@oxyhq/core 12.10.6 → 12.11.0

package/dist/cjs/i18n/locales/locales/ja-JP.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",
     "showQrAnyway": "別のデバイスにCommonsがあります",
     "switchWhileSignedInAs": "アカウントを切り替え（{{name}} としてログイン中）",
-    "manageOnDevice": "このデバイスのアカウントを管理"
+    "manageOnDevice": "このデバイスのアカウントを管理",
+    "continueWithOxy": "Oxyで続ける",
+    "havingTrouble": "うまくいきませんか？",
+    "progress": {
+      "preparing": "リクエストを準備しています",
+      "awaitingApproval": "承認を待っています",
+      "scanWithCommons": "スマートフォンのCommonsでスキャンしてください",
+      "continueInCommons": "Commonsで続けてください",
+      "checkCommons": "スマートフォンのCommonsを確認してください",
+      "openedInCommons": "Commonsで開きました",
+      "confirming": "本人確認をしています",
+      "confirmed": "本人確認が完了しました"
+    }
   },
   "common": {
     "actions": {

package/dist/cjs/i18n/locales/locales/ko-KR.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",
     "showQrAnyway": "다른 기기에 Commons가 있습니다",
     "switchWhileSignedInAs": "계정 전환, {{name}}(으)로 로그인됨",
-    "manageOnDevice": "이 기기의 계정 관리"
+    "manageOnDevice": "이 기기의 계정 관리",
+    "continueWithOxy": "Oxy로 계속하기",
+    "havingTrouble": "문제가 있으신가요?",
+    "progress": {
+      "preparing": "요청 준비 중",
+      "awaitingApproval": "승인 대기 중",
+      "scanWithCommons": "휴대폰의 Commons로 스캔하세요",
+      "continueInCommons": "Commons에서 계속하세요",
+      "checkCommons": "휴대폰에서 Commons를 확인하세요",
+      "openedInCommons": "Commons에서 열림",
+      "confirming": "신원 확인 중",
+      "confirmed": "신원 확인 완료"
+    }
   },
   "common": {
     "actions": {

package/dist/cjs/i18n/locales/locales/pt-PT.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",
     "showQrAnyway": "Tenho o Commons noutro dispositivo",
     "switchWhileSignedInAs": "Mudar de conta, com sessão iniciada como {{name}}",
-    "manageOnDevice": "Gerir contas neste dispositivo"
+    "manageOnDevice": "Gerir contas neste dispositivo",
+    "continueWithOxy": "Continuar com Oxy",
+    "havingTrouble": "Algum problema?",
+    "progress": {
+      "preparing": "A preparar o pedido",
+      "awaitingApproval": "A aguardar aprovação",
+      "scanWithCommons": "Digitalize com o Commons no seu telemóvel",
+      "continueInCommons": "Continue no Commons",
+      "checkCommons": "Verifique o Commons no seu telemóvel",
+      "openedInCommons": "Aberto no Commons",
+      "confirming": "A confirmar a identidade",
+      "confirmed": "Identidade confirmada"
+    }
   },
   "common": {
     "actions": {

package/dist/cjs/i18n/locales/locales/zh-CN.json

@@ -124,7 +124,19 @@
     "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",
     "showQrAnyway": "我在另一台设备上有 Commons",
     "switchWhileSignedInAs": "切换账号，当前登录为 {{name}}",
-    "manageOnDevice": "管理此设备上的账号"
+    "manageOnDevice": "管理此设备上的账号",
+    "continueWithOxy": "使用 Oxy 继续",
+    "havingTrouble": "遇到问题？",
+    "progress": {
+      "preparing": "正在准备请求",
+      "awaitingApproval": "正在等待批准",
+      "scanWithCommons": "请用手机上的 Commons 扫描",
+      "continueInCommons": "请在 Commons 中继续",
+      "checkCommons": "请查看手机上的 Commons",
+      "openedInCommons": "已在 Commons 中打开",
+      "confirming": "正在确认身份",
+      "confirmed": "身份已确认"
+    }
   },
   "common": {
     "actions": {

package/dist/cjs/i18n/locales/pt-PT.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",
         "showQrAnyway": "Tenho o Commons noutro dispositivo",
         "switchWhileSignedInAs": "Mudar de conta, com sessão iniciada como {{name}}",
-        "manageOnDevice": "Gerir contas neste dispositivo"
+        "manageOnDevice": "Gerir contas neste dispositivo",
+        "continueWithOxy": "Continuar com Oxy",
+        "havingTrouble": "Algum problema?",
+        "progress": {
+            "preparing": "A preparar o pedido",
+            "awaitingApproval": "A aguardar aprovação",
+            "scanWithCommons": "Digitalize com o Commons no seu telemóvel",
+            "continueInCommons": "Continue no Commons",
+            "checkCommons": "Verifique o Commons no seu telemóvel",
+            "openedInCommons": "Aberto no Commons",
+            "confirming": "A confirmar a identidade",
+            "confirmed": "Identidade confirmada"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/i18n/locales/zh-CN.json

@@ -124,7 +124,19 @@
         "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",
         "showQrAnyway": "我在另一台设备上有 Commons",
         "switchWhileSignedInAs": "切换账号，当前登录为 {{name}}",
-        "manageOnDevice": "管理此设备上的账号"
+        "manageOnDevice": "管理此设备上的账号",
+        "continueWithOxy": "使用 Oxy 继续",
