@legendapp/spark 0.0.1-next.2 → 0.0.1-next.3

package/vendor/node_modules/@legendapp/spark-audio/windows/SparkAudio/SparkAudio.h

@@ -11,23 +11,52 @@
 #include <atomic>
 #include <mutex>
 #include <set>
+#include <functional>
 #include <winrt/Windows.Storage.Streams.h>
 namespace winrt::SparkAudio {
 namespace React = Microsoft::ReactNative;
 namespace Json = Windows::Data::Json;
-struct Entry { Windows::Media::Playback::MediaPlayer player{nullptr}; std::atomic<bool> ended{false}; std::atomic<bool> failed{false}; std::atomic<bool> loaded{false}; };
+struct Entry {
+  Windows::Media::Playback::MediaPlayer player{nullptr};
+  std::atomic<bool> ended{false}, failed{false}, loaded{false}, observing{false}, closed{false};
+  React::ReactContext context;
+  std::string id;
+  std::mutex readinessMutex;
+  std::mutex playerMutex;
+  std::function<void(bool, bool)> readiness;
+  void FinishReadiness() {
+    std::function<void(bool, bool)> complete;
+    { std::lock_guard lock(readinessMutex); if (loaded || failed || closed) complete = std::move(readiness); }
+    if (complete) complete(loaded && !failed && !closed, closed);
+  }
+  void EmitStatus() {
+    if (!observing || closed) return;
+    std::lock_guard lock(playerMutex); if (closed) return;
+    auto session = player.PlaybackSession();
+    context.EmitJSEvent(L"RCTDeviceEventEmitter", L"sparkAudioStatus", React::JSValueObject{{"id", id}, {"value", React::JSValueObject{
+      {"volume", player.Volume()}, {"playing", session.PlaybackState() == Windows::Media::Playback::MediaPlaybackState::Playing},
+      {"currentTime", std::chrono::duration<double>(session.Position()).count()}, {"duration", std::chrono::duration<double>(session.NaturalDuration()).count()},
+      {"didJustFinish", ended.load()}, {"error", failed ? React::JSValue("Audio could not be decoded or loaded") : React::JSValue(nullptr)}
+    }}});
+  }
+  void Close() {
+    closed = true; observing = false; FinishReadiness();
+    std::lock_guard lock(playerMutex); player.Pause(); player.Close();
+  }
+};
 struct MediaSession {
   Windows::Media::Playback::MediaPlayer player{nullptr};
   std::mutex mutex;
   std::set<std::wstring> allowed;
-  Json::JsonArray commands;
+  React::ReactContext context;
+  std::string id;
   Json::JsonObject state;
   ~MediaSession() { if (player) { player.SystemMediaTransportControls().IsEnabled(false); player.Close(); } }
   void Command(hstring const &name, double position = -1) {
-    std::lock_guard lock(mutex); if (!allowed.count(std::wstring(name)) || commands.Size() >= 128) return;
-    Json::JsonObject value; value.SetNamedValue(L"command", Json::JsonValue::CreateStringValue(name));
-    if (position >= 0) value.SetNamedValue(L"position", Json::JsonValue::CreateNumberValue(position));
-    commands.Append(value);
+    std::lock_guard lock(mutex); if (!allowed.count(std::wstring(name))) return;
+    React::JSValueObject value{{"command", to_string(name)}};
+    if (position >= 0) value.emplace("position", position);
+    context.EmitJSEvent(L"RCTDeviceEventEmitter", L"sparkMediaCommand", React::JSValueObject{{"id", id}, {"value", std::move(value)}});
   }
 };
 inline void Metadata(Windows::Media::SystemMediaTransportControls const &controls, Json::JsonObject const &metadata) {
@@ -62,7 +91,7 @@ struct Players {
   std::map<std::string, std::shared_ptr<Entry>> values;
   std::string sessionID;
   std::shared_ptr<MediaSession> session;
-  ~Players() { session.reset(); for (auto const &[id, entry] : values) { entry->player.Pause(); entry->player.Close(); } }
+  ~Players() { session.reset(); for (auto const &[id, entry] : values) entry->Close(); }
 };
 REACT_MODULE(SparkAudio, L"NativeSparkAudio")
 struct SparkAudio {
@@ -70,14 +99,14 @@ struct SparkAudio {
   std::shared_ptr<Players> players = std::make_shared<Players>();
   REACT_INIT(Initialize)
   void Initialize(React::ReactContext const &value) noexcept { context = value; }
-  static fire_and_forget Invoke(std::shared_ptr<Players> players, std::string method, std::string encoded, React::ReactPromise<std::string> promise) {
+  static fire_and_forget Invoke(std::shared_ptr<Players> players, React::ReactContext context, std::string method, std::string encoded, React::ReactPromise<std::string> promise) {
     try {
       auto args = Json::JsonObject::Parse(to_hstring(encoded)); auto id = to_string(args.GetNamedString(L"id"));
       if (method.starts_with("session")) {
         if (method == "sessionCreate") {
           players->session.reset();
           for (auto const &[key, entry] : players->values) entry->player.SystemMediaTransportControls().IsEnabled(false);
-          auto session = std::make_shared<MediaSession>(); session->player = Windows::Media::Playback::MediaPlayer();
+          auto session = std::make_shared<MediaSession>(); session->context = context; session->id = id; session->player = Windows::Media::Playback::MediaPlayer();
           session->player.CommandManager().IsEnabled(false);
