@oxyhq/core 12.1.1 → 12.2.0

package/dist/esm/i18n/locales/ar-SA.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "متاح",
         "usernameTaken": "اسم المستخدم هذا مستخدم بالفعل",
         "backToSignInLink": "لديك حساب بالفعل؟ سجّل الدخول",
-        "notAvailableHere": "‏إنشاء الحساب غير متاح في هذا التطبيق بعد — أنشئ هويتك باستخدام Commons، أو تفضّل بزيارة oxy.so للتسجيل باستخدام مفتاح مرور.",
+        "hubExplainer": "أنشئ هوية Oxy الخاصة بك في نافذة آمنة، ثم عد إلى هنا مباشرة.",
+        "continueInWindow": "المتابعة في نافذة جديدة",
         "welcome": {
             "title": "مرحبًا بك في Oxy!",
             "subtitle": "أنشئ حسابك في خطوات قليلة",

package/dist/esm/i18n/locales/ca-ES.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "Disponible",
         "usernameTaken": "Aquest nom d'usuari ja està en ús",
         "backToSignInLink": "Ja tens compte? Inicia sessió",
-        "notAvailableHere": "La creació de comptes encara no està disponible en aquesta app: crea la teva identitat amb Commons o visita oxy.so per registrar-te amb una clau d'accés.",
+        "hubExplainer": "Crea la teva Oxy ID en una finestra segura i torna de seguida.",
+        "continueInWindow": "Continua en una finestra nova",
         "welcome": {
             "title": "Benvingut a Oxy!",
             "subtitle": "Crea el teu compte en pocs passos",

package/dist/esm/i18n/locales/de-DE.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "Verfügbar",
         "usernameTaken": "Dieser Benutzername ist bereits vergeben",
         "backToSignInLink": "Sie haben bereits ein Konto? Anmelden",
-        "notAvailableHere": "Die Kontoerstellung ist in dieser App noch nicht verfügbar – erstellen Sie Ihre Identität mit Commons oder besuchen Sie oxy.so, um sich mit einem Passkey zu registrieren.",
+        "hubExplainer": "Erstellen Sie Ihre Oxy-ID in einem sicheren Fenster und kehren Sie dann direkt zurück.",
+        "continueInWindow": "In einem neuen Fenster fortfahren",
         "welcome": {
             "title": "Willkommen bei Oxy!",
             "subtitle": "Erstellen Sie Ihr Konto in nur wenigen Schritten",

package/dist/esm/i18n/locales/en-US.json

@@ -68,7 +68,8 @@
         "usernameAvailable": "Available",
         "usernameTaken": "This username is taken",
         "backToSignInLink": "Already have an account? Sign in",
-        "notAvailableHere": "Account creation isn't available in this app yet — create your identity with Commons, or visit oxy.so to sign up with a passkey.",
+        "hubExplainer": "Create your Oxy ID in a secure window, then come right back.",
+        "continueInWindow": "Continue in a new window",
         "welcome": {
             "title": "Welcome to Oxy!",
             "subtitle": "Let's create your account in just a few steps",

package/dist/esm/i18n/locales/es-ES.json

@@ -68,7 +68,8 @@
         "usernameAvailable": "Disponible",
         "usernameTaken": "Este usuario ya está en uso",
         "backToSignInLink": "¿Ya tienes cuenta? Inicia sesión",
-        "notAvailableHere": "La creación de cuentas aún no está disponible en esta app: crea tu identidad con Commons o visita oxy.so para registrarte con una clave de acceso.",
+        "hubExplainer": "Crea tu Oxy ID en una ventana segura y vuelve enseguida.",
+        "continueInWindow": "Continuar en una ventana nueva",
         "welcome": {
             "title": "¡Te damos la bienvenida a Oxy!",
             "subtitle": "Crea tu cuenta en pocos pasos",

package/dist/esm/i18n/locales/fr-FR.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "Disponible",
         "usernameTaken": "Ce nom d'utilisateur est déjà pris",
         "backToSignInLink": "Vous avez déjà un compte ? Connectez-vous",
-        "notAvailableHere": "La création de compte n'est pas encore disponible dans cette app — créez votre identité avec Commons, ou rendez-vous sur oxy.so pour vous inscrire avec une clé d'accès.",
+        "hubExplainer": "Créez votre Oxy ID dans une fenêtre sécurisée, puis revenez directement.",
+        "continueInWindow": "Continuer dans une nouvelle fenêtre",
         "welcome": {
             "title": "Bienvenue sur Oxy !",
             "subtitle": "Créez votre compte en quelques étapes",

