@oxyhq/core 7.1.1 → 8.0.0

package/dist/esm/HttpService.js

@@ -53,7 +53,7 @@ const CSRF_FETCH_RETRY_DELAY_MS = 500;
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
  * refresh is attempted. Prevents a refresh storm (and server hammering) when
- * the AuthManager's refresh handler is failing — every in-flight request that
+ * the auth refresh handler is failing — every in-flight request that
  * hits a 401 would otherwise trigger its own refresh.
  */
 const TOKEN_REFRESH_COOLDOWN_MS = 15000;
@@ -140,7 +140,7 @@ export class HttpService {
         this.cacheSizeWarningSilentUntil = 0;
         /**
          * Fan-out listeners notified on EVERY access-token change on this instance:
-         * explicit `setTokens`, `clearTokens`, an AuthManager-owned refresh, and the
+         * explicit `setTokens`, `clearTokens`, a refresh-handler rotation, and the
          * internal 401-driven clear. This is a Set so multiple independent observers
          * can mirror token state without clobbering each other.
          *
@@ -358,9 +358,9 @@ export class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    // On 401, delegate refresh to AuthManager and retry once before
-                    // giving up. HttpService deliberately does not know any session
-                    // routes; the AuthManager is the single session authority.
+                    // On 401, delegate to the installed auth refresh handler and retry
+                    // once before giving up. HttpService deliberately does not know any
+                    // session routes; the refresh handler owns session rotation.
                     if (response.status === 401 && !config._isAuthRetry && !config.skipAuth) {
                         const refreshed = await this.refreshAccessToken('response-401');
                         if (refreshed) {
@@ -820,7 +820,7 @@ export class HttpService {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
                 }
-                this.logger.debug('Token refreshed via AuthManager');
+                this.logger.debug('Token refreshed via the auth refresh handler');
                 return newToken;
             })
                 .catch((error) => {

package/dist/esm/i18n/locales/en-US.json

@@ -384,7 +384,11 @@
             "subtitle": "Add another account to switch between them quickly"
         },
         "label": "Account switcher",
-        "searchPlaceholder": "Search accounts"
+        "searchPlaceholder": "Search accounts",
+        "scanTitle": "Scan to sign in",
+        "scanSubtitle": "Open the Oxy app on your phone and scan this code",
+        "scanWithOxy": "Scan with the Oxy app to continue",
+        "scanQr": "Scan QR code"
     },
     "reputation": {
         "faq": {
@@ -1905,5 +1909,44 @@
             "earlyAdopter": "Early Adopter",
             "earlyAdopterDesc": "Been part of the community from the start"
         }
+    },
+    "consent": {
+        "title": "Continue to {{app}}",
+        "subtitle": "Use your Oxy account to sign in to {{app}}. Review what this connection means before you continue.",
+        "provenance": {
+            "title": "Who is requesting access",
+            "official": "Official Oxy application",
+            "developer": "Published by {{developer}}",
+            "thirdParty": "Third-party application"
+        },
+        "permissions": {
+            "title": "Permissions requested",
+            "basic": "Sign you in and read your basic profile"
+        },
+        "scopes": {
+            "openid": "Confirm your identity",
+            "profile": "Read your basic profile",
+            "email": "Read your email address",
+            "offlineAccess": "Keep you signed in when you're away",
+            "userRead": "Read your basic profile",
+            "filesRead": "Read your files",
+            "filesWrite": "Upload and modify your files",
+            "filesDelete": "Delete your files",
+            "webhooksReceive": "Receive webhooks",
+            "chatCompletions": "Use AI chat on your behalf",
+            "modelsRead": "List available AI models",
+            "federationWrite": "Act across federated services"
+        },
+        "account": {
+            "title": "Signing in as"
+        },
+        "links": {
+            "website": "Website",
+            "privacy": "Privacy Policy",
+            "terms": "Terms of Service"
+        },
+        "allow": "Continue to {{app}}",
+        "deny": "Cancel",
+        "disclaimer": "By continuing, {{app}} will be able to sign in with your Oxy account. You can manage connected apps anytime in your Oxy account settings."
     }
 }