           std::weak_ptr<MediaSession> weak = session; auto controls = session->player.SystemMediaTransportControls();
           controls.ButtonPressed([weak](auto const &, auto const &event) { if (auto current = weak.lock()) {
@@ -90,13 +119,11 @@ struct SparkAudio {
           players->session = session; players->sessionID = id;
           UpdateSession(session, args);
         } else {
+          if ((!players->session || players->sessionID != id) && method == "sessionRemove") { promise.Resolve("null"); co_return; }
           if (!players->session || players->sessionID != id) throw hresult_invalid_argument(L"Media session has been replaced");
           if (method == "sessionUpdate") UpdateSession(players->session, args);
           else if (method == "sessionRemove") { players->session.reset(); players->sessionID.clear(); }
-          else if (method == "sessionCommands") {
-            std::lock_guard lock(players->session->mutex);
-            auto result = to_string(players->session->commands.Stringify()); players->session->commands.Clear(); promise.Resolve(result); co_return;
-          } else throw hresult_invalid_argument(L"Unknown media session operation");
+          else throw hresult_invalid_argument(L"Unknown media session operation");
         }
       } else if (method == "create") {
         auto uri = args.GetNamedString(L"uri"); Windows::Media::Core::MediaSource source{nullptr};
@@ -107,23 +134,39 @@ struct SparkAudio {
         Windows::Media::Playback::MediaPlayer player; player.AutoPlay(false);
         auto controls = player.SystemMediaTransportControls(); controls.IsEnabled(!players->session); controls.IsPlayEnabled(true); controls.IsPauseEnabled(true);
         auto display = controls.DisplayUpdater(); display.Type(Windows::Media::MediaPlaybackType::Music); display.MusicProperties().Title(args.GetNamedString(L"title", L"Music")); display.Update();
-        auto entry = std::make_shared<Entry>(); entry->player = player; std::weak_ptr<Entry> weak = entry;
-        player.MediaEnded([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->ended = true; });
-        player.MediaFailed([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->failed = true; });
-        player.MediaOpened([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->loaded = true; });
+        auto entry = std::make_shared<Entry>(); entry->player = player; entry->context = context; entry->id = id; std::weak_ptr<Entry> weak = entry;
+        player.MediaEnded([weak](auto const &, auto const &) { if (auto entry = weak.lock()) { entry->ended = true; entry->EmitStatus(); } });
+        player.MediaFailed([weak](auto const &, auto const &) { if (auto entry = weak.lock()) { entry->failed = true; entry->FinishReadiness(); entry->EmitStatus(); } });
+        player.MediaOpened([weak](auto const &, auto const &) { if (auto entry = weak.lock()) { entry->loaded = true; entry->FinishReadiness(); entry->EmitStatus(); } });
+        auto playback = player.PlaybackSession();
+        playback.PositionChanged([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->EmitStatus(); });
+        playback.PlaybackStateChanged([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->EmitStatus(); });
+        playback.NaturalDurationChanged([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->EmitStatus(); });
+        player.VolumeChanged([weak](auto const &, auto const &) { if (auto entry = weak.lock()) entry->EmitStatus(); });
         player.Source(source);
         players->values.emplace(id, entry);
       } else {
         auto found = players->values.find(id);
+        if (found == players->values.end() && method == "remove") { promise.Resolve("null"); co_return; }
         if (found == players->values.end()) throw hresult_invalid_argument(L"Audio player is not available");
         auto entry = found->second; auto player = entry->player; auto session = player.PlaybackSession();
-        if (method == "ready") { if (entry->failed) throw hresult_error(E_FAIL, L"Audio could not be decoded or loaded"); promise.Resolve(entry->loaded ? "true" : "false"); co_return; }
+        if (method == "awaitReady") {
+          { std::lock_guard lock(entry->readinessMutex);
+            if (entry->readiness) throw hresult_invalid_argument(L"Audio readiness is already pending");
+            entry->readiness = [promise](bool loaded, bool closed) {
+              if (loaded) promise.Resolve("true");
+              else promise.Reject(React::ReactError{closed ? "E_CLOSED" : "E_AUDIO", closed ? "Audio player was removed during loading" : "Audio could not be decoded or loaded"});
+            };
+          }
+          entry->FinishReadiness(); co_return;
+        }
         else if (method == "volume") { auto volume = args.GetNamedNumber(L"volume"); if (!std::isfinite(volume) || volume < 0 || volume > 1) throw hresult_invalid_argument(L"Invalid volume"); player.Volume(volume); }
