@oxy.so/core 7.8.1 → 7.9.0

package/dist/cjs/session/deviceComparisonCode.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceComparisonCode = deviceComparisonCode;
+/**
+ * The code a person compares between a device with no keyboard (a TV, a photo
+ * frame) and the phone approving its sign-in: `CE7F-B31F`.
+ *
+ * The device's QR carries the request's full `authorizeCode` (16 random bytes,
+ * hex), and that alone is what approves. Its first eight characters are
+ * enough to tell "the request on this screen" from any other: the server draws
+ * the code at random, so a look-alike request would take about four billion
+ * rate-limited attempts, while thirty-two characters were too many for anyone
+ * to compare. Both sides (`OxyDeviceSignIn` on the device and the approval
+ * page on the phone) derive it here, so they always print the same thing.
+ */
+const COMPARISON_LENGTH = 8;
+const GROUP_LENGTH = 4;
+function deviceComparisonCode(authorizeCode) {
+    const head = authorizeCode.slice(0, COMPARISON_LENGTH).toUpperCase();
+    return `${head.slice(0, GROUP_LENGTH)}-${head.slice(GROUP_LENGTH)}`;
+}

package/dist/cjs/session/index.js

@@ -8,7 +8,7 @@
  * the API with a token it already has never needs it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runColdBoot = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.DeviceManager = void 0;
+exports.runColdBoot = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.deviceComparisonCode = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.DeviceManager = void 0;
 // Session code reaches the identity key (identity-bound sessions), so the
 // crypto shim goes first — see `../crypto/polyfill`.
 require("../crypto/polyfill");
@@ -59,6 +59,8 @@ Object.defineProperty(exports, "resolveDeviceContext", { enumerable: true, get:
 var deviceSwitcherRows_1 = require("./deviceSwitcherRows");
 Object.defineProperty(exports, "buildSwitcherRows", { enumerable: true, get: function () { return deviceSwitcherRows_1.buildSwitcherRows; } });
 Object.defineProperty(exports, "showsPrincipalHeaders", { enumerable: true, get: function () { return deviceSwitcherRows_1.showsPrincipalHeaders; } });
+var deviceComparisonCode_1 = require("./deviceComparisonCode");
+Object.defineProperty(exports, "deviceComparisonCode", { enumerable: true, get: function () { return deviceComparisonCode_1.deviceComparisonCode; } });
 // The switch-target predicates over the account GRAPH — a list of accounts to
 // manage, not the device's list of identities to become (that is the directory
 // above). `isSwitchTargetAccount` is the structural half ("is this kind

package/dist/esm/session/deviceComparisonCode.js

@@ -0,0 +1,18 @@
+/**
+ * The code a person compares between a device with no keyboard (a TV, a photo
+ * frame) and the phone approving its sign-in: `CE7F-B31F`.
+ *
+ * The device's QR carries the request's full `authorizeCode` (16 random bytes,
+ * hex), and that alone is what approves. Its first eight characters are
+ * enough to tell "the request on this screen" from any other: the server draws
+ * the code at random, so a look-alike request would take about four billion
+ * rate-limited attempts, while thirty-two characters were too many for anyone
+ * to compare. Both sides (`OxyDeviceSignIn` on the device and the approval
+ * page on the phone) derive it here, so they always print the same thing.
+ */
+const COMPARISON_LENGTH = 8;
+const GROUP_LENGTH = 4;
+export function deviceComparisonCode(authorizeCode) {
+    const head = authorizeCode.slice(0, COMPARISON_LENGTH).toUpperCase();
+    return `${head.slice(0, GROUP_LENGTH)}-${head.slice(GROUP_LENGTH)}`;
+}

package/dist/esm/session/index.js

@@ -40,6 +40,7 @@ export { canActivateContext, directoryDisplayName, directoryHandle, projectDevic
 // auth.oxy.so chooser so the two cannot drift, the same reason the flat
 // projection lived here before it.
 export { buildSwitcherRows, showsPrincipalHeaders } from './deviceSwitcherRows.js';
+export { deviceComparisonCode } from './deviceComparisonCode.js';
 // The switch-target predicates over the account GRAPH — a list of accounts to
 // manage, not the device's list of identities to become (that is the directory
 // above). `isSwitchTargetAccount` is the structural half ("is this kind

package/dist/types/session/deviceComparisonCode.d.ts

@@ -0,0 +1 @@
+export declare function deviceComparisonCode(authorizeCode: string): string;

package/dist/types/session/index.d.ts

@@ -18,6 +18,7 @@ export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountId
 export { canActivateContext, directoryDisplayName, directoryHandle, projectDevicePrincipals, resolveActiveContext, resolveDeviceContext, } from './deviceDirectory';
 export type { DeviceContext, DeviceContextActor, DeviceContextSubject, DevicePrincipalGroup, } from './deviceDirectory';
 export { buildSwitcherRows, showsPrincipalHeaders } from './deviceSwitcherRows';
+export { deviceComparisonCode } from './deviceComparisonCode';
 export type { ResolveAvatarUrl, SwitcherContextRow, SwitcherPrincipalRow, } from './deviceSwitcherRows';
 export { isSwitchTargetAccount, canSwitchIntoAccount, } from './accountSwitchTargets';
 export { resolveAccountDelegationAccess } from './accountDelegationAccess';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.8.1",
+  "version": "7.9.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/session/deviceComparisonCode.ts

@@ -0,0 +1,19 @@
+/**
+ * The code a person compares between a device with no keyboard (a TV, a photo
+ * frame) and the phone approving its sign-in: `CE7F-B31F`.
+ *
+ * The device's QR carries the request's full `authorizeCode` (16 random bytes,
+ * hex), and that alone is what approves. Its first eight characters are
+ * enough to tell "the request on this screen" from any other: the server draws
+ * the code at random, so a look-alike request would take about four billion
+ * rate-limited attempts, while thirty-two characters were too many for anyone
+ * to compare. Both sides (`OxyDeviceSignIn` on the device and the approval
+ * page on the phone) derive it here, so they always print the same thing.
+ */
+const COMPARISON_LENGTH = 8;
+const GROUP_LENGTH = 4;
+
+export function deviceComparisonCode(authorizeCode: string): string {
+  const head = authorizeCode.slice(0, COMPARISON_LENGTH).toUpperCase();
+  return `${head.slice(0, GROUP_LENGTH)}-${head.slice(GROUP_LENGTH)}`;
+}

package/src/session/index.ts

@@ -75,6 +75,7 @@ export type {
 // auth.oxy.so chooser so the two cannot drift, the same reason the flat
 // projection lived here before it.
 export { buildSwitcherRows, showsPrincipalHeaders } from './deviceSwitcherRows';
+export { deviceComparisonCode } from './deviceComparisonCode';
 export type {
   ResolveAvatarUrl,
   SwitcherContextRow,