@oxy.so/services 1.0.0

package/lib/commonjs/ui/oauth/browserAuthTransport.js

@@ -0,0 +1,170 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.startWebOAuthSignIn = startWebOAuthSignIn;
+var _core = require("@oxy.so/core");
+var _oauthNavigation = require("../components/oauthNavigation.js");
+var _isWebBrowser = require("../utils/isWebBrowser.js");
+var _completeOAuthCode = require("./completeOAuthCode.js");
+var _oauthHandshake = require("./oauthHandshake.js");
+var _oauthPopup = require("./oauthPopup.js");
+/**
+ * The single web entry point for third-party "Sign in with Oxy".
+ *
+ * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
+ * result — so callers (`OxySignInButton`, and any RP with its own button) never
+ * touch `window.open`, `postMessage`, or the token exchange themselves.
+ *
+ * Popup mode keeps the relying party mounted: its route, scroll position, and
+ * unsaved state survive because the tab never navigates. Redirect mode is the
+ * compatibility fallback, and is also where popup mode lands when the browser
+ * blocks the window — a blocked popup must still sign the user in, not dead-end.
+ *
+ * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
+ * remains the native lane and is untouched by this module.
+ */
+
+/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
+
+/** Per-press inputs for {@link startWebOAuthSignIn}. */
+
+async function startWebOAuthSignIn(context, options) {
+  if (!(0, _isWebBrowser.isWebBrowser)()) {
+    (0, _oauthPopup.closeOAuthPopup)(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'no-browser'
+    };
+  }
+  if (context.identityBound) {
+    (0, _oauthPopup.closeOAuthPopup)(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'identity-bound'
+    };
+  }
+  if (!context.clientId) {
+    (0, _oauthPopup.closeOAuthPopup)(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'missing-client-id'
+    };
+  }
+
+  // Claim the window BEFORE the first `await` below, so a caller that invoked us
+  // straight from the click still has gesture attribution. An explicit `null`
+  // means the caller already tried and was blocked.
+  const popup = context.mode === 'popup' && options.popup === undefined ? (0, _oauthPopup.openOAuthPopup)() : options.popup ?? null;
+  if (context.mode === 'redirect') {
+    (0, _oauthPopup.closeOAuthPopup)(popup);
+    return startRedirectSignIn(context, options, 'redirect-mode');
+  }
+  if (!popup) {
+    _core.logger.warn('OAuth sign-in popup was blocked; falling back to a full-page redirect', {
+      component: 'browserAuthTransport'
+    });
+    return startRedirectSignIn(context, options, 'popup-blocked');
+  }
+  try {
+    const prepared = await (0, _oauthHandshake.prepareAuthorizeRequest)({
+      clientId: context.clientId,
+      redirectUri: options.redirectUri,
+      authorizeBaseUrl: context.authorizeBaseUrl,
+      scope: options.scope,
+      responseMode: 'web_message'
+    });
+    if (!(0, _oauthPopup.navigateOAuthPopup)(popup, prepared.authorizeUrl)) {
+      return startRedirectSignIn(context, options, 'popup-navigation-failed');
+    }
+    const outcome = await (0, _oauthPopup.awaitOAuthPopupResult)({
+      popup,
+      expectedOrigin: prepared.authorizeOrigin,
+      expectedState: prepared.handshake.state,
+      redirectUri: options.redirectUri,
+      ...(options.timeoutMs !== undefined ? {
+        timeoutMs: options.timeoutMs
+      } : {})
+    });
+    switch (outcome.kind) {
+      case 'code':
+        {
+          const completion = await (0, _completeOAuthCode.completeOAuthCode)({
+            oxyServices: context.oxyServices,
+            clientId: context.clientId,
+            code: outcome.code,
+            returnedState: outcome.state,
+            handshake: prepared.handshake,
+            redirectUri: options.redirectUri,
+            commitSession: context.commitSession
+          });
+          return completion.ok ? {
+            status: 'signed-in'
+          } : {
+            status: 'failed',
+            reason: completion.reason
+          };
+        }
+      case 'oauth-error':
+        return {
+          status: 'failed',
+          reason: 'idp-error',
+          description: outcome.errorDescription ?? outcome.error
+        };
+      case 'state-mismatch':
+        return {
+          status: 'failed',
+          reason: 'state-mismatch'
+        };
+      case 'closed':
+        return {
+          status: 'cancelled'
+        };
+      case 'timed-out':
+        return {
+          status: 'timed-out'
+        };
+      case 'unsupported':
+        return {
+          status: 'unsupported',
+          reason: 'no-browser'
+        };
+    }
+  } finally {
+    // Covers throws after open (prepare/exchange/commit) and every settled outcome.
+    (0, _oauthPopup.closeOAuthPopup)(popup);
+  }
+}
+
+/**
+ * Full-page hand-off to the IdP. The document is destroyed by the navigation, so
+ * the handshake MUST reach `sessionStorage` first — without it the return trip
+ * cannot validate `state`, and starting the redirect anyway would strand the
+ * user at a callback that can only refuse them.
+ */
+async function startRedirectSignIn(context, options, via) {
+  // Narrowed by the caller; repeated here so this helper is safe on its own.