         else if (method == "metadata") Metadata(player.SystemMediaTransportControls(), args.GetNamedObject(L"metadata"));
         else if (method == "play") { if (!players->session) player.SystemMediaTransportControls().IsEnabled(true); entry->ended = false; player.Play(); }
         else if (method == "pause") player.Pause();
         else if (method == "seek") { entry->ended = false; auto seconds = args.GetNamedNumber(L"seconds"); if (!std::isfinite(seconds) || seconds < 0) throw hresult_invalid_argument(L"Invalid seek position"); session.Position(std::chrono::duration_cast<Windows::Foundation::TimeSpan>(std::chrono::duration<double>(seconds))); }
-        else if (method == "remove") { player.Pause(); player.Close(); players->values.erase(found); }
+        else if (method == "statusUpdates") { entry->observing = args.GetNamedBoolean(L"enabled"); entry->EmitStatus(); }
+        else if (method == "remove") { entry->Close(); players->values.erase(found); }
         else if (method == "status") {
           auto position = std::chrono::duration<double>(session.Position()).count(), duration = std::chrono::duration<double>(session.NaturalDuration()).count();
           Json::JsonObject status;
@@ -140,7 +183,11 @@ struct SparkAudio {
   }
   REACT_METHOD(call)
   void call(std::string method, std::string args, React::ReactPromise<std::string> promise) noexcept {
-    context.UIDispatcher().Post([players = players, method, args, promise]() { Invoke(players, method, args, promise); });
+    context.UIDispatcher().Post([players = players, context = context, method, args, promise]() { Invoke(players, context, method, args, promise); });
   }
+  REACT_METHOD(addListener)
+  void addListener(std::string) noexcept {}
+  REACT_METHOD(removeListeners)
+  void removeListeners(double) noexcept {}
 };
 }

package/vendor/node_modules/@legendapp/spark-auth-session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@legendapp/spark-auth-session",
-  "version": "0.0.1-next.2",
+  "version": "0.0.1-next.3",
   "license": "MIT",
   "main": "src/index",
   "react-native": "src/index",
@@ -8,8 +8,9 @@
     "src"
   ],
   "dependencies": {
-    "@legendapp/spark-desktop-links": "0.0.1-next.2",
-    "base64-js": "1.5.1"
+    "@legendapp/spark-desktop-links": "0.0.1-next.3",
+    "base64-js": "1.5.1",
+    "@legendapp/spark-desktop-app": "0.0.1-next.3"
   },
   "peerDependencies": {
     "react-native": "0.81.6",

package/vendor/node_modules/@legendapp/spark-auth-session/src/core.ts

@@ -1,68 +1,86 @@
+import { SparkError, asyncRegistration, nativeError } from "@legendapp/spark-desktop-app/src/contracts";
 import { authorize, callbackMatches, timeout, validateRedirect, type AuthSession, type AuthSessionOptions, type AuthSessionResult } from "./types";
 export type AuthTransport = {
   randomState(): Promise<string>;
   prepare(id: string, port: number, path: string): Promise<string>;
-  poll(id: string): Promise<string[]>;
+  subscribeLoopback(id: string, listener: (url: string) => void): Promise<{ remove(): void }>;
   close(id: string): Promise<void>;
   subscribe(listener: (url: string) => void): Promise<{ remove(): void }>;
   open(url: string): Promise<unknown>;
 };
 export function authSessions(transport: AuthTransport) {
   let busy = false, sequence = 0;
+  let orphan: { remove(): Promise<void> } | undefined;
   return async function createAuthSession(options: AuthSessionOptions = {}): Promise<AuthSession> {
     const duration = timeout(options);
-    if (busy) throw Object.assign(new Error("An authentication session is already active"), { code: "E_BUSY" });
-    if (options.signal?.aborted) throw Object.assign(new Error("Authentication was cancelled"), { name: "AbortError" });
+    options = { ...options };
+    const requestedRedirect = options.redirectUri;
+    let port = 0, path = "/auth/callback";
+    const loopback = !requestedRedirect || validateRedirect(requestedRedirect).protocol === "http:";
+    if (requestedRedirect) {
+      const uri = validateRedirect(requestedRedirect);
+      if (loopback) {
+        if (uri.hostname !== "127.0.0.1" || !uri.port || !/^\/[a-zA-Z0-9/_-]*$/.test(uri.pathname)) throw new SparkError("E_INVALID_ARGUMENT", "Desktop HTTP callbacks require 127.0.0.1, an explicit port, and a plain path");
+        port = Number(uri.port); path = uri.pathname;
+      } else if (uri.protocol === "https:") throw new SparkError("E_UNSUPPORTED_OPTION", "Desktop callbacks require a loopback URI or registered application scheme");
+    }
+    if (orphan) { const previous = orphan; await previous.remove(); if (orphan === previous) orphan = undefined; }
+    if (busy) throw new SparkError("E_BUSY", "An authentication session is already active");
+    if (options.signal?.aborted) throw new SparkError("E_ABORTED", "Authentication was cancelled");
     busy = true;
-    const id = `auth-${Date.now()}-${++sequence}`;
-    let loopback = false, closed = false, opened = false, subscription: { remove(): void } | undefined;
