@oxy.so/services 11.2.0-oxy-one.3 → 11.2.0-oxy-one.4

package/src/ui/oauth/__tests__/nativeAuthTransport.test.ts

@@ -3,55 +3,138 @@ import { startNativeOAuthSignIn, type NativeOAuthSignInContext } from '../native
 import { openAuthorizeUrlNative } from '../../components/oauthNavigation';
 import { prepareAuthorizeRequest } from '../oauthHandshake';
 jest.mock('../../components/oauthNavigation', () => ({ openAuthorizeUrlNative: jest.fn() }));
-jest.mock('../oauthHandshake', () => ({ prepareAuthorizeRequest: jest.fn(async () => ({ authorizeUrl: 'https://auth.oxy.so/authorize', handshake: { state: 'expected', codeVerifier: 'verifier' } })) }));
+jest.mock('../oauthHandshake', () => ({
+  prepareAuthorizeRequest: jest.fn(async () => ({
+    authorizeUrl: 'https://auth.oxy.so/authorize',
+    handshake: { state: 'expected', codeVerifier: 'verifier' },
+  })),
+}));
 const open = openAuthorizeUrlNative as jest.Mock;
 const prepare = prepareAuthorizeRequest as jest.Mock;
 const uri = 'externalapp://oauth/callback?tenant=fixed';
 function fixture() {
-  const exchange = jest.fn(async () => ({ sessionId: 'isolated', accessToken: 'bearer', user: { id: 'user' } }));
-  const getPublic = jest.fn(async () => ({ id: 'app', name: 'External', type: 'third_party', isOfficial: false, isInternal: false, scopes: [] }));
-  const context: NativeOAuthSignInContext = { platform: 'native', oxyServices: { apps: { getPublic }, auth: { oauth: { exchangeCode: exchange } } } as unknown as OxyServices, clientId: 'oxy_dk_registered', identityBound: false, commitSession: jest.fn(async () => undefined) };
+  const exchange = jest.fn(async () => ({
+    sessionId: 'isolated',
+    accessToken: 'bearer',
+    user: { id: 'user' },
+  }));
+  const getPublic = jest.fn(async () => ({
+    id: 'app',
+    name: 'External',
+    type: 'third_party',
+    isOfficial: false,
+    isInternal: false,
+    scopes: [],
+  }));
+  const context: NativeOAuthSignInContext = {
+    platform: 'native',
+    oxyServices: {
+      apps: { getPublic },
+      auth: { oauth: { exchangeCode: exchange } },
+    } as unknown as OxyServices,
+    clientId: 'oxy_dk_registered',
+    identityBound: false,
+    commitSession: jest.fn(async () => undefined),
+  };
   return { context, exchange, getPublic };
 }
-beforeEach(() => { jest.clearAllMocks(); open.mockResolvedValue({ redirectUrl: `${uri}&code=legitimate&state=expected` }); });
+beforeEach(() => {
+  jest.clearAllMocks();
+  open.mockResolvedValue({ redirectUrl: `${uri}&code=legitimate&state=expected` });
+});
 it('uses the common exchange and commits a fixed-query callback without device credentials', async () => {
   const { context, exchange, getPublic } = fixture();
-  expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({ status: 'signed-in' });
+  expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({
+    status: 'signed-in',
+  });
   expect(getPublic).toHaveBeenCalledWith('oxy_dk_registered', { cache: false });
-  expect(open).toHaveBeenCalledWith('https://auth.oxy.so/authorize', uri, { allowExternalFallback: false });
-  expect(exchange).toHaveBeenCalledWith({ code: 'legitimate', clientId: 'oxy_dk_registered', redirectUri: uri, codeVerifier: 'verifier' }, { plantTokens: false });
-  expect(context.commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'isolated', userId: 'user', deviceId: undefined, deviceSecret: undefined }));
+  expect(open).toHaveBeenCalledWith('https://auth.oxy.so/authorize', uri, {
+    allowExternalFallback: false,
+  });
+  expect(exchange).toHaveBeenCalledWith(
+    {
+      code: 'legitimate',
+      clientId: 'oxy_dk_registered',
+      redirectUri: uri,
+      codeVerifier: 'verifier',
+    },
+    { plantTokens: false },
+  );
+  expect(context.commitSession).toHaveBeenCalledWith(
+    expect.objectContaining({
+      sessionId: 'isolated',
+      userId: 'user',
+      deviceId: undefined,
+      deviceSecret: undefined,
+    }),
+  );
 });
 it.each([
- `${uri}&code=x&state=expected&code=y`, `${uri}&code=x&state=expected&state=expected`,
- `${uri}&error=access_denied&state=wrong`, `${uri}&error=access_denied&state=expected`,
- `${uri}&code=x&state=wrong`, `${uri}&tenant=other&code=x&state=expected`, 'externalapp://oauth/callback?tenant=other&code=x&state=expected',
- `${uri}/extra?code=x&state=expected`, `${uri}&code=x&state=expected#fragment`,
+  `${uri}&code=x&state=expected&code=y`,
