@oxyhq/core 11.0.1 → 12.1.0

package/dist/cjs/index.js

@@ -11,7 +11,7 @@
  * ```ts
  * import { OxyServices, oxyClient } from '@oxyhq/core';
  *
- * const user = await oxyClient.signIn(publicKey);
+ * const user = await oxyClient.getCurrentUser();
  * ```
  *
  * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
@@ -21,7 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
 exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = void 0;
 exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = exports.isValidPassword = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -300,6 +300,7 @@ var officialOrigins_1 = require("./utils/officialOrigins");
 Object.defineProperty(exports, "buildIdpHubOrigin", { enumerable: true, get: function () { return officialOrigins_1.buildIdpHubOrigin; } });
 Object.defineProperty(exports, "buildHubSyncUrl", { enumerable: true, get: function () { return officialOrigins_1.buildHubSyncUrl; } });
 Object.defineProperty(exports, "isIdpHubOrigin", { enumerable: true, get: function () { return officialOrigins_1.isIdpHubOrigin; } });
+Object.defineProperty(exports, "isLoopbackOrigin", { enumerable: true, get: function () { return officialOrigins_1.isLoopbackOrigin; } });
 Object.defineProperty(exports, "isOfficialWebOrigin", { enumerable: true, get: function () { return officialOrigins_1.isOfficialWebOrigin; } });
 Object.defineProperty(exports, "isAllowedDeviceJoinOrigin", { enumerable: true, get: function () { return officialOrigins_1.isAllowedDeviceJoinOrigin; } });
 Object.defineProperty(exports, "normalizeOfficialReturnOrigin", { enumerable: true, get: function () { return officialOrigins_1.normalizeOfficialReturnOrigin; } });
@@ -335,9 +336,10 @@ Object.defineProperty(exports, "projectSwitchableAccounts", { enumerable: true,
 Object.defineProperty(exports, "switchableAccountIds", { enumerable: true, get: function () { return accountProjection_1.switchableAccountIds; } });
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
-// — no password/2FA logic (that lives at the IdP; `openPasswordAtOxyAuth` only
-// hands off). Reuses `SessionClient.switchAccount` / `oxyServices.switchToAccount`
-// for the uniform switch and the existing device-flow methods for sign-in.
+// — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
+// password, social login, and 2FA were removed ecosystem-wide. Reuses
+// `SessionClient.switchAccount` / `oxyServices.switchToAccount` for the uniform
+// switch and the existing device-flow methods for sign-in.
 var accountDialogController_1 = require("./session/accountDialogController");
 Object.defineProperty(exports, "AccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.AccountDialogController; } });
 Object.defineProperty(exports, "createAccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.createAccountDialogController; } });

