@oxyhq/auth 2.0.8 → 2.0.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/README.md +3 -2
  2. package/dist/cjs/.tsbuildinfo +1 -1
  3. package/dist/cjs/WebOxyProvider.js +15 -34
  4. package/dist/cjs/hooks/useWebSSO.js +44 -7
  5. package/dist/esm/.tsbuildinfo +1 -1
  6. package/dist/esm/WebOxyProvider.js +15 -34
  7. package/dist/esm/hooks/useWebSSO.js +44 -7
  8. package/dist/types/.tsbuildinfo +1 -1
  9. package/package.json +1 -1
  10. package/src/WebOxyProvider.tsx +16 -34
  11. package/src/hooks/useWebSSO.ts +46 -7
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  OxyHQ Web Auth SDK. Headless React hooks for web applications. Zero React Native or Expo dependencies.
4
4
 
5
- **Current published version: 2.0.7**
5
+ **Current published version: 2.0.8**
6
6
 
7
7
  ## Installation
8
8
 
@@ -96,7 +96,8 @@ v1.x required passing 8+ props manually. In v2.0 all state is derived from conte
96
96
  ## FedCM (`useWebSSO`, `WebOxyProvider`)
97
97
 
98
98
  - Use W3C-spec `mode` values `'active'` / `'passive'`. The legacy `'button'` / `'widget'` values throw `TypeError` in current Chrome.
99
- - `WebOxyProvider` contains a `fedcmSilentSignInAttempted` flag; `useWebSSO` has a module-level `silentSSOAttempted` Set keyed on `origin+baseURL`. Together they ensure silent SSO fires exactly once per page load, surviving unmount/remount and StrictMode.
99
+ - **Silent SSO guard is centralized in `@oxyhq/core`** (`OxyServices.silentSignInWithFedCM()`). `useWebSSO` no longer owns a cross-mount guard — it keeps only a per-instance `hasCheckedRef` to skip redundant renders within the same mount.
100
+ - `WebOxyProvider` retains its own guard (keyed `origin+baseURL`) because its silent path also runs the `oxyServices.silentSignIn()` iframe/popup fallback, which the core FedCM memo does not cover.
100
101
  - Token exchange requires a server-minted nonce (`POST /fedcm/nonce`) — local UUID nonces are rejected.
101
102
 
102
103
  ## Offline-First Persistence