package/dist/esm/i18n/locales/it-IT.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "Disponibile",
         "usernameTaken": "Questo nome utente è già in uso",
         "backToSignInLink": "Hai già un account? Accedi",
-        "notAvailableHere": "La creazione dell'account non è ancora disponibile in questa app: crea la tua identità con Commons oppure visita oxy.so per registrarti con una passkey.",
+        "hubExplainer": "Crea il tuo Oxy ID in una finestra sicura, poi torna subito qui.",
+        "continueInWindow": "Continua in una nuova finestra",
         "welcome": {
             "title": "Benvenuto su Oxy!",
             "subtitle": "Crea il tuo account in pochi passaggi",

package/dist/esm/i18n/locales/ja-JP.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "利用可能",
         "usernameTaken": "このユーザー名は既に使用されています",
         "backToSignInLink": "すでにアカウントをお持ちですか？サインイン",
-        "notAvailableHere": "このアプリではまだアカウントを作成できません。Commonsでアイデンティティを作成するか、oxy.soにアクセスしてパスキーで登録してください。",
+        "hubExplainer": "安全なウィンドウでOxy IDを作成し、すぐに戻ってきてください。",
+        "continueInWindow": "新しいウィンドウで続ける",
         "welcome": {
             "title": "Oxyへようこそ！",
             "subtitle": "数ステップでアカウントを作成",

package/dist/esm/i18n/locales/ko-KR.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "사용 가능",
         "usernameTaken": "이미 사용 중인 사용자 이름입니다",
         "backToSignInLink": "이미 계정이 있으신가요? 로그인",
-        "notAvailableHere": "이 앱에서는 아직 계정을 만들 수 없습니다. Commons로 아이덴티티를 만들거나 oxy.so에서 패스키로 가입하세요.",
+        "hubExplainer": "안전한 창에서 Oxy ID를 만든 후 바로 돌아오세요.",
+        "continueInWindow": "새 창에서 계속하기",
         "welcome": {
             "title": "Oxy에 오신 것을 환영합니다!",
             "subtitle": "몇 단계만으로 계정을 만드세요",

package/dist/esm/i18n/locales/locales/ar-SA.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "متاح",
     "usernameTaken": "اسم المستخدم هذا مستخدم بالفعل",
     "backToSignInLink": "لديك حساب بالفعل؟ سجّل الدخول",
-    "notAvailableHere": "‏إنشاء الحساب غير متاح في هذا التطبيق بعد — أنشئ هويتك باستخدام Commons، أو تفضّل بزيارة oxy.so للتسجيل باستخدام مفتاح مرور.",
+    "hubExplainer": "أنشئ هوية Oxy الخاصة بك في نافذة آمنة، ثم عد إلى هنا مباشرة.",
+    "continueInWindow": "المتابعة في نافذة جديدة",
     "welcome": {
       "title": "مرحبًا بك في Oxy!",
       "subtitle": "أنشئ حسابك في خطوات قليلة",

package/dist/esm/i18n/locales/locales/ca-ES.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "Disponible",
     "usernameTaken": "Aquest nom d'usuari ja està en ús",
     "backToSignInLink": "Ja tens compte? Inicia sessió",
-    "notAvailableHere": "La creació de comptes encara no està disponible en aquesta app: crea la teva identitat amb Commons o visita oxy.so per registrar-te amb una clau d'accés.",
+    "hubExplainer": "Crea la teva Oxy ID en una finestra segura i torna de seguida.",
+    "continueInWindow": "Continua en una finestra nova",
     "welcome": {
       "title": "Benvingut a Oxy!",
       "subtitle": "Crea el teu compte en pocs passos",

