
+  }
+  return new URL(\`/\${callbackPath}\`, origin).toString();
+}
+
+function toTransportOutcome(result: AuthOAuthCompletionResult): GeneratedOAuthTransportOutcome {
+  if (result.ok) return { status: 'authenticated', completion: 'fresh' };
+  if (result.status === 'cancelled') {
+    return {
+      status: 'cancelled',
+      message:
+        result.reason === 'provider_denied'
+          ? 'Authorization was declined by the provider.'
+          : 'Authorization was cancelled.',
+    };
+  }
+  return {
+    status: 'error',
+    message: result.error.message,
+    recoverable: result.error.recoverable,
+  };
+}
+`;
+}
+function serializeOptionalScheme(scheme) {
+    return scheme === undefined ? 'undefined' : `'${escapeStringLiteral(scheme)}'`;
+}
+//# sourceMappingURL=oauthCompletion.js.map

package/dist/host/layout/templates/auth/oauthCompletion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthCompletion.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauthCompletion.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,MAAM,UAAU,wBAAwB,CAAC,IAGxC;IACC,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAElE,OAAO;;;;;;;;;gCASuB,aAAa;;aAEhC,aAAa;SACjB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4HjB,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA0B;IACzD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC;AACjF,CAAC"}

package/dist/host/layout/templates/auth/oauthState.d.ts

@@ -0,0 +1,2 @@
+export declare function getAuthOAuthStateTs(): string;
+//# sourceMappingURL=oauthState.d.ts.map

package/dist/host/layout/templates/auth/oauthState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthState.d.ts","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauthState.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,WA2ClC"}

package/dist/host/layout/templates/auth/oauthState.js

@@ -0,0 +1,45 @@
+export function getAuthOAuthStateTs() {
+    return `import { authSessionStorage } from './session';
+
+const OAUTH_TRANSPORT_ATTEMPT_KEY = 'ankh.auth.oauth.transport';
+
+interface StoredTransportAttempt {
+  attemptId: string;
+}
+
+export async function clearTransportAttempt(): Promise<void> {
+  try {
+    await authSessionStorage.removeItem(OAUTH_TRANSPORT_ATTEMPT_KEY);
+  } catch {
+    // Cleanup failures are intentionally not surfaced with persisted state.
+  }
+}
+
+export async function readTransportAttempt(): Promise<StoredTransportAttempt | null> {
+  const raw = await authSessionStorage.getItem(OAUTH_TRANSPORT_ATTEMPT_KEY);
+  if (!raw) return null;
+  try {
+    const value: unknown = JSON.parse(raw);
+    if (isRecord(value)) {
+      const attemptId: unknown = Reflect.get(value, 'attemptId');
+      if (typeof attemptId === 'string' && attemptId.trim().length > 0) {
+        return { attemptId };
+      }
+    }
+  } catch {
+    // Invalid transport state is cleaned below without exposing its contents.
+  }
+  await clearTransportAttempt();
+  return null;
+}
+
+export async function writeTransportAttempt(attempt: StoredTransportAttempt): Promise<void> {
+  await authSessionStorage.setItem(OAUTH_TRANSPORT_ATTEMPT_KEY, JSON.stringify(attempt));
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+`;
+}
+//# sourceMappingURL=oauthState.js.map

package/dist/host/layout/templates/auth/oauthState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthState.js","sourceRoot":"","sources":["../../../../../src/host/layout/templates/auth/oauthState.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,mBAAmB;IACjC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCR,CAAC;AACF,CAAC"}