@oxyhq/core 12.0.0 → 12.1.1

package/dist/cjs/session/accountDialogController.js

@@ -13,17 +13,23 @@
  *   - the unified account list (via {@link projectSwitchableAccounts}), fetched
  *     from `SessionClient` state ∪ `oxyServices.listAccounts()` and hydrated
  *     with `oxyServices.getUsersByIds()`;
- *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add`);
+ *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add` |
+ *     `signup`);
  *   - `switchTo` (the uniform switch: `SessionClient.switchAccount` for an
  *     account already on the device, `oxyServices.switchToAccount` to mint on
  *     first entry into a graph account — reusing the existing SDK primitives, no
  *     new switch path);
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`).
+ *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *   - `commonsAvailability` — whether Commons is installed on this device
+ *     (native only, via the injected `canOpenApp` probe), so the QR view can
+ *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
- * password, social login, and 2FA were removed ecosystem-wide.
+ * password, social login, and 2FA were removed ecosystem-wide. Account
+ * creation (`signup` view) is the same two identity backends: a passkey
+ * ceremony on web, or a Commons-created identity.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccountDialogController = void 0;
@@ -67,6 +73,7 @@ class AccountDialogController {
         this.error = null;
         this.switchingAccountId = null;
         this.signIn = IDLE_SIGN_IN;
+        this.commonsAvailability = 'unknown';
         // --- Sign-in device-flow bookkeeping ---
         /** The secret device-flow token of the active QR flow (never surfaced). */
         this.signInToken = null;
@@ -95,6 +102,7 @@ class AccountDialogController {
         this.clientId = options.clientId ?? null;
         this.locale = options.locale;
         this.commitSession = options.commitSession;
+        this.commitSwitchedSession = options.commitSwitchedSession;
         this.onSignedIn = options.onSignedIn;
         this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
         this.openUrl = options.openUrl;
@@ -151,6 +159,11 @@ class AccountDialogController {
         // bearer is already planted (warm start); when signed out (cold boot before
         // restore) it re-projects from device state and makes NO private call.
         void this.refresh();
+        // Eager, cached Commons-availability probe (native only — a no-op when no
+        // `canOpenApp` was injected). It's a cheap local OS check, so by the time a
+        // user actually opens the sign-in entry it has almost always resolved —
+        // `showQr`'s own lazy probe below is only the safety net for the rare race.
+        void this.resolveCommonsAvailability();
     }
     /**
      * Stop driving the dialog: unsubscribe from `SessionClient` and tear down the
@@ -234,6 +247,10 @@ class AccountDialogController {
     add() {
         this.setView('add');
     }
+    /** Switch to the "create account" view (passkey / Commons signup entry). */
+    startSignup() {
+        this.setView('signup');
+    }
     // =========================================================================
     // Account list
     // =========================================================================
@@ -379,7 +396,11 @@ class AccountDialogController {
                     expiresAt: result.expiresAt,
                     user: result.user,
                     accessToken: result.accessToken,
-                }, result.user);
+                }, result.user, 
+                // A switch is IN-PLACE: commit without the hub-sync redirect (the
+                // device is already known/synced). Cross-tab/app propagation rides the
+                // server's `session_state` socket broadcast, not a navigation.
+                { fromSwitch: true });
             }
             // Re-project + refetch immediately; the subscription also fires.
             await this.refresh();
@@ -447,32 +468,63 @@ class AccountDialogController {
             // connect, so it now runs at the slow fallback cadence.
             this.openAuthSessionSocket(handle.sessionToken);
             this.scheduleNextPoll(handle.sessionToken);
-            // Same-device convenience: if Commons is installed (native only — `canOpenApp`
-            // is undefined/false on web), deep-link straight into its approve screen with
-            // the same `oxycommons://approve?...` payload the QR encodes. The QR + polling
+            // Same-device convenience: if Commons is confirmed installed (native
+            // only — stays `'unknown'` on web, where this never opens anything),
+            // deep-link straight into its approve screen with the same
+            // `oxycommons://approve?...` payload the QR encodes. The QR + polling
             // stay live as the fallback, so a user who dismisses the app-open still
             // completes the sign-in by scanning.