package/dist/esm/i18n/locales/locales/de-DE.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "Verfügbar",
     "usernameTaken": "Dieser Benutzername ist bereits vergeben",
     "backToSignInLink": "Sie haben bereits ein Konto? Anmelden",
-    "notAvailableHere": "Die Kontoerstellung ist in dieser App noch nicht verfügbar – erstellen Sie Ihre Identität mit Commons oder besuchen Sie oxy.so, um sich mit einem Passkey zu registrieren.",
+    "hubExplainer": "Erstellen Sie Ihre Oxy-ID in einem sicheren Fenster und kehren Sie dann direkt zurück.",
+    "continueInWindow": "In einem neuen Fenster fortfahren",
     "welcome": {
       "title": "Willkommen bei Oxy!",
       "subtitle": "Erstellen Sie Ihr Konto in nur wenigen Schritten",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -68,7 +68,8 @@
     "usernameAvailable": "Available",
     "usernameTaken": "This username is taken",
     "backToSignInLink": "Already have an account? Sign in",
-    "notAvailableHere": "Account creation isn't available in this app yet — create your identity with Commons, or visit oxy.so to sign up with a passkey.",
+    "hubExplainer": "Create your Oxy ID in a secure window, then come right back.",
+    "continueInWindow": "Continue in a new window",
     "welcome": {
       "title": "Welcome to Oxy!",
       "subtitle": "Let's create your account in just a few steps",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -68,7 +68,8 @@
     "usernameAvailable": "Disponible",
     "usernameTaken": "Este usuario ya está en uso",
     "backToSignInLink": "¿Ya tienes cuenta? Inicia sesión",
-    "notAvailableHere": "La creación de cuentas aún no está disponible en esta app: crea tu identidad con Commons o visita oxy.so para registrarte con una clave de acceso.",
+    "hubExplainer": "Crea tu Oxy ID en una ventana segura y vuelve enseguida.",
+    "continueInWindow": "Continuar en una ventana nueva",
     "welcome": {
       "title": "¡Te damos la bienvenida a Oxy!",
       "subtitle": "Crea tu cuenta en pocos pasos",

package/dist/esm/i18n/locales/locales/fr-FR.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "Disponible",
     "usernameTaken": "Ce nom d'utilisateur est déjà pris",
     "backToSignInLink": "Vous avez déjà un compte ? Connectez-vous",
-    "notAvailableHere": "La création de compte n'est pas encore disponible dans cette app — créez votre identité avec Commons, ou rendez-vous sur oxy.so pour vous inscrire avec une clé d'accès.",
+    "hubExplainer": "Créez votre Oxy ID dans une fenêtre sécurisée, puis revenez directement.",
+    "continueInWindow": "Continuer dans une nouvelle fenêtre",
     "welcome": {
       "title": "Bienvenue sur Oxy !",
       "subtitle": "Créez votre compte en quelques étapes",

package/dist/esm/i18n/locales/locales/it-IT.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "Disponibile",
     "usernameTaken": "Questo nome utente è già in uso",
     "backToSignInLink": "Hai già un account? Accedi",
-    "notAvailableHere": "La creazione dell'account non è ancora disponibile in questa app: crea la tua identità con Commons oppure visita oxy.so per registrarti con una passkey.",
+    "hubExplainer": "Crea il tuo Oxy ID in una finestra sicura, poi torna subito qui.",
+    "continueInWindow": "Continua in una nuova finestra",
     "welcome": {
       "title": "Benvenuto su Oxy!",
       "subtitle": "Crea il tuo account in pochi passaggi",

package/dist/esm/i18n/locales/locales/ja-JP.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "利用可能",
     "usernameTaken": "このユーザー名は既に使用されています",
     "backToSignInLink": "すでにアカウントをお持ちですか？サインイン",
-    "notAvailableHere": "このアプリではまだアカウントを作成できません。Commonsでアイデンティティを作成するか、oxy.soにアクセスしてパスキーで登録してください。",
+    "hubExplainer": "安全なウィンドウでOxy IDを作成し、すぐに戻ってきてください。",
+    "continueInWindow": "新しいウィンドウで続ける",
     "welcome": {
       "title": "Oxyへようこそ！",
       "subtitle": "数ステップでアカウントを作成",

package/dist/esm/i18n/locales/locales/ko-KR.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "사용 가능",
     "usernameTaken": "이미 사용 중인 사용자 이름입니다",
     "backToSignInLink": "이미 계정이 있으신가요? 로그인",
-    "notAvailableHere": "이 앱에서는 아직 계정을 만들 수 없습니다. Commons로 아이덴티티를 만들거나 oxy.so에서 패스키로 가입하세요.",
+    "hubExplainer": "안전한 창에서 Oxy ID를 만든 후 바로 돌아오세요.",
+    "continueInWindow": "새 창에서 계속하기",
     "welcome": {
       "title": "Oxy에 오신 것을 환영합니다!",
       "subtitle": "몇 단계만으로 계정을 만드세요",

package/dist/esm/i18n/locales/locales/pt-PT.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "Disponível",
     "usernameTaken": "Este nome de utilizador já está em uso",
     "backToSignInLink": "Já tem uma conta? Inicie sessão",
-    "notAvailableHere": "A criação de conta ainda não está disponível nesta app: crie a sua identidade com o Commons ou visite oxy.so para se registar com uma chave de acesso.",
+    "hubExplainer": "Crie a sua Oxy ID numa janela segura e volte de seguida.",
+    "continueInWindow": "Continuar numa nova janela",
     "welcome": {
       "title": "Bem-vindo ao Oxy!",
       "subtitle": "Crie a sua conta em poucos passos",

package/dist/esm/i18n/locales/locales/zh-CN.json

@@ -61,7 +61,8 @@
     "usernameAvailable": "可用",
     "usernameTaken": "该用户名已被占用",
     "backToSignInLink": "已有账户？登录",
-    "notAvailableHere": "此应用暂不支持创建账户——请使用 Commons 创建您的身份，或访问 oxy.so 使用通行密钥注册。",
+    "hubExplainer": "在安全窗口中创建您的 Oxy ID，然后立即返回。",
+    "continueInWindow": "在新窗口中继续",
     "welcome": {
       "title": "欢迎使用Oxy！",
       "subtitle": "只需几步即可创建您的账户",

package/dist/esm/i18n/locales/pt-PT.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "Disponível",
         "usernameTaken": "Este nome de utilizador já está em uso",
         "backToSignInLink": "Já tem uma conta? Inicie sessão",
-        "notAvailableHere": "A criação de conta ainda não está disponível nesta app: crie a sua identidade com o Commons ou visite oxy.so para se registar com uma chave de acesso.",
+        "hubExplainer": "Crie a sua Oxy ID numa janela segura e volte de seguida.",
+        "continueInWindow": "Continuar numa nova janela",
         "welcome": {
             "title": "Bem-vindo ao Oxy!",
             "subtitle": "Crie a sua conta em poucos passos",

package/dist/esm/i18n/locales/zh-CN.json

@@ -61,7 +61,8 @@
         "usernameAvailable": "可用",
         "usernameTaken": "该用户名已被占用",
         "backToSignInLink": "已有账户？登录",
-        "notAvailableHere": "此应用暂不支持创建账户——请使用 Commons 创建您的身份，或访问 oxy.so 使用通行密钥注册。",
+        "hubExplainer": "在安全窗口中创建您的 Oxy ID，然后立即返回。",
+        "continueInWindow": "在新窗口中继续",
         "welcome": {
             "title": "欢迎使用Oxy！",
             "subtitle": "只需几步即可创建您的账户",