+        "havingTrouble": "遇到问题？",
+        "progress": {
+            "preparing": "正在准备请求",
+            "awaitingApproval": "正在等待批准",
+            "scanWithCommons": "请用手机上的 Commons 扫描",
+            "continueInCommons": "请在 Commons 中继续",
+            "checkCommons": "请查看手机上的 Commons",
+            "openedInCommons": "已在 Commons 中打开",
+            "confirming": "正在确认身份",
+            "confirmed": "身份已确认"
+        }
     },
     "common": {
         "actions": {

package/dist/cjs/index.js

@@ -18,11 +18,11 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.buildUrl = exports.buildSearchParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = void 0;
-exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = void 0;
-exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = void 0;
-exports.packageInfo = void 0;
+exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
+exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = void 0;
+exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = void 0;
+exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -44,6 +44,12 @@ Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: t
 var commonsApproval_1 = require("./utils/commonsApproval");
 Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable: true, get: function () { return commonsApproval_1.getCommonsApprovalBlockingReason; } });
 Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
+// Automatic "Sign in with Oxy" delivery selection — ONE pure decision that maps
+// the caller's facts onto exactly one primary route (open Commons / await push / QR).
+var commonsDelivery_1 = require("./utils/commonsDelivery");
+Object.defineProperty(exports, "selectCommonsDelivery", { enumerable: true, get: function () { return commonsDelivery_1.selectCommonsDelivery; } });
+Object.defineProperty(exports, "pushTargetsFromDelivery", { enumerable: true, get: function () { return commonsDelivery_1.pushTargetsFromDelivery; } });
+Object.defineProperty(exports, "commonsDeliveryPlatform", { enumerable: true, get: function () { return commonsDelivery_1.commonsDeliveryPlatform; } });
 var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
 Object.defineProperty(exports, "OxyAppDataIdentifierError", { enumerable: true, get: function () { return OxyServices_appData_1.OxyAppDataIdentifierError; } });
 // ---------------------------------------------------------------------------
@@ -312,10 +318,12 @@ Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPE", { enumerable: true, get: f
 Object.defineProperty(exports, "OXY_AUTHORIZE_URL", { enumerable: true, get: function () { return oauthPkce_1.OXY_AUTHORIZE_URL; } });
 Object.defineProperty(exports, "OXY_OAUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_STATE_STORAGE_KEY; } });
 Object.defineProperty(exports, "OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY; } });
+Object.defineProperty(exports, "OXY_OAUTH_REDIRECT_URI_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY; } });
 Object.defineProperty(exports, "OXY_SILENT_OAUTH_ATTEMPTED_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_SILENT_OAUTH_ATTEMPTED_KEY; } });
 Object.defineProperty(exports, "OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY; } });
 Object.defineProperty(exports, "OXY_OAUTH_RETURN_PATH_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_RETURN_PATH_STORAGE_KEY; } });
 Object.defineProperty(exports, "normalizeOAuthRedirectUri", { enumerable: true, get: function () { return oauthPkce_1.normalizeOAuthRedirectUri; } });
+Object.defineProperty(exports, "canonicalizeOAuthRedirectUri", { enumerable: true, get: function () { return oauthPkce_1.canonicalizeOAuthRedirectUri; } });
 Object.defineProperty(exports, "persistOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.persistOAuthHandshake; } });
 Object.defineProperty(exports, "readOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.readOAuthHandshake; } });
 Object.defineProperty(exports, "clearOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.clearOAuthHandshake; } });
@@ -380,6 +388,24 @@ Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, ge
 Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
 Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
 Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
+// Identity-bound sessions (the identity vault). The pin is the durable
+// `{publicKey, accountId}` binding between this device's PRIMARY identity key
+// and the account it authenticates as; it is what keeps such a client from
+// following the device's mutable `activeAccountId`.
+var identityPin_1 = require("./session/identityPin");
+Object.defineProperty(exports, "createWebIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createWebIdentityPinStore; } });
+Object.defineProperty(exports, "createNativeIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createNativeIdentityPinStore; } });
+Object.defineProperty(exports, "createMemoryIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createMemoryIdentityPinStore; } });
+Object.defineProperty(exports, "identityPinMatches", { enumerable: true, get: function () { return identityPin_1.identityPinMatches; } });
+Object.defineProperty(exports, "IDENTITY_PIN_STORAGE_KEY", { enumerable: true, get: function () { return identityPin_1.IDENTITY_PIN_STORAGE_KEY; } });
+var identitySession_1 = require("./session/identitySession");
+Object.defineProperty(exports, "resolveIdentityPin", { enumerable: true, get: function () { return identitySession_1.resolveIdentityPin; } });
+Object.defineProperty(exports, "establishIdentitySession", { enumerable: true, get: function () { return identitySession_1.establishIdentitySession; } });
+// The typed `401 account_not_on_device` from a PINNED device-secret mint: the
+// pinned account left this device's session set, so the caller re-establishes
+// the identity session instead of dropping a healthy device credential.
+var OxyServices_deviceBoot_1 = require("./mixins/OxyServices.deviceBoot");
+Object.defineProperty(exports, "AccountNotOnDeviceError", { enumerable: true, get: function () { return OxyServices_deviceBoot_1.AccountNotOnDeviceError; } });
 var refresh_1 = require("./session/refresh");
 Object.defineProperty(exports, "refreshPersistedSession", { enumerable: true, get: function () { return refresh_1.refreshPersistedSession; } });
 Object.defineProperty(exports, "refreshDeviceSecretArm", { enumerable: true, get: function () { return refresh_1.refreshDeviceSecretArm; } });

package/dist/cjs/mixins/OxyServices.auth.js

@@ -18,6 +18,61 @@ const userIdentity_1 = require("../utils/userIdentity");
  * returned `expiresAt` is authoritative; this is only the client-proposed value.
  */
 const COMMONS_SIGN_IN_EXPIRY_MS = 5 * 60 * 1000;
+/**
+ * @internal Narrow an untrusted `requesterLabel` from the approve-info response.
+ *
+ * Returns the trimmed label only when the server sent a real, non-empty string;
+ * everything else — absent (an API that predates the field), `null` (a native
+ * requester the server could not describe), or a non-string — degrades to
+ * `null`, so the approval UI drops the line instead of rendering a blank or a
+ * coerced value under the app it is about to authorize.
+ */
+function parseCommonsRequesterLabel(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const label = value.trim();
+    return label.length > 0 ? label : null;
+}
+/**
+ * @internal Narrow an untrusted `subjectAccount` from the approve-info response.
+ *
+ * Returns `null` unless the value is an object carrying a non-empty string `id`
+ * AND `username` — the two fields the approval UI needs to name the delegated
+ * account. A half-populated object is rejected whole rather than rendered with
+ * blanks, and `displayName` is only carried through when it is a string.