+  `${uri}&code=x&state=expected&state=expected`,
+  `${uri}&error=access_denied&state=wrong`,
+  `${uri}&error=access_denied&state=expected`,
+  `${uri}&code=x&state=wrong`,
+  `${uri}&tenant=other&code=x&state=expected`,
+  'externalapp://oauth/callback?tenant=other&code=x&state=expected',
+  `${uri}/extra?code=x&state=expected`,
+  `${uri}&code=x&state=expected#fragment`,
 ])('rejects %s before exchange/commit', async (redirectUrl) => {
- const { context, exchange } = fixture(); open.mockResolvedValue({ redirectUrl });
- expect((await startNativeOAuthSignIn(context, { redirectUri: uri })).status).toBe('failed');
- expect(exchange).not.toHaveBeenCalled(); expect(context.commitSession).not.toHaveBeenCalled();
+  const { context, exchange } = fixture();
+  open.mockResolvedValue({ redirectUrl });
+  expect((await startNativeOAuthSignIn(context, { redirectUri: uri })).status).toBe('failed');
+  expect(exchange).not.toHaveBeenCalled();
+  expect(context.commitSession).not.toHaveBeenCalled();
 });
 it('cancellation commits nothing', async () => {
- const { context, exchange } = fixture(); open.mockResolvedValue({ redirectUrl: null });
- expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({ status: 'cancelled' });
- expect(exchange).not.toHaveBeenCalled(); expect(context.commitSession).not.toHaveBeenCalled();
-});
-it.each(['platform','client','identity','official','registry-error'])('direct method rejects %s before opening', async (mode) => {
- const { context, exchange, getPublic } = fixture();
- if(mode==='platform') context.platform='unsupported';
- if(mode==='client') context.clientId=null;
- if(mode==='identity') context.identityBound=true;
- if(mode==='official') getPublic.mockResolvedValue({ id:'official', name:'Official', type:'first_party', isOfficial:true, isInternal:false, scopes:[] });
- if(mode==='registry-error') getPublic.mockRejectedValue(new Error('unavailable'));
- expect((await startNativeOAuthSignIn(context,{redirectUri:uri})).status).not.toBe('signed-in');
- expect(open).not.toHaveBeenCalled(); expect(prepare).not.toHaveBeenCalled(); expect(exchange).not.toHaveBeenCalled();
+  const { context, exchange } = fixture();
+  open.mockResolvedValue({ redirectUrl: null });
+  expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({
+    status: 'cancelled',
+  });
+  expect(exchange).not.toHaveBeenCalled();
+  expect(context.commitSession).not.toHaveBeenCalled();
 });
+it.each(['platform', 'client', 'identity', 'official', 'registry-error'])(
+  'direct method rejects %s before opening',
+  async (mode) => {
+    const { context, exchange, getPublic } = fixture();
+    if (mode === 'platform') context.platform = 'unsupported';
+    if (mode === 'client') context.clientId = null;
+    if (mode === 'identity') context.identityBound = true;
+    if (mode === 'official')
+      getPublic.mockResolvedValue({
+        id: 'official',
+        name: 'Official',
+        type: 'first_party',
+        isOfficial: true,
+        isInternal: false,
+        scopes: [],
+      });
+    if (mode === 'registry-error') getPublic.mockRejectedValue(new Error('unavailable'));
+    expect((await startNativeOAuthSignIn(context, { redirectUri: uri })).status).not.toBe(
+      'signed-in',
+    );
+    expect(open).not.toHaveBeenCalled();
+    expect(prepare).not.toHaveBeenCalled();
+    expect(exchange).not.toHaveBeenCalled();
+  },
+);
 it('rejects reentry without replacing the first handshake', async () => {
- const { context }=fixture(); let cancel!: (result:{redirectUrl:null})=>void;
- open.mockImplementation(()=>new Promise(resolve=>{cancel=resolve;}));
- const first=startNativeOAuthSignIn(context,{redirectUri:uri});
- for(let i=0;i<8;i++) await Promise.resolve();
- expect(await startNativeOAuthSignIn(context,{redirectUri:uri})).toEqual({status:'failed',reason:'already-in-progress'});
- cancel({redirectUrl:null}); await first;
+  const { context } = fixture();
+  let cancel!: (result: { redirectUrl: null }) => void;
+  open.mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        cancel = resolve;
+      }),
+  );
+  const first = startNativeOAuthSignIn(context, { redirectUri: uri });
+  for (let i = 0; i < 8; i++) await Promise.resolve();
+  expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({
+    status: 'failed',
+    reason: 'already-in-progress',
+  });
+  cancel({ redirectUrl: null });
+  await first;
 });

