@oxyhq/core 12.11.0 → 13.0.0

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -12,6 +12,8 @@
  * degrade-to-QR behaviour every ambiguous input must produce.
  */
 
+import type { CommonsDenyReason } from '@oxyhq/contracts';
+import { COMMONS_DENY_REASONS } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../../models/session';
 import type { ChallengeResponse } from '../OxyServices.auth';
 import type { CommonsDeliveryPlatform } from '../../utils/commonsDelivery';
@@ -769,12 +771,17 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
       );
     });
 
-    it.each([['declined'], ['not_me']] as const)(
+    // Iterating the CONTRACT set (rather than a local literal) is the point: the
+    // SDK, the API request schema and the persisted `AuthSession.deniedReason`
+    // enum all read this one declaration, so a value added on the server side
+    // without an SDK release — or the reverse — cannot go unnoticed here.
+    it.each([...COMMONS_DENY_REASONS])(
       'sends the closed-set reason %s in the body',
       async (reason) => {
         makeRequestSpy.mockResolvedValue({ success: true });
 
-        await oxy.denyCommonsSignIn('code-1', reason);
+        const typedReason: CommonsDenyReason = reason;
+        await oxy.denyCommonsSignIn('code-1', typedReason);
 
         expect(makeRequestSpy).toHaveBeenCalledWith(
           'POST',

package/src/mixins/__tests__/privacyCacheInvalidation.test.ts

@@ -134,10 +134,12 @@ describe('privacy cache invalidation', () => {
     fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
     await oxy.blockUser('u1');
     expect(clearSpy).toHaveBeenCalledWith('GET:/privacy/blocked');
+    expect(clearSpy).toHaveBeenCalledWith('GET:/users/me/graph');
 
     fetchMock.mockResolvedValueOnce(jsonResponse({ message: 'ok' }));
     await oxy.restrictUser('u2');
     expect(clearSpy).toHaveBeenCalledWith('GET:/privacy/restricted');
+    expect(clearSpy).toHaveBeenCalledWith('GET:/users/me/graph');
 
     fetchMock.mockResolvedValueOnce(jsonResponse({ isPrivateAccount: true }));
     await oxy.updatePrivacySettings({ isPrivateAccount: true }, 'me');

package/src/server/index.ts

@@ -71,11 +71,4 @@ export { verifySecret } from './verifySecret';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex';
-export {
-  buildIdpHubOrigin,
-  buildHubSyncUrl,
-  isIdpHubOrigin,
-  isOfficialWebOrigin,
-  normalizeOfficialReturnOrigin,
-  parseHubSyncReturnUrl,
-} from '../utils/officialOrigins';
+export { isOfficialWebOrigin } from '../utils/officialOrigins';

package/src/server/rateLimit.ts

@@ -278,6 +278,9 @@ export function createOxyRateLimit(
     standardHeaders: true,
     legacyHeaders: false,
     skip,
+    // hashAnonymousIp already buckets IPv6 to /56 before HMAC; disable the v8
+    // static source scan that false-positives on req.ip (ERR_ERL_KEY_GEN_IPV6).
+    validate: { keyGeneratorIpFallback: false },
   });
 
   return (req, res, next) => {

package/src/session/__tests__/accountDialogController.test.ts

@@ -433,11 +433,9 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     expect(commitSession.mock.calls[0][0]).toMatchObject({ sessionId: 'sess-org', accessToken: 'access-org' });
   });
 
-  it('commits a graph switch via the IN-PLACE commitSwitchedSession — never the hub-syncing commitSession', async () => {
-    // PROBLEM 2: an account switch must not run the cross-origin hub-sync
-    // full-page redirect. When both funnels are wired, the mint-switch must use
-    // commitSwitchedSession (in-place) and NEVER commitSession (which may
-    // redirect on an official web origin).
+  it('commits a graph switch via the IN-PLACE commitSwitchedSession — never commitSession', async () => {
+    // An account switch must use commitSwitchedSession (in-place) and NEVER
+    // commitSession when both funnels are wired.
     const oxy = makeOxy();
     const sc = new TestSessionClient(host());
     sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));