package/dist/esm/i18n/locales/es-ES.json

@@ -581,7 +581,11 @@
             "subtitle": "Añade otra cuenta para cambiar rápidamente entre ellas"
         },
         "label": "Selector de cuentas",
-        "searchPlaceholder": "Buscar cuentas"
+        "searchPlaceholder": "Buscar cuentas",
+        "scanTitle": "Escanea para iniciar sesión",
+        "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
+        "scanWithOxy": "Escanea con la app de Oxy para continuar",
+        "scanQr": "Escanear código QR"
     },
     "feedback": {
         "type": {
@@ -1905,5 +1909,44 @@
             "earlyAdopter": "Pionero",
             "earlyAdopterDesc": "Has formado parte de la comunidad desde el principio"
         }
+    },
+    "consent": {
+        "title": "Continuar a {{app}}",
+        "subtitle": "Usa tu cuenta de Oxy para iniciar sesión en {{app}}. Revisa qué implica esta conexión antes de continuar.",
+        "provenance": {
+            "title": "Quién solicita acceso",
+            "official": "Aplicación oficial de Oxy",
+            "developer": "Publicada por {{developer}}",
+            "thirdParty": "Aplicación de terceros"
+        },
+        "permissions": {
+            "title": "Permisos solicitados",
+            "basic": "Iniciar sesión y leer tu perfil básico"
+        },
+        "scopes": {
+            "openid": "Confirmar tu identidad",
+            "profile": "Leer tu perfil básico",
+            "email": "Leer tu dirección de correo",
+            "offlineAccess": "Mantener tu sesión iniciada cuando no estés",
+            "userRead": "Leer tu perfil básico",
+            "filesRead": "Leer tus archivos",
+            "filesWrite": "Subir y modificar tus archivos",
+            "filesDelete": "Eliminar tus archivos",
+            "webhooksReceive": "Recibir webhooks",
+            "chatCompletions": "Usar el chat con IA en tu nombre",
+            "modelsRead": "Ver los modelos de IA disponibles",
+            "federationWrite": "Actuar en servicios federados"
+        },
+        "account": {
+            "title": "Iniciando sesión como"
+        },
+        "links": {
+            "website": "Sitio web",
+            "privacy": "Política de privacidad",
+            "terms": "Términos del servicio"
+        },
+        "allow": "Continuar a {{app}}",
+        "deny": "Cancelar",
+        "disclaimer": "Al continuar, {{app}} podrá iniciar sesión con tu cuenta de Oxy. Puedes gestionar las apps conectadas cuando quieras en los ajustes de tu cuenta de Oxy."
     }
 }

