@comfyorg/account-core 1.0.0-alpha.0

package/dist/provisioning.js

@@ -0,0 +1,76 @@
+/**
+ * The account-creation sequences both hosts must agree on, with the effects
+ * injected so the invariants live (and are tested) exactly once. Mirrors the
+ * platform app's `authStore.register` / `loginWithGoogle` semantics.
+ */
+/**
+ * Email sign-up: create the Firebase user, then provision the Comfy customer.
+ *
+ * Provisioning is where a Turnstile token gets validated server-side; if it
+ * fails (rejection, 5xx, network) the Firebase user is already created and,
+ * without rollback, the account is orphaned — every retry then fails
+ * "email already in use", permanently bricking signup. So a provisioning
+ * failure deletes the just-created user (best-effort with one retried
+ * delete, so a single transient blip cannot orphan the account; a cleanup
+ * failure never masks the original error) and rethrows.
+ */
+export async function signUpWithProvisioning(deps) {
+    const credential = await deps.createUser();
+    try {
+        await deps.provisionCustomer(credential);
+    }
+    catch (error) {
+        try {
+            try {
+                await credential.user.delete();
+            }
+            catch {
+                await credential.user.delete();
+            }
+        }
+        catch (rollbackError) {
+            // A reporting sink can throw; never let it displace the original error.
+            try {
+                deps.onRollbackFailure?.(rollbackError);
+            }
+            catch {
+                void 0;
+            }
+        }
+        throw error;
+    }
+    return credential;
+}
+/**
+ * Social sign-in: the popup, then find-or-create the Comfy customer — always,
+ * because a social user's first touch may be this host and skipping the
+ * customer record produces accounts where billing surfaces fail.
+ * `provisionCustomer` must tolerate an already-provisioned account. No
+ * rollback here: the signed-in user may be a long-standing account, and
+ * deleting it over a provisioning hiccup would destroy it — a provisioning
+ * failure propagates with the user still signed in.
+ */
+export async function socialSignInWithProvisioning(deps) {
+    const credential = await deps.signIn();
+    await deps.provisionCustomer(credential);
+    return credential;
+}
+export const CUSTOMER_PROVISIONING_PATH = '/customers';
+/**
+ * The `POST /customers` request both hosts send. `signupSource` names the
+ * host for the backend's attribution; the Turnstile token rides along only
+ * on email sign-up, where the server validates it. Body and headers only: a
+ * host that wants a bound passes its own `signal`.
+ */
+export function customerProvisioningRequest(options) {
+    const { authHeaders, signupSource, turnstileToken, signal } = options;
+    return {
+        method: 'POST',
+        headers: { ...authHeaders, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            signup_source: signupSource,
+            ...(turnstileToken ? { turnstile_token: turnstileToken } : {})
+        }),
+        ...(signal ? { signal } : {})
+    };
+}

package/dist/redirect.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Where a visitor may be sent after sign-in. Only a same-origin absolute
+ * path qualifies; anything that could leave the origin (a protocol-relative
+ * or backslash prefix, an absolute or javascript: URL, or a path hiding one
+ * of those behind a stripped control char) falls back.
+ *
+ * The prefix checks alone are not enough: the WHATWG URL parser strips C0
+ * control chars (tab, LF, CR) before parsing, so `/<TAB>//evil.com` passes a
+ * literal `startsWith('//')` check yet the browser resolves it cross-origin.
+ * So a control char is rejected outright, and the result is re-parsed against
+ * the origin to confirm it truly stays same-origin.
+ */
+export declare function safeInternalPath(raw: string | null | undefined, origin: string, fallback: string): string;