-    let timer: ReturnType<typeof setTimeout> | undefined, polling: ReturnType<typeof setTimeout> | undefined;
-    let resolve!: (result: AuthSessionResult) => void;
-    const result = new Promise<AuthSessionResult>(done => { resolve = done; });
-    let closing: Promise<void> | undefined, failure: unknown;
-    const cleanup = () => closing ??= (async () => {
-      closed = true; clearTimeout(timer); clearTimeout(polling); subscription?.remove(); options.signal?.removeEventListener("abort", cancel);
-      try { if (loopback) await transport.close(id); } finally { busy = false; }
-    })();
-    const finish = async (value: AuthSessionResult) => { if (closed) return; try { await cleanup(); } catch (error) { failure = error; } finally { resolve(value); } };
-    const cancel = () => { void finish({ type: "cancel" }).catch(console.error); };
+    const started = Date.now(), id = `auth-${started}-${++sequence}`;
+    let allocated = false, closed = false, opened = false, subscription: { remove(): void } | undefined;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    type Outcome = { value: AuthSessionResult; error?: unknown };
+    let resolve!: (outcome: Outcome) => void;
+    const result = new Promise<Outcome>(done => { resolve = done; });
+    const readResult = async () => { const outcome = await result; if (outcome.error) throw outcome.error; return outcome.value; };
+    const cleanup = asyncRegistration(() => {
+      closed = true; clearTimeout(timer); options.signal?.removeEventListener("abort", cancel);
+    }, async () => {
+      try {
+        subscription?.remove(); subscription = undefined;
+        if (allocated) await transport.close(id);
+        busy = false;
+      } catch (error) { throw nativeError(error); }
+    });
+    const finish = async (value: AuthSessionResult, error?: unknown) => {
+      if (closed) return;
+      try { await cleanup.remove(); } catch (cause) { error ??= cause; }
+      resolve({ value, error: error === undefined ? undefined : nativeError(error) });
+    };
+    const cancel = () => { void finish({ type: "cancel" }); };
     try {
       const state = await transport.randomState();
-      let redirectUri = options.redirectUri;
-      if (!redirectUri) { loopback = true; redirectUri = await transport.prepare(id, 0, "/auth/callback"); }
-      else {
-        const uri = validateRedirect(redirectUri);
-        if (uri.protocol === "http:") {
-          if (uri.hostname !== "127.0.0.1" || !uri.port || !/^\/[a-zA-Z0-9/_-]*$/.test(uri.pathname)) throw new TypeError("Desktop HTTP callbacks require 127.0.0.1, an explicit port, and a plain path");
-          loopback = true; redirectUri = await transport.prepare(id, Number(uri.port), uri.pathname);
-        } else if (uri.protocol === "https:") throw new TypeError("Desktop callbacks require a loopback URI or registered application scheme");
-      }
-      const redirect = redirectUri;
-      const received = (url: string) => { if (opened && !closed && callbackMatches(url, redirect, state)) void finish({ type: "success", url }).catch(console.error); };
-      if (!loopback) subscription = await transport.subscribe(received);
-      async function poll() {
-        try { for (const url of await transport.poll(id)) received(url); }
-        catch (error) { if (!closed) { failure = error; await finish({ type: "dismiss" }); } }
-        finally { if (!closed) polling = setTimeout(poll, 100); }
-      }
+      let redirect = requestedRedirect!;
+      const received = (url: string) => { if (opened && !closed && callbackMatches(url, redirect, state)) void finish({ type: "success", url }); };
+      if (loopback) {
+        subscription = await transport.subscribeLoopback(id, received);
+        allocated = true; redirect = await transport.prepare(id, port, path);
+      } else subscription = await transport.subscribe(received);
       options.signal?.addEventListener("abort", cancel, { once: true });
-      timer = setTimeout(() => { void finish({ type: "timeout" }).catch(console.error); }, duration);
+      const remaining = duration - (Date.now() - started);
       if (options.signal?.aborted) cancel();
+      else if (remaining <= 0) void finish({ type: "timeout" });
+      else timer = setTimeout(() => { void finish({ type: "timeout" }); }, remaining);
       return {
         state, redirectUri: redirect,
         async open(url) {
-          if (opened) throw new Error("Auth sessions can only be opened once");
-          if (closed) { const value = await result; if (failure) throw failure; return value; }
+          if (opened) throw new SparkError("E_CLOSED", "Auth sessions can only be opened once");
+          if (closed) return readResult();
           try {
             authorize(url, state, redirect); opened = true;
-            if (loopback) void poll();
-            // Don't let a slow browser launch suppress cancellation or a received callback.
