@oxy.so/core 1.12.1 → 1.16.0

package/dist/types/crypto/webIdentityCarrier.d.ts

@@ -11,7 +11,7 @@
  *
  * The PRF output is produced inside the user's authenticator, behind user
  * verification, and never leaves the page that asked for it. The envelope is
- * therefore safe to store anywhere — the holder host's IndexedDB and the server
+ * therefore safe to store anywhere — auth.oxy.so's IndexedDB and the server
  * copy alike — and opens only with a registered passkey or the recovery material.
  *
  * PURE: no storage, no network, no WebAuthn call, no platform globals beyond the

package/dist/types/index.d.ts

@@ -29,6 +29,8 @@ export type { ServiceTokenResponse, OAuthUserInfoResponse, OAuthTokenExchangeRes
 export type { CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, } from './mixins/OxyServices.auth';
 export type { PushTokenPlatform, RegisterPushTokenInput, } from './mixins/OxyServices.notifications';
 export type { ServiceApp, ServiceActingAsVerification, OxyAuthRefusal } from './mixins/OxyServices.utility';
+export type { OxyAccountEvent, OxyAccountEventFeedItem, OxyAccountEventFeedPage, VerifyAccountEventOptions, } from './mixins/OxyServices.utility';
+export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './mixins/OxyServices.utility';
 export type { ContactDiscoveryMatch, ContactDiscoveryResponse, } from './mixins/OxyServices.contacts';
 export type { BulkFollowEntry, BulkFollowResult, BulkUnfollowEntry, BulkUnfollowResult, FollowMutationResult, ViewerGraph, } from './mixins/OxyServices.user';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData';
@@ -109,12 +111,12 @@ export { updateAvatarVisibility } from './utils/avatarUtils';
 export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 export { registrableApex } from './utils/registrableApex';
-export { CENTRAL_IDP_APEX, IDENTITY_WEB_ORIGIN } from './utils/authWebUrl';
+export { AUTH_WEB_ORIGIN, CENTRAL_IDP_APEX } from './utils/authWebUrl';
 export { isOxyRpOrigin } from './utils/webauthnOrigin';
 export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
-export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
+export type { PkcePair, BuildOAuthAuthorizeUrlParams, OxyAuthScreen } from './utils/oauthPkce';
 export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins';
 export { SessionClient } from './session/SessionClient';
 export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './session/SessionClient';
@@ -130,7 +132,7 @@ export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountS
 export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
 export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
 export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -25,6 +25,64 @@ export interface ServiceActingAsVerification {
     authorized: boolean;
     scopes: string[];
 }
+/** The SET `events` member Oxy uses for an account deletion. */
+export declare const OXY_ACCOUNT_DELETED_EVENT_URI = "https://oxy.so/events/account.deleted";
+/**
+ * A verified account event from Oxy (OxyHQ/Mention#1169): a person deleted
+ * their Oxy account and every relying application must erase what it holds
+ * for them. Returned by `verifyAccountEvent` only after the signature, `typ`,
+ * issuer and audience all check out.
+ */
+export interface OxyAccountEvent {
+    /** The event id (`jti`). Stable across webhook retries and the pull feed: dedupe on it. */
+    eventId: string;
+    type: 'account.deleted';
+    /** The deleted Oxy account. */
+    userId: string;
+    /**
+     * The account's handle at deletion time, for relying parties that address
+     * the person by handle (an ActivityPub actor URI). `null` when the account had
+     * none, or when the token predates the field.
+     */
+    username: string | null;
+    /** ISO-8601 time the deletion committed. */
+    occurredAt: string;
+    /** `true` when Oxy archived the row to keep financial records. Erase either way. */
+    retained: boolean;
+    /** The application the event was addressed to (`aud`). */
+    applicationId: string;
+    /** Seconds since the epoch the token was issued at (`iat`). */
+    issuedAt: number;
+}
+/** One entry of the account-event pull feed (`GET /account-events`). */
+export interface OxyAccountEventFeedItem {
+    eventId: string;
+    type: 'account.deleted';
+    userId: string;
+    username: string | null;
+    occurredAt: string;
+    retained: boolean;
+    /** The same signed token the webhook carries. Verify it with `verifyAccountEvent`. */
+    token: string;
+}
+export interface OxyAccountEventFeedPage {
+    events: OxyAccountEventFeedItem[];
+    /** Pass back as `after` to continue; unchanged when the page is empty. */
+    nextCursor: string | null;
+}
+export interface VerifyAccountEventOptions {
+    /**
+     * The application id the token must be addressed to. Defaults to the `appId`
+     * of this client's configured service credential.
+     */
+    audience?: string;
+    /** Defaults to `/.well-known/jwks.json` on this client's API origin. */
+    jwksUrl?: string;
+}
+/** Why an account event token was refused. `message` never contains the token. */
+export declare class OxyAccountEventError extends Error {
+    constructor(message: string);
+}
 /**
  * Service app metadata attached to requests authenticated with service tokens.
  *
@@ -177,6 +235,31 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
          * @internal Used by the auth() middleware — not part of the public API
          */
         verifyServiceActingAs(appId: string, userId: string): Promise<ServiceActingAsVerification | null>;
+        /**
+         * Verify an account event token from Oxy — the body of an account-event
+         * webhook, or an entry's `token` from `listAccountEvents` — and return the
+         * event. Throws {@link OxyAccountEventError} unless the token is an
+         * EdDSA-signed `secevent+jwt` from Oxy's published key set, issued by
+         * `oxy-auth`, addressed to this application, carrying exactly one known
+         * event. A service token (`typ: JWT`) is refused here, as this token is
+         * refused as a service token.
+         *
+         * Node only (it needs `node:crypto`). The caller must still be idempotent on
+         * `eventId`: Oxy delivers at least once, by push and by pull.
+         */
+        verifyAccountEvent(token: string, options?: VerifyAccountEventOptions): Promise<OxyAccountEvent>;
+        /**
+         * One page of account events addressed to this application, oldest first,
+         * from Oxy's pull feed — the reconciliation path behind the webhook. Needs
+         * the service credential (`configureServiceAuth`). Verify each entry's
+         * `token` with {@link verifyAccountEvent} before acting on it.
+         */
+        listAccountEvents(options?: {
+            after?: string;
+            limit?: number;
+        }): Promise<OxyAccountEventFeedPage>;
+        /** @internal The `appId` claim of this client's own service token. */
+        _configuredServiceAppId(): Promise<string>;
         /**
          * Express.js authentication middleware
          *
@@ -380,7 +463,7 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;
             retryDelay?: number;
-            authTimeoutMs?: number;
+            authTimeoutMs? /** @internal Per-client public-key cache; never contains private material. */: number;
         }): Promise<T_1>;
         validate(): Promise<boolean>;
         handleError(error: unknown): Error;