package/src/session/accountDialogController.ts

@@ -302,21 +302,17 @@ export interface AccountDialogControllerOptions {
    * `SessionClient.registerAndActivate` (registration + activation only — no
    * provider-side durable persist/hydration).
    *
-   * This is the SIGN-IN commit: on an official web origin it may run the
-   * cross-origin hub-sync (a full-page redirect to `auth.oxy.so/sync`) that
-   * bootstraps silent OAuth restore on OTHER origins. A first sign-in on a web
-   * origin legitimately needs that. An account SWITCH does NOT — see
-   * {@link commitSwitchedSession}.
+   * This is the SIGN-IN commit: registers the session into the host's device
+   * set with durable persist + profile hydration. An account SWITCH uses
+   * {@link commitSwitchedSession} instead — see below.
    */
   commitSession?: (session: SessionLoginResponse) => Promise<void>;
   /**
    * Commit a minted graph SWITCH session into the host's session set — same
    * device-first registration + durable persist + profile hydration as
-   * {@link commitSession}, but IN-PLACE: it must NOT trigger the cross-origin
-   * hub-sync redirect. Switching into an account you already operate reuses the
-   * device credential that was already hub-synced at the original sign-in, so
-   * re-syncing is redundant and a full-page redirect on switch is the exact
-   * regression this separation prevents. Cross-tab/app propagation of the switch
+   * {@link commitSession}, but IN-PLACE: it must NOT re-run sign-in side effects
+   * that belong only to a fresh authorization (for example, a redundant full
+   * device-set reconcile on switch). Cross-tab/app propagation of the switch
    * still happens instantly via the server's device-scoped `session_state` /
    * `session_accounts_changed` socket broadcast — no navigation required.
    *
@@ -811,9 +807,9 @@ export class AccountDialogController {
             accessToken: result.accessToken,
           },
           result.user,
-          // A switch is IN-PLACE: commit without the hub-sync redirect (the
-          // device is already known/synced). Cross-tab/app propagation rides the
-          // server's `session_state` socket broadcast, not a navigation.
+          // A switch is IN-PLACE: use the switch commit funnel (not sign-in).
+          // Cross-tab/app propagation rides the server's `session_state` socket
+          // broadcast, not a navigation.
           { fromSwitch: true },
         );
       }
@@ -1349,11 +1345,9 @@ export class AccountDialogController {
    * consumer's commit funnel (durable persist + hydration); falls back to
    * `SessionClient.registerAndActivate` (registration + activation only).
    *
-   * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
-   * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
-   * `commitSession` (which may hub-sync on an official web origin). When the
-   * switch funnel is not wired it falls back to the sign-in funnel, then to
-   * `registerAndActivate`.
+   * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel;
+   * a SIGN-IN uses `commitSession`. When the switch funnel is not wired it falls
+   * back to the sign-in funnel, then to `registerAndActivate`.
    */
   private async commitAuthorizedSession(
     session: SessionLoginResponse,

package/src/utils/__tests__/officialOrigins.test.ts

@@ -1,19 +1,10 @@
 import {
-  buildHubSyncUrl,
-  buildIdpHubOrigin,
   isAllowedDeviceJoinOrigin,
-  isIdpHubOrigin,
   isLoopbackOrigin,
   isOfficialWebOrigin,
-  normalizeOfficialReturnOrigin,
-  parseHubSyncReturnUrl,
 } from '../officialOrigins';
 