package/src/ui/oauth/__tests__/oauthBearerCommit.http.test.ts

@@ -55,42 +55,80 @@ describe('OAuth bearer commit with real HTTP transport', () => {
         expect(params.get('redirect_uri')).toBe(REDIRECT);
         expect(params.get('code_verifier')).toBeTruthy();
         exchanges += 1;
-        res.end(JSON.stringify({ access_token: token(exchangeSubject), session_id: 'fixture-session',
-          expires_in: 300, user: { id: exchangeSubject, username: exchangeSubject === PERSON ? 'fixture-person' : 'fixture-organization' } }));
+        res.end(
+          JSON.stringify({
+            access_token: token(exchangeSubject),
+            session_id: 'fixture-session',
+            expires_in: 300,
+            user: {
+              id: exchangeSubject,
+              username: exchangeSubject === PERSON ? 'fixture-person' : 'fixture-organization',
+            },
+          }),
+        );
       } else if (req.method === 'GET' && req.url === '/users/me') {
         const bearer = req.headers.authorization;
-        const subject = bearer === `Bearer ${token(PERSON)}` ? PERSON
-          : bearer === `Bearer ${token(ORGANIZATION)}` ? ORGANIZATION : null;
-        if (!subject) { res.statusCode = 401; res.end(JSON.stringify({ message: 'Unauthorized' })); return; }
+        const subject =
+          bearer === `Bearer ${token(PERSON)}`
+            ? PERSON
+            : bearer === `Bearer ${token(ORGANIZATION)}`
+              ? ORGANIZATION
+              : null;
+        if (!subject) {
+          res.statusCode = 401;
+          res.end(JSON.stringify({ message: 'Unauthorized' }));
+          return;
+        }
         profileSubjects.push(subject);
-        res.end(JSON.stringify({ id: subject, username: subject === PERSON ? 'fixture-person' : 'fixture-organization' }));
+        res.end(
+          JSON.stringify({
+            id: subject,
+            username: subject === PERSON ? 'fixture-person' : 'fixture-organization',
+          }),
+        );
       } else {
         unexpectedRequests.push(`${req.method} ${req.url}`);
-        res.statusCode = 500; res.end(JSON.stringify({ message: 'Unexpected fixture request' }));
+        res.statusCode = 500;
+        res.end(JSON.stringify({ message: 'Unexpected fixture request' }));
       }
     });
     await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
     const address = server.address();
     if (!address || typeof address === 'string') throw new Error('Owned HTTP listener missing');
-    oxy = new OxyServices({ baseURL: `http://127.0.0.1:${address.port}`, enableCache: false, maxRetries: 0 });
+    oxy = new OxyServices({
+      baseURL: `http://127.0.0.1:${address.port}`,
+      enableCache: false,
+      maxRetries: 0,
+    });
     oxy.session.setAccessToken(token(PERSON));
   });
 