package/dist/types/server/requesterAssertion.d.ts

@@ -40,8 +40,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     sub: string;
     aud: string;
     iss: string;
-    iat: number;
     jti: string;
+    iat: number;
     azp: string;
     cid: string;
     agentId: string;
@@ -50,8 +50,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     sub: string;
     aud: string;
     iss: string;
-    iat: number;
     jti: string;
+    iat: number;
     azp: string;
     cid: string;
     agentId: string;

package/dist/types/server/securityHeaders.d.ts

@@ -166,6 +166,15 @@ export interface OxyPagesHeadersOptions {
      * injecting the beacon at all — otherwise every page load logs a CSP
      * violation for a script we never asked for. The rest of the value is Pages'
      * own default, so caching is unchanged.
+     *
+     * And, because this origin is the web identity carrier — where a person's
+     * self-custody root is created, opened, recovered and moved (ADR 0028) — the
+     * rest of the holder policy: no `<base>` and no form posts (`base-uri` /
+     * `form-action 'none'`), no Referer to anyone, passkeys for this origin only
+     * with every other powerful feature off (`Permissions-Policy`), and its
+     * responses readable by no other origin (`Cross-Origin-Resource-Policy`).
+     * Never `Cross-Origin-Opener-Policy`: the third-party OAuth popup reports
+     * its code to the app that opened it, and COOP severs `window.opener`.
      */
     sensitive?: boolean;
     /**
@@ -184,18 +193,6 @@ export interface OxyPagesHeadersOptions {
      */
     html?: readonly string[];
 }
-/**
- * Build a Cloudflare Pages `_headers` block for an Oxy HTML origin. Uses the
- * same CSP resolution as {@link createOxySecurityHeaders} plus the non-CSP
- * hardening headers Helmet would add on an Express HTML backend.
- *
- * Adding a hash to `script-src` does not narrow it: per CSP Level 3 a hash is
- * an additional source, so `'self'` and the beacon host keep matching external
- * scripts. (It WOULD neutralize `'unsafe-inline'` in the same directive — which
- * is why this hashes scripts only. `style-src` keeps `'unsafe-inline'` for
- * react-native-web's runtime stylesheet, and a style hash would silently switch
- * that off and render every Oxy web app unstyled.)
- */
 export declare function buildOxyPagesHeaders(options?: OxyPagesHeadersOptions): string;
 export interface OxySecurityHeadersOptions {
     /**