-            void this.maybeOpenCommons(handle.qrPayload);
+            void this.deepLinkIntoCommonsIfAvailable(handle.qrPayload);
         }
         catch (error) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
         }
     }
     /**
-     * When a `canOpenApp` probe is injected and reports Commons installed, open the
-     * approve deep link via the injected `openUrl`. Best-effort and non-blocking: a
-     * probe/open failure is logged and swallowed — the QR/polling fallback remains.
+     * Resolve whether Commons is installed on this device via the injected
+     * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
+     * observable snapshot state. Native only — a no-op when `canOpenApp` was
+     * not injected (web), where `commonsAvailability` stays `'unknown'` forever
+     * and the QR view renders unconditionally (no gating).
+     *
+     * Replaces the old `maybeOpenCommons` fire-and-forget probe, whose outcome
+     * was only ever reflected by whether Commons silently opened — a probe
+     * failure or "not installed" answer was swallowed into a debug log with no
+     * way for the UI to react. `commonsAvailability` fixes that.
      */
-    async maybeOpenCommons(qrPayload) {
-        if (!this.canOpenApp || !this.openUrl)
+    async resolveCommonsAvailability() {
+        if (!this.canOpenApp)
             return;
+        this.commonsAvailability = 'checking';
+        this.emit();
+        let available = false;
         try {
-            if (await this.canOpenApp(COMMONS_APP_SCHEME)) {
-                this.openUrl(qrPayload);
-            }
+            available = await this.canOpenApp(COMMONS_APP_SCHEME);
         }
         catch (error) {
-            logger_1.logger.debug('[AccountDialogController] Commons deep-link probe failed (QR fallback active)', { component: 'AccountDialogController' }, error);
+            logger_1.logger.debug('[AccountDialogController] Commons availability probe failed', { component: 'AccountDialogController' }, error);
+            available = false; // fail-closed — treat a probe error as "not installed"
+        }
+        this.commonsAvailability = available ? 'available' : 'unavailable';
+        this.emit();
+    }
+    /**
+     * When Commons is confirmed installed, deep-link straight into its approve
+     * screen via the injected `openUrl` with the same `oxycommons://approve?...`
+     * payload the QR encodes. Best-effort and non-blocking — the QR/polling
+     * fallback stays live regardless of the outcome here.
+     */
+    async deepLinkIntoCommonsIfAvailable(qrPayload) {
+        if (!this.openUrl)
+            return;
+        if (this.commonsAvailability === 'unknown' || this.commonsAvailability === 'checking') {
+            // The eager `start()` probe hasn't resolved yet (or was never run, e.g.
+            // `showQr` called without a prior `start()`) — resolve it now rather
+            // than skipping the deep link.
+            await this.resolveCommonsAvailability();
+        }
+        if (this.commonsAvailability === 'available') {
+            this.openUrl(qrPayload);
         }
     }
     /** Tear down the active sign-in device flow (timers + socket + token) and reset to idle. */
@@ -595,12 +647,21 @@ class AccountDialogController {
     }
     /**
      * Register a token-planted session into the device set. Prefers the
-     * consumer's `commitSession` (durable persist + hydration); falls back to
+     * consumer's commit funnel (durable persist + hydration); falls back to
      * `SessionClient.registerAndActivate` (registration + activation only).
+     *
+     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
+     * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
+     * `commitSession` (which may hub-sync on an official web origin). When the
+     * switch funnel is not wired it falls back to the sign-in funnel, then to
+     * `registerAndActivate`.
      */
-    async commitAuthorizedSession(session, user) {
-        if (this.commitSession) {
-            await this.commitSession(session);
+    async commitAuthorizedSession(session, user, opts) {
+        const commit = opts?.fromSwitch
+            ? this.commitSwitchedSession ?? this.commitSession
+            : this.commitSession;
+        if (commit) {
+            await commit(session);
         }
         else {
             await this.sessionClient.registerAndActivate(user.id);
@@ -712,6 +773,7 @@ class AccountDialogController {
             error: this.error,
             switchingAccountId: this.switchingAccountId,
             signIn: this.signIn,
+            commonsAvailability: this.commonsAvailability,
         };
     }
     /** Recompute the snapshot and notify subscribers. */