+  if (!context.clientId) return {
+    status: 'unsupported',
+    reason: 'missing-client-id'
+  };
+  const prepared = await (0, _oauthHandshake.prepareAuthorizeRequest)({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope
+  });
+  if (!(0, _core.persistOAuthHandshake)(prepared.handshake.state, prepared.handshake.codeVerifier, options.redirectUri)) {
+    return {
+      status: 'failed',
+      reason: 'handshake-storage'
+    };
+  }
+  (0, _oauthNavigation.redirectToAuthorize)(prepared.authorizeUrl);
+  return {
+    status: 'redirecting',
+    via
+  };
+}
+//# sourceMappingURL=browserAuthTransport.js.map

package/lib/commonjs/ui/oauth/browserAuthTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","_oauthNavigation","_isWebBrowser","_completeOAuthCode","_oauthHandshake","_oauthPopup","startWebOAuthSignIn","context","options","isWebBrowser","closeOAuthPopup","popup","status","reason","identityBound","clientId","mode","undefined","openOAuthPopup","startRedirectSignIn","logger","warn","component","prepared","prepareAuthorizeRequest","redirectUri","authorizeBaseUrl","scope","responseMode","navigateOAuthPopup","authorizeUrl","outcome","awaitOAuthPopupResult","expectedOrigin","authorizeOrigin","expectedState","handshake","state","timeoutMs","kind","completion","completeOAuthCode","oxyServices","code","returnedState","commitSession","ok","description","errorDescription","error","via","persistOAuthHandshake","codeVerifier","redirectToAuthorize"],"sourceRoot":"../../../../src","sources":["ui/oauth/browserAuthTransport.ts"],"mappings":";;;;;;AAgBA,IAAAA,KAAA,GAAAC,OAAA;AAEA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,kBAAA,GAAAH,OAAA;AACA,IAAAI,eAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AAtBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAiBA;;AAeA;;AAwBO,eAAeM,mBAAmBA,CACvCC,OAAiC,EACjCC,OAAmC,EACJ;EAC/B,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE;IACnB,IAAAC,2BAAe,EAACF,OAAO,CAACG,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAa,CAAC;EACxD;EACA,IAAIN,OAAO,CAACO,aAAa,EAAE;IACzB,IAAAJ,2BAAe,EAACF,OAAO,CAACG,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAC5D;EACA,IAAI,CAACN,OAAO,CAACQ,QAAQ,EAAE;IACrB,IAAAL,2BAAe,EAACF,OAAO,CAACG,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC/D;;EAEA;EACA;EACA;EACA,MAAMF,KAAK,GACTJ,OAAO,CAACS,IAAI,KAAK,OAAO,IAAIR,OAAO,CAACG,KAAK,KAAKM,SAAS,GAAG,IAAAC,0BAAc,EAAC,CAAC,GAAGV,OAAO,CAACG,KAAK,IAAI,IAAI;EAEpG,IAAIJ,OAAO,CAACS,IAAI,KAAK,UAAU,EAAE;IAC/B,IAAAN,2BAAe,EAACC,KAAK,CAAC;IACtB,OAAOQ,mBAAmB,CAACZ,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EACA,IAAI,CAACG,KAAK,EAAE;IACVS,YAAM,CAACC,IAAI,CAAC,uEAAuE,EAAE;MACnFC,SAAS,EAAE;IACb,CAAC,CAAC;IACF,OAAOH,mBAAmB,CAACZ,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EAEA,IAAI;IACF,MAAMe,QAAQ,GAAG,MAAM,IAAAC,uCAAuB,EAAC;MAC7CT,QAAQ,EAAER,OAAO,CAACQ,QAAQ;MAC1BU,WAAW,EAAEjB,OAAO,CAACiB,WAAW;MAChCC,gBAAgB,EAAEnB,OAAO,CAACmB,gBAAgB;MAC1CC,KAAK,EAAEnB,OAAO,CAACmB,KAAK;MACpBC,YAAY,EAAE;IAChB,CAAC,CAAC;IAEF,IAAI,CAAC,IAAAC,8BAAkB,EAAClB,KAAK,EAAEY,QAAQ,CAACO,YAAY,CAAC,EAAE;MACrD,OAAOX,mBAAmB,CAACZ,OAAO,EAAEC,OAAO,EAAE,yBAAyB,CAAC;IACzE;IAEA,MAAMuB,OAAO,GAAG,MAAM,IAAAC,iCAAqB,EAAC;MAC1CrB,KAAK;MACLsB,cAAc,EAAEV,QAAQ,CAACW,eAAe;MACxCC,aAAa,EAAEZ,QAAQ,CAACa,SAAS,CAACC,KAAK;MACvCZ,WAAW,EAAEjB,OAAO,CAACiB,WAAW;MAChC,IAAIjB,OAAO,CAAC8B,SAAS,KAAKrB,SAAS,GAAG;QAAEqB,SAAS,EAAE9B,OAAO,CAAC8B;MAAU,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,QAAQP,OAAO,CAACQ,IAAI;MAClB,KAAK,MAAM;QAAE;UACX,MAAMC,UAAU,GAAG,MAAM,IAAAC,oCAAiB,EAAC;YACzCC,WAAW,EAAEnC,OAAO,CAACmC,WAAW;YAChC3B,QAAQ,EAAER,OAAO,CAACQ,QAAQ;YAC1B4B,IAAI,EAAEZ,OAAO,CAACY,IAAI;YAClBC,aAAa,EAAEb,OAAO,CAACM,KAAK;YAC5BD,SAAS,EAAEb,QAAQ,CAACa,SAAS;YAC7BX,WAAW,EAAEjB,OAAO,CAACiB,WAAW;YAChCoB,aAAa,EAAEtC,OAAO,CAACsC;UACzB,CAAC,CAAC;UACF,OAAOL,UAAU,CAACM,EAAE,GAChB;YAAElC,MAAM,EAAE;UAAY,CAAC,GACvB;YAAEA,MAAM,EAAE,QAAQ;YAAEC,MAAM,EAAE2B,UAAU,CAAC3B;UAAO,CAAC;QACrD;MACA,KAAK,aAAa;QAChB,OAAO;UACLD,MAAM,EAAE,QAAQ;UAChBC,MAAM,EAAE,WAAW;UACnBkC,WAAW,EAAEhB,OAAO,CAACiB,gBAAgB,IAAIjB,OAAO,CAACkB;QACnD,CAAC;MACH,KAAK,gBAAgB;QACnB,OAAO;UAAErC,MAAM,EAAE,QAAQ;UAAEC,MAAM,EAAE;QAAiB,CAAC;MACvD,KAAK,QAAQ;QACX,OAAO;UAAED,MAAM,EAAE;QAAY,CAAC;MAChC,KAAK,WAAW;QACd,OAAO;UAAEA,MAAM,EAAE;QAAY,CAAC;MAChC,KAAK,aAAa;QAChB,OAAO;UAAEA,MAAM,EAAE,aAAa;UAAEC,MAAM,EAAE;QAAa,CAAC;IAC1D;EACF,CAAC,SAAS;IACR;IACA,IAAAH,2BAAe,EAACC,KAAK,CAAC;EACxB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeQ,mBAAmBA,CAChCZ,OAAiC,EACjCC,OAAmC,EACnC0C,GAA2B,EACI;EAC/B;EACA,IAAI,CAAC3C,OAAO,CAACQ,QAAQ,EAAE,OAAO;IAAEH,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAoB,CAAC;EAEpF,MAAMU,QAAQ,GAAG,MAAM,IAAAC,uCAAuB,EAAC;IAC7CT,QAAQ,EAAER,OAAO,CAACQ,QAAQ;IAC1BU,WAAW,EAAEjB,OAAO,CAACiB,WAAW;IAChCC,gBAAgB,EAAEnB,OAAO,CAACmB,gBAAgB;IAC1CC,KAAK,EAAEnB,OAAO,CAACmB;EACjB,CAAC,CAAC;EAEF,IAAI,CAAC,IAAAwB,2BAAqB,EACxB5B,QAAQ,CAACa,SAAS,CAACC,KAAK,EACxBd,QAAQ,CAACa,SAAS,CAACgB,YAAY,EAC/B5C,OAAO,CAACiB,WACV,CAAC,EAAE;IACD,OAAO;MAAEb,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC1D;EAEA,IAAAwC,oCAAmB,EAAC9B,QAAQ,CAACO,YAAY,CAAC;EAC1C,OAAO;IAAElB,MAAM,EAAE,aAAa;IAAEsC;EAAI,CAAC;AACvC","ignoreList":[]}

package/lib/commonjs/ui/oauth/completeOAuthCode.js

@@ -0,0 +1,78 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.completeOAuthCode = completeOAuthCode;
+var _core = require("@oxy.so/core");
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+
+/** Inputs for {@link completeOAuthCode}. */
+
+async function completeOAuthCode(input) {
+  let cleaned = false;
+  const runCleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    input.cleanup?.();
+  };
+  if (!input.handshake || !input.returnedState || input.handshake.state !== input.returnedState) {
+    _core.logger.warn('OAuth completion rejected: missing or mismatched state', {
+      component: 'completeOAuthCode'
+    });
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'state-mismatch'
+    };
+  }
+  try {
+    const result = await input.oxyServices.exchangeOAuthCode({
+      code: input.code,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      codeVerifier: input.handshake.codeVerifier
+    });
+    runCleanup();
+    await input.commitSession({
+      sessionId: result.sessionId,
+      accessToken: result.accessToken,
+      deviceId: result.deviceId,
+      deviceSecret: result.deviceSecret,
+      userId: result.user.id,
+      expiresAt: result.expiresAt,
+      user: result.user
+    });
+    return {
+      ok: true
+    };
+  } catch (error) {
+    _core.logger.warn('OAuth code exchange failed', {
+      component: 'completeOAuthCode'
+    }, error);
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'exchange-failed'
+    };
+  }
+}
+//# sourceMappingURL=completeOAuthCode.js.map

package/lib/commonjs/ui/oauth/completeOAuthCode.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","logger","warn","component","ok","reason","result","oxyServices","exchangeOAuthCode","code","clientId","redirectUri","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;;;;;AAqBA,IAAAA,KAAA,GAAAC,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AA2BO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FE,YAAM,CAACC,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFP,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMZ,KAAK,CAACa,WAAW,CAACC,iBAAiB,CAAC;MACvDC,IAAI,EAAEf,KAAK,CAACe,IAAI;MAChBC,QAAQ,EAAEhB,KAAK,CAACgB,QAAQ;MACxBC,WAAW,EAAEjB,KAAK,CAACiB,WAAW;MAC9BC,YAAY,EAAElB,KAAK,CAACI,SAAS,CAACc;IAChC,CAAC,CAAC;IACFhB,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACmB,aAAa,CAAC;MACxBC,SAAS,EAAER,MAAM,CAACQ,SAAS;MAC3BC,WAAW,EAAET,MAAM,CAACS,WAAW;MAC/BC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;MACzBC,YAAY,EAAEX,MAAM,CAACW,YAAY;MACjCC,MAAM,EAAEZ,MAAM,CAACa,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEf,MAAM,CAACe,SAAS;MAC3BF,IAAI,EAAEb,MAAM,CAACa;IACf,CAAC,CAAC;IACF,OAAO;MAAEf,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOkB,KAAK,EAAE;IACdrB,YAAM,CAACC,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEmB,KAAK,CAAC;IACpF1B,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}