package/dist/esm/session/accountDialogController.js

@@ -24,6 +24,12 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
+ *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
+ *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
+ *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
+ *     session `showQr` creates, and complete it via the SAME poll/socket/claim
+ *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
+ *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -32,6 +38,7 @@
  */
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
+import { CENTRAL_IDP_APEX } from '../utils/authWebUrl.js';
 import { projectSwitchableAccounts, switchableAccountIds, } from './accountProjection.js';
 /**
  * Slow FALLBACK poll cadence for the QR flow. The `/auth-session` socket delivers
@@ -86,6 +93,10 @@ export class AccountDialogController {
          * single-use token concurrently.
          */
         this.pollInFlight = false;
+        /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
+        this.activePopup = null;
+        /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
+        this.popupWatchTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
         this.unsubscribeTokens = null;
@@ -104,6 +115,8 @@ export class AccountDialogController {
         this.openUrl = options.openUrl;
         this.canOpenApp = options.canOpenApp;
         this.socketFactory = options.socketFactory;
+        this.openPopup = options.openPopup;
+        this.hubBaseUrl = options.hubBaseUrl ?? `https://auth.${CENTRAL_IDP_APEX}`;
         this.snapshot = this.computeSnapshot();
     }
     // =========================================================================
@@ -177,6 +190,7 @@ export class AccountDialogController {
         }
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signInToken = null;
         this.listeners.clear();
     }
@@ -444,9 +458,62 @@ export class AccountDialogController {
     async showQr() {
         this.cancelSignIn();
         this.setView('qr');
+        await this.startDeviceFlowSession();
+    }
+    /**
+     * Web-only: "Sign in with a passkey" on a non-Oxy origin cannot run the
+     * WebAuthn ceremony locally — a credential minted with `WEBAUTHN_RP_ID=oxy.so`
+     * can only be asserted from `oxy.so`/a subdomain/loopback, a browser-enforced
+     * boundary `isOxyRpOrigin()` (consumer-side) already gates on. Instead, open
+     * a popup at the auth.oxy.so passkey hub, scoped to the SAME device-flow
+     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
+     * pair), and let the SAME poll/socket/claim engine complete it once the hub
+     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
+     * bearer-authed, server-side — this method never sees or transmits the
+     * secret `sessionToken`).
+     *
+     * The popup MUST be opened synchronously, before any `await`, or the
+     * browser's popup blocker loses the click-gesture attribution and silently
+     * blocks it — so {@link openPopup} is invoked as the very first step, before
+     * the device-flow session (which needs an async call) even exists. If the
+     * popup is blocked (or no `openPopup` was injected), this falls back to
+     * `showQr`'s plain QR rendering — no dead end.
+     */
+    async startPasskeyHubSignIn() {
+        this.cancelSignIn();
+        this.setView('qr');
+        const popup = this.openPopup?.() ?? null;
+        if (!popup) {
+            await this.startDeviceFlowSession();
+            return;
+        }
+        const handle = await this.startDeviceFlowSession();
+        if (!handle) {
+            popup.close();
+            return;
+        }
+        // The user may have closed the popup during the async session creation
+        // above, before any watcher was attached to catch it — guard rather than
+        // navigate a dead window (browsers vary on whether that throws).
+        if (popup.closed) {
+            this.failSignIn('Sign-in was cancelled.');
+            return;
+        }
+        this.activePopup = popup;
+        popup.location.href = `${this.hubBaseUrl}/hub-passkey?code=${encodeURIComponent(handle.authorizeCode)}`;
+        this.watchPopup(popup);
+    }
+    /**
+     * Shared device-flow session creation for both {@link showQr} (renders the
+     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
+     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * handle on success (already reflected in `signIn`), or `null` on failure
+     * (already set as `signIn.error`).
+     */
+    async startDeviceFlowSession() {
         if (!this.clientId) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: 'This app is not configured for sign-in (missing clientId).' });
-            return;
+            return null;
         }
         this.setSignIn({ ...IDLE_SIGN_IN, phase: 'starting' });
         try {
@@ -471,9 +538,49 @@ export class AccountDialogController {
             // stay live as the fallback, so a user who dismisses the app-open still
             // completes the sign-in by scanning.
             void this.deepLinkIntoCommonsIfAvailable(handle.qrPayload);
+            return handle;
         }
         catch (error) {
             this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
+            return null;
+        }
+    }
+    /**
+     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
+     * popup without completing sign-in gets prompt feedback (there is no DOM
+     * event for a cross-origin popup closing — polling is the only mechanism).
+     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
+     * calls.
+     */
+    watchPopup(popup) {
+        this.clearPopupWatchTimer();
+        this.popupWatchTimer = setInterval(() => {
+            if (!popup.closed)
+                return;
+            this.clearPopupWatchTimer();
+            if (this.signIn.phase === 'starting' || this.signIn.phase === 'waiting') {
+                this.failSignIn('Sign-in was cancelled.');
+            }
+        }, 1000);
+    }
+    clearPopupWatchTimer() {
+        if (this.popupWatchTimer !== null) {
+            clearInterval(this.popupWatchTimer);
+            this.popupWatchTimer = null;
+        }
+    }
+    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
+    closeActivePopup() {
+        this.clearPopupWatchTimer();
+        const popup = this.activePopup;
+        this.activePopup = null;
+        if (!popup || popup.closed)
+            return;
+        try {
+            popup.close();
+        }
+        catch (error) {
+            logger.debug('[AccountDialogController] popup close failed', { component: 'AccountDialogController' }, error);
         }
     }
     /**
@@ -523,10 +630,11 @@ export class AccountDialogController {
             this.openUrl(qrPayload);
         }
     }
-    /** Tear down the active sign-in device flow (timers + socket + token) and reset to idle. */
+    /** Tear down the active sign-in device flow (timers + socket + popup + token) and reset to idle. */
     cancelSignIn() {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signInToken = null;
         if (this.signIn !== IDLE_SIGN_IN) {
             this.setSignIn(IDLE_SIGN_IN);
@@ -635,6 +743,7 @@ export class AccountDialogController {
         this.signInToken = null;
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signIn = IDLE_SIGN_IN;
         this.view = 'accounts';
         this.emit();
@@ -666,6 +775,7 @@ export class AccountDialogController {
     failSignIn(message) {
         this.clearPollTimer();
         this.closeAuthSessionSocket();
+        this.closeActivePopup();
         this.signInToken = null;
         this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: message });
     }