package/dist/cjs/mixins/OxyServices.auth.js

@@ -741,117 +741,6 @@ function OxyServicesAuthMixin(Base) {
                 throw this.handleError(error);
             }
         }
-        /**
-         * Register a new user with email/username and password
-         */
-        async signUp(username, email, password, deviceName, deviceFingerprint) {
-            try {
-                const session = await this.makeRequest('POST', '/auth/signup', {
-                    username,
-                    email,
-                    password,
-                    deviceName,
-                    deviceFingerprint,
-                }, { cache: false });
-                return {
-                    ...session,
-                    user: (0, userIdentity_1.normalizeUserIdentity)(session.user),
-                };
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Sign in with email or username and password
-         */
-        async signIn(identifier, password, deviceName, deviceFingerprint) {
-            try {
-                const session = await this.makeRequest('POST', '/auth/login', {
-                    identifier,
-                    password,
-                    deviceName,
-                    deviceFingerprint,
-                }, { cache: false });
-                return {
-                    ...session,
-                    user: (0, userIdentity_1.normalizeUserIdentity)(session.user),
-                };
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Convenience helper for email sign-in
-         */
-        async signInWithEmail(email, password, deviceName, deviceFingerprint) {
-            return this.signIn(email, password, deviceName, deviceFingerprint);
-        }
-        /**
-         * Device-first password sign-in. Unlike the legacy {@link signIn} (which
-         * assumes a one-step session and is kept intact for existing callers until
-         * the F4 cutover), this returns the FULL `POST /auth/login` contract — the
-         * discriminated {@link LoginResult}: either a 2FA challenge
-         * (`{ twoFactorRequired, loginToken }`) to complete via
-         * {@link completeTwoFactorSignIn}, or a session arm.
-         *
-         * On the session arm, a returned access token is planted immediately
-         * (mirroring {@link verifyChallenge}), so the caller has an authenticated
-         * client without a second round-trip. The response's `deviceId` +
-         * `deviceSecret` are the zero-cookie restore credential the caller persists.
-         */
-        async passwordSignIn(identifier, password, options = {}) {
-            try {
-                const res = await this.makeRequest('POST', '/auth/login', {
-                    identifier,
-                    password,
-                    deviceName: options.deviceName,
-                    deviceFingerprint: options.deviceFingerprint,
-                    ...(options.deviceId ? { deviceId: options.deviceId } : {}),
-                }, { cache: false });
-                const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
-                if (!parsed) {
-                    throw new Error('auth/login returned an unexpected response shape');
-                }
-                if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
-                    this.setTokens(parsed.accessToken);
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Complete a 2FA-gated sign-in started by {@link passwordSignIn}. Presents
-         * the short-lived `loginToken` with either a TOTP `token` or a `backupCode`
-         * to `POST /security/2fa/verify-login`, which must resolve to the session
-         * arm of {@link LoginResult} (a second 2FA challenge here is a protocol
-         * error). A returned access token is planted immediately.
-         */
-        async completeTwoFactorSignIn(params) {
-            try {
-                const res = await this.makeRequest('POST', '/security/2fa/verify-login', {
-                    loginToken: params.loginToken,
-                    token: params.token,
-                    backupCode: params.backupCode,
-                    deviceName: params.deviceName,
-                    ...(params.deviceId ? { deviceId: params.deviceId } : {}),
-                }, { cache: false });
-                const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
-                if (!parsed || 'twoFactorRequired' in parsed) {
-                    throw new Error('security/2fa/verify-login returned an unexpected response shape');
-                }
-                if (parsed.accessToken) {
-                    this.setTokens(parsed.accessToken);
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
         /**
          * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
          * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
@@ -896,7 +785,7 @@ function OxyServicesAuthMixin(Base) {
                         if (!parsed) {
                             throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
                         }
-                        if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                        if (parsed.accessToken) {
                             this.setTokens(parsed.accessToken);
                         }
                         return parsed;
@@ -934,9 +823,9 @@ function OxyServicesAuthMixin(Base) {
          * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
          * browser `AuthenticationResponseJSON` (`response`) alongside the
          * device-session envelope. Resolves to the SAME {@link LoginResult} contract
-         * as `POST /auth/verify`; on the session arm the access token is planted
-         * immediately (mirroring {@link passwordSignIn}), and the response's
-         * `deviceId` + `deviceSecret` are the zero-cookie restore credential.
+         * as `POST /auth/verify`; the access token is planted immediately, and the
+         * response's `deviceId` + `deviceSecret` are the zero-cookie restore
+         * credential.
          */
         async webauthnLoginVerify(response, envelope = {}) {
             try {
@@ -945,7 +834,7 @@ function OxyServicesAuthMixin(Base) {
                 if (!parsed) {
                     throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
                 }
-                if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                if (parsed.accessToken) {
                     this.setTokens(parsed.accessToken);
                 }
                 return parsed;
@@ -956,7 +845,7 @@ function OxyServicesAuthMixin(Base) {
         }
         /**
          * Exchange an OAuth authorization code (returned to the RP redirect URI
-         * after password sign-in at auth.oxy.so) for a device-first session.
+         * after sign-in at auth.oxy.so) for a device-first session.
          * Public first-party clients use PKCE (`codeVerifier`); the access token is
          * planted immediately on success.
          */