-            const launch = transport.open(url).then(() => result);
-            const value = await Promise.race([result, launch]); if (failure) throw failure; return value;
-          } catch (error) { try { await cleanup(); } finally { resolve({ type: "dismiss" }); } throw error; }
+            // A slow browser launch must not suppress cancellation or callback delivery.
+            const launch = transport.open(url).catch(async error => { await finish({ type: "dismiss" }, error); });
+            await Promise.race([result, launch.then(() => result)]);
+            return readResult();
+          } catch (error) { await finish({ type: "dismiss" }, error); return readResult(); }
         },
-        async dismiss() { await finish({ type: "dismiss" }); if (failure) throw failure; },
+        async dismiss() { if (!closed) { await finish({ type: "dismiss" }); await readResult(); } else await cleanup.remove(); },
       };
-    } catch (error) { try { await cleanup(); } finally { resolve({ type: "dismiss" }); } throw error; }
+    } catch (error) {
+      try { await cleanup.remove(); } catch { orphan = cleanup; }
+      throw nativeError(error);
+    }
   };
 }

package/vendor/node_modules/@legendapp/spark-auth-session/src/index.ts

@@ -1,22 +1,38 @@
-import Native from "@legendapp/spark-desktop-links/src/NativeDesktopLinks";
-import { onOpen, openURL } from "@legendapp/spark-desktop-links";
+import { SparkError } from "@legendapp/spark-desktop-app/src/contracts";
+import { callLinks, linksCommand } from "@legendapp/spark-desktop-links/src/native";
+import { openURL } from "@legendapp/spark-desktop-links";
+import { subscribeToOpenRequests } from "@legendapp/spark-desktop-app/src/open-requests";
+import { onDesktopEvent } from "@legendapp/spark-desktop-app/src/events";
+import { toByteArray, fromByteArray } from "base64-js";
 import { authSessions } from "./core";
-import { validateCount, validateDigest } from "./types";
+import { validateCount, validateDigest, type CompleteAuthSessionResult } from "./types";
 export type * from "./types";
-async function call<T>(method: string, args: object): Promise<T> { return JSON.parse(await Native.call(method, JSON.stringify(args))); }
 export async function getRandomBytesAsync(count: number): Promise<Uint8Array> {
-  validateCount(count); const base64 = await call<string>("cryptoRandom", { count });
-  const { toByteArray } = await import("base64-js"); return toByteArray(base64);
+  validateCount(count);
+  const base64 = await callLinks("cryptoRandom", { count }, (value): value is string => typeof value === "string" && value.length === Math.ceil(count / 3) * 4 && /^[A-Za-z0-9+/]*={0,2}$/.test(value));
+  const bytes = toByteArray(base64);
+  if (bytes.length !== count || fromByteArray(bytes) !== base64) throw new SparkError("E_INVALID_DATA", "Native random bytes do not match the requested count");
+  return bytes;
 }
 export async function digestStringAsync(algorithm: "SHA-256", value: string): Promise<string> {
-  validateDigest(algorithm, value); return call("cryptoDigest", { value });
+  validateDigest(algorithm, value);
+  return callLinks("cryptoDigest", { value }, (result): result is string => typeof result === "string" && /^[0-9a-f]{64}$/.test(result));
 }
 export const createAuthSession = authSessions({
   randomState: async () => Array.from(await getRandomBytesAsync(32), byte => byte.toString(16).padStart(2, "0")).join(""),
-  prepare: (id, port, path) => call("authPrepare", { id, port, path }),
-  poll: id => call("authPoll", { id }), close: id => call("authClose", { id }),
-  subscribe: listener => onOpen(event => { if (event.type === "openURL") listener(event.url); }),
+  prepare: (id, port, path) => callLinks("authPrepare", { id, port, path }, (value): value is string => {
+    if (typeof value !== "string") return false;
+    try {
+      const url = new URL(value);
+      return url.protocol === "http:" && url.hostname === "127.0.0.1" && Number(url.port) > 0 && (!port || Number(url.port) === port) && url.pathname === path && !url.username && !url.password && !url.search && !url.hash;
+    } catch { return false; }
+  }),
+  subscribeLoopback: async (id, listener) => onDesktopEvent(event => {
+    if (typeof event.url === "string") listener(event.url);
+  }, { types: ["authRedirect"], target: { field: "id", value: id } }),
+  close: id => linksCommand("authClose", { id }),
+  subscribe: listener => subscribeToOpenRequests(event => { if (event.type === "url") listener(event.url); }),
   open: openURL,
 });
-/** Desktop receives callbacks natively; no popup-completion step is needed. */
-export function maybeCompleteAuthSession(): void {}
+/** Expo-compatible completion result: native hosts do not use a browser popup. */