package/dist/esm/i18n/locales/locales/en-US.json

@@ -384,7 +384,11 @@
       "subtitle": "Add another account to switch between them quickly"
     },
     "label": "Account switcher",
-    "searchPlaceholder": "Search accounts"
+    "searchPlaceholder": "Search accounts",
+    "scanTitle": "Scan to sign in",
+    "scanSubtitle": "Open the Oxy app on your phone and scan this code",
+    "scanWithOxy": "Scan with the Oxy app to continue",
+    "scanQr": "Scan QR code"
   },
   "reputation": {
     "faq": {
@@ -1905,5 +1909,44 @@
       "earlyAdopter": "Early Adopter",
       "earlyAdopterDesc": "Been part of the community from the start"
     }
+  },
+  "consent": {
+    "title": "Continue to {{app}}",
+    "subtitle": "Use your Oxy account to sign in to {{app}}. Review what this connection means before you continue.",
+    "provenance": {
+      "title": "Who is requesting access",
+      "official": "Official Oxy application",
+      "developer": "Published by {{developer}}",
+      "thirdParty": "Third-party application"
+    },
+    "permissions": {
+      "title": "Permissions requested",
+      "basic": "Sign you in and read your basic profile"
+    },
+    "scopes": {
+      "openid": "Confirm your identity",
+      "profile": "Read your basic profile",
+      "email": "Read your email address",
+      "offlineAccess": "Keep you signed in when you're away",
+      "userRead": "Read your basic profile",
+      "filesRead": "Read your files",
+      "filesWrite": "Upload and modify your files",
+      "filesDelete": "Delete your files",
+      "webhooksReceive": "Receive webhooks",
+      "chatCompletions": "Use AI chat on your behalf",
+      "modelsRead": "List available AI models",
+      "federationWrite": "Act across federated services"
+    },
+    "account": {
+      "title": "Signing in as"
+    },
+    "links": {
+      "website": "Website",
+      "privacy": "Privacy Policy",
+      "terms": "Terms of Service"
+    },
+    "allow": "Continue to {{app}}",
+    "deny": "Cancel",
+    "disclaimer": "By continuing, {{app}} will be able to sign in with your Oxy account. You can manage connected apps anytime in your Oxy account settings."
   }
-}
+}

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -581,7 +581,11 @@
       "subtitle": "Añade otra cuenta para cambiar rápidamente entre ellas"
     },
     "label": "Selector de cuentas",
-    "searchPlaceholder": "Buscar cuentas"
+    "searchPlaceholder": "Buscar cuentas",
+    "scanTitle": "Escanea para iniciar sesión",
+    "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
+    "scanWithOxy": "Escanea con la app de Oxy para continuar",
+    "scanQr": "Escanear código QR"
   },
   "feedback": {
     "type": {
@@ -1905,5 +1909,44 @@
       "earlyAdopter": "Pionero",
       "earlyAdopterDesc": "Has formado parte de la comunidad desde el principio"
     }
+  },
+  "consent": {
+    "title": "Continuar a {{app}}",
+    "subtitle": "Usa tu cuenta de Oxy para iniciar sesión en {{app}}. Revisa qué implica esta conexión antes de continuar.",
+    "provenance": {
+      "title": "Quién solicita acceso",
+      "official": "Aplicación oficial de Oxy",
+      "developer": "Publicada por {{developer}}",
+      "thirdParty": "Aplicación de terceros"
+    },
+    "permissions": {
+      "title": "Permisos solicitados",
+      "basic": "Iniciar sesión y leer tu perfil básico"
+    },
+    "scopes": {
+      "openid": "Confirmar tu identidad",
+      "profile": "Leer tu perfil básico",
+      "email": "Leer tu dirección de correo",
+      "offlineAccess": "Mantener tu sesión iniciada cuando no estés",
+      "userRead": "Leer tu perfil básico",
+      "filesRead": "Leer tus archivos",
+      "filesWrite": "Subir y modificar tus archivos",
+      "filesDelete": "Eliminar tus archivos",
+      "webhooksReceive": "Recibir webhooks",
+      "chatCompletions": "Usar el chat con IA en tu nombre",
+      "modelsRead": "Ver los modelos de IA disponibles",
+      "federationWrite": "Actuar en servicios federados"
+    },
+    "account": {
+      "title": "Iniciando sesión como"
+    },
+    "links": {
+      "website": "Sitio web",
+      "privacy": "Política de privacidad",
+      "terms": "Términos del servicio"
+    },
+    "allow": "Continuar a {{app}}",
+    "deny": "Cancelar",
+    "disclaimer": "Al continuar, {{app}} podrá iniciar sesión con tu cuenta de Oxy. Puedes gestionar las apps conectadas cuando quieras en los ajustes de tu cuenta de Oxy."
   }
-}
+}