package/lib/commonjs/ui/oauth/explicitOAuthConsent.js

@@ -0,0 +1,245 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.requestOAuthConsent = requestOAuthConsent;
+var _oauthNavigation = require("../components/oauthNavigation.js");
+var _browserAuthTransport = require("./browserAuthTransport.js");
+var _completeOAuthCode = require("./completeOAuthCode.js");
+var _oauthHandshake = require("./oauthHandshake.js");
+var _oauthPopup = require("./oauthPopup.js");
+/**
+ * Explicit OAuth consent for an already-authenticated Oxy user.
+ *
+ * This is deliberately separate from sign-in routing. First-party applications
+ * normally use the account dialog, but a consent-required scope (for example
+ * `acting-as:offline`) still has to go through the OAuth authorize surface. The
+ * caller must invoke this operation from a real user gesture; it never runs on
+ * mount, retries silently, or grants anything locally.
+ */
+
+const EXACT_SCOPE = /^[a-z][a-z0-9-]*(?::[a-z0-9-]+)+$/;
+function hasExactRedirectUri(value) {
+  if (!value || value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const parsed = new URL(value);
+    return Boolean(parsed.protocol) && !parsed.username && !parsed.password && !parsed.hash;
+  } catch {
+    return false;
+  }
+}
+function hasExactScopes(scopes) {
+  if (scopes.length === 0 || new Set(scopes).size !== scopes.length) return false;
+  return scopes.every(scope => scope === scope.trim() && EXACT_SCOPE.test(scope));
+}
+function parseNativeCallback(redirectUrl, expectedRedirectUri) {
+  const separator = expectedRedirectUri.includes("?") ? "&" : "?";
+  if (!redirectUrl.startsWith(`${expectedRedirectUri}${separator}`)) {
+    return {
+      kind: "invalid"
+    };
+  }
+  const response = redirectUrl.slice(expectedRedirectUri.length + 1);
+  const params = new URLSearchParams(response);
+  if (params.getAll("code").length > 1 || params.getAll("state").length > 1) {
+    return {
+      kind: "invalid"
+    };
+  }
+  const error = params.get("error");
+  if (error) {
+    const description = params.get("error_description");
+    return description ? {
+      kind: "error",
+      description
+    } : {
+      kind: "error"
+    };
+  }
+  const code = params.get("code");
+  const state = params.get("state");
+  if (!code || !state) return {
+    kind: "invalid"
+  };
+  return {
+    kind: "code",
+    code,
+    state
+  };
+}
+
+/**
+ * Ask the current user to grant exact application scopes through Oxy OAuth.
+ *
+ * Scope syntax is checked before any window opens. After that, the exact client
+ * id resolves its public Application and every requested scope must be present
+ * in that application's configured scope list. Unknown, trimmed, duplicated or
+ * reordered-by-the-SDK values are never sent to the IdP.
+ */
+async function requestOAuthConsent(context, options) {
+  if (!hasExactRedirectUri(options.redirectUri)) {
+    return {
+      status: "failed",
+      reason: "invalid-redirect-uri"
+    };
+  }
+  if (!hasExactScopes(options.scopes)) {
+    return {
+      status: "failed",
+      reason: "invalid-scopes"
+    };
+  }
+  if (!context.clientId) {
+    return {
+      status: "unsupported",
+      reason: "missing-client-id"
+    };
+  }
+  if (context.identityBound) {
+    return {
+      status: "unsupported",
+      reason: "identity-bound"
+    };
+  }
+  if (!context.expectedUserId) {
+    return {
+      status: "unsupported",
+      reason: "not-authenticated"
+    };
+  }
+  if (context.platform === "unsupported") {
+    return {
+      status: "unsupported",
+      reason: "unsupported-platform"
+    };
+  }
+
+  // Claim a popup before the first await. This function is only safe when the
+  // caller invokes it directly from the user's confirmation gesture.
+  const popup = context.platform === "web" && context.mode === "popup" ? (0, _oauthPopup.openOAuthPopup)() : null;
+  let application;
+  try {
+    application = await context.oxyServices.getPublicApplication(context.clientId);
+  } catch {
+    (0, _oauthPopup.closeOAuthPopup)(popup);
+    return {
+      status: "failed",
+      reason: "client-resolution-failed"
+    };
+  }
+  const configuredScopes = new Set(application.scopes);
+  if (options.scopes.some(scope => !configuredScopes.has(scope))) {
+    (0, _oauthPopup.closeOAuthPopup)(popup);
+    return {
+      status: "failed",
+      reason: "scope-not-configured"
+    };
+  }
+  const scope = options.scopes.join(" ");
+  let subjectMismatch = false;
+  const commitExactSubject = async input => {
+    if (input.userId !== context.expectedUserId) {
+      subjectMismatch = true;
+      throw new Error("OAuth consent returned a different user");
+    }
+    await context.commitSession(input);
+  };
+  if (context.platform === "web") {
+    const result = await (0, _browserAuthTransport.startWebOAuthSignIn)({
+      mode: context.mode,
+      oxyServices: context.oxyServices,
+      clientId: context.clientId,
+      authorizeBaseUrl: context.authorizeBaseUrl,
+      identityBound: false,
+      commitSession: commitExactSubject
+    }, {
+      redirectUri: options.redirectUri,
+      scope,
+      ...(context.mode === "popup" ? {
+        popup
+      } : {}),
+      ...(options.timeoutMs !== undefined ? {
+        timeoutMs: options.timeoutMs
+      } : {})
+    });
+    if (subjectMismatch) return {
+      status: "failed",
+      reason: "subject-mismatch"
+    };
+    switch (result.status) {
+      case "signed-in":
+        return {
+          status: "consented"
+        };
+      case "redirecting":
+      case "cancelled":
+      case "timed-out":
+        return result;
+      case "failed":
+        return {
+          status: "failed",
+          reason: result.reason,
+          ...(result.description ? {
+            description: result.description
+          } : {})
+        };
+      case "unsupported":
+        return {
+          status: "unsupported",
+          reason: "unsupported-platform"
+        };
+    }
+  }
+  (0, _oauthPopup.closeOAuthPopup)(popup);
+  const prepared = await (0, _oauthHandshake.prepareAuthorizeRequest)({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope
+  });
+  const {
+    redirectUrl
+  } = await (0, _oauthNavigation.openAuthorizeUrlNative)(prepared.authorizeUrl, options.redirectUri, {
+    allowExternalFallback: false
+  });
+  if (!redirectUrl) return {
+    status: "cancelled"
+  };
+  const callback = parseNativeCallback(redirectUrl, options.redirectUri);
+  if (callback.kind === "error") {
+    return {
+      status: "failed",
+      reason: "idp-error",
+      ...(callback.description ? {
+        description: callback.description
+      } : {})
+    };
+  }
+  if (callback.kind === "invalid") {
+    return {
+      status: "failed",
+      reason: "native-callback-invalid"
+    };
+  }
+  const completion = await (0, _completeOAuthCode.completeOAuthCode)({
+    oxyServices: context.oxyServices,
+    clientId: context.clientId,
+    code: callback.code,
+    returnedState: callback.state,
+    handshake: prepared.handshake,
+    redirectUri: options.redirectUri,
+    commitSession: commitExactSubject
+  });
+  if (subjectMismatch) return {
+    status: "failed",
+    reason: "subject-mismatch"
+  };
+  return completion.ok ? {
+    status: "consented"
+  } : {
+    status: "failed",
+    reason: completion.reason
+  };
+}
+//# sourceMappingURL=explicitOAuthConsent.js.map

package/lib/commonjs/ui/oauth/explicitOAuthConsent.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_oauthNavigation","require","_browserAuthTransport","_completeOAuthCode","_oauthHandshake","_oauthPopup","EXACT_SCOPE","hasExactRedirectUri","value","trim","test","parsed","URL","Boolean","protocol","username","password","hash","hasExactScopes","scopes","length","Set","size","every","scope","parseNativeCallback","redirectUrl","expectedRedirectUri","separator","includes","startsWith","kind","response","slice","params","URLSearchParams","getAll","error","get","description","code","state","requestOAuthConsent","context","options","redirectUri","status","reason","clientId","identityBound","expectedUserId","platform","popup","mode","openOAuthPopup","application","oxyServices","getPublicApplication","closeOAuthPopup","configuredScopes","some","has","join","subjectMismatch","commitExactSubject","input","userId","Error","commitSession","result","startWebOAuthSignIn","authorizeBaseUrl","timeoutMs","undefined","prepared","prepareAuthorizeRequest","openAuthorizeUrlNative","authorizeUrl","allowExternalFallback","callback","completion","completeOAuthCode","returnedState","handshake","ok"],"sourceRoot":"../../../../src","sources":["ui/oauth/explicitOAuthConsent.ts"],"mappings":";;;;;;AAWA,IAAAA,gBAAA,GAAAC,OAAA;AACA,IAAAC,qBAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,eAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkEA,MAAMK,WAAW,GAAG,mCAAmC;AAEvD,SAASC,mBAAmBA,CAACC,KAAa,EAAW;EACpD,IAAI,CAACA,KAAK,IAAIA,KAAK,KAAKA,KAAK,CAACC,IAAI,CAAC,CAAC,IAAI,IAAI,CAACC,IAAI,CAACF,KAAK,CAAC,EAAE,OAAO,KAAK;EACtE,IAAI;IACH,MAAMG,MAAM,GAAG,IAAIC,GAAG,CAACJ,KAAK,CAAC;IAC7B,OACCK,OAAO,CAACF,MAAM,CAACG,QAAQ,CAAC,IACxB,CAACH,MAAM,CAACI,QAAQ,IAChB,CAACJ,MAAM,CAACK,QAAQ,IAChB,CAACL,MAAM,CAACM,IAAI;EAEd,CAAC,CAAC,MAAM;IACP,OAAO,KAAK;EACb;AACD;AAEA,SAASC,cAAcA,CAACC,MAAyB,EAAW;EAC3D,IAAIA,MAAM,CAACC,MAAM,KAAK,CAAC,IAAI,IAAIC,GAAG,CAACF,MAAM,CAAC,CAACG,IAAI,KAAKH,MAAM,CAACC,MAAM,EAChE,OAAO,KAAK;EACb,OAAOD,MAAM,CAACI,KAAK,CACjBC,KAAK,IAAKA,KAAK,KAAKA,KAAK,CAACf,IAAI,CAAC,CAAC,IAAIH,WAAW,CAACI,IAAI,CAACc,KAAK,CAC5D,CAAC;AACF;AAEA,SAASC,mBAAmBA,CAC3BC,WAAmB,EACnBC,mBAA2B,EAIL;EACtB,MAAMC,SAAS,GAAGD,mBAAmB,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG;EAC/D,IAAI,CAACH,WAAW,CAACI,UAAU,CAAC,GAAGH,mBAAmB,GAAGC,SAAS,EAAE,CAAC,EAAE;IAClE,OAAO;MAAEG,IAAI,EAAE;IAAU,CAAC;EAC3B;EAEA,MAAMC,QAAQ,GAAGN,WAAW,CAACO,KAAK,CAACN,mBAAmB,CAACP,MAAM,GAAG,CAAC,CAAC;EAClE,MAAMc,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAAC;EAC5C,IAAIE,MAAM,CAACE,MAAM,CAAC,MAAM,CAAC,CAAChB,MAAM,GAAG,CAAC,IAAIc,MAAM,CAACE,MAAM,CAAC,OAAO,CAAC,CAAChB,MAAM,GAAG,CAAC,EAAE;IAC1E,OAAO;MAAEW,IAAI,EAAE;IAAU,CAAC;EAC3B;EACA,MAAMM,KAAK,GAAGH,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACjC,IAAID,KAAK,EAAE;IACV,MAAME,WAAW,GAAGL,MAAM,CAACI,GAAG,CAAC,mBAAmB,CAAC;IACnD,OAAOC,WAAW,GAAG;MAAER,IAAI,EAAE,OAAO;MAAEQ;IAAY,CAAC,GAAG;MAAER,IAAI,EAAE;IAAQ,CAAC;EACxE;EACA,MAAMS,IAAI,GAAGN,MAAM,CAACI,GAAG,CAAC,MAAM,CAAC;EAC/B,MAAMG,KAAK,GAAGP,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACjC,IAAI,CAACE,IAAI,IAAI,CAACC,KAAK,EAAE,OAAO;IAAEV,IAAI,EAAE;EAAU,CAAC;EAC/C,OAAO;IAAEA,IAAI,EAAE,MAAM;IAAES,IAAI;IAAEC;EAAM,CAAC;AACrC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,mBAAmBA,CACxCC,OAA4B,EAC5BC,OAAmC,EACL;EAC9B,IAAI,CAACrC,mBAAmB,CAACqC,OAAO,CAACC,WAAW,CAAC,EAAE;IAC9C,OAAO;MAAEC