package/dist/cjs/mixins/OxyServices.identity.js

@@ -104,15 +104,15 @@ function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * Link password authentication to the current account. Adds a `password`
-         * auth method (does not remove existing methods).
+         * Unlink an authentication method from the current account. The server
+         * refuses to remove the last remaining method (the account would become
+         * inaccessible). Unlinking `identity` downgrades the account to custodial.
          *
-         * @param email - The email to associate with password auth.
-         * @param password - The new password (server enforces strength rules).
+         * @param type - The auth-method type to remove.
          */
-        async linkPassword(email, password) {
+        async unlinkAuthMethod(type) {
             try {
-                const result = await this.makeRequest('POST', '/auth/link', { type: 'password', email, password }, { cache: false });
+                const result = await this.makeRequest('DELETE', `/auth/link/${encodeURIComponent(type)}`, undefined, { cache: false });
                 this._invalidateIdentityCaches(this.getCurrentUserId());
                 return result;
             }
@@ -121,15 +121,19 @@ function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * Unlink an authentication method from the current account. The server
-         * refuses to remove the last remaining method (the account would become
-         * inaccessible). Unlinking `identity` downgrades the account to custodial.
+         * Remove ONE passkey (WebAuthn credential) from the current account.
          *
-         * @param type - The auth-method type to remove.
+         * Passkeys are per-credential, so unlike {@link unlinkAuthMethod} (which
+         * removes an auth method by type) this targets a specific credential id.
+         * The server refuses to remove the last remaining auth method (the account
+         * would become inaccessible) and deletes the stored `WebauthnCredential`.
+         *
+         * @param credentialId - The passkey's public credential id
+         *   (`AuthMethodEntry.credentialId`).
          */
-        async unlinkAuthMethod(type) {
+        async removePasskey(credentialId) {
             try {
-                const result = await this.makeRequest('DELETE', `/auth/link/${encodeURIComponent(type)}`, undefined, { cache: false });
+                const result = await this.makeRequest('DELETE', `/auth/link/webauthn/${encodeURIComponent(credentialId)}`, undefined, { cache: false });
                 this._invalidateIdentityCaches(this.getCurrentUserId());
                 return result;
             }