package/dist/esm/index.js

@@ -119,28 +119,26 @@ export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccou
 // ---------------------------------------------------------------------------
 // Registrable-domain + central-IdP-apex helpers.
 //
-// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
-// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
-// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
-// via the `@oxyhq/core/server` re-export consumed by
-// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
-// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
-// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
-// module as of wave 2 — kept exported for now rather than removed here (an
-// export deletion is a logic change, out of scope for a comment sweep); flag
-// for a follow-up dead-export cleanup pass.
+// `registrableApex` (eTLD+1) is consumed via the `@oxyhq/core/server`
+// re-export by `packages/api/src/utils/sameSite.ts` for same-site origin
+// checks; `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`).
 // ---------------------------------------------------------------------------
 export { registrableApex } from './utils/registrableApex.js';
 export { CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
-export { SSO_CALLBACK_PATH } from './utils/ssoBounce.js';
 export { runColdBoot } from './utils/coldBoot.js';
 // ---------------------------------------------------------------------------
+// OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
+// Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
+// ---------------------------------------------------------------------------
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, } from './utils/oauthPkce.js';
+// ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------
 export { SessionClient } from './session/SessionClient.js';
 // Shared SessionClient integration layer: the host adapter, the pure
 // DeviceSessionState projection helpers, and the client factory are defined
-// ONCE here so `@oxyhq/services` and `@oxyhq/auth` both reuse them instead of
+// ONCE here so every `@oxyhq/services` platform variant reuses them instead of
 // duplicating a local copy. Each consumer supplies its own `TokenTransport`
 // (native vs. web mint strategies differ) to `createSessionClient`.
 export { createSessionClientHost } from './session/sessionClientHost.js';
@@ -149,7 +147,7 @@ export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountId
 // Unified account-list projection (THE single source of truth for the account
 // chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
 // I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
-// `@oxyhq/services`, `@oxyhq/auth`, and auth.oxy.so so the list can't diverge.
+// `@oxyhq/services` and auth.oxy.so so the list can't diverge.
 export { projectSwitchableAccounts, switchableAccountIds, } from './session/accountProjection.js';
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)

package/dist/esm/server/index.js

@@ -27,8 +27,3 @@ export { verifySecret } from './verifySecret.js';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex.js';
-// The single RP callback path the IdP redirects back to. A pure wire-contract
-// constant (no browser deps at module top level), re-used server-side so the
-// `/sso/establish-token` `return_to` cannot drift from what `/sso/establish`
-// validates.
-export { SSO_CALLBACK_PATH } from '../utils/ssoBounce.js';

package/dist/esm/session/accountDialogController.js

@@ -3,7 +3,7 @@
  *
  * A framework-agnostic state machine + subscribe/getSnapshot store (the same
  * pattern {@link SessionClient} uses — no React, no RN) that both
- * `@oxyhq/services` (RN `OxyProvider`) and `@oxyhq/auth` (web `WebOxyProvider`)
+ * every `OxyProvider` platform variant (Expo/RN and RN-Web)
  * bind to via `useSyncExternalStore`, so the account chooser is ONE
  * implementation across the ecosystem instead of the five drifting copies it
  * replaces.

package/dist/esm/session/accountProjection.js

@@ -5,7 +5,7 @@
  * merging the device's server-authoritative session set (`DeviceSessionState`
  * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
  * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
- * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `@oxyhq/core` so every `@oxyhq/services` platform variant — and
  * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
  * diverge.
  *

package/dist/esm/session/projectSessionState.js

@@ -1,7 +1,7 @@
 /**
  * Pure projection helpers: `DeviceSessionState` (the device-scoped
  * multi-account session-sync state produced by `SessionClient`) -> the
- * shapes consumers (`@oxyhq/services`, `@oxyhq/auth`) render today
+ * shapes `@oxyhq/services` consumers render today
  * (`ClientSession[]`, an active session id, an active `User`).
  *
  * No I/O. The caller fetches profiles via

package/dist/esm/session/sessionClientHost.js

@@ -4,8 +4,7 @@
  * `SessionClient` is host-agnostic: it only needs a REST + token surface.
  * `OxyServices` already exposes all of that except `getCurrentAccountId`,
  * which has no direct equivalent — the adapter holds a mutable ref set by
- * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
- * `@oxyhq/auth`) via `setCurrentAccountId`.
+ * the caller (`OxyContext` in `@oxyhq/services`) via `setCurrentAccountId`.
  *
  * Shared here (rather than duplicated per consumer) because it is entirely
  * platform-agnostic: every method it calls exists identically on

package/dist/esm/utils/accountUtils.js

@@ -1,6 +1,6 @@
 /**
  * Shared account types and pure helper functions.
- * Used by both @oxyhq/services (React Native) and @oxyhq/auth (Web) account stores.
+ * Used by the @oxyhq/services account stores (Expo/RN and RN-Web).
  */
 import { translate } from '../i18n/index.js';
 /**

package/dist/esm/utils/oauthPkce.js

@@ -0,0 +1,135 @@
+/**
+ * OAuth 2.0 Authorization Code + PKCE helpers for "Sign in with Oxy" third-party
+ * sign-in.
+ *
+ * Third-party Relying Parties (SPAs, static sites, and native apps that are NOT
+ * Oxy first-party) authenticate through the standard OAuth flow against
+ * `auth.oxy.so/authorize` — never FedCM, SSO bounces, or Oxy session cookies.
+ * Public clients (no secret) prove possession of the authorization code with
+ * PKCE (RFC 7636, S256): the RP generates a random `code_verifier`, sends its
+ * `code_challenge = BASE64URL(SHA-256(code_verifier))` on the authorize
+ * redirect, and later replays the raw verifier on the token exchange.
+ *
+ * All cross-platform crypto (random bytes, SHA-256) is delegated to the shared
+ * `@oxyhq/protocol` platform loaders — the exact primitives the rest of core's
+ * crypto already uses — so these helpers run identically on web, Node, and
+ * React Native. No `require()`, so the ESM build stays bundler-clean.
+ */
+import { isNodeJS, isReactNative, loadExpoCrypto, loadNodeCrypto, sha256 } from '@oxyhq/protocol';
+import { logger } from './loggerUtils.js';
+/** The central Oxy IdP authorization endpoint used by default. */
+export const OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';
+/** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
+export const DEFAULT_OAUTH_SCOPE = 'openid profile';
+/**
+ * Number of random bytes behind a PKCE `code_verifier`. 64 bytes → 86 base64url
+ * characters, comfortably inside RFC 7636 §4.1's required 43–128 range.
+ */
+const PKCE_VERIFIER_BYTES = 64;
+/** Number of random bytes behind an OAuth `state` (CSRF) token. */
+const OAUTH_STATE_BYTES = 32;
+/** RFC 4648 §5 base64url alphabet (URL- and filename-safe, no padding). */
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/**
+ * Cryptographically-secure random bytes, cross-platform.
+ *
+ * Mirrors the platform gating the rest of core's crypto already uses:
+ * `expo-crypto` on React Native, Node's built-in `crypto` on the server, and
+ * the Web Crypto API in the browser (also the fallback if Node's `crypto`
+ * fails to load in an unusual bundled-Node environment).
+ */
+async function getSecureRandomBytes(byteLength) {
+    if (isReactNative()) {
+        const crypto = await loadExpoCrypto();
+        return Uint8Array.from(await crypto.getRandomBytesAsync(byteLength));
+    }
+    if (isNodeJS()) {
+        try {
+            const nodeCrypto = await loadNodeCrypto();
+            return Uint8Array.from(nodeCrypto.randomBytes(byteLength));
+        }
+        catch (error) {
+            logger.warn('[oxy.oauth] Node crypto unavailable for PKCE random bytes, falling back to Web Crypto', { component: 'oauthPkce' }, error);
+        }
+    }
+    const bytes = new Uint8Array(byteLength);
