@oxyhq/core 12.11.1 → 13.0.0

package/dist/types/index.d.ts

@@ -26,7 +26,7 @@ export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from
 export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery';
 export type { CommonsDeliveryFacts, CommonsDeliveryPlatform, CommonsDeliveryRoute, } from './utils/commonsDelivery';
 export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
-export type { CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsDenyReason, CommonsOAuthFinalizeResult, CommonsDeliveryResult, } from './mixins/OxyServices.auth';
+export type { CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, } from './mixins/OxyServices.auth';
 export type { PushTokenPlatform, RegisterPushTokenInput, } from './mixins/OxyServices.notifications';
 export type { ServiceApp, ServiceActingAsVerification } from './mixins/OxyServices.utility';
 export type { ContactDiscoveryMatch, ContactDiscoveryResponse, } from './mixins/OxyServices.contacts';
@@ -96,11 +96,9 @@ export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
 export { isOxyRpOrigin } from './utils/webauthnOrigin';
 export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
-export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
 export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins';
-export { syncHubAfterSignIn, redeemHubTicketOnHub, } from './session/hubSync';
-export type { SyncHubAfterSignInOptions } from './session/hubSync';
+export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins';
 export { SessionClient } from './session/SessionClient';
 export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './session/SessionClient';
 export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -4,7 +4,7 @@
  * Supports password-based login (email/username) and public key challenge-response.
  */
 import type { User } from '../models/interfaces';
-import type { LoginResult, LoginSessionResult } from '@oxyhq/contracts';
+import type { LoginResult, LoginSessionResult, CommonsDenyReason } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import type { PublicApplication } from './OxyServices.connectedApps';
@@ -226,17 +226,6 @@ export interface CommonsApprovalInfo {
 export interface CommonsSignInActionResult {
     success: boolean;
 }
-/**
- * Why the approver denied a "Sign in with Oxy" request. A CLOSED set — the deny
- * endpoint is unauthenticated, so it accepts no free-form text:
- *
- *  - `'declined'` the approver rejected a request they recognised ("Not now").
- *  - `'not_me'`   the approver did not start the request ("This wasn't me").
- *                 The only value that records the denial as suspicious rather
- *                 than an ordinary cancel, so a UI may only offer it where the
- *                 user genuinely said so.
- */
-export type CommonsDenyReason = 'declined' | 'not_me';
 /**
  * Result of finalizing an approved, OAuth-bound "Sign in with Oxy" request.
  *

package/dist/types/mixins/OxyServices.deviceBoot.d.ts

@@ -13,7 +13,7 @@
  * the cold boot / re-mint handler own persistence and `setTokens`, so the same
  * primitive can be reused from either without double-planting.
  */
-import { type DeviceTokenMintResponse, type DeviceHubTicketIssueResponse, type DeviceHubTicketRedeemResponse } from '@oxyhq/contracts';
+import { type DeviceTokenMintResponse } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
  * The server's `401 account_not_on_device` for a PINNED mint: the requested
@@ -71,10 +71,6 @@ export declare function OxyServicesDeviceBootMixin<T extends typeof OxyServicesB
         mintFromDeviceSecret(deviceId: string, deviceSecret: string, options?: {
             accountId?: string;
         }): Promise<DeviceTokenMintResponse>;
-        /** Mint a one-time hub sync ticket (bearer required). */
-        issueHubTicket(returnOrigin: string): Promise<DeviceHubTicketIssueResponse>;
-        /** Redeem a hub sync ticket for a fresh device secret (public). */
-        redeemHubTicket(ticket: string, returnOrigin: string): Promise<DeviceHubTicketRedeemResponse>;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;

package/dist/types/server/index.d.ts

@@ -24,4 +24,4 @@ export { createOxyCors } from './cors';
 export type { OxyCorsOptions } from './cors';
 export { verifySecret } from './verifySecret';
 export { registrableApex } from '../utils/registrableApex';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isOfficialWebOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from '../utils/officialOrigins';
+export { isOfficialWebOrigin } from '../utils/officialOrigins';