package/dist/cjs/session/accountDialogController.js

@@ -13,26 +13,29 @@
  *   - the unified account list (via {@link projectSwitchableAccounts}), fetched
  *     from `SessionClient` state ∪ `oxyServices.listAccounts()` and hydrated
  *     with `oxyServices.getUsersByIds()`;
- *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add`);
+ *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add` |
+ *     `signup`);
  *   - `switchTo` (the uniform switch: `SessionClient.switchAccount` for an
  *     account already on the device, `oxyServices.switchToAccount` to mint on
  *     first entry into a graph account — reusing the existing SDK primitives, no
  *     new switch path);
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`).
+ *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *   - `commonsAvailability` — whether Commons is installed on this device
+ *     (native only, via the injected `canOpenApp` probe), so the QR view can
+ *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
- * It deliberately owns NO password/2FA logic — those live at the IdP
- * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
- * builds the hand-off URL; device-first convergence syncs the session back.
+ * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
+ * password, social login, and 2FA were removed ecosystem-wide. Account
+ * creation (`signup` view) is the same two identity backends: a passkey
+ * ceremony on web, or a Commons-created identity.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccountDialogController = void 0;
 exports.createAccountDialogController = createAccountDialogController;
 const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
-const authWebUrl_1 = require("../utils/authWebUrl");
-const oauthPkce_1 = require("../utils/oauthPkce");
 const accountProjection_1 = require("./accountProjection");
 /**
  * Slow FALLBACK poll cadence for the QR flow. The `/auth-session` socket delivers
@@ -70,6 +73,7 @@ class AccountDialogController {
         this.error = null;
         this.switchingAccountId = null;
         this.signIn = IDLE_SIGN_IN;
+        this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
         /** The secret device-flow token of the active QR flow (never surfaced). */
         this.signInToken = null;
@@ -98,9 +102,8 @@ class AccountDialogController {
         this.clientId = options.clientId ?? null;
         this.locale = options.locale;
         this.commitSession = options.commitSession;
+        this.commitSwitchedSession = options.commitSwitchedSession;
         this.onSignedIn = options.onSignedIn;
-        this.idpApex = options.idpApex ?? authWebUrl_1.CENTRAL_IDP_APEX;
-        this.authRedirectUri = options.authRedirectUri ?? null;
         this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
@@ -156,6 +159,11 @@ class AccountDialogController {
         // bearer is already planted (warm start); when signed out (cold boot before
         // restore) it re-projects from device state and makes NO private call.
         void this.refresh();
+        // Eager, cached Commons-availability probe (native only — a no-op when no
+        // `canOpenApp` was injected). It's a cheap local OS check, so by the time a
+        // user actually opens the sign-in entry it has almost always resolved —
+        // `showQr`'s own lazy probe below is only the safety net for the rare race.
+        void this.resolveCommonsAvailability();
     }
     /**
      * Stop driving the dialog: unsubscribe from `SessionClient` and tear down the
@@ -239,6 +247,10 @@ class AccountDialogController {
     add() {
         this.setView('add');
     }
+    /** Switch to the "create account" view (passkey / Commons signup entry). */
+    startSignup() {
+        this.setView('signup');
+    }
     // =========================================================================
     // Account list
     // =========================================================================
@@ -384,7 +396,11 @@ class AccountDialogController {
                     expiresAt: result.expiresAt,
                     user: result.user,
                     accessToken: result.accessToken,
-                }, result.user);
+                }, result.user, 
+                // A switch is IN-PLACE: commit without the hub-sync redirect (the
+                // device is already known/synced). Cross-tab/app propagation rides the
+                // server's `session_state` socket broadcast, not a navigation.
+                { fromSwitch: true });
             }
             // Re-project + refetch immediately; the subscription also fires.
             await this.refresh();
@@ -452,32 +468,63 @@ class AccountDialogController {
             // connect, so it now runs at the slow fallback cadence.
             this.openAuthSessionSocket(handle.sessionToken);
             this.scheduleNextPoll(handle.sessionToken);
-            // Same-device convenience: if Commons is installed (native only — `canOpenApp`
-            // is undefined/false on web), deep-link straight into its approve screen with
-            // the same `oxycommons://approve?...` payload the QR encodes. The QR + polling
+            // Same-device convenience: if Commons is confirmed installed (native
+            // only — stays `'unknown'` on web, where this never opens anything),
+            // deep-link straight into its approve screen with the same
+            // `oxycommons://approve?...` payload the QR encodes. The QR + polling
             // stay live as the fallback, so a user who dismisses the app-open still
             // completes the sign-in by scanning.
-            void this.maybeOpenCommons(handle.qrPayload);
+            void this.deepLinkIntoCommonsIfAvailable(handle.qrPayload);
         }
         catch (error) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
         }
     }
     /**
-     * When a `canOpenApp` probe is injected and reports Commons installed, open the
-     * approve deep link via the injected `openUrl`. Best-effort and non-blocking: a
-     * probe/open failure is logged and swallowed — the QR/polling fallback remains.
+     * Resolve whether Commons is installed on this device via the injected
+     * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
+     * observable snapshot state. Native only — a no-op when `canOpenApp` was
+     * not injected (web), where `commonsAvailability` stays `'unknown'` forever
+     * and the QR view renders unconditionally (no gating).
+     *
+     * Replaces the old `maybeOpenCommons` fire-and-forget probe, whose outcome
+     * was only ever reflected by whether Commons silently opened — a probe
+     * failure or "not installed" answer was swallowed into a debug log with no
+     * way for the UI to react. `commonsAvailability` fixes that.
      */
-    async maybeOpenCommons(qrPayload) {
-        if (!this.canOpenApp || !this.openUrl)
+    async resolveCommonsAvailability() {
+        if (!this.canOpenApp)
             return;
+        this.commonsAvailability = 'checking';
+        this.emit();
