@oxyhq/core 11.0.0 → 12.0.0

package/dist/esm/index.js

@@ -10,7 +10,7 @@
  * ```ts
  * import { OxyServices, oxyClient } from '@oxyhq/core';
  *
- * const user = await oxyClient.signIn(publicKey);
+ * const user = await oxyClient.getCurrentUser();
  * ```
  *
  * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
@@ -130,13 +130,17 @@ export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccou
 // ---------------------------------------------------------------------------
 export { registrableApex } from './utils/registrableApex.js';
 export { CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
+// WebAuthn relying-party origin guard (client side). Mirrors the server's
+// `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
+// current page (first-party Oxy origin / loopback only).
+export { isOxyRpOrigin } from './utils/webauthnOrigin.js';
 export { runColdBoot } from './utils/coldBoot.js';
 // ---------------------------------------------------------------------------
 // OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
 // Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
 // ---------------------------------------------------------------------------
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, normalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, } from './utils/oauthPkce.js';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins.js';
+export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins.js';
 export { syncHubAfterSignIn, redeemHubTicketOnHub, } from './session/hubSync.js';
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
@@ -157,9 +161,10 @@ export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountId
 export { projectSwitchableAccounts, switchableAccountIds, } from './session/accountProjection.js';
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
-// — no password/2FA logic (that lives at the IdP; `openPasswordAtOxyAuth` only
-// hands off). Reuses `SessionClient.switchAccount` / `oxyServices.switchToAccount`
-// for the uniform switch and the existing device-flow methods for sign-in.
+// — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
+// password, social login, and 2FA were removed ecosystem-wide. Reuses
+// `SessionClient.switchAccount` / `oxyServices.switchToAccount` for the uniform
+// switch and the existing device-flow methods for sign-in.
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController.js';
 // ---------------------------------------------------------------------------
 // Device-first session machinery (zero-cookie transport).