,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAuB,CAAC;EAC5D;EACA,IAAI,CAAC7B,cAAc,CAAC0B,OAAO,CAACzB,MAAM,CAAC,EAAE;IACpC,OAAO;MAAE2B,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAiB,CAAC;EACtD;EACA,IAAI,CAACJ,OAAO,CAACK,QAAQ,EAAE;IACtB,OAAO;MAAEF,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC9D;EACA,IAAIJ,OAAO,CAACM,aAAa,EAAE;IAC1B,OAAO;MAAEH,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAC3D;EACA,IAAI,CAACJ,OAAO,CAACO,cAAc,EAAE;IAC5B,OAAO;MAAEJ,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC9D;EACA,IAAIJ,OAAO,CAACQ,QAAQ,KAAK,aAAa,EAAE;IACvC,OAAO;MAAEL,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAuB,CAAC;EACjE;;EAEA;EACA;EACA,MAAMK,KAA8B,GACnCT,OAAO,CAACQ,QAAQ,KAAK,KAAK,IAAIR,OAAO,CAACU,IAAI,KAAK,OAAO,GACnD,IAAAC,0BAAc,EAAC,CAAC,GAChB,IAAI;EAER,IAAIC,WAA8B;EAClC,IAAI;IACHA,WAAW,GAAG,MAAMZ,OAAO,CAACa,WAAW,CAACC,oBAAoB,CAC3Dd,OAAO,CAACK,QACT,CAAC;EACF,CAAC,CAAC,MAAM;IACP,IAAAU,2BAAe,EAACN,KAAK,CAAC;IACtB,OAAO;MAAEN,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA2B,CAAC;EAChE;EAEA,MAAMY,gBAAgB,GAAG,IAAItC,GAAG,CAACkC,WAAW,CAACpC,MAAM,CAAC;EACpD,IAAIyB,OAAO,CAACzB,MAAM,CAACyC,IAAI,CAAEpC,KAAK,IAAK,CAACmC,gBAAgB,CAACE,GAAG,CAACrC,KAAK,CAAC,CAAC,EAAE;IACjE,IAAAkC,2BAAe,EAACN,KAAK,CAAC;IACtB,OAAO;MAAEN,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAuB,CAAC;EAC5D;EAEA,MAAMvB,KAAK,GAAGoB,OAAO,CAACzB,MAAM,CAAC2C,IAAI,CAAC,GAAG,CAAC;EACtC,IAAIC,eAAe,GAAG,KAAK;EAC3B,MAAMC,kBAAkB,GAAG,MAC1BC,KAA8B,IACX;IACnB,IAAIA,KAAK,CAACC,MAAM,KAAKvB,OAAO,CAACO,cAAc,EAAE;MAC5Ca,eAAe,GAAG,IAAI;MACtB,MAAM,IAAII,KAAK,CAAC,yCAAyC,CAAC;IAC3D;IACA,MAAMxB,OAAO,CAACyB,aAAa,CAACH,KAAK,CAAC;EACnC,CAAC;EAED,IAAItB,OAAO,CAACQ,QAAQ,KAAK,KAAK,EAAE;IAC/B,MAAMkB,MAAM,GAAG,MAAM,IAAAC,yCAAmB,EACvC;MACCjB,IAAI,EAAEV,OAAO,CAACU,IAAI;MAClBG,WAAW,EAAEb,OAAO,CAACa,WAAW;MAChCR,QAAQ,EAAEL,OAAO,CAACK,QAAQ;MAC1BuB,gBAAgB,EAAE5B,OAAO,CAAC4B,gBAAgB;MAC1CtB,aAAa,EAAE,KAAK;MACpBmB,aAAa,EAAEJ;IAChB,CAAC,EACD;MACCnB,WAAW,EAAED,OAAO,CAACC,WAAW;MAChCrB,KAAK;MACL,IAAImB,OAAO,CAACU,IAAI,KAAK,OAAO,GAAG;QAAED;MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;MAC9C,IAAIR,OAAO,CAAC4B,SAAS,KAAKC,SAAS,GAChC;QAAED,SAAS,EAAE5B,OAAO,CAAC4B;MAAU,CAAC,GAChC,CAAC,CAAC;IACN,CACD,CAAC;IACD,IAAIT,eAAe,EAClB,OAAO;MAAEjB,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAmB,CAAC;IACxD,QAAQsB,MAAM,CAACvB,MAAM;MACpB,KAAK,WAAW;QACf,OAAO;UAAEA,MAAM,EAAE;QAAY,CAAC;MAC/B,KAAK,aAAa;MAClB,KAAK,WAAW;MAChB,KAAK,WAAW;QACf,OAAOuB,MAAM;MACd,KAAK,QAAQ;QACZ,OAAO;UACNvB,MAAM,EAAE,QAAQ;UAChBC,MAAM,EAAEsB,MAAM,CAACtB,MAAM;UACrB,IAAIsB,MAAM,CAAC9B,WAAW,GAAG;YAAEA,WAAW,EAAE8B,MAAM,CAAC9B;UAAY,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;MACF,KAAK,aAAa;QACjB,OAAO;UAAEO,MAAM,EAAE,aAAa;UAAEC,MAAM,EAAE;QAAuB,CAAC;IAClE;EACD;EAEA,IAAAW,2BAAe,EAACN,KAAK,CAAC;EACtB,MAAMsB,QAAQ,GAAG,MAAM,IAAAC,uCAAuB,EAAC;IAC9C3B,QAAQ,EAAEL,OAAO,CAACK,QAAQ;IAC1BH,WAAW,EAAED,OAAO,CAACC,WAAW;IAChC0B,gBAAgB,EAAE5B,OAAO,CAAC4B,gBAAgB;IAC1C/C;EACD,CAAC,CAAC;EACF,MAAM;IAAEE;EAAY,CAAC,GAAG,MAAM,IAAAkD,uCAAsB,EACnDF,QAAQ,CAACG,YAAY,EACrBjC,OAAO,CAACC,WAAW,EACnB;IAAEiC,qBAAqB,EAAE;EAAM,CAChC,CAAC;EACD,IAAI,CAACpD,WAAW,EAAE,OAAO;IAAEoB,MAAM,EAAE;EAAY,CAAC;EAEhD,MAAMiC,QAAQ,GAAGtD,mBAAmB,CAACC,WAAW,EAAEkB,OAAO,CAACC,WAAW,CAAC;EACtE,IAAIkC,QAAQ,CAAChD,IAAI,KAAK,OAAO,EAAE;IAC9B,OAAO;MACNe,MAAM,EAAE,QAAQ;MAChBC,MAAM,EAAE,WAAW;MACnB,IAAIgC,QAAQ,CAACxC,WAAW,GAAG;QAAEA,WAAW,EAAEwC,QAAQ,CAACxC;MAAY,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;EACF;EACA,IAAIwC,QAAQ,CAAChD,IAAI,KAAK,SAAS,EAAE;IAChC,OAAO;MAAEe,