@oxy.so/core 1.12.1 → 1.16.0

package/dist/cjs/mixins/OxyServices.utility.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OxyAccountEventError = exports.OXY_ACCOUNT_DELETED_EVENT_URI = void 0;
 exports.OxyServicesUtilityMixin = OxyServicesUtilityMixin;
 /**
  * Utility Methods Mixin
@@ -10,6 +11,16 @@ const jwt_decode_1 = require("jwt-decode");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
 const oxyServiceEnvironment_1 = require("../utils/oxyServiceEnvironment");
+/** The SET `events` member Oxy uses for an account deletion. */
+exports.OXY_ACCOUNT_DELETED_EVENT_URI = 'https://oxy.so/events/account.deleted';
+/** Why an account event token was refused. `message` never contains the token. */
+class OxyAccountEventError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OxyAccountEventError';
+    }
+}
+exports.OxyAccountEventError = OxyAccountEventError;
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */
@@ -136,6 +147,135 @@ function OxyServicesUtilityMixin(Base) {
                 return null;
             }
         }
+        /**
+         * Verify an account event token from Oxy — the body of an account-event
+         * webhook, or an entry's `token` from `listAccountEvents` — and return the
+         * event. Throws {@link OxyAccountEventError} unless the token is an
+         * EdDSA-signed `secevent+jwt` from Oxy's published key set, issued by
+         * `oxy-auth`, addressed to this application, carrying exactly one known
+         * event. A service token (`typ: JWT`) is refused here, as this token is
+         * refused as a service token.
+         *
+         * Node only (it needs `node:crypto`). The caller must still be idempotent on
+         * `eventId`: Oxy delivers at least once, by push and by pull.
+         */
+        async verifyAccountEvent(token, options = {}) {
+            if (typeof token !== 'string' || token.length === 0 || token.length > 16 * 1024) {
+                throw new OxyAccountEventError('Account event token is missing or oversized');
+            }
+            const parts = token.split('.');
+            if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+                throw new OxyAccountEventError('Account event token is not a compact JWS');
+            }
+            const [headerB64, payloadB64, signatureB64] = parts;
+            let header;
+            let payload;
+            try {
+                header = parseJsonSegment(headerB64);
+                payload = parseJsonSegment(payloadB64);
+            }
+            catch {
+                throw new OxyAccountEventError('Account event token is malformed');
+            }
+            if (Object.keys(header).length !== 3
+                || header.alg !== 'EdDSA'
+                || header.typ !== 'secevent+jwt'
+                || typeof header.kid !== 'string'
+                || !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid)) {
+                throw new OxyAccountEventError('Account event token header is not supported');
+            }
+            const nodeCrypto = await (0, protocol_1.loadNodeCrypto)();
+            let jwk;
+            try {
+                jwk = await resolveServiceTokenPublicKey(header.kid, options.jwksUrl ?? new URL('/.well-known/jwks.json', this.getBaseURL()).toString(), this._serviceTokenJwksCache);
+            }
+            catch (error) {
+                throw new OxyAccountEventError(error instanceof Error ? error.message.replace('Service token', 'Account event') : 'Signing key is unavailable');
+            }
+            const signature = Buffer.from(signatureB64, 'base64url');
+            if (signature.toString('base64url') !== signatureB64 || signature.length !== 64) {
+                throw new OxyAccountEventError('Account event token signature is malformed');
+            }
+            let verified = false;
+            try {
+                const publicKey = nodeCrypto.createPublicKey({ key: jwk, format: 'jwk' });
+                verified = nodeCrypto.verify(null, Buffer.from(`${headerB64}.${payloadB64}`), publicKey, signature);
+            }
+            catch {
+                verified = false;
+            }
+            if (!verified)
+                throw new OxyAccountEventError('Account event token signature is invalid');