+ */
+function parseCommonsSubjectAccount(value) {
+    if (value === null || typeof value !== 'object') {
+        return null;
+    }
+    const raw = value;
+    const { id, username, displayName } = raw;
+    if (typeof id !== 'string' || !id || typeof username !== 'string' || !username) {
+        return null;
+    }
+    return {
+        id,
+        username,
+        ...(typeof displayName === 'string' ? { displayName } : {}),
+    };
+}
+/**
+ * @internal Narrow an untrusted delivery-progress timestamp from the status
+ * response.
+ *
+ * Returns the ISO-8601 string unchanged when it is a real, parseable instant,
+ * and `null` for everything else — absent (an older API that has no delivery
+ * progress at all), empty, non-string, or unparseable. Progress is advisory, so
+ * degrading to "no progress yet" is always safe; surfacing a garbage timestamp
+ * to the waiting UI is not.
+ */
+function parseCommonsProgressTimestamp(value) {
+    if (typeof value !== 'string' || !value) {
+        return null;
+    }
+    return Number.isFinite(Date.parse(value)) ? value : null;
+}
 /**
  * Sentinel error raised when getServiceToken() is called with a known apiKey
  * but a non-matching secret. Indicates either credential drift in the caller
@@ -466,11 +521,16 @@ function OxyServicesAuthMixin(Base) {
         //   A. Same-device shared-keychain SSO (`signInWithSharedIdentity`): a
         //      sibling native app silently mints its own session from the shared
         //      identity key. No user interaction.
-        //   B. QR / app-to-app handoff: a relying party (`startCommonsSignIn` +
-        //      `pollCommonsSignIn` + the existing `claimSessionByToken`) and the
-        //      approver / Commons (`getCommonsApprovalInfo` + `approveCommonsSignIn`
-        //      / `denyCommonsSignIn`). The approver signs with its PRIMARY local
-        //      key; the RP never sees the private key.
+        //   B. QR / app-to-app / popup / push handoff: a relying party
+        //      (`startCommonsSignIn` + `pollCommonsSignIn`, finalized with either
+        //      `claimSessionByToken` or `finalizeCommonsOAuth`) and the approver /
+        //      Commons (`getCommonsApprovalInfo` + `approveCommonsSignIn` /
+        //      `denyCommonsSignIn`). The approver signs with its PRIMARY local key;
+        //      the RP never sees the private key.
+        //
+        //      ONE request serves every delivery surface. The delivery surface is
+        //      not part of the model: only the request's purpose is, and it is fixed
+        //      at creation by whether an OAuth binding was attached.
         // =======================================================================
         /**
          * MECHANISM A — same-device shared-keychain SSO.
@@ -521,12 +581,23 @@ function OxyServicesAuthMixin(Base) {
          * returns the server-issued public `authorizeCode` + ready-to-render
          * `qrPayload`. Render the QR (web) / open the deep-link (same-device); the
          * approver resolves the code and authorizes. Then poll with
-         * {@link pollCommonsSignIn} and, on `authorized`, exchange the
-         * `sessionToken` via the existing `claimSessionByToken`.
+         * {@link pollCommonsSignIn} and finalize.
+         *
+         * ONE request serves every delivery surface, and how it finalizes is decided
+         * here by whether an OAuth binding is attached:
+         *   - no `oauth` (the default): a `device_sign_in` request — on `authorized`,
+         *     exchange the `sessionToken` via the existing `claimSessionByToken`.
+         *   - with `oauth`: an `oauth_authorization` request — on `authorized`, call
+         *     {@link finalizeCommonsOAuth} with the same `sessionToken` to mint the
+         *     single-use authorization code, then exchange it with PKCE.
          *
          * @param params.clientId - The RP's registered OAuth client id
          *   (ApplicationCredential publicKey); required so the server can resolve the
          *   requesting application's identity.
+         * @param params.oauth - Optional OAuth binding ({@link CommonsOAuthContext}).
