@oxyhq/core 5.4.2 → 5.5.0

package/dist/esm/index.js

@@ -129,7 +129,7 @@ export { generateSsoState } from './mixins/OxyServices.sso.js';
 // Post-claim durable-session establish hop (web device-flow / QR sign-in).
 export { establishIdpSessionAfterClaim } from './utils/ssoEstablish.js';
 // SSO bounce — per-origin sessionStorage keys, bounce URL builder, predicates
-export { SSO_CALLBACK_PATH, SSO_GUARD_TTL_MS, ssoStateKey, ssoGuardKey, ssoDestKey, ssoNoSessionKey, ssoAttemptedKey, ssoPriorSessionKey, ssoSignedOutKey, ssoCallbackBootstrapKey, ssoNavigate, getSsoCallbackBootstrapScript, buildSsoBounceUrl, isCentralIdPOrigin, guardActive, silentRestoreSuppressed, allowSsoBounce, } from './utils/ssoBounce.js';
+export { SSO_CALLBACK_PATH, SSO_GUARD_TTL_MS, ssoStateKey, ssoGuardKey, ssoDestKey, ssoNoSessionKey, ssoAttemptedKey, ssoPriorSessionKey, ssoSignedOutKey, ssoOutcomeKey, ssoCallbackBootstrapKey, ssoNavigate, getSsoCallbackBootstrapScript, buildSsoBounceUrl, isCentralIdPOrigin, guardActive, silentRestoreSuppressed, allowSsoBounce, } from './utils/ssoBounce.js';
 export { runColdBoot } from './utils/coldBoot.js';
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)

package/dist/esm/mixins/OxyServices.user.js

@@ -16,12 +16,23 @@ export function OxyServicesUserMixin(Base) {
             super(...args);
         }
         /**
-         * Get profile by username
-         */
-        async getProfileByUsername(username) {
+         * Get profile by username.
+         *
+         * @param username - The profile's username.
+         * @param options.cache - Defaults to `true` (5-minute TTL), matching prior
+         *   behavior. Pass `{ cache: false }` to force a registry-fresh read: the
+         *   request bypasses BOTH the cache lookup and the post-fetch cache write
+         *   (see {@link HttpService.request}'s `cache` handling), so it neither
+         *   serves nor overwrites any entry already cached for this key — a
+         *   previously cached response (if one exists) is left in place until its
+         *   own TTL expires or is explicitly invalidated elsewhere. Use this when a
+         *   caller must observe a just-written change (e.g. a privacy/consent flag)
+         *   that would otherwise be masked by the TTL window.
+         */
+        async getProfileByUsername(username, options) {
             try {
                 const user = await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
-                    cache: true,
+                    cache: options?.cache ?? true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache for profiles
                 });
                 return normalizeUserIdentity(user);
@@ -204,12 +215,23 @@ export function OxyServicesUserMixin(Base) {
             return users.map((user) => normalizeUserIdentity(user));
         }
         /**
-         * Get user by ID
-         */
-        async getUserById(userId) {
+         * Get user by ID.
+         *
+         * @param userId - The target user's id.
+         * @param options.cache - Defaults to `true` (5-minute TTL), matching prior
+         *   behavior. Pass `{ cache: false }` to force a registry-fresh read: the
+         *   request bypasses BOTH the cache lookup and the post-fetch cache write
+         *   (see {@link HttpService.request}'s `cache` handling), so it neither
+         *   serves nor overwrites any entry already cached for this key — a
+         *   previously cached response (if one exists) is left in place until its
+         *   own TTL expires or is explicitly invalidated elsewhere. Use this when a
+         *   caller must observe a just-written change (e.g. a privacy/consent flag)
+         *   that would otherwise be masked by the TTL window.
+         */
+        async getUserById(userId, options) {
             try {
                 const user = await this.makeRequest('GET', `/users/${userId}`, undefined, {
-                    cache: true,
+                    cache: options?.cache ?? true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache
                 });
                 return normalizeUserIdentity(user);