   afterEach(async () => {
     oxy?.dispose();
     server.closeAllConnections();
-    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+    await new Promise<void>((resolve, reject) =>
+      server.close((error) => (error ? reject(error) : resolve())),
+    );
     expect(unexpectedRequests).toEqual([]);
   });
 
   async function consent() {
-    return requestOAuthConsent({ platform: 'native', mode: 'popup', oxyServices: oxy,
-      clientId: CLIENT, identityBound: false, expectedUserId: PERSON,
-      commitSession: async (session) => {
-        if (!session.accessToken) throw new Error('Fixture commit requires bearer');
-        oxy.session.setAccessToken(session.accessToken);
-        visibleSubject = session.userId;
-      } }, { redirectUri: REDIRECT, scopes: ['user:read'] });
+    return requestOAuthConsent(
+      {
+        platform: 'native',
+        mode: 'popup',
+        oxyServices: oxy,
+        clientId: CLIENT,
+        identityBound: false,
+        expectedUserId: PERSON,
+        commitSession: async (session) => {
+          if (!session.accessToken) throw new Error('Fixture commit requires bearer');
+          oxy.session.setAccessToken(session.accessToken);
+          visibleSubject = session.userId;
+        },
+      },
+      { redirectUri: REDIRECT, scopes: ['user:read'] },
+    );
   }
 
   it('rejects a different returned subject without replacing the previous bearer', async () => {
@@ -123,8 +161,12 @@ describe('OAuth bearer commit with real HTTP transport', () => {
   });
 
   it('preserves legacy direct exchange planting by default', async () => {
-    await oxy.auth.oauth.exchangeCode({ code: 'owned-code', clientId: CLIENT,
-      redirectUri: REDIRECT, codeVerifier: 'fixture-verifier' });
+    await oxy.auth.oauth.exchangeCode({
+      code: 'owned-code',
+      clientId: CLIENT,
+      redirectUri: REDIRECT,
+      codeVerifier: 'fixture-verifier',
+    });
     expect(exchanges).toBe(1);
     expect((await oxy.users.me()).id).toBe(ORGANIZATION);
   });

package/src/ui/oauth/__tests__/oauthPopup.test.ts

@@ -51,10 +51,7 @@ function codeMessage(source: unknown, state = STATE, origin = IDP_ORIGIN) {
 async function outcomeOrPending(
   promise: Promise<OAuthPopupOutcome>,
 ): Promise<OAuthPopupOutcome | 'pending'> {
-  return Promise.race([
-    promise,
-    Promise.resolve().then(() => 'pending' as const),
-  ]);
+  return Promise.race([promise, Promise.resolve().then(() => 'pending' as const)]);
 }
 
 describe('openOAuthPopup', () => {
@@ -64,9 +61,7 @@ describe('openOAuthPopup', () => {
 
   it('opens an empty, named window so a second press reuses it', () => {
     const handle = fakePopup();
-    const openSpy = jest
-      .spyOn(window, 'open')
-      .mockReturnValue(handle as unknown as Window);
+    const openSpy = jest.spyOn(window, 'open').mockReturnValue(handle as unknown as Window);
 
     expect(openOAuthPopup()).toBe(handle);
     expect(openSpy).toHaveBeenCalledWith('', OXY_OAUTH_POPUP_WINDOW_NAME, expect.any(String));