+        let available = false;
         try {
-            if (await this.canOpenApp(COMMONS_APP_SCHEME)) {
-                this.openUrl(qrPayload);
-            }
+            available = await this.canOpenApp(COMMONS_APP_SCHEME);
         }
         catch (error) {
-            logger_1.logger.debug('[AccountDialogController] Commons deep-link probe failed (QR fallback active)', { component: 'AccountDialogController' }, error);
+            logger_1.logger.debug('[AccountDialogController] Commons availability probe failed', { component: 'AccountDialogController' }, error);
+            available = false; // fail-closed — treat a probe error as "not installed"
+        }
+        this.commonsAvailability = available ? 'available' : 'unavailable';
+        this.emit();
+    }
+    /**
+     * When Commons is confirmed installed, deep-link straight into its approve
+     * screen via the injected `openUrl` with the same `oxycommons://approve?...`
+     * payload the QR encodes. Best-effort and non-blocking — the QR/polling
+     * fallback stays live regardless of the outcome here.
+     */
+    async deepLinkIntoCommonsIfAvailable(qrPayload) {
+        if (!this.openUrl)
+            return;
+        if (this.commonsAvailability === 'unknown' || this.commonsAvailability === 'checking') {
+            // The eager `start()` probe hasn't resolved yet (or was never run, e.g.
+            // `showQr` called without a prior `start()`) — resolve it now rather
+            // than skipping the deep link.
+            await this.resolveCommonsAvailability();
+        }
+        if (this.commonsAvailability === 'available') {
+            this.openUrl(qrPayload);
         }
     }
     /** Tear down the active sign-in device flow (timers + socket + token) and reset to idle. */
@@ -489,46 +536,6 @@ class AccountDialogController {
             this.setSignIn(IDLE_SIGN_IN);
         }
     }
-    /**
-     * Build (and, when an `openUrl` handler was supplied, open) the auth.oxy.so
-     * password sign-in URL. Password + 2FA are NOT in the SDK — they live at the
-     * IdP; this only hands off. Device-first: after login at the IdP the device
-     * session converges and the caller is woken via the device socket /
-     * `BroadcastChannel`, so the URL only needs to point at the IdP sign-in with
-     * the right return.
-     *
-     * @param params.returnUrl - Where the IdP returns after login. Defaults to the
-     *   current document URL on web (`globalThis.location.href`); pass explicitly
-     *   on native (no `location`).
-     * @param params.state - Optional opaque state echoed back on return.
-     * @returns The absolute auth.oxy.so sign-in URL.
-     */
-    async openPasswordAtOxyAuth(params = {}) {
-        const base = `https://auth.${this.idpApex}`;
-        const url = new URL('/login', base);
-        const rawRedirect = params.redirectUri ??
-            this.authRedirectUri ??
-            params.returnUrl ??
-            currentLocationOrigin();
-        const redirectUri = rawRedirect ? (0, oauthPkce_1.normalizeOAuthRedirectUri)(rawRedirect) : '';
-        if (redirectUri) {
-            url.searchParams.set('redirect_uri', redirectUri);
-        }
-        if (this.clientId) {
-            url.searchParams.set('client_id', this.clientId);
-        }
-        const state = params.state ?? (await (0, oauthPkce_1.generateOAuthState)());
-        url.searchParams.set('state', state);
-        const { codeChallenge, codeVerifier } = await (0, oauthPkce_1.generatePkcePair)();
-        url.searchParams.set('code_challenge', codeChallenge);
-        url.searchParams.set('code_challenge_method', 'S256');
-        if (!(0, oauthPkce_1.persistOAuthHandshake)(state, codeVerifier)) {
-            throw new Error('Could not persist OAuth handshake for password sign-in');
-        }
-        const href = url.toString();
-        this.openUrl?.(href);
-        return href;
-    }
     // =========================================================================
     // Internal sign-in helpers
     // =========================================================================
@@ -640,12 +647,21 @@ class AccountDialogController {
     }
     /**
      * Register a token-planted session into the device set. Prefers the
-     * consumer's `commitSession` (durable persist + hydration); falls back to
+     * consumer's commit funnel (durable persist + hydration); falls back to
      * `SessionClient.registerAndActivate` (registration + activation only).
+     *
+     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
+     * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
+     * `commitSession` (which may hub-sync on an official web origin). When the
+     * switch funnel is not wired it falls back to the sign-in funnel, then to
+     * `registerAndActivate`.
      */
-    async commitAuthorizedSession(session, user) {
-        if (this.commitSession) {
-            await this.commitSession(session);
+    async commitAuthorizedSession(session, user, opts) {
+        const commit = opts?.fromSwitch
+            ? this.commitSwitchedSession ?? this.commitSession
+            : this.commitSession;
+        if (commit) {
+            await commit(session);
         }
         else {
             await this.sessionClient.registerAndActivate(user.id);
@@ -757,6 +773,7 @@ class AccountDialogController {
             error: this.error,
             switchingAccountId: this.switchingAccountId,
             signIn: this.signIn,
+            commonsAvailability: this.commonsAvailability,
         };
     }
     /** Recompute the snapshot and notify subscribers. */
@@ -777,11 +794,3 @@ exports.AccountDialogController = AccountDialogController;
 function createAccountDialogController(options) {
     return new AccountDialogController(options);
 }
-// ---------------------------------------------------------------------------
-// Local helpers
-// ---------------------------------------------------------------------------
-/** Current document origin on web; empty string where `location` is absent (native/SSR). */
-function currentLocationOrigin() {
-    const location = globalThis.location;
-    return typeof location?.origin === 'string' ? location.origin : '';
-}

package/dist/cjs/utils/officialOrigins.js

@@ -7,6 +7,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAllowedDeviceJoinOrigin = void 0;
 exports.buildIdpHubOrigin = buildIdpHubOrigin;
 exports.isIdpHubOrigin = isIdpHubOrigin;
+exports.isLoopbackOrigin = isLoopbackOrigin;
 exports.isOfficialWebOrigin = isOfficialWebOrigin;
 exports.normalizeOfficialReturnOrigin = normalizeOfficialReturnOrigin;
 exports.parseHubSyncReturnUrl = parseHubSyncReturnUrl;
@@ -46,6 +47,11 @@ function isIdpHubOrigin() {
         return false;
     }
 }
+/**
+ * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
+ * or `[::1]` on any port, http or https). Local dev must never be bounced to a
+ * hosted IdP for cross-origin session restore.
+ */
 function isLoopbackOrigin(origin) {
     try {
         const parsed = new URL(origin);