package/dist/esm/mixins/OxyServices.auth.js

@@ -737,106 +737,97 @@ export function OxyServicesAuthMixin(Base) {
             }
         }
         /**
-         * Register a new user with email/username and password
+         * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
+         * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
+         * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
+         *
+         * With a bearer token planted this links a passkey to the signed-in account
+         * (`username` ignored); without one it is a prospective signup and `username`
+         * is the desired handle. The returned options are OPAQUE — Oxy does not own
+         * their shape (the browser / `@simplewebauthn` does), so they pass through
+         * as `unknown` for the caller to hand straight to the ceremony.
          */
-        async signUp(username, email, password, deviceName, deviceFingerprint) {
+        async webauthnRegisterOptions(username) {
             try {
-                const session = await this.makeRequest('POST', '/auth/signup', {
-                    username,
-                    email,
-                    password,
-                    deviceName,
-                    deviceFingerprint,
-                }, { cache: false });
-                return {
-                    ...session,
-                    user: normalizeUserIdentity(session.user),
-                };
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
             }
         }
         /**
-         * Sign in with email or username and password
-         */
-        async signIn(identifier, password, deviceName, deviceFingerprint) {
+         * Finish a WebAuthn / passkey REGISTRATION ceremony. Forwards the opaque
+         * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
+         * (desired `username` for signup + the device-session naming fields).
+         *
+         * Two server branches, disambiguated by the response shape:
+         *  - **Signup** (no bearer): the account is created and a session minted —
+         *    the response carries `sessionId`, is the SAME {@link LoginResult}
+         *    contract as `POST /auth/verify`, and its access token is planted here.
+         *  - **Link** (bearer present): the passkey is attached to the signed-in
+         *    account and the server returns `{ success, message }` with no session,
+         *    which is returned verbatim (no token planting).
+         */
+        async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const session = await this.makeRequest('POST', '/auth/login', {
-                    identifier,
-                    password,
-                    deviceName,
-                    deviceFingerprint,
-                }, { cache: false });
-                return {
-                    ...session,
-                    user: normalizeUserIdentity(session.user),
-                };
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                if (res && typeof res === 'object') {
+                    const record = res;
+                    // Signup branch: mints a session (LoginSessionResult, carries
+                    // `sessionId`). Parse against the login contract and plant the token.
+                    if ('sessionId' in record) {
+                        const parsed = safeParseContract(loginResultSchema, record);
+                        if (!parsed) {
+                            throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+                        }
+                        if (parsed.accessToken) {
+                            this.setTokens(parsed.accessToken);
+                        }
+                        return parsed;
+                    }
+                    // Link branch: passkey attached to the signed-in account, no session.
+                    if (record.success === true && typeof record.message === 'string') {
+                        return { success: true, message: record.message };
+                    }
+                }
+                throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
             }
             catch (error) {
                 throw this.handleError(error);
             }
         }
         /**
-         * Convenience helper for email sign-in
-         */
-        async signInWithEmail(email, password, deviceName, deviceFingerprint) {
-            return this.signIn(email, password, deviceName, deviceFingerprint);
-        }
-        /**
-         * Device-first password sign-in. Unlike the legacy {@link signIn} (which
-         * assumes a one-step session and is kept intact for existing callers until
-         * the F4 cutover), this returns the FULL `POST /auth/login` contract — the
-         * discriminated {@link LoginResult}: either a 2FA challenge
-         * (`{ twoFactorRequired, loginToken }`) to complete via
-         * {@link completeTwoFactorSignIn}, or a session arm.
+         * Begin a WebAuthn / passkey AUTHENTICATION ceremony. Requests the
+         * `PublicKeyCredentialRequestOptions` the browser's `navigator.credentials
+         * .get()` (or `@simplewebauthn/browser`'s `startAuthentication`) needs.
          *
-         * On the session arm, a returned access token is planted immediately
-         * (mirroring {@link verifyChallenge}), so the caller has an authenticated
-         * client without a second round-trip. The response's `deviceId` +
-         * `deviceSecret` are the zero-cookie restore credential the caller persists.
+         * When `username` is present the server scopes `allowCredentials` to that
+         * user's passkeys (username-first); when omitted it returns an empty
+         * allow-list for the usernameless / discoverable-credential flow. The
+         * returned options are OPAQUE and pass through as `unknown`.
          */
-        async passwordSignIn(identifier, password, options = {}) {
+        async webauthnLoginOptions(username) {
             try {
-                const res = await this.makeRequest('POST', '/auth/login', {
-                    identifier,
-                    password,
-                    deviceName: options.deviceName,
-                    deviceFingerprint: options.deviceFingerprint,
-                    ...(options.deviceId ? { deviceId: options.deviceId } : {}),
-                }, { cache: false });
-                const parsed = safeParseContract(loginResultSchema, res);
-                if (!parsed) {
-                    throw new Error('auth/login returned an unexpected response shape');
-                }
-                if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
-                    this.setTokens(parsed.accessToken);
-                }
-                return parsed;
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
             }
         }
         /**
-         * Complete a 2FA-gated sign-in started by {@link passwordSignIn}. Presents
-         * the short-lived `loginToken` with either a TOTP `token` or a `backupCode`
-         * to `POST /security/2fa/verify-login`, which must resolve to the session
-         * arm of {@link LoginResult} (a second 2FA challenge here is a protocol
-         * error). A returned access token is planted immediately.
+         * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
+         * browser `AuthenticationResponseJSON` (`response`) alongside the
+         * device-session envelope. Resolves to the SAME {@link LoginResult} contract
+         * as `POST /auth/verify`; the access token is planted immediately, and the
+         * response's `deviceId` + `deviceSecret` are the zero-cookie restore
+         * credential.
          */
-        async completeTwoFactorSignIn(params) {
+        async webauthnLoginVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/security/2fa/verify-login', {
-                    loginToken: params.loginToken,
-                    token: params.token,
-                    backupCode: params.backupCode,
-                    deviceName: params.deviceName,
-                    ...(params.deviceId ? { deviceId: params.deviceId } : {}),
-                }, { cache: false });
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
                 const parsed = safeParseContract(loginResultSchema, res);
-                if (!parsed || 'twoFactorRequired' in parsed) {
-                    throw new Error('security/2fa/verify-login returned an unexpected response shape');
+                if (!parsed) {
+                    throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
                 }
                 if (parsed.accessToken) {
                     this.setTokens(parsed.accessToken);
@@ -849,7 +840,7 @@ export function OxyServicesAuthMixin(Base) {
         }
         /**
          * Exchange an OAuth authorization code (returned to the RP redirect URI
-         * after password sign-in at auth.oxy.so) for a device-first session.
+         * after sign-in at auth.oxy.so) for a device-first session.
          * Public first-party clients use PKCE (`codeVerifier`); the access token is
          * planted immediately on success.
          */