package/src/ui/oauth/__tests__/oauthPopupMessages.test.ts

@@ -19,11 +19,7 @@ function fakePopup(): OAuthPopupHandle {
  * `MessageEvent` constructor refuses a non-`Window` `source`, so the event is
  * assembled the way the browser hands it to the listener instead.
  */
-function makeMessageEvent(init: {
-  data: unknown;
-  origin: string;
-  source: unknown;
-}): MessageEvent {
+function makeMessageEvent(init: { data: unknown; origin: string; source: unknown }): MessageEvent {
   const event = new Event('message');
   Object.assign(event, init);
   return event as MessageEvent;
@@ -82,9 +78,15 @@ describe('parseOAuthPopupMessage', () => {
     ['an array', [{ type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 'c', state: STATE }]],
     ['an unknown type', { type: 'oxy:oauth:token', code: 'c', state: STATE }],
     ['a code message with no code', { type: OXY_OAUTH_CODE_MESSAGE_TYPE, state: STATE }],
-    ['a code message with an empty code', { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: '', state: STATE }],
+    [
+      'a code message with an empty code',
+      { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: '', state: STATE },
+    ],
     ['a code message with no state', { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 'c' }],
-    ['a code message with a non-string code', { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 1, state: STATE }],
+    [
+      'a code message with a non-string code',
+      { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 1, state: STATE },
+    ],
     ['an error message with no error', { type: OXY_OAUTH_ERROR_MESSAGE_TYPE, state: STATE }],
   ])('rejects %s', (_label, data) => {
     expect(parseOAuthPopupMessage(data)).toBeNull();

package/src/ui/oauth/__tests__/sharedCompletionPath.test.ts

@@ -15,10 +15,7 @@ jest.mock('../../components/oauthNavigation', () => ({
 }));
 
 import type { OxyServices } from '@oxy.so/core';
-import {
-  OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY,
-  OXY_OAUTH_STATE_STORAGE_KEY,
-} from '@oxy.so/core';
+import { OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_STATE_STORAGE_KEY } from '@oxy.so/core';
 import { tryCompleteOAuthReturn } from '../../utils/oauthReturn';
 import { startWebOAuthSignIn, type WebOAuthTransportContext } from '../browserAuthTransport';
 import { completeOAuthCode } from '../completeOAuthCode';
@@ -102,7 +99,9 @@ describe('shared OAuth completion path', () => {
 
   it('the redirect return leg completes through completeOAuthCode with the persisted handshake', async () => {
     const exchangeOAuthCode = jest.fn();
-    const oxyServices = { auth: { oauth: { exchangeCode: exchangeOAuthCode } } } as unknown as OxyServices;
+    const oxyServices = {
+      auth: { oauth: { exchangeCode: exchangeOAuthCode } },
+    } as unknown as OxyServices;
     sessionStorage.setItem(OXY_OAUTH_STATE_STORAGE_KEY, 'state-from-storage');
     sessionStorage.setItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, 'verifier-from-storage');
     window.history.replaceState({}, '', '/feed?code=code-2&state=state-from-storage');

package/src/ui/oauth/applicationSessionLane.ts

@@ -3,7 +3,9 @@ import type { OxyServices } from '@oxy.so/core';
 
 export function classifyApplicationSessionLane(metadata: unknown): 'device' | 'oauth' {
   const application = publicApplicationSchema.parse(metadata);
-  return application.type === 'third_party' && !application.isOfficial && !application.isInternal ? 'oauth' : 'device';
+  return application.type === 'third_party' && !application.isOfficial && !application.isInternal
+    ? 'oauth'
+    : 'device';
 }
 
 export const APPLICATION_CLASSIFICATION_DEADLINE_MS = 5000;
@@ -19,8 +21,15 @@ export async function resolveApplicationSessionLane(
   try {
     const metadata = await Promise.race([
       oxyServices.apps.getPublic(clientId, { cache: false }),
-      new Promise<never>((_, reject) => { timer = setTimeout(() => reject(new Error('Application classification timed out')), APPLICATION_CLASSIFICATION_DEADLINE_MS); }),
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error('Application classification timed out')),
+          APPLICATION_CLASSIFICATION_DEADLINE_MS,
+        );
+      }),
     ]);
     return classifyApplicationSessionLane(metadata);
-  } finally { if (timer !== undefined) clearTimeout(timer); }
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
 }