package/dist/types/session/accountDialogController.d.ts

@@ -231,21 +231,17 @@ export interface AccountDialogControllerOptions {
      * `SessionClient.registerAndActivate` (registration + activation only — no
      * provider-side durable persist/hydration).
      *
-     * This is the SIGN-IN commit: on an official web origin it may run the
-     * cross-origin hub-sync (a full-page redirect to `auth.oxy.so/sync`) that
-     * bootstraps silent OAuth restore on OTHER origins. A first sign-in on a web
-     * origin legitimately needs that. An account SWITCH does NOT — see
-     * {@link commitSwitchedSession}.
+     * This is the SIGN-IN commit: registers the session into the host's device
+     * set with durable persist + profile hydration. An account SWITCH uses
+     * {@link commitSwitchedSession} instead — see below.
      */
     commitSession?: (session: SessionLoginResponse) => Promise<void>;
     /**
      * Commit a minted graph SWITCH session into the host's session set — same
      * device-first registration + durable persist + profile hydration as
-     * {@link commitSession}, but IN-PLACE: it must NOT trigger the cross-origin
-     * hub-sync redirect. Switching into an account you already operate reuses the
-     * device credential that was already hub-synced at the original sign-in, so
-     * re-syncing is redundant and a full-page redirect on switch is the exact
-     * regression this separation prevents. Cross-tab/app propagation of the switch
+     * {@link commitSession}, but IN-PLACE: it must NOT re-run sign-in side effects
+     * that belong only to a fresh authorization (for example, a redundant full
+     * device-set reconcile on switch). Cross-tab/app propagation of the switch
      * still happens instantly via the server's device-scoped `session_state` /
      * `session_accounts_changed` socket broadcast — no navigation required.
      *
@@ -600,11 +596,9 @@ export declare class AccountDialogController {
      * consumer's commit funnel (durable persist + hydration); falls back to
      * `SessionClient.registerAndActivate` (registration + activation only).
      *
-     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
-     * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
-     * `commitSession` (which may hub-sync on an official web origin). When the
-     * switch funnel is not wired it falls back to the sign-in funnel, then to
-     * `registerAndActivate`.
+     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel;
+     * a SIGN-IN uses `commitSession`. When the switch funnel is not wired it falls
+     * back to the sign-in funnel, then to `registerAndActivate`.
      */
     private commitAuthorizedSession;
     private failSignIn;

package/dist/types/utils/oauthPkce.d.ts

@@ -43,10 +43,18 @@ export interface BuildOAuthAuthorizeUrlParams {
     /** The PKCE `codeChallenge` from {@link generatePkcePair}. */
     codeChallenge: string;
     /**
-     * OAuth `prompt` parameter. Use `none` for silent cross-origin session restore
-     * (no UI when the IdP hub already has a session + grant).
+     * OAuth `prompt` parameter — `login` forces a fresh authentication even when
+     * the IdP already has a session, `consent` forces the consent screen even for
+     * an already-granted scope. Both are ordinary OAuth/OIDC and are here for
+     * third-party relying parties building their own authorize link.
+     *
+     * `'none'` is deliberately NOT in this union. It is the silent-SSO value, and
+     * it was the only value this SDK ever sent — from the cold-boot cross-origin
+     * restore deleted in #691 phase 7b. Accepting it again would hand consumers a
+     * one-line rebuild of the automatic, gesture-less full-page bounce to the IdP
+     * that the popup transport exists to eliminate.
      */
-    prompt?: 'none' | 'login' | 'consent';
+    prompt?: 'login' | 'consent';
     /**
      * How the IdP should deliver the authorization response. Omitted (the
      * default) means the ordinary top-level redirect back to `redirectUri`.
@@ -95,10 +103,6 @@ export declare const OXY_OAUTH_STATE_STORAGE_KEY = "oxy_oauth_state";
 export declare const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = "oxy_oauth_code_verifier";
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 export declare const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = "oxy.oauth_redirect_uri";
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-export declare const OXY_SILENT_OAUTH_ATTEMPTED_KEY = "oxy.silent_oauth_attempted";
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-export declare const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = "oxy.cross_origin_restore_attempted";
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.

package/dist/types/utils/officialOrigins.d.ts

@@ -1,23 +1,13 @@
 /**
- * Official first-party web origin allowlist — shared by hub-ticket issuance,
- * OAuth redirect validation, and cross-origin session restore.
+ * Official first-party web origin allowlist — shared by OAuth redirect
+ * validation and the server-side trusted-origin checks.
  */
-export declare function buildIdpHubOrigin(): string;
-/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
-export declare function isIdpHubOrigin(): boolean;
 /**
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
- * or `[::1]` on any port, http or https). Local dev must never be bounced to a
- * hosted IdP for cross-origin session restore.
+ * or `[::1]` on any port, http or https).
  */
 export declare function isLoopbackOrigin(origin: string): boolean;
 /** Whether an origin belongs to the official Oxy web ecosystem. */
 export declare function isOfficialWebOrigin(origin: string): boolean;
-/** Normalize and validate a return URL against official origins. Returns origin only. */
-export declare function normalizeOfficialReturnOrigin(raw: string): string | null;
-/** Validate a hub-sync return URL; returns the full normalized URL string. */
-export declare function parseHubSyncReturnUrl(raw: string | null): string | null;
-/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
-export declare function buildHubSyncUrl(ticket: string, returnUrl?: string): string;
 /** @deprecated Use {@link isOfficialWebOrigin}. */
 export declare const isAllowedDeviceJoinOrigin: typeof isOfficialWebOrigin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "12.11.1",
+  "version": "13.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -115,8 +115,8 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.18.0",
-    "@oxyhq/protocol": "^0.1.5",
+    "@oxyhq/contracts": "^0.19.0",
+    "@oxyhq/protocol": "^0.1.6",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",
     "elliptic": "^6.6.1",

package/src/index.ts

@@ -59,10 +59,15 @@ export type {
     CommonsApprovalInfo,
     CommonsApprovalSubjectAccount,
     CommonsSignInActionResult,
-    CommonsDenyReason,
     CommonsOAuthFinalizeResult,
     CommonsDeliveryResult,
 } from './mixins/OxyServices.auth';
+// `denyCommonsSignIn`'s reason parameter is typed by `CommonsDenyReason`, which
+// is a WIRE contract shared with the API (the request schema of
+// `POST /auth/session/deny/:authorizeCode` and the persisted
+// `AuthSession.deniedReason` enum read the same declaration). It lives in
+// `@oxyhq/contracts` and is NOT re-exported here: consumers import API contract
+// types directly from `@oxyhq/contracts`, per the package boundary rule.
 // Push-token registration (Expo push tokens — never raw APNs/FCM device tokens).
 export type {
     PushTokenPlatform,
@@ -601,8 +606,6 @@ export {
     OXY_OAUTH_STATE_STORAGE_KEY,
     OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY,
     OXY_OAUTH_REDIRECT_URI_STORAGE_KEY,
-    OXY_SILENT_OAUTH_ATTEMPTED_KEY,
-    OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY,
     OXY_OAUTH_RETURN_PATH_STORAGE_KEY,
     normalizeOAuthRedirectUri,
     canonicalizeOAuthRedirectUri,
@@ -615,22 +618,11 @@ export {
 export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
 
 export {
-    buildIdpHubOrigin,
-    buildHubSyncUrl,
-    isIdpHubOrigin,
     isLoopbackOrigin,
     isOfficialWebOrigin,
     isAllowedDeviceJoinOrigin,
-    normalizeOfficialReturnOrigin,
-    parseHubSyncReturnUrl,
 } from './utils/officialOrigins';
 
-export {
-    syncHubAfterSignIn,
-    redeemHubTicketOnHub,
-} from './session/hubSync';
-export type { SyncHubAfterSignInOptions } from './session/hubSync';
-
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------

package/src/mixins/OxyServices.auth.ts

@@ -4,7 +4,12 @@
  * Supports password-based login (email/username) and public key challenge-response.
  */
 import type { User } from '../models/interfaces';
-import type { UserNameResponse, LoginResult, LoginSessionResult } from '@oxyhq/contracts';
+import type {
+  UserNameResponse,
+  LoginResult,
+  LoginSessionResult,
+  CommonsDenyReason,
+} from '@oxyhq/contracts';
 import { loginResultSchema, safeParseContract } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
@@ -336,18 +341,6 @@ export interface CommonsSignInActionResult {
   success: boolean;
 }
 
-/**
- * Why the approver denied a "Sign in with Oxy" request. A CLOSED set — the deny
- * endpoint is unauthenticated, so it accepts no free-form text:
- *
- *  - `'declined'` the approver rejected a request they recognised ("Not now").
- *  - `'not_me'`   the approver did not start the request ("This wasn't me").
- *                 The only value that records the denial as suspicious rather
- *                 than an ordinary cancel, so a UI may only offer it where the
- *                 user genuinely said so.
- */
-export type CommonsDenyReason = 'declined' | 'not_me';
-
 /**
  * Result of finalizing an approved, OAuth-bound "Sign in with Oxy" request.
  *

package/src/mixins/OxyServices.deviceBoot.ts

@@ -15,12 +15,8 @@
  */
 import {
   deviceTokenMintResponseSchema,
-  deviceHubTicketIssueResponseSchema,
-  deviceHubTicketRedeemResponseSchema,
   safeParseContract,
   type DeviceTokenMintResponse,
-  type DeviceHubTicketIssueResponse,
-  type DeviceHubTicketRedeemResponse,
 } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 
@@ -124,48 +120,5 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
         throw normalized;
       }
     }
-
-    /** Mint a one-time hub sync ticket (bearer required). */
-    async issueHubTicket(returnOrigin: string): Promise<DeviceHubTicketIssueResponse> {
-      try {
-        const res = await this.makeRequest<unknown>(
-          'POST',
-          '/session/device/hub-ticket',
-          { returnOrigin },
-          { cache: false },
-        );
-        const parsed = safeParseContract(deviceHubTicketIssueResponseSchema, res);
-        if (!parsed) {
-          throw new Error('session/device/hub-ticket returned an unexpected response shape');
-        }
-        return parsed;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /** Redeem a hub sync ticket for a fresh device secret (public). */
-    async redeemHubTicket(
-      ticket: string,
-      returnOrigin: string,
-    ): Promise<DeviceHubTicketRedeemResponse> {
-      try {
-        const res = await this.makeRequest<unknown>(
-          'POST',
-          '/session/device/redeem-ticket',
-          { ticket, returnOrigin },
-          // Public device-hub sync mint (bearer-less). Same control-plane class as
-          // the device-secret mint — bypassQueue so it never waits for a slot.
-          { cache: false, skipAuth: true, bypassQueue: true },
-        );
-        const parsed = safeParseContract(deviceHubTicketRedeemResponseSchema, res);
-        if (!parsed) {
-          throw new Error('session/device/redeem-ticket returned an unexpected response shape');
-        }
-        return parsed;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
   };
 }

package/src/mixins/__tests__/commonsSignIn.test.ts

@@ -12,6 +12,8 @@
  * degrade-to-QR behaviour every ambiguous input must produce.
  */
 
+import type { CommonsDenyReason } from '@oxyhq/contracts';
+import { COMMONS_DENY_REASONS } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../../models/session';
 import type { ChallengeResponse } from '../OxyServices.auth';
 import type { CommonsDeliveryPlatform } from '../../utils/commonsDelivery';
@@ -769,12 +771,17 @@ describe('OxyServices — "Sign in with Oxy" handoff', () => {
       );
     });
 
-    it.each([['declined'], ['not_me']] as const)(
+    // Iterating the CONTRACT set (rather than a local literal) is the point: the
+    // SDK, the API request schema and the persisted `AuthSession.deniedReason`
+    // enum all read this one declaration, so a value added on the server side
+    // without an SDK release — or the reverse — cannot go unnoticed here.
+    it.each([...COMMONS_DENY_REASONS])(
       'sends the closed-set reason %s in the body',
       async (reason) => {
         makeRequestSpy.mockResolvedValue({ success: true });
 
-        await oxy.denyCommonsSignIn('code-1', reason);
+        const typedReason: CommonsDenyReason = reason;
+        await oxy.denyCommonsSignIn('code-1', typedReason);
 
         expect(makeRequestSpy).toHaveBeenCalledWith(
           'POST',

package/src/server/index.ts

@@ -71,11 +71,4 @@ export { verifySecret } from './verifySecret';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex';
-export {
-  buildIdpHubOrigin,
-  buildHubSyncUrl,
-  isIdpHubOrigin,
-  isOfficialWebOrigin,
-  normalizeOfficialReturnOrigin,
-  parseHubSyncReturnUrl,
-} from '../utils/officialOrigins';
+export { isOfficialWebOrigin } from '../utils/officialOrigins';

package/src/server/rateLimit.ts

@@ -278,6 +278,9 @@ export function createOxyRateLimit(
     standardHeaders: true,
     legacyHeaders: false,
     skip,
+    // hashAnonymousIp already buckets IPv6 to /56 before HMAC; disable the v8
+    // static source scan that false-positives on req.ip (ERR_ERL_KEY_GEN_IPV6).
+    validate: { keyGeneratorIpFallback: false },
   });
 
   return (req, res, next) => {

package/src/session/__tests__/accountDialogController.test.ts

@@ -433,11 +433,9 @@ describe('AccountDialogController — switchTo (uniform switch)', () => {
     expect(commitSession.mock.calls[0][0]).toMatchObject({ sessionId: 'sess-org', accessToken: 'access-org' });
   });
 
-  it('commits a graph switch via the IN-PLACE commitSwitchedSession — never the hub-syncing commitSession', async () => {
-    // PROBLEM 2: an account switch must not run the cross-origin hub-sync
-    // full-page redirect. When both funnels are wired, the mint-switch must use
-    // commitSwitchedSession (in-place) and NEVER commitSession (which may
-    // redirect on an official web origin).
+  it('commits a graph switch via the IN-PLACE commitSwitchedSession — never commitSession', async () => {
+    // An account switch must use commitSwitchedSession (in-place) and NEVER
+    // commitSession when both funnels are wired.
     const oxy = makeOxy();
     const sc = new TestSessionClient(host());
     sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));

package/src/session/accountDialogController.ts

@@ -302,21 +302,17 @@ export interface AccountDialogControllerOptions {
    * `SessionClient.registerAndActivate` (registration + activation only — no
    * provider-side durable persist/hydration).
    *
-   * This is the SIGN-IN commit: on an official web origin it may run the
-   * cross-origin hub-sync (a full-page redirect to `auth.oxy.so/sync`) that
-   * bootstraps silent OAuth restore on OTHER origins. A first sign-in on a web
-   * origin legitimately needs that. An account SWITCH does NOT — see
-   * {@link commitSwitchedSession}.
+   * This is the SIGN-IN commit: registers the session into the host's device
+   * set with durable persist + profile hydration. An account SWITCH uses
+   * {@link commitSwitchedSession} instead — see below.
    */
   commitSession?: (session: SessionLoginResponse) => Promise<void>;
   /**
    * Commit a minted graph SWITCH session into the host's session set — same
    * device-first registration + durable persist + profile hydration as
-   * {@link commitSession}, but IN-PLACE: it must NOT trigger the cross-origin
-   * hub-sync redirect. Switching into an account you already operate reuses the
-   * device credential that was already hub-synced at the original sign-in, so
-   * re-syncing is redundant and a full-page redirect on switch is the exact
-   * regression this separation prevents. Cross-tab/app propagation of the switch
+   * {@link commitSession}, but IN-PLACE: it must NOT re-run sign-in side effects
+   * that belong only to a fresh authorization (for example, a redundant full
+   * device-set reconcile on switch). Cross-tab/app propagation of the switch
    * still happens instantly via the server's device-scoped `session_state` /
    * `session_accounts_changed` socket broadcast — no navigation required.
    *
@@ -811,9 +807,9 @@ export class AccountDialogController {
             accessToken: result.accessToken,
           },
           result.user,
-          // A switch is IN-PLACE: commit without the hub-sync redirect (the
-          // device is already known/synced). Cross-tab/app propagation rides the
-          // server's `session_state` socket broadcast, not a navigation.
+          // A switch is IN-PLACE: use the switch commit funnel (not sign-in).
+          // Cross-tab/app propagation rides the server's `session_state` socket
+          // broadcast, not a navigation.
           { fromSwitch: true },
         );
       }
@@ -1349,11 +1345,9 @@ export class AccountDialogController {
    * consumer's commit funnel (durable persist + hydration); falls back to
    * `SessionClient.registerAndActivate` (registration + activation only).
    *
-   * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
-   * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
-   * `commitSession` (which may hub-sync on an official web origin). When the
-   * switch funnel is not wired it falls back to the sign-in funnel, then to
-   * `registerAndActivate`.
+   * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel;
+   * a SIGN-IN uses `commitSession`. When the switch funnel is not wired it falls
+   * back to the sign-in funnel, then to `registerAndActivate`.
    */
   private async commitAuthorizedSession(
     session: SessionLoginResponse,

package/src/utils/__tests__/officialOrigins.test.ts

@@ -1,19 +1,10 @@
 import {
-  buildHubSyncUrl,
-  buildIdpHubOrigin,
   isAllowedDeviceJoinOrigin,
-  isIdpHubOrigin,
   isLoopbackOrigin,
   isOfficialWebOrigin,
-  normalizeOfficialReturnOrigin,
-  parseHubSyncReturnUrl,
 } from '../officialOrigins';
 
 describe('officialOrigins', () => {
-  it('builds the IdP hub origin', () => {
-    expect(buildIdpHubOrigin()).toBe('https://auth.oxy.so');
-  });
-
   it('allows official first-party origins', () => {
     expect(isOfficialWebOrigin('https://inbox.oxy.so')).toBe(true);
     expect(isOfficialWebOrigin('https://mention.earth')).toBe(true);
@@ -37,52 +28,4 @@ describe('officialOrigins', () => {
     expect(isAllowedDeviceJoinOrigin('https://accounts.oxy.so')).toBe(true);
     expect(isAllowedDeviceJoinOrigin('https://evil.example')).toBe(false);
   });
-
-  it('normalizes return origins to origin only', () => {
-    expect(normalizeOfficialReturnOrigin('https://accounts.oxy.so/settings')).toBe(
-      'https://accounts.oxy.so',
-    );
-    expect(normalizeOfficialReturnOrigin('https://evil.example/')).toBeNull();
-  });
-
-  it('parses hub-sync return URLs', () => {
-    expect(parseHubSyncReturnUrl('https://inbox.oxy.so/messages')).toBe(
-      'https://inbox.oxy.so/messages',
-    );
-    expect(parseHubSyncReturnUrl('https://evil.example/')).toBeNull();
-  });
-
-  it('builds hub sync URLs with ticket and optional return', () => {
-    const url = new URL(buildHubSyncUrl('tk-abc', 'https://accounts.oxy.so/'));
-    expect(url.pathname).toBe('/sync');
-    expect(url.searchParams.get('ticket')).toBe('tk-abc');
-    expect(url.searchParams.get('return')).toBe('https://accounts.oxy.so/');
-  });
-
-  describe('isIdpHubOrigin', () => {
-    const originalLocation = globalThis.location;
-
-    afterEach(() => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: originalLocation,
-      });
-    });
-
-    it('returns true on auth.oxy.so', () => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: { href: 'https://auth.oxy.so/sync' },
-      });
-      expect(isIdpHubOrigin()).toBe(true);
-    });
-
-    it('returns false on satellite origins', () => {
-      Object.defineProperty(globalThis, 'location', {
-        configurable: true,
-        value: { href: 'https://inbox.oxy.so/' },
-      });
-      expect(isIdpHubOrigin()).toBe(false);
-    });
-  });
 });

package/src/utils/oauthPkce.ts

@@ -62,10 +62,18 @@ export interface BuildOAuthAuthorizeUrlParams {
   /** The PKCE `codeChallenge` from {@link generatePkcePair}. */
   codeChallenge: string;
   /**
-   * OAuth `prompt` parameter. Use `none` for silent cross-origin session restore
-   * (no UI when the IdP hub already has a session + grant).
+   * OAuth `prompt` parameter — `login` forces a fresh authentication even when
+   * the IdP already has a session, `consent` forces the consent screen even for
+   * an already-granted scope. Both are ordinary OAuth/OIDC and are here for
+   * third-party relying parties building their own authorize link.
+   *
+   * `'none'` is deliberately NOT in this union. It is the silent-SSO value, and
+   * it was the only value this SDK ever sent — from the cold-boot cross-origin
+   * restore deleted in #691 phase 7b. Accepting it again would hand consumers a
+   * one-line rebuild of the automatic, gesture-less full-page bounce to the IdP
+   * that the popup transport exists to eliminate.
    */
-  prompt?: 'none' | 'login' | 'consent';
+  prompt?: 'login' | 'consent';
   /**
    * How the IdP should deliver the authorization response. Omitted (the
    * default) means the ordinary top-level redirect back to `redirectUri`.
@@ -220,12 +228,6 @@ export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
 /** `sessionStorage` key — the exact `redirect_uri` sent on the authorize request. */
 export const OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = 'oxy.oauth_redirect_uri';
 
-/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
-export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
-
-/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
-export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
-
 /**
  * `sessionStorage` key for the in-app path to return to after an authorize
  * round trip. See {@link persistOAuthReturnPath}.