+export function maybeCompleteAuthSession(): CompleteAuthSessionResult { return { type: "failed", message: "Not supported on this platform" }; }

package/vendor/node_modules/@legendapp/spark-auth-session/src/mobile.ts

@@ -1,52 +1,108 @@
 import * as Browser from "expo-web-browser";
 import * as Crypto from "expo-crypto";
-import { authorize, callbackMatches, timeout, validateRedirect, validateCount, validateDigest, type AuthSession, type AuthSessionOptions, type AuthSessionResult } from "./types";
+import { AppState, Linking, Platform } from "react-native";
+import { SparkError, asyncRegistration, invokeNative, nativeError, type Subscription } from "@legendapp/spark-desktop-app/src/contracts";
+import { authorize, callbackMatches, timeout, validateRedirect, validateCount, validateDigest, type CompleteAuthSessionResult, type AuthSession, type AuthSessionOptions, type AuthSessionResult } from "./types";
 export type * from "./types";
-export function getRandomBytesAsync(count: number) { validateCount(count); return Crypto.getRandomBytesAsync(count); }
-export function digestStringAsync(algorithm: "SHA-256", value: string) { validateDigest(algorithm, value); return Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, value); }
+export async function getRandomBytesAsync(count: number): Promise<Uint8Array> {
+  validateCount(count);
+  const bytes = await invokeNative(() => Crypto.getRandomBytesAsync(count));
+  if (!(bytes instanceof Uint8Array) || bytes.length !== count) throw new SparkError("E_INVALID_DATA", "Random bytes do not match the requested count");
+  return bytes;
+}
+export async function digestStringAsync(algorithm: "SHA-256", value: string): Promise<string> {
+  validateDigest(algorithm, value);
+  const digest = await invokeNative(() => Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, value));
+  if (typeof digest !== "string" || !/^[0-9a-f]{64}$/.test(digest)) throw new SparkError("E_INVALID_DATA", "Invalid SHA-256 response");
+  return digest;
+}
 let busy = false;
-/** On web, invoke this on the redirect page so Expo can complete its popup session. */
-export const maybeCompleteAuthSession = Browser.maybeCompleteAuthSession;
+/** Call on the web redirect page. Native hosts return Expo's unsupported result. */
+export function maybeCompleteAuthSession(): CompleteAuthSessionResult {
+  try {
+    const result = Browser.maybeCompleteAuthSession();
+    if (!result || (result.type !== "success" && result.type !== "failed") || typeof result.message !== "string") throw new SparkError("E_INVALID_DATA", "Invalid popup completion response");
+    return { type: result.type, message: result.message };
+  } catch (error) { throw nativeError(error); }
+}
 export async function createAuthSession(options: AuthSessionOptions = {}): Promise<AuthSession> {
   const duration = timeout(options);
-  if (!options.redirectUri) throw new TypeError("Mobile/web authentication requires an explicit registered redirectUri");
+  options = { ...options };
+  if (!options.redirectUri) throw new SparkError("E_INVALID_ARGUMENT", "Mobile/web authentication requires an explicit registered redirectUri");
   const redirectUri = options.redirectUri; validateRedirect(redirectUri);
-  if (busy) throw Object.assign(new Error("An authentication session is already active"), { code: "E_BUSY" });
-  if (options.signal?.aborted) throw Object.assign(new Error("Authentication was cancelled"), { name: "AbortError" });
+  if (busy) throw new SparkError("E_BUSY", "An authentication session is already active");
+  if (options.signal?.aborted) throw new SparkError("E_ABORTED", "Authentication was cancelled");
   busy = true;
-  try {
-    const state = Array.from(await getRandomBytesAsync(32), byte => byte.toString(16).padStart(2, "0")).join("");
-    let closed = false, opened = false;
-    let resolve!: (value: AuthSessionResult) => void;
-    const result = new Promise<AuthSessionResult>(done => { resolve = done; });
-    const finish = (value: AuthSessionResult) => {
-      if (closed) return; closed = true; clearTimeout(timer); options.signal?.removeEventListener("abort", cancel); busy = false;
-      if (opened) { try { Browser.dismissAuthSession(); } catch { /* Android custom tabs may remain visible. */ } }
-      resolve(value);
-    };
-    const cancel = () => finish({ type: "cancel" });
-    const timer = setTimeout(() => finish({ type: "timeout" }), duration);
-    options.signal?.addEventListener("abort", cancel, { once: true });
-    if (options.signal?.aborted) cancel();
-    return {
-      state, redirectUri,
-      async open(url) {
-        if (opened) throw new Error("Auth sessions can only be opened once");
-        if (closed) return result;
-        try {
-          authorize(url, state, redirectUri); opened = true;
-          // Call synchronously within the user's gesture on web; do not await preparation here.
