@oxy.so/core 1.13.0 → 1.16.0

package/dist/cjs/session/accountDialogController.js

@@ -37,12 +37,6 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
- *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
- *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
- *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
- *     session `showQr` creates, and complete it via the SAME poll/socket/claim
- *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
- *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -62,7 +56,6 @@ exports.backViewOf = backViewOf;
 exports.createAccountDialogController = createAccountDialogController;
 const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
-const authWebUrl_1 = require("../utils/authWebUrl");
 const socketLoader_1 = require("./socketLoader");
 const deviceDirectory_1 = require("./deviceDirectory");
 const commonsDelivery_1 = require("../utils/commonsDelivery");
@@ -130,8 +123,8 @@ const IDLE_SIGN_IN_FACTS = {
  */
 const COMPLETED_SIGN_IN_FACTS = { ...IDLE_SIGN_IN_FACTS, phase: 'completed' };
 /** The full flow state for `facts`, stamped with the attempt it belongs to. */
-function buildSignIn(facts, attempt) {
-    return { ...facts, progress: deriveSignInProgress(facts), attempt };
+function buildSignIn(facts, attempt, inline) {
+    return { ...facts, progress: deriveSignInProgress(facts), attempt, inline };
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -163,7 +156,7 @@ class AccountDialogController {
          * alongside the three flags above.
          */
         this.exclusiveMutationInFlight = false;
-        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0);
+        this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, 0, false);
         this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
         /**
@@ -192,10 +185,6 @@ class AccountDialogController {
          * ABANDONED request never blocks the next request's first poll.
          */
         this.pollInFlightToken = null;
-        /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
-        this.activePopup = null;
-        /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
-        this.popupWatchTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
         this.unsubscribeTokens = null;
@@ -212,8 +201,6 @@ class AccountDialogController {
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
-        this.openPopup = options.openPopup;
-        this.identityOrigin = options.identityOrigin ?? options.hubBaseUrl ?? authWebUrl_1.IDENTITY_WEB_ORIGIN;
         this.platform = options.platform ?? 'unknown';
         this.snapshot = this.computeSnapshot();
     }
@@ -291,7 +278,6 @@ class AccountDialogController {
         }
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.listeners.clear();
     }
@@ -356,12 +342,12 @@ class AccountDialogController {
         if (this.view === view)
             return;
         this.view = view;
-        // A `'completed'` flow owns no timers, socket, popup, or token — it is only
+        // A `'completed'` flow owns no timers, socket, or token — it is only
         // the terminal "Identity confirmed" the finished surface showed. Moving to
         // another view is a NEW intention, so drop it; otherwise a later `add()`
         // would open on the previous sign-in's terminal state.
         if (this.signIn.phase === 'completed') {
-            this.signIn = buildSignIn(IDLE_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(IDLE_SIGN_IN_FACTS);
         }
         this.emit();
     }
@@ -678,82 +664,33 @@ class AccountDialogController {
         await this.startDeviceFlowSession(attempt, { deliver: true });
     }
     /**
-     * Start a NEW attempt the same way the last one was started — "Try again"
-     * repeats the user's choice rather than silently switching method. A failed
-     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
-     * retries that; an explicit QR request shows the QR.
+     * The sign-in entry's EMBEDDED QR: a request whose only route is the QR,
+     * started without leaving the current view.
      *
-     * Call it straight from the press handler: the hub route opens its popup
-     * synchronously, before this method's first `await`, so the browser still
-     * attributes it to the click.
+     * Unlike {@link showQr} it runs no delivery selection. The surface starts it
+     * by itself, on mount, so it must not push to the person's phone or open
+     * Commons — nobody asked for either. Any other sign-in the person then
+     * chooses supersedes it (and withdraws its request) like any new attempt.
+     */
+    async startInlineQr() {
+        const attempt = this.beginSignInAttempt('inline-qr');
+        await this.startDeviceFlowSession(attempt, { deliver: false });
+    }
+    /**
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method: a failed
+     * "Sign in with Oxy" retries that; an explicit QR request shows the QR.
      */
     retrySignIn() {
         switch (this.signInMethod) {
-            case 'passkey-hub':
-                return this.startPasskeyHubSignIn();
             case 'qr':
                 return this.showQr();
+            case 'inline-qr':
+                return this.startInlineQr();
             default:
                 return this.signInWithOxy();
         }
     }
-    /**
-     * Web-only: sign in (or create an account) with a passkey at the web identity
-     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
-     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
-     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
-     * and only the identity origin may unseal or create the account's identity
-     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
-     * scoped to the SAME device-flow
-     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
-     * pair), and let the SAME poll/socket/claim engine complete it once the hub
-     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
-     * bearer-authed, server-side — this method never sees or transmits the
-     * secret `sessionToken`).
-     *
-     * The popup MUST be opened synchronously, before any `await`, or the
-     * browser's popup blocker loses the click-gesture attribution and silently
-     * blocks it — so {@link openPopup} is invoked as the very first step, before
-     * the device-flow session (which needs an async call) even exists. If the
-     * popup is blocked (or no `openPopup` was injected), this falls back to
-     * `showQr`'s plain QR rendering — no dead end.
-     */
-    async startPasskeyHubSignIn() {
-        const attempt = this.beginSignInAttempt('passkey-hub');
-        this.setView('qr');
-        const popup = this.openPopup?.() ?? null;
-        if (!popup) {
-            await this.startDeviceFlowSession(attempt, { deliver: true });
-            return;
-        }
-        // Owned by the attempt from the moment it exists, so cancelling while the
-        // session is still being created closes it instead of leaving a blank
-        // window behind.
-        this.activePopup = popup;
-        // The hub popup IS the primary surface here, chosen explicitly by the user —
-        // so this flow does NOT run automatic Commons delivery (ringing the user's
-        // phone because they asked for a passkey would be exactly the "menu of
