@ikonai/sdk 1.3.4 → 1.3.5

package/index.js

@@ -3170,7 +3170,7 @@ function Xd() {
 }
 //#endregion
 //#region src/utils/embedded-oauth.ts
-var Zd = C("EmbeddedAuth"), Qd = "/oauth/popup-callback", $d = "ikon-oauth-embedder-request", ef = "ikon_pkce", tf = 1500, nf = 3e5;
+var Zd = C("EmbeddedAuth"), Qd = "/oauth/popup-callback", $d = "ikon-oauth-embedder-request", ef = "ikon_pkce", tf = 800, nf = 3e5;
 function rf() {
 	if (typeof window > "u") return !1;
 	try {
@@ -3201,11 +3201,10 @@ async function af(e, t) {
 	});
 }
 async function of(e, t) {
-	let n = window.open("about:blank", "ikon-oauth", "popup,width=520,height=680");
-	if (await af(e, t)) return n?.close(), !0;
+	if (await af(e, t)) return !0;
 	try {
-		let { code: r, provider: i } = await sf(n, e, t), a = new URL(window.location.href);
-		return a.searchParams.set("ikon_code", r), a.searchParams.set("ikon_provider", i), window.location.replace(a.toString()), !0;
+		let { code: n, provider: r } = await sf(window.open("about:blank", "ikon-oauth", "popup,width=520,height=680"), e, t), i = new URL(window.location.href);
+		return i.searchParams.set("ikon_code", n), i.searchParams.set("ikon_provider", r), window.location.replace(i.toString()), !0;
 	} catch (t) {
 		return Zd.warn(`Embedded sign-in with ${e} did not complete: ${t instanceof Error ? t.message : String(t)}`), !1;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikonai/sdk",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",

package/utils/embedded-oauth.d.ts

@@ -34,9 +34,11 @@ export declare function isEmbedded(): boolean;
  * Asks the embedder first, because a host that is cross-origin isolated severs any popup this frame
  * opens. Falls back to the popup for a host that is not.
  *
- * The window is opened BEFORE either path is chosen, while the click is still what the browser sees:
- * asking the embedder awaits, and a popup opened after that has lost the gesture and is taken for a
- * pop-under. An embedder that claims the request gets it closed again immediately.
+ * The popup is opened only once the embedder has declined, never speculatively. Opening it up front
+ * left a blank window stranded on screen in exactly the case the embedder path handles: a severed
+ * `window.open` returns null, so there is no handle left to close the window it nonetheless opened.
+ * The gesture survives the wait — {@link EMBEDDER_ACK_TIMEOUT_MS} is bounded well inside the
+ * browser's transient-activation window, so the popup is still attributable to the click.
  *
  * The code is handed over by reloading this document with `ikon_code` on it rather than by redeeming
  * it here: that is the exact shape the unframed redirect flow already produces, so the callback