+            if (payload.iss !== OXY_JWT_ISSUER) {
+                throw new OxyAccountEventError('Account event token issuer is not Oxy');
+            }
+            const audience = options.audience ?? await this._configuredServiceAppId();
+            if (typeof payload.aud !== 'string' || payload.aud !== audience) {
+                throw new OxyAccountEventError('Account event token is addressed to another application');
+            }
+            if (typeof payload.jti !== 'string' || payload.jti.length === 0 || payload.jti.length > 128) {
+                throw new OxyAccountEventError('Account event token has no event id');
+            }
+            if (typeof payload.iat !== 'number' || !Number.isFinite(payload.iat)) {
+                throw new OxyAccountEventError('Account event token has no issue time');
+            }
+            const events = payload.events;
+            if (typeof events !== 'object' || events === null || Array.isArray(events)) {
+                throw new OxyAccountEventError('Account event token carries no events');
+            }
+            const entries = Object.entries(events);
+            const deleted = events[exports.OXY_ACCOUNT_DELETED_EVENT_URI];
+            if (entries.length !== 1 || typeof deleted !== 'object' || deleted === null || Array.isArray(deleted)) {
+                throw new OxyAccountEventError('Account event token carries an unknown event');
+            }
+            const body = deleted;
+            if (typeof body.userId !== 'string' || body.userId.length === 0 || body.userId.length > 128) {
+                throw new OxyAccountEventError('Account event names no account');
+            }
+            if (typeof body.occurredAt !== 'string' || Number.isNaN(Date.parse(body.occurredAt))) {
+                throw new OxyAccountEventError('Account event has no occurrence time');
+            }
+            if (body.username !== undefined && body.username !== null && typeof body.username !== 'string') {
+                throw new OxyAccountEventError('Account event username is malformed');
+            }
+            return {
+                eventId: payload.jti,
+                type: 'account.deleted',
+                userId: body.userId,
+                username: typeof body.username === 'string' ? body.username : null,
+                occurredAt: body.occurredAt,
+                retained: body.retained === true,
+                applicationId: payload.aud,
+                issuedAt: payload.iat,
+            };
+        }
+        /**
+         * One page of account events addressed to this application, oldest first,
+         * from Oxy's pull feed — the reconciliation path behind the webhook. Needs
+         * the service credential (`configureServiceAuth`). Verify each entry's
+         * `token` with {@link verifyAccountEvent} before acting on it.
+         */
+        async listAccountEvents(options = {}) {
+            const serviceToken = await this.getServiceToken();
+            const query = {};
+            if (options.after)
+                query.after = options.after;
+            if (options.limit !== undefined)
+                query.limit = String(options.limit);
+            return this.makeRequest('GET', '/account-events', query, {
+                cache: false,
+                headers: { Authorization: `Bearer ${serviceToken}` },
+            });
+        }
+        /** @internal The `appId` claim of this client's own service token. */
+        async _configuredServiceAppId() {
+            const serviceToken = await this.getServiceToken();
+            const appId = (0, jwt_decode_1.jwtDecode)(serviceToken).appId;
+            if (typeof appId !== 'string' || appId.length === 0) {
+                throw new OxyAccountEventError('No audience given and the service credential names no application');
+            }
+            return appId;
+        }
         /**
          * Express.js authentication middleware
          *

package/dist/cjs/server/securityHeaders.js

@@ -326,6 +326,20 @@ const MAX_INLINE_SCRIPT_HASHES = 8;
  * react-native-web's runtime stylesheet, and a style hash would silently switch
  * that off and render every Oxy web app unstyled.)
  */
+/** Passkeys for this origin itself; every other powerful feature off. */
+const SENSITIVE_PERMISSIONS_POLICY = [
+    'publickey-credentials-get=(self)',
+    'publickey-credentials-create=(self)',
+    'camera=()',
+    'microphone=()',
+    'geolocation=()',
+    'payment=()',
+    'usb=()',
+    'serial=()',
+    'hid=()',
+    'bluetooth=()',
+    'display-capture=()',
+].join(', ');
 function buildOxyPagesHeaders(options = {}) {
     const hashes = [
         ...new Set((options.html ?? []).flatMap(extractInlineScripts).map(inlineScriptCspHash)),
@@ -341,6 +355,8 @@ function buildOxyPagesHeaders(options = {}) {
         for (const name of ['script-src', 'connect-src']) {
             directives[name] = (directives[name] ?? []).filter((source) => !beacon.has(source));
         }
+        directives['base-uri'] = ["'none'"];
+        directives['form-action'] = ["'none'"];
     }
     const csp = formatOxyCspPolicy(directives);
     const lines = [
@@ -348,13 +364,15 @@ function buildOxyPagesHeaders(options = {}) {
         `  Content-Security-Policy: ${csp}`,
         '  X-Frame-Options: DENY',
         '  X-Content-Type-Options: nosniff',
-        '  Referrer-Policy: strict-origin-when-cross-origin',
+        `  Referrer-Policy: ${options.sensitive ? 'no-referrer' : 'strict-origin-when-cross-origin'}`,
     ];
     if (options.hsts !== false) {
         lines.push('  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
     }
     if (options.sensitive) {
         lines.push('  Cache-Control: public, max-age=0, must-revalidate, no-transform');
+        lines.push(`  Permissions-Policy: ${SENSITIVE_PERMISSIONS_POLICY}`);
+        lines.push('  Cross-Origin-Resource-Policy: same-origin');
     }
     lines.push('');
     return lines.join('\n');

package/dist/cjs/session/accountDialogController.js

@@ -37,12 +37,6 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
- *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
- *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
- *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
- *     session `showQr` creates, and complete it via the SAME poll/socket/claim
- *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
- *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -62,7 +56,6 @@ exports.backViewOf = backViewOf;
 exports.createAccountDialogController = createAccountDialogController;
 const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
-const authWebUrl_1 = require("../utils/authWebUrl");
 const socketLoader_1 = require("./socketLoader");
 const deviceDirectory_1 = require("./deviceDirectory");
 const commonsDelivery_1 = require("../utils/commonsDelivery");
@@ -130,8 +123,8 @@ const IDLE_SIGN_IN_FACTS = {
  */
 const COMPLETED_SIGN_IN_FACTS = { ...IDLE_SIGN_IN_FACTS, phase: 'completed' };
 /** The full flow state for `facts`, stamped with the attempt it belongs to. */
-function buildSignIn(facts, attempt) {
-    return { ...facts, progress: deriveSignInProgress(facts), attempt };
+function buildSignIn(facts, attempt, inline) {
+    return { ...facts, progress: deriveSignInProgress(facts), attempt, inline };
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -163,7 +156,7 @@ class AccountDialogController {
          * alongside the three flags above.
          */
         this.exclusiveMutationInFlight = false;
-        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0);
+        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0, false);
         this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
         /**
@@ -192,10 +185,6 @@ class AccountDialogController {
          * ABANDONED request never blocks the next request's first poll.
          */
         this.pollInFlightToken = null;
-        /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
-        this.activePopup = null;
-        /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
-        this.popupWatchTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
         this.unsubscribeTokens = null;
@@ -212,8 +201,6 @@ class AccountDialogController {
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
-        this.openPopup = options.openPopup;
-        this.identityOrigin = options.identityOrigin ?? options.hubBaseUrl ?? authWebUrl_1.IDENTITY_WEB_ORIGIN;
         this.platform = options.platform ?? 'unknown';
         this.snapshot = this.computeSnapshot();
     }
@@ -291,7 +278,6 @@ class AccountDialogController {
         }
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.listeners.clear();
     }
@@ -356,12 +342,12 @@ class AccountDialogController {
         if (this.view === view)
             return;
         this.view = view;
-        // A `'completed'` flow owns no timers, socket, popup, or token — it is only
+        // A `'completed'` flow owns no timers, socket, or token — it is only
         // the terminal "Identity confirmed" the finished surface showed. Moving to
         // another view is a NEW intention, so drop it; otherwise a later `add()`
         // would open on the previous sign-in's terminal state.
         if (this.signIn.phase === 'completed') {
-            this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(IDLE_SIGN_IN_FACTS);
         }
         this.emit();
     }
@@ -678,82 +664,33 @@ class AccountDialogController {
         await this.startDeviceFlowSession(attempt, { deliver: true });
     }
     /**
-     * Start a NEW attempt the same way the last one was started — "Try again"
-     * repeats the user's choice rather than silently switching method. A failed
-     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
-     * retries that; an explicit QR request shows the QR.
+     * The sign-in entry's EMBEDDED QR: a request whose only route is the QR,
+     * started without leaving the current view.
      *
-     * Call it straight from the press handler: the hub route opens its popup
-     * synchronously, before this method's first `await`, so the browser still
-     * attributes it to the click.
+     * Unlike {@link showQr} it runs no delivery selection. The surface starts it
+     * by itself, on mount, so it must not push to the person's phone or open
+     * Commons — nobody asked for either. Any other sign-in the person then
+     * chooses supersedes it (and withdraws its request) like any new attempt.
+     */
+    async startInlineQr() {
+        const attempt = this.beginSignInAttempt('inline-qr');
+        await this.startDeviceFlowSession(attempt, { deliver: false });
+    }
+    /**
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method: a failed
+     * "Sign in with Oxy" retries that; an explicit QR request shows the QR.
      */
     retrySignIn() {
         switch (this.signInMethod) {
-            case 'passkey-hub':
-                return this.startPasskeyHubSignIn();
             case 'qr':
                 return this.showQr();
+            case 'inline-qr':
+                return this.startInlineQr();
             default:
                 return this.signInWithOxy();
         }
     }
-    /**
-     * Web-only: sign in (or create an account) with a passkey at the web identity
-     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
-     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
-     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
-     * and only the identity origin may unseal or create the account's identity
-     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
-     * scoped to the SAME device-flow
-     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
-     * pair), and let the SAME poll/socket/claim engine complete it once the hub
-     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
-     * bearer-authed, server-side — this method never sees or transmits the
-     * secret `sessionToken`).
-     *
-     * The popup MUST be opened synchronously, before any `await`, or the
-     * browser's popup blocker loses the click-gesture attribution and silently
-     * blocks it — so {@link openPopup} is invoked as the very first step, before
-     * the device-flow session (which needs an async call) even exists. If the
-     * popup is blocked (or no `openPopup` was injected), this falls back to
-     * `showQr`'s plain QR rendering — no dead end.
-     */
-    async startPasskeyHubSignIn() {
-        const attempt = this.beginSignInAttempt('passkey-hub');
-        this.setView('qr');
-        const popup = this.openPopup?.() ?? null;
-        if (!popup) {
-            await this.startDeviceFlowSession(attempt, { deliver: true });
-            return;
-        }
-        // Owned by the attempt from the moment it exists, so cancelling while the
-        // session is still being created closes it instead of leaving a blank
-        // window behind.
-        this.activePopup = popup;
-        // The hub popup IS the primary surface here, chosen explicitly by the user —
-        // so this flow does NOT run automatic Commons delivery (ringing the user's
-        // phone because they asked for a passkey would be exactly the "menu of
-        // methods" the one-primary-action rule forbids). The underlying request is
-        // the same `AuthSession`, and its Commons route stays the QR the view
-        // renders beneath the popup.
-        const handle = await this.startDeviceFlowSession(attempt, { deliver: false });
-        // `null` means the attempt failed (its teardown closed the popup) or was
-        // abandoned (the cancel closed it).
-        if (!handle)
-            return;
-        // The user may have closed the popup during the async session creation
-        // above, before any watcher was attached to catch it — guard rather than
-        // navigate a dead window (browsers vary on whether that throws).
-        if (popup.closed) {
-            const pendingCode = this.signIn.authorizeCode;
-            this.failSignIn('cancelled', 'Sign-in was cancelled.');
-            if (pendingCode)
-                void this.withdrawRequest(pendingCode);
-            return;
-        }
-        popup.location.href = `${this.identityOrigin}/continue?code=${encodeURIComponent(handle.authorizeCode)}`;
-        this.watchPopup(popup);
-    }
     /**
      * End whatever attempt is running (withdrawing its request) and begin a new
      * one. Returns the new attempt's identity for the caller to re-check after
@@ -769,9 +706,9 @@ class AccountDialogController {
         return attempt === this.signInAttempt;
     }
     /**
-     * Shared device-flow session creation for both {@link showQr} (renders the
-     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
-     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * Shared device-flow session creation for {@link signInWithOxy},
+     * {@link showQr} and {@link startInlineQr} — the same `startCommonsSignIn` →
+     * poll/socket wiring every time. Returns the
      * handle on success (already reflected in `signIn`), or `null` when the
      * attempt failed (already set as `signIn.failure`) or was abandoned while the
      * request was being created.
@@ -782,8 +719,8 @@ class AccountDialogController {
      *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
-     *   entry; `false` when the caller already owns the primary surface (the
-     *   passkey hub popup), where the request's Commons route is simply the QR.
+     *   entry; `false` for the embedded QR, which the screen starts by itself,
+     *   where the request's Commons route is simply the QR.
      */
     async startDeviceFlowSession(attempt, opts) {
         if (!this.isCurrentAttempt(attempt))
@@ -826,9 +763,9 @@ class AccountDialogController {
         void this.openAuthSessionSocket(handle.sessionToken);
         this.scheduleNextPoll(handle.sessionToken);
         if (opts.deliver) {
-            // Non-blocking on purpose: the QR/authorizeCode are already renderable
-            // and the popup caller can navigate immediately, while the route (a
-            // local probe plus at most one delivery round-trip) resolves behind it.
+            // Non-blocking on purpose: the QR/authorizeCode are already renderable,
+            // while the route (a local probe plus at most one delivery round-trip)
+            // resolves behind it.
             void this.resolveDeliveryRoute(handle);
         }
         return handle;
@@ -932,49 +869,6 @@ class AccountDialogController {
             return false;
         }
     }
-    /**
-     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
-     * popup without completing sign-in gets prompt feedback (there is no DOM
-     * event for a cross-origin popup closing — polling is the only mechanism).
-     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
-     * calls.
-     */
-    watchPopup(popup) {
-        this.clearPopupWatchTimer();
-        this.popupWatchTimer = setInterval(() => {
-            if (!popup.closed)
-                return;
-            this.clearPopupWatchTimer();
-            if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
-                // Closing the surface cancels the REQUEST too, not just this listener.
-                const pendingCode = this.signIn.authorizeCode;
-                this.failSignIn('cancelled', 'Sign-in was cancelled.');
-                if (pendingCode) {
-                    void this.withdrawRequest(pendingCode);
-                }
-            }
-        }, 1000);
-    }
-    clearPopupWatchTimer() {
-        if (this.popupWatchTimer !== null) {
-            clearInterval(this.popupWatchTimer);
-            this.popupWatchTimer = null;
-        }
-    }
-    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
-    closeActivePopup() {
-        this.clearPopupWatchTimer();
-        const popup = this.activePopup;
-        this.activePopup = null;
-        if (!popup || popup.closed)
-            return;
-        try {
-            popup.close();
-        }
-        catch (error) {
-            logger_1.logger.debug('[AccountDialogController] popup close failed', { component: 'AccountDialogController' }, error);
-        }
-    }
     /**
      * Resolve whether Commons is installed on this device via the injected
      * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
@@ -1004,7 +898,7 @@ class AccountDialogController {
         this.emit();
     }
     /**
-     * Tear down the active sign-in device flow (timers + socket + popup + token),
+     * Tear down the active sign-in device flow (timers + socket + token),
      * WITHDRAW the request server-side, and reset to idle.
      *
      * Cancellation has to converge in both directions: the surface closing must
@@ -1027,7 +921,6 @@ class AccountDialogController {
             : null;
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         if (this.signIn.phase !== 'idle') {
             this.setSignIn(IDLE_SIGN_IN_FACTS);
@@ -1226,10 +1119,9 @@ class AccountDialogController {
             this.signInToken = null;
             this.clearPollTimer();
             this.closeAuthSessionSocket();
-            this.closeActivePopup();
             // Terminal SUCCESS, not idle: the surface gets one honest frame to show
             // "Identity confirmed" before it closes. Cleared on the next view change.
-            this.signIn = buildSignIn(COMPLETED_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(COMPLETED_SIGN_IN_FACTS);
             this.view = 'accounts';
             this.emit();
         }
@@ -1256,7 +1148,6 @@ class AccountDialogController {
     failSignIn(failure, message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: message, failure });
     }
@@ -1348,9 +1239,13 @@ class AccountDialogController {
      * to advance without a fact behind it.
      */
     setSignIn(facts) {
-        this.signIn = buildSignIn(facts, this.signInAttempt);
+        this.signIn = this.stampSignIn(facts);
         this.emit();
     }
+    /** `facts` as the current attempt's state. */
+    stampSignIn(facts) {
+        return buildSignIn(facts, this.signInAttempt, this.signInMethod === 'inline-qr');
+    }
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     patchSignIn(patch) {
         const { phase, authorizeCode, qrPayload, expiresAt, error, failure, route, routeFailed, pushSentAt, openedAt, } = this.signIn;

package/dist/cjs/utils/authWebUrl.js

@@ -10,7 +10,7 @@
  * past the SSO/FedCM teardown.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
+exports.AUTH_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
  * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
@@ -18,9 +18,10 @@ exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
  */
 exports.CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The web identity carrier's origin — where a person signs in or creates an
- * account with a passkey, and where their self-custody identity is kept sealed
- * under that passkey (one identity, two carriers). Apps open it; they never
- * handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface AND the
+ * web identity carrier: where a person signs in or creates an account with a
+ * passkey from another origin's popup, and the one origin that may create,
+ * open, recover or move their self-custody identity (one identity, two
+ * carriers). Apps open it; they never handle the identity themselves.
  */
-exports.IDENTITY_WEB_ORIGIN = `https://id.${exports.CENTRAL_IDP_APEX}`;
+exports.AUTH_WEB_ORIGIN = `https://auth.${exports.CENTRAL_IDP_APEX}`;

package/dist/cjs/utils/oauthPkce.js

@@ -29,10 +29,11 @@ exports.consumeOAuthReturnPath = consumeOAuthReturnPath;
 exports.persistOAuthHandshake = persistOAuthHandshake;
 exports.readOAuthHandshake = readOAuthHandshake;
 exports.clearOAuthHandshake = clearOAuthHandshake;
+const authWebUrl_1 = require("./authWebUrl");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
 /** The central Oxy IdP authorization endpoint used by default. */
-exports.OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';
+exports.OXY_AUTHORIZE_URL = `${authWebUrl_1.AUTH_WEB_ORIGIN}/authorize`;
 /** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
 exports.DEFAULT_OAUTH_SCOPE = 'openid profile';
 /**
@@ -151,6 +152,9 @@ function buildOAuthAuthorizeUrl(params) {
     if (params.responseMode) {
         url.searchParams.set('response_mode', params.responseMode);
     }
+    if (params.screen) {
+        url.searchParams.set('screen', params.screen);
+    }
     return url.toString();
 }
 /** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */