@oxyhq/core 3.8.2 → 3.9.0

package/dist/types/OxyServices.base.d.ts

@@ -52,6 +52,18 @@ export declare class OxyServicesBase {
      * OxyServices instance mounted in OxyProvider. The returned client has its own
      * base URL, cache and request queue, but its bearer token is kept in lockstep
      * with this session and its 401 refresh path delegates back to this session.
+     *
+     * **GET response caching is OFF by default for linked clients.** The SDK's
+     * per-instance GET cache is only safe where the SDK OWNS invalidation: on the
+     * canonical OxyServices client, every mutation (`updateProfile`, `followUser`,
+     * `blockUser`, …) busts the matching cached GET. A linked client targets the
+     * consuming app's OWN backend (`api.mention.earth`, `api.syra.fm`, …), whose
+     * resources and write endpoints the SDK has no knowledge of — so it cannot
+     * invalidate them, and a cached GET there would silently serve stale data
+     * after the app mutates its own data. Caching is therefore unsafe-by-construction
+     * here and is left to the consumer's own layer (React Query / stores), which
+     * owns its invalidation. Pass `createLinkedClient({ baseURL, enableCache: true })`
+     * to explicitly opt back in when the consumer accepts that responsibility.
      */
     createLinkedClient(config: OxyConfig): LinkedHttpClient;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "3.8.2",
+  "version": "3.9.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/OxyServices.base.ts

@@ -129,9 +129,23 @@ export class OxyServicesBase {
    * OxyServices instance mounted in OxyProvider. The returned client has its own
    * base URL, cache and request queue, but its bearer token is kept in lockstep
    * with this session and its 401 refresh path delegates back to this session.
+   *
+   * **GET response caching is OFF by default for linked clients.** The SDK's
+   * per-instance GET cache is only safe where the SDK OWNS invalidation: on the
+   * canonical OxyServices client, every mutation (`updateProfile`, `followUser`,
+   * `blockUser`, …) busts the matching cached GET. A linked client targets the
+   * consuming app's OWN backend (`api.mention.earth`, `api.syra.fm`, …), whose
+   * resources and write endpoints the SDK has no knowledge of — so it cannot
+   * invalidate them, and a cached GET there would silently serve stale data
+   * after the app mutates its own data. Caching is therefore unsafe-by-construction
+   * here and is left to the consumer's own layer (React Query / stores), which
+   * owns its invalidation. Pass `createLinkedClient({ baseURL, enableCache: true })`
+   * to explicitly opt back in when the consumer accepts that responsibility.
    */
   public createLinkedClient(config: OxyConfig): LinkedHttpClient {
-    const client = new HttpService(config);
+    // Default the GET cache OFF unless the caller explicitly opts in (see the
+    // method doc): the SDK cannot invalidate the consumer backend's resources.
+    const client = new HttpService({ ...config, enableCache: config.enableCache ?? false });
 
     const syncToken = (accessToken: string | null): void => {
       const currentAccessToken = client.getAccessToken();

package/src/__tests__/linkedClient.test.ts

@@ -206,4 +206,65 @@ describe('OxyServices.createLinkedClient', () => {
 
     linked.dispose();
   });
+
+  /**
+   * GET response caching is OFF by default for linked clients: the SDK cannot
+   * invalidate the consumer backend's resources, so a cached GET there would
+   * serve stale data after the app mutates its own data. The consumer's own
+   * layer (React Query / stores) owns caching. An explicit `enableCache: true`
+   * opts back in.
+   */
+  describe('linked client GET cache default', () => {
+    it('does NOT cache GETs by default — every read hits the network', async () => {
+      const fetchMock = jest.fn();
+      globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+
+      const oxy = createServices();
+      const accessToken = createJwt({
+        userId: 'user_1',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      });
+      oxy.setTokens(accessToken);
+      const linked = oxy.createLinkedClient({ baseURL: 'https://api.mention.earth' });
+
+      // Two identical GETs with cache:true — both MUST hit the network because
+      // the linked client's cache is disabled by default.
+      fetchMock.mockResolvedValueOnce(jsonResponse({ v: 1 }));
+      const first = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
+      fetchMock.mockResolvedValueOnce(jsonResponse({ v: 2 }));
+      const second = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
+
+      expect(first.v).toBe(1);
+      expect(second.v).toBe(2);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+
+      linked.dispose();
+    });
+
+    it('caches GETs when the caller explicitly opts in with enableCache: true', async () => {
+      const fetchMock = jest.fn();
+      globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+
+      const oxy = createServices();
+      const accessToken = createJwt({
+        userId: 'user_1',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+      });
+      oxy.setTokens(accessToken);
+      const linked = oxy.createLinkedClient({
+        baseURL: 'https://api.mention.earth',
+        enableCache: true,
+      });
+
+      // Second identical GET is a warm cache hit — only one network call.
+      fetchMock.mockResolvedValueOnce(jsonResponse({ v: 1 }));
+      const first = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
+      const second = await linked.client.get<{ v: number }>('/feed/mtn', { cache: true });
+
+      expect(first).toEqual(second);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      linked.dispose();
+    });
+  });
 });

package/dist/cjs/mixins/OxyServices.popup.js

@@ -1,263 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OxyServicesPopupAuthMixin = OxyServicesPopupAuthMixin;
-exports.PopupAuthMixin = OxyServicesPopupAuthMixin;
-const OxyServices_errors_1 = require("../OxyServices.errors");
-const debugUtils_1 = require("../shared/utils/debugUtils");
-const debug = (0, debugUtils_1.createDebugLogger)("PopupAuth");
-/**
- * Cross-domain browser auth helpers.
- *
- * Popup sign-in is intentionally fail-closed in the clean session model because
- * the historical implementation required bearer-token callback URLs. FedCM,
- * redirect SSO, and silent iframe SSO are the supported browser paths.
- */
-function OxyServicesPopupAuthMixin(Base) {
-    var _a;
-    return _a = class extends Base {
-            constructor(...args) {
-                super(...args);
-            }
-            /** Resolve auth URL from config or static default (method, not getter — getters break in TS mixins) */
-            resolveAuthUrl() {
-                return (this.config.authWebUrl || this.constructor.DEFAULT_AUTH_URL);
-            }
-            /**
-             * Removed popup sign-in. Closes a caller-supplied popup handle and throws.
-             */
-            async signInWithPopup(options = {}) {
-                if (typeof window === "undefined") {
-                    throw new OxyServices_errors_1.OxyAuthenticationError("Popup authentication requires browser environment");
-                }
-                if (options.popup && !options.popup.closed) {
-                    options.popup.close();
-                }
-                throw new OxyServices_errors_1.OxyAuthenticationError("Popup authentication has been removed because it required access-token callback URLs. Use FedCM or redirect authentication.");
-            }
-            /**
-             * Removed popup signup. Closes a caller-supplied popup handle and throws.
-             */
-            async signUpWithPopup(options = {}) {
-                return this.signInWithPopup({ ...options, mode: "signup" });
-            }
-            /**
-             * Silent sign-in using hidden iframe
-             *
-             * Attempts to automatically re-authenticate the user without any UI.
-             * This is what enables seamless SSO across all Oxy domains.
-             *
-             * How it works:
-             * 1. Creates hidden iframe pointing to auth.oxy.so/silent-auth
-             * 2. If user has valid session at auth.oxy.so, it exchanges an opaque SSO code
-             * 3. If not, iframe responds with null (no error thrown)
-             *
-             * This should be called on app startup to check for existing sessions.
-             *
-             * @param options - Silent auth options
-             * @returns Session if user is signed in, null otherwise
-             *
-             * @example
-             * ```typescript
-             * useEffect(() => {
-             *   const checkAuth = async () => {
-             *     const session = await oxyServices.silentSignIn();
-             *     if (session) {
-             *       setUser(session.user);
-             *     }
-             *   };
-             *   checkAuth();
-             * }, []);
-             * ```
-             */
-            async silentSignIn(options = {}) {
-                if (typeof window === "undefined") {
-                    return null;
-                }
-                const timeout = options.timeout || this.constructor.SILENT_TIMEOUT;
-                const nonce = this.generateNonce();
-                const clientId = window.location.origin;
-                // Resolve the IdP origin for the iframe. An explicit per-apex override (the
-                // durable cross-domain reload path — see `SilentAuthOptions.authWebUrlOverride`)
-                // wins over the instance's configured central auth URL. The SAME origin is
-                // handed to `waitForIframeAuth` so the postMessage origin check matches the
-                // exact host the iframe was loaded from.
-                const authOrigin = options.authWebUrlOverride && options.authWebUrlOverride.length > 0
-                    ? options.authWebUrlOverride
-                    : this.resolveAuthUrl();
-                const iframe = document.createElement("iframe");
-                iframe.style.display = "none";
-                iframe.style.position = "absolute";
-                iframe.style.width = "0";
-                iframe.style.height = "0";
-                iframe.style.border = "none";
-                const silentUrl = `${authOrigin}/auth/silent?` +
-                    `client_id=${encodeURIComponent(clientId)}&` +
-                    `nonce=${nonce}`;
-                iframe.src = silentUrl;
-                document.body.appendChild(iframe);
-                try {
-                    const session = await this.waitForIframeAuth(iframe, timeout, authOrigin);
-                    // Bail early on incomplete responses. The iframe contract requires
-                    // both an access token and a session id; anything less is unusable.
-                    // Returning `null` here (without installing the token) prevents a
-                    // stale credential from being committed to HttpService when the
-                    // user is actually signed out — that pattern caused a `getCurrentUser`
-                    // -> 401 -> token-clear loop in consumer apps because callers gated
-                    // on `session?.user` and never installed the user via
-                    // `handleAuthSuccess`, while HttpService quietly held the token.
-                    const accessToken = session
-                        ? session.accessToken
-                        : undefined;
-                    if (!session || !accessToken || !session.sessionId) {
-                        return null;
-                    }
-                    // Snapshot the previous token so we can roll back if the user
-                    // lookup below fails — this avoids leaving a half-committed session
-                    // (token installed, user missing) which would let the next
-                    // authenticated request 401 with no way to recover.
-                    const previousAccessToken = this.httpService.getAccessToken();
-                    this.httpService.setTokens(accessToken);
-                    // The iframe typically returns `{ sessionId, accessToken }` without
-                    // user data. Fetch the user explicitly so callers receive a
-                    // fully-formed session and never need a second `/users/me` round
-                    // trip. If this fails the session is unusable — revert the token
-                    // and return null so the caller treats this exactly like a
-                    // missing-session response.
-                    if (!session.user) {
-                        try {
-                            const userData = await this.makeRequest("GET", `/session/user/${session.sessionId}`, undefined, { cache: false, retry: false });
-                            if (!userData) {
-                                throw new Error("Empty user response");
-                            }
-                            session.user = userData;
-                        }
-                        catch (userError) {
-                            debug.warn("silentSignIn: failed to fetch user data, rolling back token", userError);
-                            if (previousAccessToken) {
-                                this.httpService.setTokens(previousAccessToken);
-                            }
-                            else {
-                                this.httpService.clearTokens();
-                            }
-                            return null;
-                        }
-                    }
-                    return session;
-                }
-                catch (error) {
-                    return null;
-                }
-                finally {
-                    document.body.removeChild(iframe);
-                }
-            }
-            /**
-             * Open a blank, centered popup window SYNCHRONOUSLY.
-             *
-             * Kept only so legacy callers can pass a handle to the removed popup method,
-             * which closes it before throwing. New auth code should use FedCM or redirect.
-             */
-            openBlankPopup(width, height) {
-                if (typeof window === "undefined") {
-                    return null;
-                }
-                const ctor = this.constructor;
-                const w = width ?? ctor.POPUP_WIDTH;
-                const h = height ?? ctor.POPUP_HEIGHT;
-                return this.openCenteredPopup("about:blank", "Oxy Sign In", w, h);
-            }
-            /**
-             * Open a centered popup window
-             *
-             * @private
-             */
-            openCenteredPopup(url, title, width, height) {
-                const left = window.screenX + (window.outerWidth - width) / 2;
-                const top = window.screenY + (window.outerHeight - height) / 2;
-                const features = [
-                    `width=${width}`,
-                    `height=${height}`,
-                    `left=${left}`,
-                    `top=${top}`,
-                    "toolbar=no",
-                    "menubar=no",
-                    "scrollbars=yes",
-                    "resizable=yes",
-                    "status=no",
-                    "location=no",
-                ].join(",");
-                return window.open(url, title, features);
-            }
-            /**
-             * Wait for authentication response from iframe
-             *
-             * @private
-             */
-            async waitForIframeAuth(iframe, timeout, expectedOrigin) {
-                return new Promise((resolve) => {
-                    const timeoutId = setTimeout(() => {
-                        cleanup();
-                        resolve(null); // Silent failure - don't throw
-                    }, timeout);
-                    const messageHandler = (event) => {
-                        // Verify origin against the EXACT host the iframe was loaded from
-                        // (`expectedOrigin`). For the per-apex durable-restore path this is
-                        // `auth.<rp-apex>`, not the instance's central `resolveAuthUrl()` — so
-                        // we must honour the caller-supplied origin, never re-derive it here.
-                        if (event.origin !== expectedOrigin) {
-                            return;
-                        }
-                        const { type, session } = event.data;
-                        if (type !== "oxy_silent_auth") {
-                            return;
-                        }
-                        cleanup();
-                        resolve(session || null);
-                    };
-                    // Fail-fast on a load failure. When the per-apex `/auth/silent` host is
-                    // unreachable, blocked by CSP `frame-ancestors`/`X-Frame-Options`, or the
-                    // network drops, the iframe never posts a message — without this handler
-                    // the silent restore would block for the FULL `timeout` (dead latency in
-                    // the cold-boot critical path). `onerror`/`onabort` fire on a failed load,
-                    // so resolve `null` immediately and let the next cold-boot step run. The
-                    // success path posts a message and is handled above; these only catch the
-                    // no-message failure modes.
-                    const failFast = () => {
-                        cleanup();
-                        resolve(null);
-                    };
-                    iframe.onerror = failFast;
-                    iframe.onabort = failFast;
-                    const cleanup = () => {
-                        clearTimeout(timeoutId);
-                        iframe.onerror = null;
-                        iframe.onabort = null;
-                        window.removeEventListener("message", messageHandler);
-                    };
-                    window.addEventListener("message", messageHandler);
-                });
-            }
-            /**
-             * Generate nonce for replay attack prevention
-             *
-             * @private
-             */
-            generateNonce() {
-                if (typeof crypto !== "undefined" && crypto.randomUUID) {
-                    return crypto.randomUUID();
-                }
-                if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-                    const bytes = new Uint8Array(16);
-                    crypto.getRandomValues(bytes);
-                    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-                }
-                throw new Error("No secure random source available for nonce generation");
-            }
-        },
-        _a.DEFAULT_AUTH_URL = "https://auth.oxy.so",
-        _a.POPUP_WIDTH = 500,
-        _a.POPUP_HEIGHT = 700,
-        _a.SILENT_TIMEOUT = 5000 // 5 seconds
-    ,
-        _a;
-}

package/dist/esm/mixins/OxyServices.popup.js

@@ -1,261 +0,0 @@
-import { OxyAuthenticationError } from "../OxyServices.errors.js";
-import { createDebugLogger } from "../shared/utils/debugUtils.js";
-const debug = createDebugLogger("PopupAuth");
-/**
- * Cross-domain browser auth helpers.
- *
- * Popup sign-in is intentionally fail-closed in the clean session model because
- * the historical implementation required bearer-token callback URLs. FedCM,
- * redirect SSO, and silent iframe SSO are the supported browser paths.
- */
-export function OxyServicesPopupAuthMixin(Base) {
-    var _a;
-    return _a = class extends Base {
-            constructor(...args) {
-                super(...args);
-            }
-            /** Resolve auth URL from config or static default (method, not getter — getters break in TS mixins) */
-            resolveAuthUrl() {
-                return (this.config.authWebUrl || this.constructor.DEFAULT_AUTH_URL);
-            }
-            /**
-             * Removed popup sign-in. Closes a caller-supplied popup handle and throws.
-             */
-            async signInWithPopup(options = {}) {
-                if (typeof window === "undefined") {
-                    throw new OxyAuthenticationError("Popup authentication requires browser environment");
-                }
-                if (options.popup && !options.popup.closed) {
-                    options.popup.close();
-                }
-                throw new OxyAuthenticationError("Popup authentication has been removed because it required access-token callback URLs. Use FedCM or redirect authentication.");
-            }
-            /**
-             * Removed popup signup. Closes a caller-supplied popup handle and throws.
-             */
-            async signUpWithPopup(options = {}) {
-                return this.signInWithPopup({ ...options, mode: "signup" });
-            }
-            /**
-             * Silent sign-in using hidden iframe
-             *
-             * Attempts to automatically re-authenticate the user without any UI.
-             * This is what enables seamless SSO across all Oxy domains.
-             *
-             * How it works:
-             * 1. Creates hidden iframe pointing to auth.oxy.so/silent-auth
-             * 2. If user has valid session at auth.oxy.so, it exchanges an opaque SSO code
-             * 3. If not, iframe responds with null (no error thrown)
-             *
-             * This should be called on app startup to check for existing sessions.
-             *
-             * @param options - Silent auth options
-             * @returns Session if user is signed in, null otherwise
-             *
-             * @example
-             * ```typescript
-             * useEffect(() => {
-             *   const checkAuth = async () => {
-             *     const session = await oxyServices.silentSignIn();
-             *     if (session) {
-             *       setUser(session.user);
-             *     }
-             *   };
-             *   checkAuth();
-             * }, []);
-             * ```
-             */
-            async silentSignIn(options = {}) {
-                if (typeof window === "undefined") {
-                    return null;
-                }
-                const timeout = options.timeout || this.constructor.SILENT_TIMEOUT;
-                const nonce = this.generateNonce();
-                const clientId = window.location.origin;
-                // Resolve the IdP origin for the iframe. An explicit per-apex override (the
-                // durable cross-domain reload path — see `SilentAuthOptions.authWebUrlOverride`)
-                // wins over the instance's configured central auth URL. The SAME origin is
-                // handed to `waitForIframeAuth` so the postMessage origin check matches the
-                // exact host the iframe was loaded from.
-                const authOrigin = options.authWebUrlOverride && options.authWebUrlOverride.length > 0
-                    ? options.authWebUrlOverride
-                    : this.resolveAuthUrl();
-                const iframe = document.createElement("iframe");
-                iframe.style.display = "none";
-                iframe.style.position = "absolute";
-                iframe.style.width = "0";
-                iframe.style.height = "0";
-                iframe.style.border = "none";
-                const silentUrl = `${authOrigin}/auth/silent?` +
-                    `client_id=${encodeURIComponent(clientId)}&` +
-                    `nonce=${nonce}`;
-                iframe.src = silentUrl;
-                document.body.appendChild(iframe);
-                try {
-                    const session = await this.waitForIframeAuth(iframe, timeout, authOrigin);
-                    // Bail early on incomplete responses. The iframe contract requires
-                    // both an access token and a session id; anything less is unusable.
-                    // Returning `null` here (without installing the token) prevents a
-                    // stale credential from being committed to HttpService when the
-                    // user is actually signed out — that pattern caused a `getCurrentUser`
-                    // -> 401 -> token-clear loop in consumer apps because callers gated
-                    // on `session?.user` and never installed the user via
-                    // `handleAuthSuccess`, while HttpService quietly held the token.
-                    const accessToken = session
-                        ? session.accessToken
-                        : undefined;
-                    if (!session || !accessToken || !session.sessionId) {
-                        return null;
-                    }
-                    // Snapshot the previous token so we can roll back if the user
-                    // lookup below fails — this avoids leaving a half-committed session
-                    // (token installed, user missing) which would let the next
-                    // authenticated request 401 with no way to recover.
-                    const previousAccessToken = this.httpService.getAccessToken();
-                    this.httpService.setTokens(accessToken);
-                    // The iframe typically returns `{ sessionId, accessToken }` without
-                    // user data. Fetch the user explicitly so callers receive a
-                    // fully-formed session and never need a second `/users/me` round
-                    // trip. If this fails the session is unusable — revert the token
-                    // and return null so the caller treats this exactly like a
-                    // missing-session response.
-                    if (!session.user) {
-                        try {
-                            const userData = await this.makeRequest("GET", `/session/user/${session.sessionId}`, undefined, { cache: false, retry: false });
-                            if (!userData) {
-                                throw new Error("Empty user response");
-                            }
-                            session.user = userData;
-                        }
-                        catch (userError) {
-                            debug.warn("silentSignIn: failed to fetch user data, rolling back token", userError);
-                            if (previousAccessToken) {
-                                this.httpService.setTokens(previousAccessToken);
-                            }
-                            else {
-                                this.httpService.clearTokens();
-                            }
-                            return null;
-                        }
-                    }
-                    return session;
-                }
-                catch (error) {
-                    return null;
-                }
-                finally {
-                    document.body.removeChild(iframe);
-                }
-            }
-            /**
-             * Open a blank, centered popup window SYNCHRONOUSLY.
-             *
-             * Kept only so legacy callers can pass a handle to the removed popup method,
-             * which closes it before throwing. New auth code should use FedCM or redirect.
-             */
-            openBlankPopup(width, height) {
-                if (typeof window === "undefined") {
-                    return null;
-                }
-                const ctor = this.constructor;
-                const w = width ?? ctor.POPUP_WIDTH;
-                const h = height ?? ctor.POPUP_HEIGHT;
-                return this.openCenteredPopup("about:blank", "Oxy Sign In", w, h);
-            }
-            /**
-             * Open a centered popup window
-             *
-             * @private
-             */
-            openCenteredPopup(url, title, width, height) {
-                const left = window.screenX + (window.outerWidth - width) / 2;
-                const top = window.screenY + (window.outerHeight - height) / 2;
-                const features = [
-                    `width=${width}`,
-                    `height=${height}`,
-                    `left=${left}`,
-                    `top=${top}`,
-                    "toolbar=no",
-                    "menubar=no",
-                    "scrollbars=yes",
-                    "resizable=yes",
-                    "status=no",
-                    "location=no",
-                ].join(",");
-                return window.open(url, title, features);
-            }
-            /**
-             * Wait for authentication response from iframe
-             *
-             * @private
-             */
-            async waitForIframeAuth(iframe, timeout, expectedOrigin) {
-                return new Promise((resolve) => {
-                    const timeoutId = setTimeout(() => {
-                        cleanup();
-                        resolve(null); // Silent failure - don't throw
-                    }, timeout);
-                    const messageHandler = (event) => {
-                        // Verify origin against the EXACT host the iframe was loaded from
-                        // (`expectedOrigin`). For the per-apex durable-restore path this is
-                        // `auth.<rp-apex>`, not the instance's central `resolveAuthUrl()` — so
-                        // we must honour the caller-supplied origin, never re-derive it here.
-                        if (event.origin !== expectedOrigin) {
-                            return;
-                        }
-                        const { type, session } = event.data;
-                        if (type !== "oxy_silent_auth") {
-                            return;
-                        }
-                        cleanup();
-                        resolve(session || null);
-                    };
-                    // Fail-fast on a load failure. When the per-apex `/auth/silent` host is
-                    // unreachable, blocked by CSP `frame-ancestors`/`X-Frame-Options`, or the
-                    // network drops, the iframe never posts a message — without this handler
-                    // the silent restore would block for the FULL `timeout` (dead latency in
-                    // the cold-boot critical path). `onerror`/`onabort` fire on a failed load,
-                    // so resolve `null` immediately and let the next cold-boot step run. The
-                    // success path posts a message and is handled above; these only catch the
-                    // no-message failure modes.
-                    const failFast = () => {
-                        cleanup();
-                        resolve(null);
-                    };
-                    iframe.onerror = failFast;
-                    iframe.onabort = failFast;
-                    const cleanup = () => {
-                        clearTimeout(timeoutId);
-                        iframe.onerror = null;
-                        iframe.onabort = null;
-                        window.removeEventListener("message", messageHandler);
-                    };
-                    window.addEventListener("message", messageHandler);
-                });
-            }
-            /**
-             * Generate nonce for replay attack prevention
-             *
-             * @private
-             */
-            generateNonce() {
-                if (typeof crypto !== "undefined" && crypto.randomUUID) {
-                    return crypto.randomUUID();
-                }
-                if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-                    const bytes = new Uint8Array(16);
-                    crypto.getRandomValues(bytes);
-                    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-                }
-                throw new Error("No secure random source available for nonce generation");
-            }
-        },
-        _a.DEFAULT_AUTH_URL = "https://auth.oxy.so",
-        _a.POPUP_WIDTH = 500,
-        _a.POPUP_HEIGHT = 700,
-        _a.SILENT_TIMEOUT = 5000 // 5 seconds
-    ,
-        _a;
-}
-// Export the mixin function as both named and default
-export { OxyServicesPopupAuthMixin as PopupAuthMixin };