-          const browser = Browser.openAuthSessionAsync(url, redirectUri).then(value => {
+  const started = Date.now();
+  let state: string;
+  try { state = Array.from(await getRandomBytesAsync(32), byte => byte.toString(16).padStart(2, "0")).join(""); }
+  catch (error) { busy = false; throw error; }
+  let closed = false, opened = false, browserFinished = false;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let linking: Subscription | undefined, appState: Subscription | undefined;
+  type Outcome = { value: AuthSessionResult; error?: unknown };
+  let resolve!: (value: Outcome) => void;
+  const result = new Promise<Outcome>(done => { resolve = done; });
+  const readResult = async () => { const outcome = await result; if (outcome.error) throw outcome.error; return outcome.value; };
+  const cleanup = asyncRegistration(() => {
+    closed = true; clearTimeout(timer); options.signal?.removeEventListener("abort", cancel);
+  }, async () => {
+    try {
+      linking?.remove(); linking = undefined; appState?.remove(); appState = undefined;
+      // Android cannot close a Custom Tab. Spark owns and removes its callback observers.
+      if (opened && !browserFinished && Platform.OS !== "android") Browser.dismissAuthSession();
+      busy = false;
+    } catch (error) { throw nativeError(error); }
+  });
+  const finish = async (value: AuthSessionResult, error?: unknown) => {
+    if (closed) return;
+    try { await cleanup.remove(); } catch (cause) { error ??= cause; }
+    resolve({ value, error: error === undefined ? undefined : nativeError(error) });
+  };
+  const cancel = () => { void finish({ type: "cancel" }); };
+  options.signal?.addEventListener("abort", cancel, { once: true });
+  const remaining = duration - (Date.now() - started);
+  if (options.signal?.aborted) cancel();
+  else if (remaining <= 0) void finish({ type: "timeout" });
+  else timer = setTimeout(() => { void finish({ type: "timeout" }); }, remaining);
+  return {
+    state, redirectUri,
+    async open(url) {
+      if (opened) throw new SparkError("E_CLOSED", "Auth sessions can only be opened once");
+      if (closed) return readResult();
+      try {
+        authorize(url, state, redirectUri); opened = true;
+        if (Platform.OS === "android") {
+          // Expo's Android auth polyfill cannot cancel its pending redirect observer.
+          // Own these observers so cancellation never prevents the next session.
+          linking = Linking.addEventListener("url", event => {
+            if (callbackMatches(event.url, redirectUri, state)) void finish({ type: "success", url: event.url });
+          });
+          let departed = AppState.currentState !== null && AppState.currentState !== "active";
+          appState = AppState.addEventListener("change", value => {
+            if (value !== "active") departed = true;
+            else if (departed) void finish({ type: "dismiss" });
+          });
+          void Browser.openBrowserAsync(url).then(value => {
+            if (value.type === "cancel" || value.type === "dismiss") return finish({ type: value.type });
+            if (value.type !== "opened") return finish({ type: "dismiss" }, new SparkError("E_INVALID_DATA", "Invalid browser launch response"));
+          }).catch(error => finish({ type: "dismiss" }, error));
+        } else {
+          // Keep this call synchronous within the user's gesture on web.
+          void Browser.openAuthSessionAsync(url, redirectUri).then(value => {
+            browserFinished = true;
             if (closed) return;
             if (value.type === "success") {
-              if (!callbackMatches(value.url, redirectUri, state)) throw new Error("Authentication callback state or redirect did not match");
-              finish({ type: "success", url: value.url });
-            } else finish({ type: value.type === "cancel" ? "cancel" : "dismiss" });
-          });
-          return await Promise.race([result, browser.then(() => result)]);
-        } catch (error) { finish({ type: "dismiss" }); throw error; }
-      },
-      async dismiss() { finish({ type: "dismiss" }); },
-    };
-  } catch (error) { busy = false; throw error; }
+              if (!callbackMatches(value.url, redirectUri, state)) return finish({ type: "dismiss" }, new SparkError("E_INVALID_DATA", "Authentication callback state or redirect did not match"));
+              return finish({ type: "success", url: value.url });
+            }
+            if (value.type === "cancel" || value.type === "dismiss") return finish({ type: value.type });
+            return finish({ type: "dismiss" }, new SparkError("E_INVALID_DATA", "Invalid authentication browser response"));
+          }).catch(error => { browserFinished = true; return finish({ type: "dismiss" }, error); });
+        }
+      } catch (error) { await finish({ type: "dismiss" }, error); }
+      return readResult();
+    },
+    async dismiss() { if (!closed) { await finish({ type: "dismiss" }); await readResult(); } else await cleanup.remove(); },