package/dist/esm/mixins/OxyServices.identity.js

@@ -100,15 +100,15 @@ export function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * Link password authentication to the current account. Adds a `password`
-         * auth method (does not remove existing methods).
+         * Unlink an authentication method from the current account. The server
+         * refuses to remove the last remaining method (the account would become
+         * inaccessible). Unlinking `identity` downgrades the account to custodial.
          *
-         * @param email - The email to associate with password auth.
-         * @param password - The new password (server enforces strength rules).
+         * @param type - The auth-method type to remove.
          */
-        async linkPassword(email, password) {
+        async unlinkAuthMethod(type) {
             try {
-                const result = await this.makeRequest('POST', '/auth/link', { type: 'password', email, password }, { cache: false });
+                const result = await this.makeRequest('DELETE', `/auth/link/${encodeURIComponent(type)}`, undefined, { cache: false });
                 this._invalidateIdentityCaches(this.getCurrentUserId());
                 return result;
             }
@@ -117,15 +117,19 @@ export function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * Unlink an authentication method from the current account. The server
-         * refuses to remove the last remaining method (the account would become
-         * inaccessible). Unlinking `identity` downgrades the account to custodial.
+         * Remove ONE passkey (WebAuthn credential) from the current account.
          *
-         * @param type - The auth-method type to remove.
+         * Passkeys are per-credential, so unlike {@link unlinkAuthMethod} (which
+         * removes an auth method by type) this targets a specific credential id.
+         * The server refuses to remove the last remaining auth method (the account
+         * would become inaccessible) and deletes the stored `WebauthnCredential`.
+         *
+         * @param credentialId - The passkey's public credential id
+         *   (`AuthMethodEntry.credentialId`).
          */
-        async unlinkAuthMethod(type) {
+        async removePasskey(credentialId) {
             try {
-                const result = await this.makeRequest('DELETE', `/auth/link/${encodeURIComponent(type)}`, undefined, { cache: false });
+                const result = await this.makeRequest('DELETE', `/auth/link/webauthn/${encodeURIComponent(credentialId)}`, undefined, { cache: false });
                 this._invalidateIdentityCaches(this.getCurrentUserId());
                 return result;
             }

package/dist/esm/session/accountDialogController.js

@@ -21,14 +21,11 @@
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
  *     via `startCommonsSignIn` → poll → `claimSessionByToken`).
  *
- * It deliberately owns NO password/2FA logic — those live at the IdP
- * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
- * builds the hand-off URL; device-first convergence syncs the session back.
+ * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
+ * password, social login, and 2FA were removed ecosystem-wide.
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
-import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
-import { generateOAuthState, generatePkcePair, normalizeOAuthRedirectUri, persistOAuthHandshake, } from '../utils/oauthPkce.js';
 import { projectSwitchableAccounts, switchableAccountIds, } from './accountProjection.js';
 /**
  * Slow FALLBACK poll cadence for the QR flow. The `/auth-session` socket delivers
@@ -95,8 +92,6 @@ export class AccountDialogController {
         this.locale = options.locale;
         this.commitSession = options.commitSession;
         this.onSignedIn = options.onSignedIn;
-        this.idpApex = options.idpApex ?? CENTRAL_IDP_APEX;
-        this.authRedirectUri = options.authRedirectUri ?? null;
         this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
@@ -485,46 +480,6 @@ export class AccountDialogController {
             this.setSignIn(IDLE_SIGN_IN);
         }
     }
-    /**
-     * Build (and, when an `openUrl` handler was supplied, open) the auth.oxy.so
-     * password sign-in URL. Password + 2FA are NOT in the SDK — they live at the
-     * IdP; this only hands off. Device-first: after login at the IdP the device
-     * session converges and the caller is woken via the device socket /
-     * `BroadcastChannel`, so the URL only needs to point at the IdP sign-in with
-     * the right return.
-     *
-     * @param params.returnUrl - Where the IdP returns after login. Defaults to the
-     *   current document URL on web (`globalThis.location.href`); pass explicitly
-     *   on native (no `location`).
-     * @param params.state - Optional opaque state echoed back on return.
-     * @returns The absolute auth.oxy.so sign-in URL.
-     */
-    async openPasswordAtOxyAuth(params = {}) {
-        const base = `https://auth.${this.idpApex}`;
-        const url = new URL('/login', base);
-        const rawRedirect = params.redirectUri ??
-            this.authRedirectUri ??
-            params.returnUrl ??
-            currentLocationOrigin();
-        const redirectUri = rawRedirect ? normalizeOAuthRedirectUri(rawRedirect) : '';
-        if (redirectUri) {
-            url.searchParams.set('redirect_uri', redirectUri);
-        }
-        if (this.clientId) {
-            url.searchParams.set('client_id', this.clientId);
-        }
-        const state = params.state ?? (await generateOAuthState());
-        url.searchParams.set('state', state);
-        const { codeChallenge, codeVerifier } = await generatePkcePair();
-        url.searchParams.set('code_challenge', codeChallenge);
-        url.searchParams.set('code_challenge_method', 'S256');
-        if (!persistOAuthHandshake(state, codeVerifier)) {
-            throw new Error('Could not persist OAuth handshake for password sign-in');
-        }
-        const href = url.toString();
-        this.openUrl?.(href);
-        return href;
-    }
     // =========================================================================
     // Internal sign-in helpers
     // =========================================================================
@@ -772,11 +727,3 @@ export class AccountDialogController {
 export function createAccountDialogController(options) {
     return new AccountDialogController(options);
 }
-// ---------------------------------------------------------------------------
-// Local helpers
-// ---------------------------------------------------------------------------
-/** Current document origin on web; empty string where `location` is absent (native/SSR). */
-function currentLocationOrigin() {
-    const location = globalThis.location;
-    return typeof location?.origin === 'string' ? location.origin : '';
-}

