@oxyhq/core 12.10.5 → 12.11.0

package/dist/esm/utils/commonsDelivery.js

@@ -0,0 +1,54 @@
+import { getPlatformOS } from './platform.js';
+/**
+ * Choose the ONE primary delivery route for a "Sign in with Oxy" request.
+ *
+ * Decision order (issue #691, "Automatic delivery selection"):
+ *
+ *  1. Mobile with a verified Commons link available → open Commons directly.
+ *     No push is needed when the identity is already reachable on this device.
+ *  2. At least one eligible Commons installation was pushed to → await the push.
+ *  3. Otherwise → QR.
+ *
+ * A caller that already knows it is on step 1 does not need to call
+ * `deliverCommonsSignIn` at all; every other caller runs the delivery
+ * round-trip first and passes its `targets` in here.
+ *
+ * `pushTargets` is server-derived, so it is validated rather than trusted: a
+ * negative, fractional, non-finite, or otherwise malformed count is treated as
+ * "no targets" and degrades to QR instead of parking the user on a "check your
+ * phone" screen that nothing will ever wake.
+ */
+export function selectCommonsDelivery(facts) {
+    if (facts.platform === 'mobile' && facts.commonsAvailable) {
+        return 'open-commons';
+    }
+    if (Number.isInteger(facts.pushTargets) && facts.pushTargets >= 1) {
+        return 'await-push';
+    }
+    return 'qr';
+}
+/**
+ * Map a `deliverCommonsSignIn` result onto the `pushTargets` fact for
+ * {@link selectCommonsDelivery}. The server reports eligible install *count*
+ * separately from whether any push was accepted — a transport failure can leave
+ * `delivered: false` with `targets > 0`, which must NOT park the user on
+ * "check your phone".
+ */
+export function pushTargetsFromDelivery(result) {
+    return result.delivered ? result.targets : 0;
+}
+/**
+ * Classify the current runtime surface for delivery selection. Callers that
+ * cannot confidently detect the platform should not use this — pass
+ * `'unknown'` explicitly instead.
+ */
+export function commonsDeliveryPlatform() {
+    const os = getPlatformOS();
+    if (os === 'ios' || os === 'android') {
+        return 'mobile';
+    }
+    if (os === 'web') {
+        return 'desktop';
+    }
+    return 'unknown';
+}

package/dist/esm/utils/oauthPkce.js

@@ -134,12 +134,17 @@ export function buildOAuthAuthorizeUrl(params) {
     if (params.prompt) {
         url.searchParams.set('prompt', params.prompt);
     }
+    if (params.responseMode) {
+        url.searchParams.set('response_mode', params.responseMode);
+    }
     return url.toString();
 }
 /** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */
 export const OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
 /** `sessionStorage` key for the PKCE `code_verifier` across an authorize redirect. */
 export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
+/** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
+export const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
 /** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
 export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
 /** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
@@ -166,6 +171,25 @@ export function normalizeOAuthRedirectUri(input) {
         return input;
     }
 }
+/**
+ * Collapse `https://app.example/` → `https://app.example` for OAuth binding.
+ * Path-qualified redirect URIs are preserved — matches the API token exchange.
+ */
+export function canonicalizeOAuthRedirectUri(redirectUri) {
+    try {
+        const parsed = new URL(redirectUri);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return redirectUri;
+        }
+        if (parsed.pathname === '/' && !parsed.search && !parsed.hash) {
+            return parsed.origin;
+        }
+        return redirectUri;
+    }
+    catch {
+        return redirectUri;
+    }
+}
 /**
  * Is this a safe same-origin path to restore into the address bar?
  *
@@ -231,13 +255,16 @@ export function consumeOAuthReturnPath() {
     }
 }
 /** Persist the OAuth handshake for a full-page redirect return (web only). */
-export function persistOAuthHandshake(state, codeVerifier) {
+export function persistOAuthHandshake(state, codeVerifier, redirectUri) {
     const store = globalThis.sessionStorage;
     try {
         if (!store)
             throw new Error('sessionStorage is unavailable');
         store.setItem(OXY_OAUTH_STATE_STORAGE_KEY, state);
         store.setItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, codeVerifier);
+        if (redirectUri) {
+            store.setItem(OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, canonicalizeOAuthRedirectUri(redirectUri));
+        }
         return true;
     }
     catch (error) {
@@ -254,7 +281,8 @@ export function readOAuthHandshake() {
     const codeVerifier = store.getItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
     if (!state || !codeVerifier)
         return null;
-    return { state, codeVerifier };
+    const redirectUri = store.getItem(OXY_OAUTH_REDIRECT_URI_STORAGE_KEY) ?? undefined;
+    return redirectUri ? { state, codeVerifier, redirectUri } : { state, codeVerifier };
 }
 /** Drop persisted OAuth handshake keys after a successful or aborted return. */
 export function clearOAuthHandshake() {
@@ -262,6 +290,7 @@ export function clearOAuthHandshake() {
     try {
         store?.removeItem(OXY_OAUTH_STATE_STORAGE_KEY);
         store?.removeItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+        store?.removeItem(OXY_OAUTH_REDIRECT_URI_STORAGE_KEY);
         // The return path belongs to this handshake. Leaving it behind would let a
         // later, unrelated navigation in the same tab be redirected by it.
         store?.removeItem(OXY_OAUTH_RETURN_PATH_STORAGE_KEY);