package/dist/redirect.js

@@ -0,0 +1,38 @@
+/** True if the string contains any C0 control char the URL parser would strip. */
+function hasControlChar(value) {
+    for (let i = 0; i < value.length; i++) {
+        if (value.charCodeAt(i) <= 0x1f)
+            return true;
+    }
+    return false;
+}
+/**
+ * Where a visitor may be sent after sign-in. Only a same-origin absolute
+ * path qualifies; anything that could leave the origin (a protocol-relative
+ * or backslash prefix, an absolute or javascript: URL, or a path hiding one
+ * of those behind a stripped control char) falls back.
+ *
+ * The prefix checks alone are not enough: the WHATWG URL parser strips C0
+ * control chars (tab, LF, CR) before parsing, so `/<TAB>//evil.com` passes a
+ * literal `startsWith('//')` check yet the browser resolves it cross-origin.
+ * So a control char is rejected outright, and the result is re-parsed against
+ * the origin to confirm it truly stays same-origin.
+ */
+export function safeInternalPath(raw, origin, fallback) {
+    if (typeof raw !== 'string' ||
+        !raw.startsWith('/') ||
+        raw.startsWith('//') ||
+        raw.startsWith('/\\') ||
+        hasControlChar(raw)) {
+        return fallback;
+    }
+    try {
+        const resolved = new URL(raw, origin);
+        if (resolved.origin !== origin)
+            return fallback;
+        return resolved.pathname + resolved.search + resolved.hash;
+    }
+    catch {
+        return fallback;
+    }
+}

package/dist/signInSchemas.d.ts

@@ -0,0 +1,88 @@
+import { z } from 'zod';
+/**
+ * The exact message keys the schemas emit, so a host wires every one of them
+ * or the compiler says which is missing. Both hosts already carry these keys:
+ * the app in `src/locales/en/main.json`, the website in its translations map.
+ */
+export type AuthSchemaMessageKey = 'validation.prefix' | 'validation.length' | 'validation.invalidEmail' | 'validation.required' | 'validation.minLength' | 'validation.maxLength' | 'validation.password.uppercase' | 'validation.password.lowercase' | 'validation.password.number' | 'validation.password.special' | 'validation.password.match';
+export type AuthSchemaTranslate = (key: AuthSchemaMessageKey, params?: Record<string, string | number>) => string;
+/**
+ * The one password policy, shared by the schema and by the live checklist
+ * sign-up forms show while the field is being typed.
+ */
+export declare const PASSWORD_RULES: {
+    readonly minLength: 8;
+    readonly maxLength: 32;
+    readonly uppercase: RegExp;
+    readonly lowercase: RegExp;
+    readonly number: RegExp;
+    readonly special: RegExp;
+};
+export type PasswordRule = 'length' | 'uppercase' | 'lowercase' | 'number' | 'special';
+export declare function passwordRuleChecks(password: string): Readonly<Record<PasswordRule, boolean>>;
+/**
+ * Builds the auth validation schemas with the host's own translator, so the
+ * rules live once while each host keeps its i18n system. Messages resolve
+ * eagerly at build time, so a locale switch requires rebuilding the schemas.
+ */
+export declare function createAuthSchemas(t: AuthSchemaTranslate): {
+    apiKeySchema: z.ZodObject<{
+        apiKey: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        apiKey: string;
+    }, {
+        apiKey: string;
+    }>;
+    signInSchema: z.ZodObject<{
+        email: z.ZodString;
+        password: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        email: string;
+        password: string;
+    }, {
+        email: string;
+        password: string;
+    }>;
+    updatePasswordSchema: z.ZodEffects<z.ZodObject<{
+        password: z.ZodString;
+        confirmPassword: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        password: string;
+        confirmPassword: string;
+    }, {
+        password: string;
+        confirmPassword: string;
+    }>, {
+        password: string;
+        confirmPassword: string;
+    }, {
+        password: string;
+        confirmPassword: string;
+    }>;
+    signUpSchema: z.ZodEffects<z.ZodObject<{
+        password: z.ZodString;
+        confirmPassword: z.ZodString;
+    } & {
+        email: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        email: string;
+        password: string;
+        confirmPassword: string;
+    }, {
+        email: string;
+        password: string;
+        confirmPassword: string;
+    }>, {
+        email: string;
+        password: string;
+        confirmPassword: string;
+    }, {
+        email: string;
+        password: string;
+        confirmPassword: string;
+    }>;
+};
+type AuthSchemas = ReturnType<typeof createAuthSchemas>;
+export type SignInData = z.infer<AuthSchemas['signInSchema']>;
+export type SignUpData = z.infer<AuthSchemas['signUpSchema']>;
+export {};