package/dist/esm/session/SessionClient.js

@@ -117,7 +117,10 @@ export class SessionClient {
         }
     }
     async connectSocket() {
-        const io = await getSocketIO();
+        // Prefer a statically-injected factory (services/auth-sdk bundle
+        // socket.io-client as a real dep); fall back to the lazy loader — and warn
+        // if THAT yields nothing — only when no factory was injected.
+        const io = this.options.socketFactory ?? (await getSocketIO());
         if (!io) {
             logger.warn('[SessionClient] no socket.io-client; running REST-only (no realtime sync)', { component: 'SessionClient' });
             return;

package/dist/esm/session/createSessionClient.js

@@ -15,9 +15,15 @@ import { createSessionClientHost } from './sessionClientHost.js';
  * The host is returned alongside the client (not just the client) so the
  * caller can call `host.setCurrentAccountId(...)` as the active account
  * changes.
+ *
+ * `socketFactory` is the statically-injected `socket.io-client` `io` export.
+ * Consumers that bundle socket.io-client as a real dependency pass it so
+ * realtime sync never depends on core's lazy dynamic import of a bare
+ * specifier (bundler-fragile in Metro/Expo-web and Vite against the published
+ * dist). When omitted, the client falls back to the lazy loader.
  */
-export function createSessionClient(oxyServices, transport) {
+export function createSessionClient(oxyServices, transport, socketFactory) {
     const host = createSessionClientHost(oxyServices);
-    const client = new SessionClient(host, { transport });
+    const client = new SessionClient(host, { transport, socketFactory });
     return { client, host };
 }

package/dist/esm/utils/ssoBounce.js

@@ -66,6 +66,7 @@ const ATTEMPTED_KEY_PREFIX = 'oxy_sso_attempted:';
 const CALLBACK_BOOTSTRAP_KEY_PREFIX = 'oxy_sso_callback_bootstrap:';
 const PRIOR_SESSION_KEY_PREFIX = 'oxy_sso_prior_session:';
 const SIGNED_OUT_KEY_PREFIX = 'oxy_signed_out:';
+const OUTCOME_KEY_PREFIX = 'oxy_sso_outcome:';
 /** Per-origin CSRF state key (matched on return to defeat fragment forgery). */
 export function ssoStateKey(origin) {
     return `${STATE_KEY_PREFIX}${origin}`;
@@ -145,6 +146,26 @@ export function ssoPriorSessionKey(origin) {
 export function ssoSignedOutKey(origin) {
     return `${SIGNED_OUT_KEY_PREFIX}${origin}`;
 }
+/**
+ * Per-origin key holding the LAST consumed SSO-return outcome (`ok` | `none` |
+ * `error`, plus an optional machine-readable `reason` on the non-`ok` outcomes).
+ *
+ * Lives in per-tab `sessionStorage` like the other loop-breaker keys, and for
+ * the same reason: a `none`/`error` return HARD-navigates the RP off the
+ * internal callback path back to its real destination (a fresh document load),
+ * so the outcome an RP wants to render ("the central IdP had no session — show a
+ * branded sign-in screen instead of bouncing again") must survive that
+ * round-trip. The RP reads it on the destination load to decide whether an
+ * AUTOMATIC (guard-driven) sign-in should re-bounce or defer to a user gesture.
+ *
+ * Written as a small JSON blob (`{kind, reason?}`). Set whenever a return is
+ * consumed; cleared on a successful session commit and on an explicit
+ * user-gesture sign-in / full sign-out (so a deliberate retry is never
+ * suppressed by a prior automatic none/error).
+ */
+export function ssoOutcomeKey(origin) {
+    return `${OUTCOME_KEY_PREFIX}${origin}`;
+}
 /**
  * Per-origin marker written by the pre-hydration callback bootstrap.
  *

package/dist/esm/utils/ssoReturn.js

@@ -66,6 +66,14 @@ export function parseSsoReturnFragment(hash) {
             result.code = code;
         }
     }
+    else {
+        // A machine-readable reason accompanies a NON-`ok` outcome when the IdP
+        // supplies one. Success carries no reason, so it is only read here.
+        const reason = params.get('reason');
+        if (reason !== null && reason.length > 0) {
+            result.reason = reason;
+        }
+    }
     return result;
 }
 /**