package/dist/esm/utils/officialOrigins.js

@@ -37,7 +37,12 @@ export function isIdpHubOrigin() {
         return false;
     }
 }
-function isLoopbackOrigin(origin) {
+/**
+ * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
+ * or `[::1]` on any port, http or https). Local dev must never be bounced to a
+ * hosted IdP for cross-origin session restore.
+ */
+export function isLoopbackOrigin(origin) {
     try {
         const parsed = new URL(origin);
         if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {

package/dist/esm/utils/webauthnOrigin.js

@@ -0,0 +1,48 @@
+/**
+ * WebAuthn relying-party origin guard (client side).
+ *
+ * The passkey ceremonies (`OxyServices.webauthn*`) are only meaningful when the
+ * page is served from a first-party Oxy web origin: a credential minted with
+ * `WEBAUTHN_RP_ID=oxy.so` can only be created/asserted from `oxy.so`, one of its
+ * subdomains, or a loopback dev server. This is the browser-side mirror of the
+ * server's `isOxyApexOrigin` (`packages/api/src/utils/origin.ts`), which forms
+ * the server's `expectedOrigin` allow-set — consumers use it to decide whether to
+ * even offer the passkey UI on the current page.
+ *
+ * It reads `globalThis.location` directly (no argument) because that is the only
+ * origin the browser will let a WebAuthn ceremony run against. On native / SSR /
+ * any environment without a DOM `location`, it returns `false` (there is no
+ * relying-party origin, so passkeys are not applicable).
+ */
+/**
+ * True iff the current page's host is a first-party Oxy relying-party origin:
+ * `oxy.so`, any `*.oxy.so` subdomain, or a loopback dev host
+ * (`localhost` / `127.0.0.1` / `[::1]`).
+ *
+ * Fails closed: no `location` (native/SSR), a non-string/empty hostname, or a
+ * host that merely ends in the literal `oxy.so` without the dot boundary
+ * (`evil-oxy.so`, `oxy.so.evil.com`) all return `false`.
+ *
+ * @example
+ *   isOxyRpOrigin() // true  on https://accounts.oxy.so
+ *   isOxyRpOrigin() // true  on http://localhost:8081
+ *   isOxyRpOrigin() // false on https://evil.com
+ *   isOxyRpOrigin() // false in a React Native / SSR context (no location)
+ */
+export function isOxyRpOrigin() {
+    // `globalThis.location` is typed `Location` by the DOM lib, but is genuinely
+    // `undefined` on native/SSR — widen to a nullable local so the guard is a real
+    // runtime check, not a type-level no-op.
+    const location = globalThis.location;
+    if (!location || typeof location.hostname !== 'string') {
+        return false;
+    }
+    const hostname = location.hostname.toLowerCase();
+    if (hostname.length === 0) {
+        return false;
+    }
+    if (hostname === 'oxy.so' || hostname.endsWith('.oxy.so')) {
+        return true;
+    }
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}