 describe('officialOrigins', () => {
-  it('builds the IdP hub origin', () => {
-    expect(buildIdpHubOrigin()).toBe('https://auth.oxy.so');
-  });
-
   it('allows official first-party origins', () => {
     expect(isOfficialWebOrigin('https://inbox.oxy.so')).toBe(true);
     expect(isOfficialWebOrigin('https://mention.earth')).toBe(true);
@@ -37,52 +28,4 @@ describe('officialOrigins', () => {
     expect(isAllowedDeviceJoinOrigin('https://accounts.oxy.so')).toBe(true);
     expect(isAllowedDeviceJoinOrigin('https://evil.example')).toBe(false);
   });
-
-  it('normalizes return origins to origin only', () => {
-    expect(normalizeOfficialReturnOrigin('https://accounts.oxy.so/settings')).toBe(
-      'https://accounts.oxy.so',
-    );
-    expect(normalizeOfficialReturnOrigin('https://evil.example/')).toBeNull();
-  });
-
-  it('parses hub-sync return URLs', () => {
-    expect(parseHubSyncReturnUrl('https://inbox.oxy.so/messages')).toBe(
-      'https://inbox.oxy.so/messages',
-    );
-    expect(parseHubSyncReturnUrl('https://evil.example/')).toBeNull();
-  });
-
-  it('builds hub sync URLs with ticket and optional return', () => {
-    const url = new URL(buildHubSyncUrl('tk-abc', 'https://accounts.oxy.so/'));
-    expect(url.pathname).toBe('/sync');
-    expect(url.searchParams.get('ticket')).toBe('tk-abc');
-    expect(url.searchParams.get('return')).toBe('https://accounts.oxy.so/');
-  });
-
-  describe('isIdpHubOrigin', () => {
-    const originalLocation = globalThis.location;
-
-    afterEach(() => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: originalLocation,
-      });
-    });
-
-    it('returns true on auth.oxy.so', () => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: { href: 'https://auth.oxy.so/sync' },
-      });
-      expect(isIdpHubOrigin()).toBe(true);
-    });
-
-    it('returns false on satellite origins', () => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: { href: 'https://inbox.oxy.so/' },
-      });
-      expect(isIdpHubOrigin()).toBe(false);
-    });
-  });
 });

package/src/utils/oauthPkce.ts

@@ -62,10 +62,18 @@ export interface BuildOAuthAuthorizeUrlParams {
   /** The PKCE `codeChallenge` from {@link generatePkcePair}. */
   codeChallenge: string;
   /**
-   * OAuth `prompt` parameter. Use `none` for silent cross-origin session restore
-   * (no UI when the IdP hub already has a session + grant).
+   * OAuth `prompt` parameter — `login` forces a fresh authentication even when
+   * the IdP already has a session, `consent` forces the consent screen even for
+   * an already-granted scope. Both are ordinary OAuth/OIDC and are here for
+   * third-party relying parties building their own authorize link.
+   *
+   * `'none'` is deliberately NOT in this union. It is the silent-SSO value, and
+   * it was the only value this SDK ever sent — from the cold-boot cross-origin
+   * restore deleted in #691 phase 7b. Accepting it again would hand consumers a
+   * one-line rebuild of the automatic, gesture-less full-page bounce to the IdP
+   * that the popup transport exists to eliminate.
    */
-  prompt?: 'none' | 'login' | 'consent';
+  prompt?: 'login' | 'consent';
   /**
    * How the IdP should deliver the authorization response. Omitted (the
    * default) means the ordinary top-level redirect back to `redirectUri`.
@@ -220,12 +228,6 @@ export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 export const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
 
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
-
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
-
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.

package/src/utils/officialOrigins.ts

@@ -1,6 +1,6 @@
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
 
 import { CENTRAL_IDP_APEX } from './authWebUrl';
@@ -20,31 +20,9 @@ const OFFICIAL_APEXES = new Set([
   'mercaria.co',
 ]);
 
-export function buildIdpHubOrigin(): string {
-  return `https://auth.${CENTRAL_IDP_APEX}`;
-}
-
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-export function isIdpHubOrigin(): boolean {
-  if (typeof globalThis === 'undefined') {
-    return false;
-  }
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) {
-    return false;
-  }
-  try {
-    const { hostname } = new URL(location.href);
-    return hostname === `auth.${CENTRAL_IDP_APEX}`;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 export function isLoopbackOrigin(origin: string): boolean {
   try {
@@ -80,50 +58,5 @@ export function isOfficialWebOrigin(origin: string): boolean {
   }
 }
 
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-export function normalizeOfficialReturnOrigin(raw: string): string | null {
-  try {
-    const parsed = new URL(raw);
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-      return null;
-    }
-    if (!isOfficialWebOrigin(parsed.origin)) {
-      return null;
-    }
-    return parsed.origin;
-  } catch {
-    return null;
-  }
-}
-
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-export function parseHubSyncReturnUrl(raw: string | null): string | null {
-  if (!raw) {
-    return null;
-  }
-  try {
-    const parsed = new URL(raw);
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-      return null;
-    }
-    if (!isOfficialWebOrigin(parsed.origin)) {
-      return null;
-    }
-    return parsed.toString();
-  } catch {
-    return null;
-  }
-}
-
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-export function buildHubSyncUrl(ticket: string, returnUrl?: string): string {
-  const url = new URL('/sync', buildIdpHubOrigin());
-  url.searchParams.set('ticket', ticket);
-  if (returnUrl) {
-    url.searchParams.set('return', returnUrl);
-  }
-  return url.toString();
-}
-
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 export const isAllowedDeviceJoinOrigin = isOfficialWebOrigin;

package/dist/cjs/session/hubSync.js

@@ -1,55 +0,0 @@
-"use strict";
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.syncHubAfterSignIn = syncHubAfterSignIn;
-exports.redeemHubTicketOnHub = redeemHubTicketOnHub;
-const officialOrigins_1 = require("../utils/officialOrigins");
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-async function syncHubAfterSignIn(oxy, opts) {
-    if (opts?.enabled === false) {
-        return false;
-    }
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    if ((0, officialOrigins_1.isIdpHubOrigin)()) {
-        return false;
-    }
-    if (!(0, officialOrigins_1.isOfficialWebOrigin)(location.origin)) {
-        return false;
-    }
-    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
-    const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-    const syncUrl = (0, officialOrigins_1.buildHubSyncUrl)(issued.ticket, returnUrl);
-    window.location.assign(syncUrl);
-    return true;
-}
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-async function redeemHubTicketOnHub(oxy, store, ticket) {
-    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
-    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-    const prior = await store.load();
-    await store.save({
-        sessionId: prior?.sessionId ?? '',
-        userId: prior?.userId ?? '',
-        deviceId: creds.deviceId,
-        deviceSecret: creds.deviceSecret,
-        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-    });
-    return true;
-}

package/dist/esm/session/hubSync.js

@@ -1,51 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-import { buildHubSyncUrl, buildIdpHubOrigin, isIdpHubOrigin, isOfficialWebOrigin, } from '../utils/officialOrigins.js';
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export async function syncHubAfterSignIn(oxy, opts) {
-    if (opts?.enabled === false) {
-        return false;
-    }
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    if (isIdpHubOrigin()) {
-        return false;
-    }
-    if (!isOfficialWebOrigin(location.origin)) {
-        return false;
-    }
-    const hubOrigin = buildIdpHubOrigin();
-    const issued = await oxy.issueHubTicket(hubOrigin);
-    const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-    const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
-    window.location.assign(syncUrl);
-    return true;
-}
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export async function redeemHubTicketOnHub(oxy, store, ticket) {
-    const hubOrigin = buildIdpHubOrigin();
-    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-    const prior = await store.load();
-    await store.save({
-        sessionId: prior?.sessionId ?? '',
-        userId: prior?.userId ?? '',
-        deviceId: creds.deviceId,
-        deviceSecret: creds.deviceSecret,
-        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-    });
-    return true;
-}

package/dist/types/session/hubSync.d.ts

@@ -1,20 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-import type { OxyServices } from '../OxyServices';
-import type { AuthStateStore } from './authStateStore';
-export interface SyncHubAfterSignInOptions {
-    /** Skip sync when false (OxyProvider hubSync prop). @default true */
-    enabled?: boolean;
-}
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export declare function syncHubAfterSignIn(oxy: Pick<OxyServices, 'issueHubTicket'>, opts?: SyncHubAfterSignInOptions): Promise<boolean>;
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export declare function redeemHubTicketOnHub(oxy: Pick<OxyServices, 'redeemHubTicket'>, store: AuthStateStore, ticket: string): Promise<boolean>;

package/src/session/__tests__/hubSync.test.ts

@@ -1,51 +0,0 @@
-import { syncHubAfterSignIn } from '../hubSync';
-
-jest.mock('../../utils/officialOrigins', () => {
-  const actual = jest.requireActual('../../utils/officialOrigins');
-  return {
-    ...actual,
-    isIdpHubOrigin: jest.fn(() => false),
-    isOfficialWebOrigin: jest.fn(() => true),
-    buildIdpHubOrigin: jest.fn(() => 'https://auth.oxy.so'),
-  };
-});
-
-describe('syncHubAfterSignIn', () => {
-  const originalLocation = globalThis.location;
-  const originalAssign = (globalThis as { location?: Location }).location?.assign;
-
-  afterEach(() => {
-    Object.defineProperty(globalThis, 'location', {
-      configurable: true,
-      value: originalLocation,
-    });
-    jest.restoreAllMocks();
-  });
-
-  it('includes the hash fragment in the hub-sync return URL', async () => {
-    const assign = jest.fn();
-    Object.defineProperty(globalThis, 'location', {
-      configurable: true,
-      value: {
-        origin: 'https://oxy.so',
-        pathname: '/pricing',
-        search: '?plan=pro',
-        hash: '#compare',
-        assign,
-      },
-    });
-    Object.defineProperty(globalThis, 'window', {
-      configurable: true,
-      value: { location: globalThis.location },
-    });
-
-    const issueHubTicket = jest.fn().mockResolvedValue({ ticket: 'tk-1' });
-
-    const redirected = await syncHubAfterSignIn({ issueHubTicket });
-
-    expect(redirected).toBe(true);
-    expect(issueHubTicket).toHaveBeenCalledWith('https://auth.oxy.so');
-    const syncUrl = new URL(String(assign.mock.calls[0]?.[0] ?? ''));
-    expect(syncUrl.searchParams.get('return')).toBe('https://oxy.so/pricing?plan=pro#compare');
-  });
-});

package/src/session/hubSync.ts

@@ -1,79 +0,0 @@
-/**
- * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
- * one-time server ticket (no secrets in URL fragments).
- */
-
-import type { OxyServices } from '../OxyServices';
-import type { AuthStateStore } from './authStateStore';
-import {
-  buildHubSyncUrl,
-  buildIdpHubOrigin,
-  isIdpHubOrigin,
-  isOfficialWebOrigin,
-} from '../utils/officialOrigins';
-
-export interface SyncHubAfterSignInOptions {
-  /** Skip sync when false (OxyProvider hubSync prop). @default true */
-  enabled?: boolean;
-}
-
-/**
- * After a successful sign-in on an official web app, mint a hub ticket and
- * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
- * shared device credential for silent OAuth restore on other origins.
- *
- * No-op on native, non-official origins, and when already on the IdP hub.
- */
-export async function syncHubAfterSignIn(
-  oxy: Pick<OxyServices, 'issueHubTicket'>,
-  opts?: SyncHubAfterSignInOptions,
-): Promise<boolean> {
-  if (opts?.enabled === false) {
-    return false;
-  }
-
-  if (typeof globalThis === 'undefined') {
-    return false;
-  }
-
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) {
-    return false;
-  }
-
-  if (isIdpHubOrigin()) {
-    return false;
-  }
-
-  if (!isOfficialWebOrigin(location.origin)) {
-    return false;
-  }
-
-  const hubOrigin = buildIdpHubOrigin();
-  const issued = await oxy.issueHubTicket(hubOrigin);
-  const returnUrl = `${location.origin}${location.pathname}${location.search}${location.hash}`;
-  const syncUrl = buildHubSyncUrl(issued.ticket, returnUrl);
-
-  window.location.assign(syncUrl);
-  return true;
-}
-
-/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
-export async function redeemHubTicketOnHub(
-  oxy: Pick<OxyServices, 'redeemHubTicket'>,
-  store: AuthStateStore,
-  ticket: string,
-): Promise<boolean> {
-  const hubOrigin = buildIdpHubOrigin();
-  const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
-  const prior = await store.load();
-  await store.save({
-    sessionId: prior?.sessionId ?? '',
-    userId: prior?.userId ?? '',
-    deviceId: creds.deviceId,
-    deviceSecret: creds.deviceSecret,
-    ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
-    ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
-  });
-  return true;
-}