-        // methods" the one-primary-action rule forbids). The underlying request is
-        // the same `AuthSession`, and its Commons route stays the QR the view
-        // renders beneath the popup.
-        const handle = await this.startDeviceFlowSession(attempt, { deliver: false });
-        // `null` means the attempt failed (its teardown closed the popup) or was
-        // abandoned (the cancel closed it).
-        if (!handle)
-            return;
-        // The user may have closed the popup during the async session creation
-        // above, before any watcher was attached to catch it — guard rather than
-        // navigate a dead window (browsers vary on whether that throws).
-        if (popup.closed) {
-            const pendingCode = this.signIn.authorizeCode;
-            this.failSignIn('cancelled', 'Sign-in was cancelled.');
-            if (pendingCode)
-                void this.withdrawRequest(pendingCode);
-            return;
-        }
-        popup.location.href = `${this.identityOrigin}/continue?code=${encodeURIComponent(handle.authorizeCode)}`;
-        this.watchPopup(popup);
-    }
     /**
      * End whatever attempt is running (withdrawing its request) and begin a new
      * one. Returns the new attempt's identity for the caller to re-check after
@@ -769,9 +706,9 @@ class AccountDialogController {
         return attempt === this.signInAttempt;
     }
     /**
-     * Shared device-flow session creation for both {@link showQr} (renders the
-     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
-     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * Shared device-flow session creation for {@link signInWithOxy},
+     * {@link showQr} and {@link startInlineQr} — the same `startCommonsSignIn` →
+     * poll/socket wiring every time. Returns the
      * handle on success (already reflected in `signIn`), or `null` when the
      * attempt failed (already set as `signIn.failure`) or was abandoned while the
      * request was being created.
@@ -782,8 +719,8 @@ class AccountDialogController {
      *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
-     *   entry; `false` when the caller already owns the primary surface (the
-     *   passkey hub popup), where the request's Commons route is simply the QR.
+     *   entry; `false` for the embedded QR, which the screen starts by itself,
+     *   where the request's Commons route is simply the QR.
      */
     async startDeviceFlowSession(attempt, opts) {
         if (!this.isCurrentAttempt(attempt))
@@ -826,9 +763,9 @@ class AccountDialogController {
         void this.openAuthSessionSocket(handle.sessionToken);
         this.scheduleNextPoll(handle.sessionToken);
         if (opts.deliver) {
-            // Non-blocking on purpose: the QR/authorizeCode are already renderable
-            // and the popup caller can navigate immediately, while the route (a
-            // local probe plus at most one delivery round-trip) resolves behind it.
+            // Non-blocking on purpose: the QR/authorizeCode are already renderable,
+            // while the route (a local probe plus at most one delivery round-trip)
+            // resolves behind it.
             void this.resolveDeliveryRoute(handle);
         }
         return handle;
@@ -932,49 +869,6 @@ class AccountDialogController {
             return false;
         }
     }
-    /**
-     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
-     * popup without completing sign-in gets prompt feedback (there is no DOM
-     * event for a cross-origin popup closing — polling is the only mechanism).
-     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
-     * calls.
-     */
-    watchPopup(popup) {
-        this.clearPopupWatchTimer();
-        this.popupWatchTimer = setInterval(() => {
-            if (!popup.closed)
-                return;
-            this.clearPopupWatchTimer();
-            if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
-                // Closing the surface cancels the REQUEST too, not just this listener.
-                const pendingCode = this.signIn.authorizeCode;
-                this.failSignIn('cancelled', 'Sign-in was cancelled.');
-                if (pendingCode) {
-                    void this.withdrawRequest(pendingCode);
-                }
-            }
-        }, 1000);
-    }
-    clearPopupWatchTimer() {
-        if (this.popupWatchTimer !== null) {
-            clearInterval(this.popupWatchTimer);
-            this.popupWatchTimer = null;
-        }
-    }
-    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
-    closeActivePopup() {
-        this.clearPopupWatchTimer();
-        const popup = this.activePopup;
-        this.activePopup = null;
-        if (!popup || popup.closed)
-            return;
-        try {
-            popup.close();
-        }
-        catch (error) {
-            logger_1.logger.debug('[AccountDialogController] popup close failed', { component: 'AccountDialogController' }, error);
-        }
-    }
     /**
      * Resolve whether Commons is installed on this device via the injected
      * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
@@ -1004,7 +898,7 @@ class AccountDialogController {
         this.emit();
     }
     /**
-     * Tear down the active sign-in device flow (timers + socket + popup + token),
+     * Tear down the active sign-in device flow (timers + socket + token),
      * WITHDRAW the request server-side, and reset to idle.
      *
      * Cancellation has to converge in both directions: the surface closing must
@@ -1027,7 +921,6 @@ class AccountDialogController {
             : null;
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         if (this.signIn.phase !== 'idle') {
             this.setSignIn(IDLE_SIGN_IN_FACTS);
@@ -1226,10 +1119,9 @@ class AccountDialogController {
             this.signInToken = null;
             this.clearPollTimer();
             this.closeAuthSessionSocket();
-            this.closeActivePopup();
             // Terminal SUCCESS, not idle: the surface gets one honest frame to show
             // "Identity confirmed" before it closes. Cleared on the next view change.
-            this.signIn = buildSignIn(COMPLETED_SIGN_IN_FACTS, this.signInAttempt);
+            this.signIn = this.stampSignIn(COMPLETED_SIGN_IN_FACTS);
             this.view = 'accounts';
             this.emit();
         }
@@ -1256,7 +1148,6 @@ class AccountDialogController {
     failSignIn(failure, message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
-        this.closeActivePopup();
         this.signInToken = null;
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'error', error: message, failure });
     }
@@ -1348,9 +1239,13 @@ class AccountDialogController {
      * to advance without a fact behind it.
      */
     setSignIn(facts) {
-        this.signIn = buildSignIn(facts, this.signInAttempt);
+        this.signIn = this.stampSignIn(facts);
         this.emit();
     }
+    /** `facts` as the current attempt's state. */
+    stampSignIn(facts) {
+        return buildSignIn(facts, this.signInAttempt, this.signInMethod === 'inline-qr');
+    }
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     patchSignIn(patch) {
         const { phase, authorizeCode, qrPayload, expiresAt, error, failure, route, routeFailed, pushSentAt, openedAt, } = this.signIn;