package/src/ui/oauth/browserAuthTransport.ts

@@ -20,7 +20,12 @@ import { redirectToAuthorize } from '../components/oauthNavigation';
 import { isWebBrowser } from '../utils/isWebBrowser';
 import { completeOAuthCode } from './completeOAuthCode';
 import { prepareAuthorizeRequest } from './oauthHandshake';
-import { awaitOAuthPopupResult, closeOAuthPopup, navigateOAuthPopup, openOAuthPopup } from './oauthPopup';
+import {
+  awaitOAuthPopupResult,
+  closeOAuthPopup,
+  navigateOAuthPopup,
+  openOAuthPopup,
+} from './oauthPopup';
 import type {
   OAuthPopupHandle,
   OAuthSessionCommitInput,
@@ -97,7 +102,8 @@ export async function startWebOAuthSignIn(
   // straight from the click still has gesture attribution. An explicit `null`
   // means the caller already tried and was blocked.
   const mode = options.transport ?? context.mode;
-  const popup = mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
+  const popup =
+    mode === 'popup' && options.popup === undefined ? openOAuthPopup() : (options.popup ?? null);
 
   if (mode === 'redirect') {
     closeOAuthPopup(popup);
@@ -190,11 +196,13 @@ async function startRedirectSignIn(
     ...(options.screen ? { screen: options.screen } : {}),
   });
 
-  if (!persistOAuthHandshake(
-    prepared.handshake.state,
-    prepared.handshake.codeVerifier,
-    options.redirectUri,
-  )) {
+  if (
+    !persistOAuthHandshake(
+      prepared.handshake.state,
+      prepared.handshake.codeVerifier,
+      options.redirectUri,
+    )
+  ) {
     return { status: 'failed', reason: 'handshake-storage' };
   }
 

package/src/ui/oauth/browserBridge.ts

@@ -122,7 +122,11 @@ export function readBridgeMessage(
   const data = event.data as Record<string, unknown> | null;
   if (typeof data !== 'object' || data === null) return { kind: 'ignore' };
   if (data.state !== context.expectedState) return { kind: 'ignore' };
-  if (data.type === OXY_BRIDGE_CODE_MESSAGE_TYPE && typeof data.code === 'string' && data.code.length > 0) {
+  if (
+    data.type === OXY_BRIDGE_CODE_MESSAGE_TYPE &&
+    typeof data.code === 'string' &&
+    data.code.length > 0
+  ) {
     return { kind: 'code', code: data.code };
   }
   if (data.type === OXY_BRIDGE_ERROR_MESSAGE_TYPE && typeof data.error === 'string') {
@@ -153,10 +157,16 @@ export type BrowserBridgeResult =
  * Drive an opened bridge window to a device credential for this app. Settles
  * exactly once, closes the window whatever the outcome, and never rejects.
  */
-export async function runBrowserBridge(options: RunBrowserBridgeOptions): Promise<BrowserBridgeResult> {
+export async function runBrowserBridge(
+  options: RunBrowserBridgeOptions,
+): Promise<BrowserBridgeResult> {
   const { popup, bridgeOrigin, oxyServices, clientId, redirectUri } = options;
   const host = bridgeHost();
-  if (!host || typeof host.addEventListener !== 'function' || typeof host.removeEventListener !== 'function') {
+  if (
+    !host ||
+    typeof host.addEventListener !== 'function' ||
+    typeof host.removeEventListener !== 'function'
+  ) {
     closeBridgeWindow(popup);
     return { ok: false, reason: 'no-browser' };
   }
@@ -204,7 +214,12 @@ export async function runBrowserBridge(options: RunBrowserBridgeOptions): Promis
 
 function awaitBridgeMessage(
   host: BridgeHost,
-  context: { popup: OAuthPopupHandle; expectedOrigin: string; expectedState: string; timeoutMs: number },
+  context: {
+    popup: OAuthPopupHandle;
+    expectedOrigin: string;
+    expectedState: string;
+    timeoutMs: number;
+  },
 ): Promise<{ kind: 'code'; code: string } | { kind: 'closed' | 'timed-out' | 'bridge-error' }> {
   return new Promise((resolve) => {
     let settled = false;
@@ -220,7 +235,9 @@ function awaitBridgeMessage(
       // The bridge posts and THEN closes; let an already-queued message win.
       closeGrace = setTimeout(() => settle({ kind: 'closed' }), CLOSE_GRACE_MS);
     }, CLOSE_POLL_INTERVAL_MS);
-    function settle(outcome: { kind: 'code'; code: string } | { kind: 'closed' | 'timed-out' | 'bridge-error' }): void {
+    function settle(
+      outcome: { kind: 'code'; code: string } | { kind: 'closed' | 'timed-out' | 'bridge-error' },
+    ): void {
       if (settled) return;
       settled = true;
       host.removeEventListener?.('message', onMessage);