package/dist/signInSchemas.js

@@ -0,0 +1,71 @@
+import { z } from 'zod';
+/**
+ * The one password policy, shared by the schema and by the live checklist
+ * sign-up forms show while the field is being typed.
+ */
+export const PASSWORD_RULES = {
+    minLength: 8,
+    maxLength: 32,
+    uppercase: /[A-Z]/,
+    lowercase: /[a-z]/,
+    number: /\d/,
+    special: /[^A-Za-z0-9]/
+};
+export function passwordRuleChecks(password) {
+    return {
+        length: password.length >= PASSWORD_RULES.minLength &&
+            password.length <= PASSWORD_RULES.maxLength,
+        uppercase: PASSWORD_RULES.uppercase.test(password),
+        lowercase: PASSWORD_RULES.lowercase.test(password),
+        number: PASSWORD_RULES.number.test(password),
+        special: PASSWORD_RULES.special.test(password)
+    };
+}
+/**
+ * Builds the auth validation schemas with the host's own translator, so the
+ * rules live once while each host keeps its i18n system. Messages resolve
+ * eagerly at build time, so a locale switch requires rebuilding the schemas.
+ */
+export function createAuthSchemas(t) {
+    const apiKeySchema = z.object({
+        apiKey: z
+            .string()
+            .trim()
+            .startsWith('comfyui-', t('validation.prefix', { prefix: 'comfyui-' }))
+            .length(72, t('validation.length', { length: 72 }))
+    });
+    const signInSchema = z.object({
+        email: z
+            .string()
+            .email(t('validation.invalidEmail'))
+            .min(1, t('validation.required')),
+        password: z.string().min(1, t('validation.required'))
+    });
+    const passwordSchema = z.object({
+        password: z
+            .string()
+            .min(PASSWORD_RULES.minLength, t('validation.minLength', { length: PASSWORD_RULES.minLength }))
+            .max(PASSWORD_RULES.maxLength, t('validation.maxLength', { length: PASSWORD_RULES.maxLength }))
+            .regex(PASSWORD_RULES.uppercase, t('validation.password.uppercase'))
+            .regex(PASSWORD_RULES.lowercase, t('validation.password.lowercase'))
+            .regex(PASSWORD_RULES.number, t('validation.password.number'))
+            .regex(PASSWORD_RULES.special, t('validation.password.special')),
+        confirmPassword: z.string().min(1, t('validation.required'))
+    });
+    const updatePasswordSchema = passwordSchema.refine((data) => data.password === data.confirmPassword, {
+        message: t('validation.password.match'),
+        path: ['confirmPassword']
+    });
+    const signUpSchema = passwordSchema
+        .extend({
+        email: z
+            .string()
+            .email(t('validation.invalidEmail'))
+            .min(1, t('validation.required'))
+    })
+        .refine((data) => data.password === data.confirmPassword, {
+        message: t('validation.password.match'),
+        path: ['confirmPassword']
+    });
+    return { apiKeySchema, signInSchema, updatePasswordSchema, signUpSchema };
+}

package/dist/telemetry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared telemetry vocabulary. The event names match the cloud app's
+ * TelemetryEvents verbatim so an auth outcome is one queryable event across
+ * every host. The package never calls a telemetry API itself; call sites
+ * stay host-specific.
+ */
+export declare const SESSION_TELEMETRY_EVENT: {
+    readonly refreshSucceeded: "auth.unified.refresh.succeeded";
+    readonly refreshFailed: "auth.unified.refresh.failed";
+};
+/**
+ * The cloud app's `billing.operation.*` events, emitted by the billing
+ * operation lifecycle for every observed `billing_op_id` regardless of
+ * which presentation settled it.
+ */
+export declare const BILLING_OPERATION_TELEMETRY_EVENT: {
+    readonly started: "billing.operation.started";
+    readonly succeeded: "billing.operation.succeeded";
+    readonly failed: "billing.operation.failed";
+    readonly timeout: "billing.operation.timeout";
+};
+export declare const AUTH_TELEMETRY_EVENT: {
+    readonly signUpOpened: "app:user_sign_up_opened";
+    readonly authCompleted: "app:user_auth_completed";
+    readonly authFailed: "app:user_auth_failed";
+};
+export type AuthMethod = 'email' | 'google' | 'github';
+/** What the cloud app reports on every successful credential. */
+export interface AuthCompletedMetadata {
+    method: AuthMethod;
+    is_new_user: boolean;
+    user_id: string;
+    email?: string;
+}
+export type AuthFlowAction = 'email_sign_in' | 'email_sign_up' | 'google_sign_in' | 'google_sign_up' | 'github_sign_in' | 'github_sign_up' | 'password_reset';
+export interface AuthErrorMetadata {
+    error_code: string;
+    auth_action: AuthFlowAction;
+}

package/dist/telemetry.js

@@ -0,0 +1,26 @@
+/**
+ * Shared telemetry vocabulary. The event names match the cloud app's
+ * TelemetryEvents verbatim so an auth outcome is one queryable event across
+ * every host. The package never calls a telemetry API itself; call sites
+ * stay host-specific.
+ */
+export const SESSION_TELEMETRY_EVENT = {
+    refreshSucceeded: 'auth.unified.refresh.succeeded',
+    refreshFailed: 'auth.unified.refresh.failed'
+};
+/**
+ * The cloud app's `billing.operation.*` events, emitted by the billing
+ * operation lifecycle for every observed `billing_op_id` regardless of
+ * which presentation settled it.
+ */
+export const BILLING_OPERATION_TELEMETRY_EVENT = {
+    started: 'billing.operation.started',
+    succeeded: 'billing.operation.succeeded',
+    failed: 'billing.operation.failed',
+    timeout: 'billing.operation.timeout'
+};
+export const AUTH_TELEMETRY_EVENT = {
+    signUpOpened: 'app:user_sign_up_opened',
+    authCompleted: 'app:user_auth_completed',
+    authFailed: 'app:user_auth_failed'
+};

package/dist/testing.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The test seam for fakes: a hand-written port becomes an identity the
+ * session client accepts. Production hosts use `@comfyorg/account-core/firebase`.
+ */
+export type { IdentityPort } from './core/identity.js';
+export { brandIdentity as createTestIdentity } from './core/identity.js';
+export declare const ENUMERATION_ORACLE: RegExp;

package/dist/testing.js

@@ -0,0 +1,3 @@
+export { brandIdentity as createTestIdentity } from './core/identity.js';
+// Enumerating wording (CWE-204) each host asserts its copy never matches; shared so the two suites can't drift.
+export const ENUMERATION_ORACLE = /\bexists?\b|already (?:registered|in use|have|exists)|wrong password|no account|not found|is registered|different (?:sign-in method|credential)/i;

package/dist/turnstile.d.ts

@@ -0,0 +1,14 @@
+export type TurnstileMode = 'off' | 'shadow' | 'enforce';
+/**
+ * Clamp an externally-sourced value to a known TurnstileMode. Unknown strings
+ * (typos, stale flag variants) resolve to 'off' so a bad value can never leave
+ * the widget rendered-but-unenforced — mirrors the server-side resolver.
+ */
+export declare function normalizeTurnstileMode(raw: string | undefined): TurnstileMode;
+/**
+ * Whether the signup Turnstile widget should render. Purely config-driven: the
+ * flag must be shadow/enforce and a sitekey must be configured. Hosts that
+ * resolve no sitekey (OSS / local builds) never render the widget; their
+ * exemption lives server-side (loopback-IP check in CreateCustomer).
+ */
+export declare function isTurnstileEnabled(mode: TurnstileMode, siteKey: string): boolean;

package/dist/turnstile.js

@@ -0,0 +1,17 @@
+/**
+ * Clamp an externally-sourced value to a known TurnstileMode. Unknown strings
+ * (typos, stale flag variants) resolve to 'off' so a bad value can never leave
+ * the widget rendered-but-unenforced — mirrors the server-side resolver.
+ */
+export function normalizeTurnstileMode(raw) {
+    return raw === 'shadow' || raw === 'enforce' ? raw : 'off';
+}
+/**
+ * Whether the signup Turnstile widget should render. Purely config-driven: the
+ * flag must be shadow/enforce and a sitekey must be configured. Hosts that
+ * resolve no sitekey (OSS / local builds) never render the widget; their
+ * exemption lives server-side (loopback-IP check in CreateCustomer).
+ */
+export function isTurnstileEnabled(mode, siteKey) {
+    return mode !== 'off' && siteKey !== '';
+}

package/dist/turnstileScript.d.ts

@@ -0,0 +1,18 @@
+export interface TurnstileRenderOptions {
+    sitekey: string;
+    theme?: 'light' | 'dark' | 'auto';
+    callback?: (token: string) => void;
+    'expired-callback'?: () => void;
+    'error-callback'?: () => void;
+}
+export interface TurnstileApi {
+    render: (container: string | HTMLElement, options: TurnstileRenderOptions) => string;
+    reset: (widgetId?: string) => void;
+    remove: (widgetId: string) => void;
+}
+declare global {
+    interface Window {
+        turnstile?: TurnstileApi;
+    }
+}
+export declare function loadTurnstile(): Promise<TurnstileApi>;

package/dist/turnstileScript.js

@@ -0,0 +1,6 @@
+import { createScriptLoader } from './loadExternalScript.js';
+const TURNSTILE_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit';
+const loadTurnstileScript = createScriptLoader(TURNSTILE_SRC, () => window.turnstile ?? null);
+export function loadTurnstile() {
+    return loadTurnstileScript();
+}

package/dist/web/crossTabRefresh.d.ts

@@ -0,0 +1,18 @@
+import type { CrossTabRefreshPort } from '../core/session.js';
+/**
+ * Web Locks + BroadcastChannel implementation of the cross-tab refresh port.
+ * The coordination key names both the lock and the channel. Resolves to
+ * undefined where either API is missing (older browsers, non-browser and
+ * unit-test environments), so hosts fall back to uncoordinated per-tab
+ * refresh.
+ *
+ * Trust boundary, decided rather than assumed: the workspace JWT travels on
+ * a same-origin BroadcastChannel whose name any script in the page can
+ * derive from the uid and workspace id, and an inbound message is accepted
+ * on shape, uid, workspace and a newer expiry, all of which a script in the
+ * realm can read and forge. Same-origin script already holds the token and
+ * the session client's storage adapter, so this widens what such a script
+ * can do to siblings (hand them a token), not what it can reach. Hosts that
+ * load third-party script into the realm accept that when they opt in.
+ */
+export declare function createWebCrossTabRefreshPort(): CrossTabRefreshPort | undefined;

package/dist/web/crossTabRefresh.js

@@ -0,0 +1,121 @@
+/**
+ * Web Locks + BroadcastChannel implementation of the cross-tab refresh port.
+ * The coordination key names both the lock and the channel. Resolves to
+ * undefined where either API is missing (older browsers, non-browser and
+ * unit-test environments), so hosts fall back to uncoordinated per-tab
+ * refresh.
+ *
+ * Trust boundary, decided rather than assumed: the workspace JWT travels on
+ * a same-origin BroadcastChannel whose name any script in the page can
+ * derive from the uid and workspace id, and an inbound message is accepted
+ * on shape, uid, workspace and a newer expiry, all of which a script in the
+ * realm can read and forge. Same-origin script already holds the token and
+ * the session client's storage adapter, so this widens what such a script
+ * can do to siblings (hand them a token), not what it can reach. Hosts that
+ * load third-party script into the realm accept that when they opt in.
+ */
+export function createWebCrossTabRefreshPort() {
+    // Feature-detect defensively: test DOMs ship these piecemeal (happy-dom
+    // has a BroadcastChannel but a null navigator.locks), and either gap must
+    // resolve to undefined.
+    if (typeof BroadcastChannel === 'undefined')
+        return undefined;
+    if (typeof navigator === 'undefined')
+        return undefined;
+    const locks = navigator.locks;
+    if (!locks)
+        return undefined;
+    // A present BroadcastChannel can still throw on construction (policy,
+    // sandbox, privacy mode, partial impl); probe once so the port is either
+    // fully usable or absent, never interrupted mid-commit.
+    try {
+        const probe = new BroadcastChannel('@comfyorg/account-core cross-tab probe');
+        probe.close();
+    }
+    catch {
+        return undefined;
+    }
+    // One refcounted channel per subscribed key, shared by subscribe and
+    // publish. A channel never delivers a message back to itself, so
+    // publishing on the subscription channel keeps a tab from hearing its own
+    // broadcasts.
+    const channels = new Map();
+    return {
+        requestLeadership(key, onAcquired) {
+            const controller = new AbortController();
+            let disposed = false;
+            let releaseHeld;
+            void locks
+                .request(key, { signal: controller.signal }, () => {
+                // A grant can win the race against our own abandon; returning
+                // without holding releases the lock straight to the next tab.
+                if (disposed)
+                    return;
+                onAcquired();
+                // onAcquired may dispose synchronously, and neither abort() (a
+                // no-op on a granted lock) nor releaseHeld (not wired yet) can
+                // observe that — re-check before committing to the hold.
+                // oxlint-disable-next-line typescript/no-unnecessary-condition -- the narrowing is not call-aware; onAcquired() can flip this
+                if (disposed)
+                    return;
+                // Hold the lock until released; the browser releases it for us
+                // when the tab dies, which is what promotes the next tab.
+                return new Promise((resolve) => {
+                    releaseHeld = resolve;
+                });
+            })
+                .catch((error) => {
+                // Abandoning the request aborts it; anything else means this tab
+                // silently never leads, which deserves a trace.
+                if (error instanceof DOMException && error.name === 'AbortError') {
+                    return;
+                }
+                console.warn('Cross-tab refresh leadership request failed:', error);
+            });
+            return () => {
+                disposed = true;
+                controller.abort();
+                releaseHeld?.();
+            };
+        },
+        publishCredential(key, credential) {
+            const entry = channels.get(key);
+            if (entry !== undefined) {
+                entry.channel.postMessage(credential);
+                return;
+            }
+            // No subscriber on this key here: publish on an ephemeral channel so
+            // nothing is left open with no owner to close it.
+            const channel = new BroadcastChannel(key);
+            channel.postMessage(credential);
+            channel.close();
+        },
+        onCredential(key, callback) {
+            let entry = channels.get(key);
+            if (entry === undefined) {
+                entry = { channel: new BroadcastChannel(key), subscribers: 0 };
+                channels.set(key, entry);
+            }
+            entry.subscribers += 1;
+            const subscribed = entry;
+            const handler = (event) => {
+                const message = event.data;
+                callback(message);
+            };
+            subscribed.channel.addEventListener('message', handler);
+            let active = true;
+            return () => {
+                if (!active)
+                    return;
+                active = false;
+                subscribed.channel.removeEventListener('message', handler);
+                subscribed.subscribers -= 1;
+                if (subscribed.subscribers === 0) {
+                    subscribed.channel.close();
+                    if (channels.get(key) === subscribed)
+                        channels.delete(key);
+                }
+            };
+        }
+    };
+}