+         *   Carries only the redirect URI, the PKCE S256 challenge, the requested
+         *   scope, and an optional delegated `subjectAccountId` — never the PKCE
+         *   verifier, the OAuth `state`, or any token.
          */
         async startCommonsSignIn(params) {
             try {
@@ -535,7 +606,15 @@ function OxyServicesAuthMixin(Base) {
                 // QR. Reuses the platform-safe random generator.
                 const sessionToken = await signatureService_1.SignatureService.generateChallenge();
                 const expiresAt = Date.now() + COMMONS_SIGN_IN_EXPIRY_MS;
-                const res = await this.makeRequest('POST', '/auth/session/create', { sessionToken, expiresAt, clientId: params.clientId }, 
+                const res = await this.makeRequest('POST', '/auth/session/create', {
+                    sessionToken,
+                    expiresAt,
+                    clientId: params.clientId,
+                    // Omitted entirely when absent so the device-sign-in body stays
+                    // exactly what it has always been (the server reads presence, not a
+                    // null, to decide the request's purpose).
+                    ...(params.oauth ? { oauth: params.oauth } : {}),
+                }, 
                 // Public/pre-session (no bearer): skip the preflight so a stale
                 // near-expiry token cannot re-enter refreshAccessToken while the
                 // refresh handler is already in flight (self-await hang).
@@ -556,18 +635,162 @@ function OxyServicesAuthMixin(Base) {
          * MECHANISM B (relying party) — poll a device-flow session for approval.
          *
          * Backstop for the auth socket. On `authorized` (with a `sessionId`), the
-         * caller exchanges the secret `sessionToken` via the existing
-         * `claimSessionByToken` to mint the first access token.
+         * caller finalizes: `claimSessionByToken` for a `device_sign_in` request,
+         * {@link finalizeCommonsOAuth} for an `oauth_authorization` one.
+         *
+         * Every field is narrowed fail-safe. `authorized` counts only as a literal
+         * `true`, the identifiers only as non-empty strings, and the delivery
+         * progress timestamps degrade to `null` when absent or unparseable — so a
+         * partial or older-API payload can advance the waiting UI at most, never
+         * make it believe a request was approved.
          *
          * @param sessionToken - The secret token from {@link startCommonsSignIn}.
          */
         async pollCommonsSignIn(sessionToken) {
             try {
-                return await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, 
+                const res = await this.makeRequest('GET', `/auth/session/status/${encodeURIComponent(sessionToken)}`, undefined, 
                 // Public/pre-session (no bearer): a preflight here is wrong per se and,
                 // if ever reached while a refresh is pending, would re-enter
                 // refreshAccessToken and await the very promise it runs inside.
                 { cache: false, retry: false, skipAuth: true });
+                if (res === null || typeof res !== 'object') {
+                    throw new Error('auth/session/status returned an unexpected response shape');
+                }
+                const { authorized, sessionId, publicKey, status, purpose, pushSentAt, openedAt } = res;
+                return {
+                    authorized: authorized === true,
+                    ...(typeof sessionId === 'string' && sessionId ? { sessionId } : {}),
+                    ...(typeof publicKey === 'string' && publicKey ? { publicKey } : {}),
+                    ...(typeof status === 'string' && status ? { status } : {}),
+                    purpose: purpose === 'oauth_authorization' ? 'oauth_authorization' : 'device_sign_in',
+                    pushSentAt: parseCommonsProgressTimestamp(pushSentAt),
+                    openedAt: parseCommonsProgressTimestamp(openedAt),
+                };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * MECHANISM B (relying party) — ask Oxy to DELIVER a pending sign-in request
+         * to the identity's known Commons installations.
+         *
+         * This is the automatic half of "one intention, one primary action": rather
+         * than offering the user a menu of transports, the caller asks for delivery
+         * and lets the answer pick the route. Pass the returned `targets` to
+         * `selectCommonsDelivery` (`utils/commonsDelivery`) — `targets: 0` means no
+         * capable Commons installation is registered, which is a NORMAL outcome that
+         * resolves to the QR route, not an error to surface.