+  };
 }

package/vendor/node_modules/@legendapp/spark-auth-session/src/types.ts

@@ -1,3 +1,4 @@
+import { SparkError } from "@legendapp/spark-desktop-app/src/contracts";
 export type AuthSessionResult = { type: "success"; url: string } | { type: "cancel" | "dismiss" | "timeout" };
 export type AuthSessionOptions = { redirectUri?: string; timeoutMs?: number; signal?: AbortSignal };
 export interface AuthSession {
@@ -7,8 +8,12 @@ export interface AuthSession {
   dismiss(): Promise<void>;
 }
 export function timeout(options: AuthSessionOptions) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) throw new SparkError("E_INVALID_ARGUMENT", "Expected authentication options");
+  for (const key of Object.keys(options)) if (!["redirectUri", "timeoutMs", "signal"].includes(key)) throw new SparkError("E_UNSUPPORTED_OPTION", `Unknown authentication option: ${key}`);
+  if (options.redirectUri !== undefined && (typeof options.redirectUri !== "string" || !options.redirectUri)) throw new SparkError("E_INVALID_ARGUMENT", "Expected a redirect URI");
+  if (options.signal !== undefined && (!options.signal || typeof options.signal.aborted !== "boolean" || typeof options.signal.addEventListener !== "function" || typeof options.signal.removeEventListener !== "function")) throw new SparkError("E_INVALID_ARGUMENT", "Expected an AbortSignal");
   const value = options.timeoutMs ?? 120_000;
-  if (!Number.isInteger(value) || value < 1 || value > 600_000) throw new TypeError("Auth timeout must be 1–600000 milliseconds");
+  if (!Number.isInteger(value) || value < 1 || value > 600_000) throw new SparkError("E_INVALID_ARGUMENT", "Auth timeout must be 1–600000 milliseconds");
   return value;
 }
 export function callbackMatches(value: string, redirectUri: string, state: string) {
@@ -20,19 +25,25 @@ export function callbackMatches(value: string, redirectUri: string, state: strin
   } catch { return false; }
 }
 export function authorize(value: string, state: string, redirectUri: string) {
-  const url = new URL(value);
-  if ((url.protocol !== "https:" && !(url.protocol === "http:" && url.hostname === "127.0.0.1")) || url.username || url.password) throw new TypeError("Authorization requires HTTPS (or a local loopback test server)");
+  const url = parseURL(value);
+  if ((url.protocol !== "https:" && !(url.protocol === "http:" && url.hostname === "127.0.0.1")) || url.username || url.password) throw new SparkError("E_INVALID_ARGUMENT", "Authorization requires HTTPS (or a local loopback test server)");
   const states = url.searchParams.getAll("state");
-  if (states.length !== 1 || states[0] !== state) throw new TypeError("Authorization URL must use this session's state");
+  if (states.length !== 1 || states[0] !== state) throw new SparkError("E_INVALID_ARGUMENT", "Authorization URL must use this session's state");
   const redirects = url.searchParams.getAll("redirect_uri");
-  if (redirects.length > 1 || (redirects.length === 1 && redirects[0] !== redirectUri)) throw new TypeError("Authorization redirect_uri must match the prepared session");
+  if (redirects.length > 1 || (redirects.length === 1 && redirects[0] !== redirectUri)) throw new SparkError("E_INVALID_ARGUMENT", "Authorization redirect_uri must match the prepared session");
 }
 export function validateRedirect(uri: string) {
-  const url = new URL(uri);
-  if (url.username || url.password || url.search || url.hash || ["javascript:", "data:", "file:", "about:"].includes(url.protocol)) throw new TypeError("Invalid authentication redirect URI");
+  const url = parseURL(uri);
+  if (url.username || url.password || url.search || url.hash || ["javascript:", "data:", "file:", "about:"].includes(url.protocol)) throw new SparkError("E_INVALID_ARGUMENT", "Invalid authentication redirect URI");
   return url;
 }
-export function validateCount(count: number) { if (!Number.isInteger(count) || count < 1 || count > 1024) throw new TypeError("Random byte count must be 1–1024"); }
+export function validateCount(count: number) { if (!Number.isInteger(count) || count < 1 || count > 1024) throw new SparkError("E_INVALID_ARGUMENT", "Random byte count must be 1–1024"); }
 export function validateDigest(algorithm: string, value: string) {
-  if (algorithm !== "SHA-256" || typeof value !== "string" || value.length > 262144) throw new TypeError("Expected SHA-256 and at most 262144 characters");
+  if (algorithm !== "SHA-256" || typeof value !== "string" || value.length > 262144) throw new SparkError("E_INVALID_ARGUMENT", "Expected SHA-256 and at most 262144 characters");
 }
+
+function parseURL(value: string): URL {
+  if (typeof value !== "string" || !value || value.trim() !== value) throw new SparkError("E_INVALID_ARGUMENT", "Expected an absolute URL");
+  try { return new URL(value); } catch (cause) { throw new SparkError("E_INVALID_ARGUMENT", "Expected an absolute URL", { cause }); }
+}
+export type CompleteAuthSessionResult = { type: "success" | "failed"; message: string };