package/dist/types/session/accountDialogController.d.ts

@@ -36,12 +36,6 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
- *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
- *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
- *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
- *     session `showQr` creates, and complete it via the SAME poll/socket/claim
- *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
- *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -114,8 +108,6 @@ export type SignInProgress = 'idle' | 'preparing' | 'awaiting-approval' | 'deliv
  * WHY a sign-in attempt ended in `'error'` — a machine-readable reason the UI
  * turns into localized copy (the controller ships no user-facing prose).
  *
- *  - `'cancelled'` — the USER walked away (closed the passkey hub popup). A
- *    voluntary outcome, not a failure to report.
  *  - `'denied'` — the approver declined the request in Commons.
  *  - `'expired'` — the request outlived its server-authoritative expiry.
  *  - `'network'` — Oxy could not be reached (no response, timeout).
@@ -124,22 +116,7 @@ export type SignInProgress = 'idle' | 'preparing' | 'awaiting-approval' | 'deliv
  *  - `'claim-failed'` — the request WAS approved, but the session could not be claimed.
  *  - `'unknown'` — anything else; the raw message stays on `error` for logs.
  */
-export type SignInFailureReason = 'cancelled' | 'denied' | 'expired' | 'network' | 'not-configured' | 'unsupported-flow' | 'claim-failed' | 'unknown';
-/**
- * Minimal structural handle over a popup `Window` — just enough for the
- * cross-origin passkey hub flow ({@link AccountDialogController.startPasskeyHubSignIn}):
- * navigate it once the device-flow session's `authorizeCode` is known, detect
- * the user closing it early (`closed`), and close it programmatically on
- * completion/failure. Satisfied directly by `window.open()`'s return value on
- * web; native has no popup concept and never injects an opener.
- */
-export interface PopupWindowHandle {
-    readonly closed: boolean;
-    close(): void;
-    location: {
-        href: string;
-    };
-}
+export type SignInFailureReason = 'denied' | 'expired' | 'network' | 'not-configured' | 'unsupported-flow' | 'claim-failed' | 'unknown';
 /**
  * State of the "Sign in with Oxy" (shared-key / QR) device flow.
  *
@@ -217,6 +194,14 @@ export interface SignInFlowState {
      * attempt failing with the same message is).
      */
     attempt: number;
+    /**
+     * `true` when this attempt is the sign-in entry's EMBEDDED QR
+     * ({@link AccountDialogController.startInlineQr}): a request the surface
+     * started on its own, not one the person asked for. Its failures (an expired
+     * code, above all) belong to that QR, which renews itself, and are not news
+     * to report.
+     */
+    inline: boolean;
 }
 /** Immutable snapshot consumed by `useSyncExternalStore`. */
 export interface AccountDialogSnapshot {
@@ -343,28 +328,6 @@ export interface AccountDialogControllerOptions {
      * `showQr` behaves exactly as before (render QR only).
      */
     canOpenApp?: (url: string) => Promise<boolean>;
-    /**
-     * Open a new, empty popup window SYNCHRONOUSLY (before any `await`) so the
-     * browser attributes it to the click gesture that triggered it, returning a
-     * handle to navigate once the device-flow session is known — or `null` if
-     * the popup was blocked. Injected by the provider (web only:
-     * `window.open('', ...)`; absent on native, where the hub-popup flow does
-     * not apply). Used by {@link AccountDialogController.startPasskeyHubSignIn}.
-     */
-    openPopup?: () => PopupWindowHandle | null;
-    /**
-     * Origin of the web identity carrier (default `IDENTITY_WEB_ORIGIN`,
-     * `https://id.oxy.so`) — where a passkey sign-in or sign-up runs
-     * and the account's identity is kept sealed under the passkey. The popup opens
-     * `<identityOrigin>/continue?code=…`. Overridable for local/staging testing.
-     */
-    identityOrigin?: string;
-    /**
-     * @deprecated Alias of {@link identityOrigin}, kept for existing
-     * configuration. The popup used to open `auth.oxy.so/hub-passkey`; it now opens
-     * the identity origin's `/continue`, so a value here must be that origin.
-     */
-    hubBaseUrl?: string;
     /**
      * Which surface the sign-in is initiated from — a FACT supplied by the
      * consumer, because only the consumer can classify its own environment
@@ -389,8 +352,6 @@ export declare class AccountDialogController {
     private readonly openUrl?;
     private readonly canOpenApp?;
     private readonly socketFactory?;
-    private readonly openPopup?;
-    private readonly identityOrigin;
     private readonly platform;
     private readonly listeners;
     private view;
@@ -433,10 +394,6 @@ export declare class AccountDialogController {
      * ABANDONED request never blocks the next request's first poll.
      */
     private pollInFlightToken;
-    /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
-    private activePopup;
-    /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
-    private popupWatchTimer;
     private unsubscribeSession;
     private unsubscribeTokens;
     /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
@@ -642,38 +599,21 @@ export declare class AccountDialogController {
      */
     showQr(): Promise<void>;
     /**
-     * Start a NEW attempt the same way the last one was started — "Try again"
-     * repeats the user's choice rather than silently switching method. A failed
-     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
-     * retries that; an explicit QR request shows the QR.
+     * The sign-in entry's EMBEDDED QR: a request whose only route is the QR,
+     * started without leaving the current view.
      *
-     * Call it straight from the press handler: the hub route opens its popup
-     * synchronously, before this method's first `await`, so the browser still
-     * attributes it to the click.
+     * Unlike {@link showQr} it runs no delivery selection. The surface starts it
+     * by itself, on mount, so it must not push to the person's phone or open
+     * Commons — nobody asked for either. Any other sign-in the person then
+     * chooses supersedes it (and withdraws its request) like any new attempt.
      */
-    retrySignIn(): Promise<void>;
+    startInlineQr(): Promise<void>;
     /**
-     * Web-only: sign in (or create an account) with a passkey at the web identity
-     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
-     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
-     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
-     * and only the identity origin may unseal or create the account's identity
-     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
-     * scoped to the SAME device-flow
-     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
-     * pair), and let the SAME poll/socket/claim engine complete it once the hub
-     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
-     * bearer-authed, server-side — this method never sees or transmits the
-     * secret `sessionToken`).
-     *
-     * The popup MUST be opened synchronously, before any `await`, or the
-     * browser's popup blocker loses the click-gesture attribution and silently
-     * blocks it — so {@link openPopup} is invoked as the very first step, before
-     * the device-flow session (which needs an async call) even exists. If the
-     * popup is blocked (or no `openPopup` was injected), this falls back to
-     * `showQr`'s plain QR rendering — no dead end.
-     */
-    startPasskeyHubSignIn(): Promise<void>;
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method: a failed
+     * "Sign in with Oxy" retries that; an explicit QR request shows the QR.
+     */
+    retrySignIn(): Promise<void>;
     /**
      * End whatever attempt is running (withdrawing its request) and begin a new
      * one. Returns the new attempt's identity for the caller to re-check after
@@ -683,9 +623,9 @@ export declare class AccountDialogController {
     /** Whether `attempt` is still the one the surface is waiting on. */
     private isCurrentAttempt;
     /**
-     * Shared device-flow session creation for both {@link showQr} (renders the
-     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
-     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * Shared device-flow session creation for {@link signInWithOxy},
+     * {@link showQr} and {@link startInlineQr} — the same `startCommonsSignIn` →
+     * poll/socket wiring every time. Returns the
      * handle on success (already reflected in `signIn`), or `null` when the
      * attempt failed (already set as `signIn.failure`) or was abandoned while the
      * request was being created.
@@ -696,8 +636,8 @@ export declare class AccountDialogController {
      *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
-     *   entry; `false` when the caller already owns the primary surface (the
-     *   passkey hub popup), where the request's Commons route is simply the QR.
+     *   entry; `false` for the embedded QR, which the screen starts by itself,
+     *   where the request's Commons route is simply the QR.
      */
     private startDeviceFlowSession;
     /**
@@ -744,17 +684,6 @@ export declare class AccountDialogController {
      * end the user stares at.
      */
     private openCommonsLink;
-    /**
-     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
-     * popup without completing sign-in gets prompt feedback (there is no DOM
-     * event for a cross-origin popup closing — polling is the only mechanism).
-     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
-     * calls.
-     */
-    private watchPopup;
-    private clearPopupWatchTimer;
-    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
-    private closeActivePopup;
     /**
      * Resolve whether Commons is installed on this device via the injected
      * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
@@ -769,7 +698,7 @@ export declare class AccountDialogController {
      */
     private resolveCommonsAvailability;
     /**
-     * Tear down the active sign-in device flow (timers + socket + popup + token),
+     * Tear down the active sign-in device flow (timers + socket + token),
      * WITHDRAW the request server-side, and reset to idle.
      *
      * Cancellation has to converge in both directions: the surface closing must
@@ -869,6 +798,8 @@ export declare class AccountDialogController {
      * to advance without a fact behind it.
      */
     private setSignIn;
+    /** `facts` as the current attempt's state. */
+    private stampSignIn;
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     private patchSignIn;
     private computeSnapshot;

package/dist/types/utils/authWebUrl.d.ts

@@ -15,9 +15,10 @@
  */
 export declare const CENTRAL_IDP_APEX = "oxy.so";
 /**
- * The web identity carrier's origin — where a person signs in or creates an
- * account with a passkey, and where their self-custody identity is kept sealed
- * under that passkey (one identity, two carriers). Apps open it; they never
- * handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface AND the
+ * web identity carrier: where a person signs in or creates an account with a
+ * passkey from another origin's popup, and the one origin that may create,
+ * open, recover or move their self-custody identity (one identity, two
+ * carriers). Apps open it; they never handle the identity themselves.
  */
-export declare const IDENTITY_WEB_ORIGIN = "https://id.oxy.so";
+export declare const AUTH_WEB_ORIGIN = "https://auth.oxy.so";

package/dist/types/utils/oauthPkce.d.ts

@@ -67,7 +67,17 @@ export interface BuildOAuthAuthorizeUrlParams {
      * a token, device secret, or the PKCE verifier, which the opener keeps.
      */
     responseMode?: 'web_message';
+    /**
+     * Which of the IdP's screens a person with no session there lands on:
+     * `signin` (sign in with a passkey), `signup` (create an account with its
+     * root), `recover` (recover it from the recovery phrase). Omitted, the IdP
+     * offers its Commons request first. An Oxy app sends this when it sends the
+     * person to auth.oxy.so for what only that origin can do, in the same tab.
+     */
+    screen?: OxyAuthScreen;
 }
+/** The IdP screens {@link BuildOAuthAuthorizeUrlParams.screen} can open. */
+export type OxyAuthScreen = 'signin' | 'signup' | 'recover';
 /**
  * Compute the PKCE S256 `code_challenge` for a given verifier:
  * `BASE64URL(SHA-256(ASCII(codeVerifier)))` (RFC 7636 §4.2). The verifier is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.12.1",
+  "version": "1.16.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -118,7 +118,7 @@
     "@oxy.so/telemetry": "^1.1.1",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "^1.5.0",
+    "@oxy.so/contracts": "^2.0.0",
     "@oxy.so/protocol": "^1.1.1",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",

package/src/crypto/webIdentityCarrier.ts

@@ -11,7 +11,7 @@
  *
  * The PRF output is produced inside the user's authenticator, behind user
  * verification, and never leaves the page that asked for it. The envelope is
- * therefore safe to store anywhere — the holder host's IndexedDB and the server
+ * therefore safe to store anywhere — auth.oxy.so's IndexedDB and the server
  * copy alike — and opens only with a registered passkey or the recovery material.
  *
  * PURE: no storage, no network, no WebAuthn call, no platform globals beyond the

package/src/i18n/locales/ar-SA.json

@@ -1,53 +1,48 @@
 {
   "signin": {
     "title": "تسجيل الدخول",
-    "subtitle": "سجل الدخول للمتابعة",
+    "subtitle": "استخدم حسابك في Oxy",
     "addAccountTitle": "إضافة حساب آخر",
     "addAccountSubtitle": "تسجيل الدخول بحساب آخر",
     "username": {
       "label": "اسم المستخدم",
-      "placeholder": "أدخل اسم المستخدم",
-      "helper": "3-30 حرفًا، أحرف وأرقام فقط",
-      "required": "يرجى إدخال اسم المستخدم.",
-      "minLength": "يجب أن يكون اسم المستخدم 3 أحرف على الأقل."
-    },
-    "password": {
-      "label": "كلمة المرور",
-      "placeholder": "أدخل كلمة المرور",
-      "required": "يرجى إدخال كلمة المرور.",
-      "hint": "أدخل كلمة المرور لتسجيل الدخول"
+      "placeholder": "yourname",
+      "required": "يرجى إدخال اسم المستخدم."
     },
     "actions": {
       "continue": "متابعة",
-      "back": "رجوع",
-      "signIn": "تسجيل الدخول",
-      "verify": "التحقق",
-      "openAccountSwitcher": "التبديل إلى حساب آخر",
-      "openAccountSwitcherSubtitle": "{{count}} حسابات أخرى متاحة",
-      "openAccountSwitcherSubtitle_singular": "حساب آخر واحد متاح",
-      "openAccountSwitcherSubtitle_zero": "راجع حساباتك المحفوظة",
-      "manageAccounts": "إدارة الحسابات المحفوظة",
-      "manageAccountsSubtitle": "مراجعة الجلسات أو إزالتها أو تسجيل الخروج",
-      "loadingOtherAccounts": "جاري تحميل الحسابات الأخرى…",
-      "switchAccountFailed": "لم نتمكن من التبديل بين الحسابات. يرجى المحاولة مرة أخرى."
+      "back": "رجوع"
     },
-    "forgotPrompt": "نسيت كلمة المرور؟",
-    "security": {
-      "dataSecure": "بياناتك مشفرة وآمنة"
-    },
-    "currentlySignedInAs": "مسجل الدخول حاليًا كـ",
-    "alreadySignedInWith": "مسجل الدخول بالفعل بـ",
-    "alreadySignedIn": "مسجل الدخول بالفعل",
-    "alreadySignedInMessage": "هذا الحساب مسجل الدخول بالفعل. المتابعة بهذا الحساب؟",
-    "continueWithAccount": "متابعة",
-    "currentAccount": "الحالي",
-    "or": "أو",
-    "viewAllAccounts": "عرض {{count}} المزيد",
     "createAccountLink": "جديد على Oxy؟ أنشئ حسابًا",
     "status": {
-      "accountSwitched": "استخدام {{name}} الآن",
       "signingIn": "جارٍ تسجيل الدخول…"
-    }
+    },
+    "subtitleToApp": "للمتابعة إلى {{app}}",
+    "orContinueWith": "أو تابع باستخدام",
+    "qr": {
+      "caption": "امسح باستخدام Commons لتسجيل الدخول",
+      "renew": "عرض رمز جديد"
+    },
+    "methods": {
+      "passkey": "تسجيل الدخول بمفتاح المرور"
+    },
+    "errors": {
+      "rateLimited": "محاولات كثيرة جدًا. حاول مرة أخرى بعد {{seconds}} ث.",
+      "passkeyCancelled": "تم إغلاق طلب مفتاح المرور. حاول مرة أخرى عندما تكون مستعدًا.",
+      "passkeyFailed": "تعذر إكمال مفتاح المرور. حاول مرة أخرى."
+    },
+    "chooser": {
+      "subtitleToApp": "للمتابعة إلى {{app}}"
+    },
+    "terms": {
+      "before": "بالمتابعة، أنت توافق على",
+      "termsLink": "شروط الخدمة",
+      "and": "و",
+      "privacyLink": "سياسة الخصوصية"
+    },
+    "noAccount": "ليس لديك حساب؟",
+    "createAccount": "إنشاء حساب",
+    "recoverLink": "فقدت مفتاح المرور؟ استرد حسابك"
   },
   "signup": {
     "title": "أنشئ حسابك",
@@ -55,56 +50,9 @@
     "createInCommons": "أنشئ هويتك في Commons",
     "createAccount": "إنشاء حساب",
     "backToSignInLink": "لديك حساب بالفعل؟ سجّل الدخول",
-    "welcome": {
-      "title": "مرحبًا بك في Oxy!",
-      "subtitle": "أنشئ حسابك في خطوات قليلة",
-      "haveAccount": "لديك حساب بالفعل؟",
-      "signInCta": "تسجيل الدخول"
-    },
-    "identity": {
-      "title": "من أنت؟",
-      "subtitle": "اختر اسم المستخدم وأدخل بريدك الإلكتروني"
-    },
-    "username": {
-      "helper": "3-30 حرفًا، أحرف وأرقام فقط",
-      "required": "يرجى إدخال اسم مستخدم",
-      "minLength": "يجب أن يكون اسم المستخدم 3 أحرف على الأقل"
-    },
-    "email": {
-      "required": "يرجى إدخال عنوان بريد إلكتروني",
-      "invalid": "يرجى إدخال عنوان بريد إلكتروني صالح",
-      "helper": "لن نشارك بريدك الإلكتروني أبدًا"
-    },
-    "security": {
-      "title": "أمّن حسابك",
-      "subtitle": "أنشئ كلمة مرور قوية لحماية حسابك"
-    },
-    "password": {
-      "helper": "8 أحرف على الأقل",
-      "required": "يرجى إدخال كلمة مرور",
-      "minLength": "يجب أن تكون كلمة المرور 8 أحرف على الأقل",
-      "confirmRequired": "يرجى تأكيد كلمة المرور",
-      "mismatch": "كلمات المرور غير متطابقة",
-      "confirmHint": "أعد إدخال كلمة المرور للتأكيد"
-    },
-    "summary": {
-      "title": "أوشكت على الانتهاء!",
-      "subtitle": "راجع معلوماتك وأنشئ حسابك",
-      "sectionTitle": "معلومات الحساب",
-      "fields": {
-        "username": "اسم المستخدم",
-        "email": "البريد الإلكتروني",
-        "password": "كلمة المرور"
-      },
-      "notSet": "غير محدد",
-      "securityTip": "لمزيد من الأمان، قم بتمكين المصادقة الحيوية من إعدادات الحساب بعد إنشاء حسابك.",
-      "legalReminder": "بإنشاء حساب، فإنك توافق على شروط الخدمة وسياسة الخصوصية الخاصة بنا."
-    }
+    "webSubtitle": "بلا كلمة مرور. ينشئ جهازك مفتاح مرور، ويحصل حسابك على عبارة استرداد تحتفظ بها أنت وحدك."
   },
   "accountSwitcher": {
-    "sections": {
-      "yourAccounts": "حساباتك"
-    },
     "loading": "جارٍ تحميل الحسابات...",
     "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
     "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
@@ -136,10 +84,7 @@
       "claimFailed": "تمت الموافقة على تسجيل الدخول، لكن تعذّر إكماله. يُرجى المحاولة مرة أخرى.",
       "generic": "تعذّر تسجيل الدخول. يُرجى المحاولة مرة أخرى."
     },
-    "linkOpenFailed": "تعذّر فتح الرابط. يُرجى المحاولة مرة أخرى.",
-    "continueWithPasskey": "متابعة",
-    "passkeyHint": "استخدم بصمتك أو وجهك أو رمز PIN للجهاز.",
-    "otherDeviceCommons": "حسابك على جهاز آخر؟ امسح الرمز باستخدام Commons"
+    "linkOpenFailed": "تعذّر فتح الرابط. يُرجى المحاولة مرة أخرى."
   },
   "common": {
     "actions": {