+         *
+         * **Requires a bearer.** Delivery is only allowed when Oxy already knows the
+         * intended identity from a trusted authenticated context — a request that
+         * merely carries a username or email typed into an unauthenticated browser
+         * must never be able to ring somebody's phone.
+         *
+         * The push it sends carries only `{ type, approvalUrl }` where the URL holds
+         * the public `authorizeCode` — no display data, no secrets. Commons resolves
+         * everything it shows from `getCommonsApprovalInfo`.
+         *
+         * @param authorizeCode - The public code from {@link startCommonsSignIn}.
+         */
+        async deliverCommonsSignIn(authorizeCode) {
+            try {
+                const res = await this.makeRequest('POST', `/auth/session/deliver/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Bearer REQUIRED (unlike its public siblings): the identity to
+                // deliver to comes from the authenticated caller, never the code.
+                { cache: false });
+                if (res === null || typeof res !== 'object') {
+                    throw new Error('auth/session/deliver returned an unexpected response shape');
+                }
+                const { delivered, targets } = res;
+                // Both fields drive the route choice, so a partial payload is rejected
+                // outright rather than defaulted into a route the server never chose.
+                if (typeof delivered !== 'boolean' ||
+                    typeof targets !== 'number' ||
+                    !Number.isInteger(targets) ||
+                    targets < 0) {
+                    throw new Error('auth/session/deliver returned an incomplete delivery result');
+                }
+                return { delivered, targets };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * MECHANISM B (approver / Commons) — report that the approval route was
+         * OPENED, so the waiting relying party can show "Opened in Commons".
+         *
+         * Progress only. It is idempotent, applies to a `pending` request alone, and
+         * records a timestamp (`openedAt`) — it never approves, authorizes, or
+         * advances the authorization state machine. Public, like the other approver
+         * handles: the approver has only the public `authorizeCode` at this point
+         * and has not yet signed anything.
+         *
+         * Best-effort by nature — a failure here costs the user only a progress
+         * line, so callers are free to ignore a rejection and continue to the
+         * approval screen.
+         *
+         * @param authorizeCode - The public code scanned from the QR / deep-link / push.
+         */
+        async markCommonsApprovalOpened(authorizeCode) {
+            try {
+                await this.makeRequest('POST', `/auth/session/opened/${encodeURIComponent(authorizeCode)}`, undefined, 
+                // Public (no bearer) — skip the preflight, exactly like approve-info.
+                { cache: false, skipAuth: true });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * MECHANISM B (relying party) — finalize an APPROVED, OAuth-bound request
+         * into a single-use OAuth authorization code.
+         *
+         * The OAuth counterpart of `claimSessionByToken`: same secret credential,
+         * same single-use semantics, different output. Call it once the request the
+         * RP started with an `oauth` binding reports `authorized`; the server
+         * atomically mints exactly ONE `AuthCode` bound to the redirect URI, PKCE
+         * challenge, scopes, approving identity, and any delegated subject account
+         * the request was created with. A second call cannot mint another code.
+         *
+         * The result is an authorization CODE, never a token — the caller completes
+         * the flow with the ordinary PKCE exchange (`exchangeOAuthCode`) using the
+         * `codeVerifier` it never sent anywhere. Nothing here is exposed to the
+         * popup: the code travels back through the registered callback, and the
+         * main window owns the verifier.
+         *
+         * Like `claimSessionByToken`, this needs no Authorization header — the
+         * high-entropy SECRET `sessionToken` IS the credential. Never pass the
+         * public `authorizeCode` here; it is the approver's handle, not the
+         * initiator's. Every server-side failure (wrong/expired/already-finalized
+         * request, non-OAuth purpose, missing permission for the delegated account)
+         * surfaces as one generic error, so nothing about the request's state can be
+         * probed from outside.
+         *
+         * @param sessionToken - The secret token from {@link startCommonsSignIn}.
+         */
+        async finalizeCommonsOAuth(sessionToken) {
+            try {
+                const res = await this.makeRequest('POST', `/auth/session/finalize/${encodeURIComponent(sessionToken)}`, undefined, 
+                // Body-authenticated by the path's secret token (no bearer) — skip the
+                // preflight, exactly like the device-flow claim.
+                { cache: false, skipAuth: true });
+                if (res === null || typeof res !== 'object') {
+                    throw new Error('auth/session/finalize returned an unexpected response shape');
+                }
+                const { code, redirectUri, expiresIn } = res;
+                // All three fields are load-bearing for the exchange that follows, so a
+                // partial payload is rejected outright rather than returned half-parsed.
+                if (typeof code !== 'string' ||
+                    !code ||
+                    typeof redirectUri !== 'string' ||
+                    !redirectUri ||
+                    typeof expiresIn !== 'number' ||
+                    !Number.isFinite(expiresIn)) {
+                    throw new Error('auth/session/finalize returned an incomplete authorization code');
+                }
+                return { code, redirectUri, expiresIn };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -577,9 +800,10 @@ function OxyServicesAuthMixin(Base) {
          * MECHANISM B (approver / Commons) — resolve the TRUSTED identity of a
          * sign-in request from its public `authorizeCode`.
          *
-         * The returned `application` is resolved server-side and is the only safe
-         * thing to display in the approval UI — NEVER trust the app/name/origin
-         * strings carried in the QR payload. Public (no auth required).
+         * The returned `application` and `subjectAccount` are resolved server-side
+         * and are the only safe things to display in the approval UI — NEVER trust
+         * the app/name/origin strings carried in the QR payload. Public (no auth
+         * required).
          *
          * @param authorizeCode - The public code scanned from the QR / deep-link.
          */
@@ -597,6 +821,17 @@ function OxyServicesAuthMixin(Base) {
                     // missing or non-boolean value (older server, malformed response)
                     // coerces to `false` so a stale server can never imply trust.
                     originVerified: raw.originVerified === true,
+                    // Same discipline: a missing/blank/non-string label degrades to null
+                    // (an older API, or a native requester with no browser to describe),
+                    // and the approver simply omits the "where from" line.
+                    requesterLabel: parseCommonsRequesterLabel(raw.requesterLabel),
+                    // Same discipline: only the literal OAuth purpose opts into OAuth
+                    // finalization. Anything else — including a server that predates this
+                    // field — is the plain device sign-in it has always been.
+                    purpose: raw.purpose === 'oauth_authorization' ? 'oauth_authorization' : 'device_sign_in',
+                    // A missing/partial delegated account degrades to "no delegation"
+                    // rather than a half-rendered "will act as" line.
+                    subjectAccount: parseCommonsSubjectAccount(raw.subjectAccount),
                     expiresAt: raw.expiresAt,
                     status: raw.status,
                 };
@@ -648,10 +883,15 @@ function OxyServicesAuthMixin(Base) {
          * device-flow session so the RP stops waiting.
          *
          * @param authorizeCode - The public code being denied.
+         * @param reason - Optional closed-set reason ({@link CommonsDenyReason}).
+         *   Pass `'not_me'` ONLY when the user actually reported the request as one
+         *   they did not start — the server records it as a suspicious denial rather
+         *   than an ordinary cancel. Omitting it sends the exact body this endpoint
+         *   has always received.
          */
-        async denyCommonsSignIn(authorizeCode) {
+        async denyCommonsSignIn(authorizeCode, reason) {
             try {
-                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, undefined, 
+                return await this.makeRequest('POST', `/auth/session/deny/${encodeURIComponent(authorizeCode)}`, reason ? { reason } : undefined, 
                 // Public (no auth required) — skip the bearer preflight.
                 { cache: false, skipAuth: true });
             }
@@ -914,7 +1154,7 @@ function OxyServicesAuthMixin(Base) {
                 const deviceId = (record.deviceId ?? record.device_id);
                 const deviceSecret = (record.deviceSecret ?? record.device_secret);
                 const userRaw = record.user;
-                if (!sessionId || !deviceId || !userRaw || typeof userRaw !== 'object') {
+                if (!sessionId || !deviceId || !deviceSecret || !userRaw || typeof userRaw !== 'object') {
                     throw new Error('auth/oauth/token returned an incomplete session payload');
                 }
                 const userObj = userRaw;