package/src/ui/oauth/completeOAuthCode.ts

@@ -68,12 +68,15 @@ export async function completeOAuthCode(
   }
 
   try {
-    const result = await input.oxyServices.auth.oauth.exchangeCode({
-      code: input.code,
-      clientId: input.clientId,
-      redirectUri: input.redirectUri,
-      codeVerifier: input.handshake.codeVerifier,
-    }, { plantTokens: false });
+    const result = await input.oxyServices.auth.oauth.exchangeCode(
+      {
+        code: input.code,
+        clientId: input.clientId,
+        redirectUri: input.redirectUri,
+        codeVerifier: input.handshake.codeVerifier,
+      },
+      { plantTokens: false },
+    );
     runCleanup();
     await input.commitSession({
       sessionId: result.sessionId,

package/src/ui/oauth/nativeAuthTransport.ts

@@ -12,8 +12,20 @@ export interface StartNativeOAuthSignInOptions {
 export type NativeOAuthSignInResult =
   | { status: 'signed-in' }
   | { status: 'cancelled' }
-  | { status: 'unsupported'; reason: 'unsupported-platform' | 'missing-client-id' | 'identity-bound' | 'not-third-party' }
-  | { status: 'failed'; reason: 'invalid-redirect-uri' | 'client-resolution-failed' | 'native-callback-invalid' | 'state-mismatch' | 'exchange-failed' | 'already-in-progress' };
+  | {
+      status: 'unsupported';
+      reason: 'unsupported-platform' | 'missing-client-id' | 'identity-bound' | 'not-third-party';
+    }
+  | {
+      status: 'failed';
+      reason:
+        | 'invalid-redirect-uri'
+        | 'client-resolution-failed'
+        | 'native-callback-invalid'
+        | 'state-mismatch'
+        | 'exchange-failed'
+        | 'already-in-progress';
+    };
 export interface NativeOAuthSignInContext {
   platform: 'native' | 'unsupported';
   oxyServices: OxyServices;
@@ -28,9 +40,15 @@ function isExactRedirectUri(value: string): boolean {
   if (!value || value !== value.trim() || /\s/.test(value)) return false;
   try {
     const uri = new URL(value);
-    return !uri.username && !uri.password && !uri.hash &&
-      !['code', 'state', 'error', 'error_description'].some((key) => uri.searchParams.has(key));
-  } catch { return false; }
+    return (
+      !uri.username &&
+      !uri.password &&
+      !uri.hash &&
+      !['code', 'state', 'error', 'error_description'].some((key) => uri.searchParams.has(key))
+    );
+  } catch {
+    return false;
+  }
 }
 
