@oxyhq/core 12.11.1 → 13.0.0

package/dist/esm/index.js

@@ -148,9 +148,8 @@ export { runColdBoot } from './utils/coldBoot.js';
 // OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
 // Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
 // ---------------------------------------------------------------------------
-export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce.js';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins.js';
-export { syncHubAfterSignIn, redeemHubTicketOnHub, } from './session/hubSync.js';
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce.js';
+export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins.js';
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -13,7 +13,7 @@
  * the cold boot / re-mint handler own persistence and `setTokens`, so the same
  * primitive can be reused from either without double-planting.
  */
-import { deviceTokenMintResponseSchema, deviceHubTicketIssueResponseSchema, deviceHubTicketRedeemResponseSchema, safeParseContract, } from '@oxyhq/contracts';
+import { deviceTokenMintResponseSchema, safeParseContract, } from '@oxyhq/contracts';
 /**
  * The server's `401 account_not_on_device` for a PINNED mint: the requested
  * `accountId` is not (or is no longer) a live account of this device session.
@@ -105,36 +105,5 @@ export function OxyServicesDeviceBootMixin(Base) {
                 throw normalized;
             }
         }
-        /** Mint a one-time hub sync ticket (bearer required). */
-        async issueHubTicket(returnOrigin) {
-            try {
-                const res = await this.makeRequest('POST', '/session/device/hub-ticket', { returnOrigin }, { cache: false });
-                const parsed = safeParseContract(deviceHubTicketIssueResponseSchema, res);
-                if (!parsed) {
-                    throw new Error('session/device/hub-ticket returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /** Redeem a hub sync ticket for a fresh device secret (public). */
-        async redeemHubTicket(ticket, returnOrigin) {
-            try {
-                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, 
-                // Public device-hub sync mint (bearer-less). Same control-plane class as
-                // the device-secret mint — bypassQueue so it never waits for a slot.
-                { cache: false, skipAuth: true, bypassQueue: true });
-                const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
-                if (!parsed) {
-                    throw new Error('session/device/redeem-ticket returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
     };
 }

package/dist/esm/server/index.js

@@ -27,4 +27,4 @@ export { verifySecret } from './verifySecret.js';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex.js';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isOfficialWebOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from '../utils/officialOrigins.js';
+export { isOfficialWebOrigin } from '../utils/officialOrigins.js';

package/dist/esm/server/rateLimit.js

@@ -168,6 +168,9 @@ export function createOxyRateLimit(oxy, options = {}) {
         standardHeaders: true,
         legacyHeaders: false,
         skip,
+        // hashAnonymousIp already buckets IPv6 to /56 before HMAC; disable the v8
+        // static source scan that false-positives on req.ip (ERR_ERL_KEY_GEN_IPV6).
+        validate: { keyGeneratorIpFallback: false },
     });
     return (req, res, next) => {
         // Skipped paths bypass BOTH session resolution and limiting — cheap and

package/dist/esm/session/accountDialogController.js

@@ -477,9 +477,9 @@ export class AccountDialogController {
                     user: result.user,
                     accessToken: result.accessToken,
                 }, result.user, 
-                // A switch is IN-PLACE: commit without the hub-sync redirect (the
-                // device is already known/synced). Cross-tab/app propagation rides the
-                // server's `session_state` socket broadcast, not a navigation.
+                // A switch is IN-PLACE: use the switch commit funnel (not sign-in).
+                // Cross-tab/app propagation rides the server's `session_state` socket
+                // broadcast, not a navigation.
                 { fromSwitch: true });
             }
             // Re-project + refetch immediately; the subscription also fires.
@@ -982,11 +982,9 @@ export class AccountDialogController {
      * consumer's commit funnel (durable persist + hydration); falls back to
      * `SessionClient.registerAndActivate` (registration + activation only).
      *
-     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
-     * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
-     * `commitSession` (which may hub-sync on an official web origin). When the
-     * switch funnel is not wired it falls back to the sign-in funnel, then to
-     * `registerAndActivate`.
+     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel;
+     * a SIGN-IN uses `commitSession`. When the switch funnel is not wired it falls
+     * back to the sign-in funnel, then to `registerAndActivate`.
      */
     async commitAuthorizedSession(session, user, opts) {
         const commit = opts?.fromSwitch

package/dist/esm/utils/oauthPkce.js

@@ -145,10 +145,6 @@ export const OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
 export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 export const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.

package/dist/esm/utils/officialOrigins.js

@@ -1,6 +1,6 @@
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
 import { CENTRAL_IDP_APEX } from './authWebUrl.js';
 import { registrableApex } from './registrableApex.js';
@@ -17,30 +17,9 @@ const OFFICIAL_APEXES = new Set([
     'moovo.now',
     'mercaria.co',
 ]);
-export function buildIdpHubOrigin() {
-    return `https://auth.${CENTRAL_IDP_APEX}`;
-}
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-export function isIdpHubOrigin() {
-    if (typeof globalThis === 'undefined') {
-        return false;
-    }
-    const location = globalThis.location;
-    if (!location) {
-        return false;
-    }
-    try {
-        const { hostname } = new URL(location.href);
-        return hostname === `auth.${CENTRAL_IDP_APEX}`;
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 export function isLoopbackOrigin(origin) {
     try {
@@ -76,49 +55,5 @@ export function isOfficialWebOrigin(origin) {
         return false;
     }
 }
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-export function normalizeOfficialReturnOrigin(raw) {
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-            return null;
-        }
-        if (!isOfficialWebOrigin(parsed.origin)) {
-            return null;
-        }
-        return parsed.origin;
-    }
-    catch {
-        return null;
-    }
-}
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-export function parseHubSyncReturnUrl(raw) {
-    if (!raw) {
-        return null;
-    }
-    try {
-        const parsed = new URL(raw);
-        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-            return null;
-        }
-        if (!isOfficialWebOrigin(parsed.origin)) {
-            return null;
-        }
-        return parsed.toString();
-    }
-    catch {
-        return null;
-    }
-}
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-export function buildHubSyncUrl(ticket, returnUrl) {
-    const url = new URL('/sync', buildIdpHubOrigin());
-    url.searchParams.set('ticket', ticket);
-    if (returnUrl) {
-        url.searchParams.set('return', returnUrl);
-    }
-    return url.toString();
-}
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 export const isAllowedDeviceJoinOrigin = isOfficialWebOrigin;