package/dist/webviewDetection.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Whether the page runs inside an app's embedded browser, where Google's
+ * popup sign-in is blocked. Both hosts show the same notice on that answer.
+ */
+export declare function isEmbeddedWebView(ua?: string): boolean;

package/dist/webviewDetection.js

@@ -0,0 +1,62 @@
+const SOCIAL_APP_PATTERNS = /FBAN|FBAV|Instagram|Line\/|Snapchat|TikTok|musical_ly/i;
+const IOS_FIRST_PARTY_BROWSER_PATTERNS = /CriOS|FxiOS|OPiOS|EdgiOS/i;
+function isAndroidWebView(ua) {
+    return /\bwv\b/.test(ua) && /Android/.test(ua);
+}
+function isIOSWebView(ua) {
+    if (!/AppleWebKit/i.test(ua))
+        return false;
+    if (/Safari\//i.test(ua))
+        return false;
+    if (IOS_FIRST_PARTY_BROWSER_PATTERNS.test(ua))
+        return false;
+    return true;
+}
+function isSocialAppBrowser(ua) {
+    return SOCIAL_APP_PATTERNS.test(ua);
+}
+function isFirstPartyIOSBrowser(ua) {
+    if (IOS_FIRST_PARTY_BROWSER_PATTERNS.test(ua))
+        return true;
+    if (!/iPhone|iPad|iPod|Macintosh.*Mobile\//i.test(ua))
+        return false;
+    return /Safari\//i.test(ua) && /Version\//i.test(ua);
+}
+function hasWkWebViewMessageBridge() {
+    try {
+        const win = globalThis;
+        return (typeof win.webkit === 'object' &&
+            win.webkit !== null &&
+            typeof win.webkit.messageHandlers ===
+                'object');
+    }
+    catch {
+        return false;
+    }
+}
+function hasReactNativeWebViewBridge() {
+    try {
+        const win = globalThis;
+        return win.ReactNativeWebView != null;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether the page runs inside an app's embedded browser, where Google's
+ * popup sign-in is blocked. Both hosts show the same notice on that answer.
+ */
+export function isEmbeddedWebView(ua = navigator.userAgent) {
+    if (isSocialAppBrowser(ua))
+        return true;
+    if (isAndroidWebView(ua))
+        return true;
+    if (isIOSWebView(ua))
+        return true;
+    if (hasReactNativeWebViewBridge())
+        return true;
+    if (!isFirstPartyIOSBrowser(ua) && hasWkWebViewMessageBridge())
+        return true;
+    return false;
+}