 /** SDK owns the in-memory handshake, observed native callback and session commit. */
@@ -38,30 +56,65 @@ export async function startNativeOAuthSignIn(
   context: NativeOAuthSignInContext,
   options: StartNativeOAuthSignInOptions,
 ): Promise<NativeOAuthSignInResult> {
-  if (context.platform !== 'native') return { status: 'unsupported', reason: 'unsupported-platform' };
+  if (context.platform !== 'native')
+    return { status: 'unsupported', reason: 'unsupported-platform' };
   if (!context.clientId) return { status: 'unsupported', reason: 'missing-client-id' };
   if (context.identityBound) return { status: 'unsupported', reason: 'identity-bound' };
-  if (!isExactRedirectUri(options.redirectUri)) return { status: 'failed', reason: 'invalid-redirect-uri' };
+  if (!isExactRedirectUri(options.redirectUri))
+    return { status: 'failed', reason: 'invalid-redirect-uri' };
   if (attempts.has(context.oxyServices)) return { status: 'failed', reason: 'already-in-progress' };
   attempts.add(context.oxyServices);
   try {
     let lane: 'device' | 'oauth';
-    try { lane = await resolveApplicationSessionLane(context.oxyServices, context.clientId); }
-    catch { return { status: 'failed', reason: 'client-resolution-failed' }; }
+    try {
+      lane = await resolveApplicationSessionLane(context.oxyServices, context.clientId);
+    } catch {
+      return { status: 'failed', reason: 'client-resolution-failed' };
+    }
     if (lane !== 'oauth') return { status: 'unsupported', reason: 'not-third-party' };
-    const prepared = await prepareAuthorizeRequest({ clientId: context.clientId, redirectUri: options.redirectUri, authorizeBaseUrl: context.authorizeBaseUrl });
-    const { redirectUrl } = await openAuthorizeUrlNative(prepared.authorizeUrl, options.redirectUri, { allowExternalFallback: false });
+    const prepared = await prepareAuthorizeRequest({
+      clientId: context.clientId,
+      redirectUri: options.redirectUri,
+      authorizeBaseUrl: context.authorizeBaseUrl,
+    });
+    const { redirectUrl } = await openAuthorizeUrlNative(
+      prepared.authorizeUrl,
+      options.redirectUri,
+      { allowExternalFallback: false },
+    );
     if (!redirectUrl) return { status: 'cancelled' };
     const prefix = `${options.redirectUri}${options.redirectUri.includes('?') ? '&' : '?'}`;
-    if (!redirectUrl.startsWith(prefix) || redirectUrl.includes('#')) return { status: 'failed', reason: 'native-callback-invalid' };
+    if (!redirectUrl.startsWith(prefix) || redirectUrl.includes('#'))
+      return { status: 'failed', reason: 'native-callback-invalid' };
     const parameters = new URLSearchParams(redirectUrl.slice(prefix.length));
-    if ([...new URL(options.redirectUri).searchParams.keys()].some((key) => parameters.has(key))) return { status: 'failed', reason: 'native-callback-invalid' };
-    if (['code', 'state', 'error', 'error_description'].some((key) => parameters.getAll(key).length > 1)) return { status: 'failed', reason: 'native-callback-invalid' };
-    if (parameters.get('state') !== prepared.handshake.state) return { status: 'failed', reason: 'state-mismatch' };
+    if ([...new URL(options.redirectUri).searchParams.keys()].some((key) => parameters.has(key)))
+      return { status: 'failed', reason: 'native-callback-invalid' };
+    if (
+      ['code', 'state', 'error', 'error_description'].some(
+        (key) => parameters.getAll(key).length > 1,
+      )
+    )
+      return { status: 'failed', reason: 'native-callback-invalid' };
+    if (parameters.get('state') !== prepared.handshake.state)
+      return { status: 'failed', reason: 'state-mismatch' };
     const code = parameters.get('code');
-    if (parameters.has('error') || !code) return { status: 'failed', reason: 'native-callback-invalid' };
-    const completion = await completeOAuthCode({ oxyServices: context.oxyServices, clientId: context.clientId, code, returnedState: parameters.get('state'), handshake: prepared.handshake, redirectUri: options.redirectUri, commitSession: context.commitSession });
-    return completion.ok ? { status: 'signed-in' } : { status: 'failed', reason: completion.reason };
-  } catch { return { status: 'failed', reason: 'exchange-failed' }; }
-  finally { attempts.delete(context.oxyServices); }
+    if (parameters.has('error') || !code)
+      return { status: 'failed', reason: 'native-callback-invalid' };
+    const completion = await completeOAuthCode({
+      oxyServices: context.oxyServices,
+      clientId: context.clientId,
+      code,
+      returnedState: parameters.get('state'),
+      handshake: prepared.handshake,
+      redirectUri: options.redirectUri,
+      commitSession: context.commitSession,
+    });
+    return completion.ok
+      ? { status: 'signed-in' }
+      : { status: 'failed', reason: completion.reason };
+  } catch {
+    return { status: 'failed', reason: 'exchange-failed' };
+  } finally {
+    attempts.delete(context.oxyServices);
+  }
 }