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA0B,CAAC;EAC/D;EAEA,MAAMiC,UAAU,GAAG,MAAM,IAAAC,oCAAiB,EAAC;IAC1CzB,WAAW,EAAEb,OAAO,CAACa,WAAW;IAChCR,QAAQ,EAAEL,OAAO,CAACK,QAAQ;IAC1BR,IAAI,EAAEuC,QAAQ,CAACvC,IAAI;IACnB0C,aAAa,EAAEH,QAAQ,CAACtC,KAAK;IAC7B0C,SAAS,EAAET,QAAQ,CAACS,SAAS;IAC7BtC,WAAW,EAAED,OAAO,CAACC,WAAW;IAChCuB,aAAa,EAAEJ;EAChB,CAAC,CAAC;EACF,IAAID,eAAe,EAAE,OAAO;IAAEjB,MAAM,EAAE,QAAQ;IAAEC,MAAM,EAAE;EAAmB,CAAC;EAC5E,OAAOiC,UAAU,CAACI,EAAE,GACjB;IAAEtC,MAAM,EAAE;EAAY,CAAC,GACvB;IAAEA,MAAM,EAAE,QAAQ;IAAEC,MAAM,EAAEiC,UAAU,CAACjC;EAAO,CAAC;AACnD","ignoreList":[]}

package/lib/commonjs/ui/oauth/legacyRedirectLanes.js

@@ -0,0 +1,48 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.allowsAutomaticIdpRedirect = allowsAutomaticIdpRedirect;
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+function allowsAutomaticIdpRedirect(webAuthMode) {
+  return webAuthMode === 'redirect';
+}
+//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/commonjs/ui/oauth/legacyRedirectLanes.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}

package/lib/commonjs/ui/oauth/oauthHandshake.js

@@ -0,0 +1,53 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.prepareAuthorizeRequest = prepareAuthorizeRequest;
+var _core = require("@oxy.so/core");
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+
+/** Inputs for {@link prepareAuthorizeRequest}. */
+
+/** A ready-to-use authorize request plus the secrets that finish it. */
+
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+async function prepareAuthorizeRequest(params) {
+  const [pkce, state] = await Promise.all([(0, _core.generatePkcePair)(), (0, _core.generateOAuthState)()]);
+  const authorizeUrl = (0, _core.buildOAuthAuthorizeUrl)({
+    authorizeBaseUrl: params.authorizeBaseUrl,
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scope: params.scope,
+    state,
+    codeChallenge: pkce.codeChallenge,
+    ...(params.responseMode ? {
+      responseMode: params.responseMode
+    } : {})
+  });
+  return {
+    authorizeUrl,
+    authorizeOrigin: new URL(authorizeUrl).origin,
+    handshake: {
+      state,
+      codeVerifier: pkce.codeVerifier
+    }
+  };
+}
+//# sourceMappingURL=oauthHandshake.js.map

package/lib/commonjs/ui/oauth/oauthHandshake.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","prepareAuthorizeRequest","params","pkce","state","Promise","all","generatePkcePair","generateOAuthState","authorizeUrl","buildOAuthAuthorizeUrl","authorizeBaseUrl","clientId","redirectUri","scope","codeChallenge","responseMode","authorizeOrigin","URL","origin","handshake","codeVerifier"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthHandshake.ts"],"mappings":";;;;;;AAWA,IAAAA,KAAA,GAAAC,OAAA;AAXA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;;AAkBA;;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,uBAAuBA,CAC3CC,MAAqC,EACF;EACnC,MAAM,CAACC,IAAI,EAAEC,KAAK,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAAC,IAAAC,sBAAgB,EAAC,CAAC,EAAE,IAAAC,wBAAkB,EAAC,CAAC,CAAC,CAAC;EAEnF,MAAMC,YAAY,GAAG,IAAAC,4BAAsB,EAAC;IAC1CC,gBAAgB,EAAET,MAAM,CAACS,gBAAgB;IACzCC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;IACzBC,WAAW,EAAEX,MAAM,CAACW,WAAW;IAC/BC,KAAK,EAAEZ,MAAM,CAACY,KAAK;IACnBV,KAAK;IACLW,aAAa,EAAEZ,IAAI,CAACY,aAAa;IACjC,IAAIb,MAAM,CAACc,YAAY,GAAG;MAAEA,YAAY,EAAEd,MAAM,CAACc;IAAa,CAAC,GAAG,CAAC,CAAC;EACtE,CAAC,CAAC;EAEF,OAAO;IACLP,YAAY;IACZQ,eAAe,EAAE,IAAIC,GAAG,CAACT,YAAY,CAAC,CAACU,MAAM;IAC7CC,SAAS,EAAE;MAAEhB,KAAK;MAAEiB,YAAY,EAAElB,IAAI,CAACkB;IAAa;EACtD,CAAC;AACH","ignoreList":[]}