package/dist/cjs/utils/authWebUrl.js

@@ -10,7 +10,7 @@
  * past the SSO/FedCM teardown.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
+exports.AUTH_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
  * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
@@ -18,9 +18,10 @@ exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
  */
 exports.CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The web identity carrier's origin — where a person signs in or creates an
- * account with a passkey, and where their self-custody identity is kept sealed
- * under that passkey (one identity, two carriers). Apps open it; they never
- * handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface AND the
+ * web identity carrier: where a person signs in or creates an account with a
+ * passkey from another origin's popup, and the one origin that may create,
+ * open, recover or move their self-custody identity (one identity, two
+ * carriers). Apps open it; they never handle the identity themselves.
  */
-exports.IDENTITY_WEB_ORIGIN = `https://id.${exports.CENTRAL_IDP_APEX}`;
+exports.AUTH_WEB_ORIGIN = `https://auth.${exports.CENTRAL_IDP_APEX}`;

package/dist/cjs/utils/oauthPkce.js

@@ -29,10 +29,11 @@ exports.consumeOAuthReturnPath = consumeOAuthReturnPath;
 exports.persistOAuthHandshake = persistOAuthHandshake;
 exports.readOAuthHandshake = readOAuthHandshake;
 exports.clearOAuthHandshake = clearOAuthHandshake;
+const authWebUrl_1 = require("./authWebUrl");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
 /** The central Oxy IdP authorization endpoint used by default. */
-exports.OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';
+exports.OXY_AUTHORIZE_URL = `${authWebUrl_1.AUTH_WEB_ORIGIN}/authorize`;
 /** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
 exports.DEFAULT_OAUTH_SCOPE = 'openid profile';
 /**
@@ -151,6 +152,9 @@ function buildOAuthAuthorizeUrl(params) {
     if (params.responseMode) {
         url.searchParams.set('response_mode', params.responseMode);
     }
+    if (params.screen) {
+        url.searchParams.set('screen', params.screen);
+    }
     return url.toString();
 }
 /** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */