@oxyhq/core 5.4.2 → 5.5.0

package/dist/cjs/index.js

@@ -21,7 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
 exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = void 0;
 exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.establishIdpSessionAfterClaim = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = void 0;
-exports.packageInfo = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.allowSsoBounce = exports.silentRestoreSuppressed = exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoSignedOutKey = exports.ssoPriorSessionKey = void 0;
+exports.packageInfo = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.allowSsoBounce = exports.silentRestoreSuppressed = exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoOutcomeKey = exports.ssoSignedOutKey = exports.ssoPriorSessionKey = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -288,6 +288,7 @@ Object.defineProperty(exports, "ssoNoSessionKey", { enumerable: true, get: funct
 Object.defineProperty(exports, "ssoAttemptedKey", { enumerable: true, get: function () { return ssoBounce_1.ssoAttemptedKey; } });
 Object.defineProperty(exports, "ssoPriorSessionKey", { enumerable: true, get: function () { return ssoBounce_1.ssoPriorSessionKey; } });
 Object.defineProperty(exports, "ssoSignedOutKey", { enumerable: true, get: function () { return ssoBounce_1.ssoSignedOutKey; } });
+Object.defineProperty(exports, "ssoOutcomeKey", { enumerable: true, get: function () { return ssoBounce_1.ssoOutcomeKey; } });
 Object.defineProperty(exports, "ssoCallbackBootstrapKey", { enumerable: true, get: function () { return ssoBounce_1.ssoCallbackBootstrapKey; } });
 Object.defineProperty(exports, "ssoNavigate", { enumerable: true, get: function () { return ssoBounce_1.ssoNavigate; } });
 Object.defineProperty(exports, "getSsoCallbackBootstrapScript", { enumerable: true, get: function () { return ssoBounce_1.getSsoCallbackBootstrapScript; } });

package/dist/cjs/mixins/OxyServices.user.js

@@ -19,12 +19,23 @@ function OxyServicesUserMixin(Base) {
             super(...args);
         }
         /**
-         * Get profile by username
-         */
-        async getProfileByUsername(username) {
+         * Get profile by username.
+         *
+         * @param username - The profile's username.
+         * @param options.cache - Defaults to `true` (5-minute TTL), matching prior
+         *   behavior. Pass `{ cache: false }` to force a registry-fresh read: the
+         *   request bypasses BOTH the cache lookup and the post-fetch cache write
+         *   (see {@link HttpService.request}'s `cache` handling), so it neither
+         *   serves nor overwrites any entry already cached for this key — a
+         *   previously cached response (if one exists) is left in place until its
+         *   own TTL expires or is explicitly invalidated elsewhere. Use this when a
+         *   caller must observe a just-written change (e.g. a privacy/consent flag)
+         *   that would otherwise be masked by the TTL window.
+         */
+        async getProfileByUsername(username, options) {
             try {
                 const user = await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
-                    cache: true,
+                    cache: options?.cache ?? true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache for profiles
                 });
                 return (0, userIdentity_1.normalizeUserIdentity)(user);
@@ -207,12 +218,23 @@ function OxyServicesUserMixin(Base) {
             return users.map((user) => (0, userIdentity_1.normalizeUserIdentity)(user));
         }
         /**
-         * Get user by ID
-         */
-        async getUserById(userId) {
+         * Get user by ID.
+         *
+         * @param userId - The target user's id.
+         * @param options.cache - Defaults to `true` (5-minute TTL), matching prior
+         *   behavior. Pass `{ cache: false }` to force a registry-fresh read: the
+         *   request bypasses BOTH the cache lookup and the post-fetch cache write
+         *   (see {@link HttpService.request}'s `cache` handling), so it neither
+         *   serves nor overwrites any entry already cached for this key — a
+         *   previously cached response (if one exists) is left in place until its
+         *   own TTL expires or is explicitly invalidated elsewhere. Use this when a
+         *   caller must observe a just-written change (e.g. a privacy/consent flag)
+         *   that would otherwise be masked by the TTL window.
+         */
+        async getUserById(userId, options) {
             try {
                 const user = await this.makeRequest('GET', `/users/${userId}`, undefined, {
-                    cache: true,
+                    cache: options?.cache ?? true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache
                 });
                 return (0, userIdentity_1.normalizeUserIdentity)(user);

package/dist/cjs/session/SessionClient.js

@@ -120,7 +120,10 @@ class SessionClient {
         }
     }
     async connectSocket() {
-        const io = await (0, socketLoader_1.getSocketIO)();
+        // Prefer a statically-injected factory (services/auth-sdk bundle
+        // socket.io-client as a real dep); fall back to the lazy loader — and warn
+        // if THAT yields nothing — only when no factory was injected.
+        const io = this.options.socketFactory ?? (await (0, socketLoader_1.getSocketIO)());
         if (!io) {
             loggerUtils_1.logger.warn('[SessionClient] no socket.io-client; running REST-only (no realtime sync)', { component: 'SessionClient' });
             return;

package/dist/cjs/session/createSessionClient.js

@@ -18,9 +18,15 @@ const sessionClientHost_1 = require("./sessionClientHost");
  * The host is returned alongside the client (not just the client) so the
  * caller can call `host.setCurrentAccountId(...)` as the active account
  * changes.
+ *
+ * `socketFactory` is the statically-injected `socket.io-client` `io` export.
+ * Consumers that bundle socket.io-client as a real dependency pass it so
+ * realtime sync never depends on core's lazy dynamic import of a bare
+ * specifier (bundler-fragile in Metro/Expo-web and Vite against the published
+ * dist). When omitted, the client falls back to the lazy loader.
  */
-function createSessionClient(oxyServices, transport) {
+function createSessionClient(oxyServices, transport, socketFactory) {
     const host = (0, sessionClientHost_1.createSessionClientHost)(oxyServices);
-    const client = new SessionClient_1.SessionClient(host, { transport });
+    const client = new SessionClient_1.SessionClient(host, { transport, socketFactory });
     return { client, host };
 }

package/dist/cjs/utils/ssoBounce.js

@@ -51,6 +51,7 @@ exports.ssoNoSessionKey = ssoNoSessionKey;
 exports.ssoAttemptedKey = ssoAttemptedKey;
 exports.ssoPriorSessionKey = ssoPriorSessionKey;
 exports.ssoSignedOutKey = ssoSignedOutKey;
+exports.ssoOutcomeKey = ssoOutcomeKey;
 exports.ssoCallbackBootstrapKey = ssoCallbackBootstrapKey;
 exports.getSsoCallbackBootstrapScript = getSsoCallbackBootstrapScript;
 exports.ssoNavigate = ssoNavigate;
@@ -84,6 +85,7 @@ const ATTEMPTED_KEY_PREFIX = 'oxy_sso_attempted:';
 const CALLBACK_BOOTSTRAP_KEY_PREFIX = 'oxy_sso_callback_bootstrap:';
 const PRIOR_SESSION_KEY_PREFIX = 'oxy_sso_prior_session:';
 const SIGNED_OUT_KEY_PREFIX = 'oxy_signed_out:';
+const OUTCOME_KEY_PREFIX = 'oxy_sso_outcome:';
 /** Per-origin CSRF state key (matched on return to defeat fragment forgery). */
 function ssoStateKey(origin) {
     return `${STATE_KEY_PREFIX}${origin}`;
@@ -163,6 +165,26 @@ function ssoPriorSessionKey(origin) {
 function ssoSignedOutKey(origin) {
     return `${SIGNED_OUT_KEY_PREFIX}${origin}`;
 }
+/**
+ * Per-origin key holding the LAST consumed SSO-return outcome (`ok` | `none` |
+ * `error`, plus an optional machine-readable `reason` on the non-`ok` outcomes).
+ *
+ * Lives in per-tab `sessionStorage` like the other loop-breaker keys, and for
+ * the same reason: a `none`/`error` return HARD-navigates the RP off the
+ * internal callback path back to its real destination (a fresh document load),
+ * so the outcome an RP wants to render ("the central IdP had no session — show a
+ * branded sign-in screen instead of bouncing again") must survive that
+ * round-trip. The RP reads it on the destination load to decide whether an
+ * AUTOMATIC (guard-driven) sign-in should re-bounce or defer to a user gesture.
+ *
+ * Written as a small JSON blob (`{kind, reason?}`). Set whenever a return is
+ * consumed; cleared on a successful session commit and on an explicit
+ * user-gesture sign-in / full sign-out (so a deliberate retry is never
+ * suppressed by a prior automatic none/error).
+ */
+function ssoOutcomeKey(origin) {
+    return `${OUTCOME_KEY_PREFIX}${origin}`;
+}
 /**
  * Per-origin marker written by the pre-hydration callback bootstrap.
  *

package/dist/cjs/utils/ssoReturn.js

@@ -70,6 +70,14 @@ function parseSsoReturnFragment(hash) {
             result.code = code;
         }
     }
+    else {
+        // A machine-readable reason accompanies a NON-`ok` outcome when the IdP
+        // supplies one. Success carries no reason, so it is only read here.
+        const reason = params.get('reason');
+        if (reason !== null && reason.length > 0) {
+            result.reason = reason;
+        }
+    }
     return result;
 }
 /**