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+}
+/** Encode raw bytes as unpadded base64url (RFC 4648 §5). */
+function bytesToBase64Url(bytes) {
+    let output = '';
+    for (let i = 0; i < bytes.length; i += 3) {
+        const byte0 = bytes[i];
+        const hasByte1 = i + 1 < bytes.length;
+        const hasByte2 = i + 2 < bytes.length;
+        const byte1 = hasByte1 ? bytes[i + 1] : 0;
+        const byte2 = hasByte2 ? bytes[i + 2] : 0;
+        output += BASE64URL_ALPHABET[byte0 >> 2];
+        output += BASE64URL_ALPHABET[((byte0 & 0x03) << 4) | (byte1 >> 4)];
+        if (hasByte1) {
+            output += BASE64URL_ALPHABET[((byte1 & 0x0f) << 2) | (byte2 >> 6)];
+        }
+        if (hasByte2) {
+            output += BASE64URL_ALPHABET[byte2 & 0x3f];
+        }
+    }
+    return output;
+}
+/** Decode a lowercase-hex string into its raw bytes. */
+function hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i += 1) {
+        bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Compute the PKCE S256 `code_challenge` for a given verifier:
+ * `BASE64URL(SHA-256(ASCII(codeVerifier)))` (RFC 7636 §4.2). The verifier is
+ * base64url (ASCII), so its UTF-8 and ASCII byte encodings are identical.
+ *
+ * Reuses `@oxyhq/protocol`'s cross-platform {@link sha256} (which returns
+ * lowercase hex); the digest bytes are recovered and re-encoded as base64url.
+ */
+export async function computeCodeChallenge(codeVerifier) {
+    const digestHex = await sha256(codeVerifier);
+    return bytesToBase64Url(hexToBytes(digestHex));
+}
+/**
+ * Generate a fresh PKCE verifier/challenge pair for an OAuth authorization-code
+ * flow. The verifier is 64 random bytes as base64url (86 chars, within RFC 7636
+ * §4.1's 43–128 range and drawn only from the unreserved set); the challenge is
+ * its S256 transform.
+ */
+export async function generatePkcePair() {
+    const codeVerifier = bytesToBase64Url(await getSecureRandomBytes(PKCE_VERIFIER_BYTES));
+    const codeChallenge = await computeCodeChallenge(codeVerifier);
+    return { codeVerifier, codeChallenge, method: 'S256' };
+}
+/**
+ * Generate an opaque, single-use OAuth `state` token (32 random bytes as
+ * base64url) for CSRF protection across the authorize redirect.
+ */
+export async function generateOAuthState() {
+    return bytesToBase64Url(await getSecureRandomBytes(OAUTH_STATE_BYTES));
+}
+/**
+ * Build the `auth.oxy.so/authorize` redirect URL for an OAuth authorization-code
+ * + PKCE (S256) flow. Built via the WHATWG `URL` API so a custom
+ * `authorizeBaseUrl` that already carries a query string keeps its existing
+ * params (the OAuth params are merged in, not clobbered by a naive `?` concat).
+ * All values are percent-encoded by `URL.searchParams`.
+ */
+export function buildOAuthAuthorizeUrl(params) {
+    const { authorizeBaseUrl = OXY_AUTHORIZE_URL, clientId, redirectUri, scope = DEFAULT_OAUTH_SCOPE, state, codeChallenge, } = params;
+    const url = new URL(authorizeBaseUrl);
+    url.searchParams.set('client_id', clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('state', state);
+    url.searchParams.set('scope', scope);
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    return url.toString();
+}

package/dist/esm/utils/platform.js

@@ -89,7 +89,7 @@ export function setPlatformOS(os) {
  *
  * Native defines a global `window` but no `document`, so the DOM probe — not a
  * bare `window` check — is the reliable discriminator. This is the single
- * source of truth consumed by `@oxyhq/services` and `@oxyhq/auth` (both dropped
+ * source of truth consumed by `@oxyhq/services` (which dropped
  * their local copies), so every consumer shares the exact same predicate.
  *
  * NOTE: this is a live runtime probe (not the cached `getPlatformOS()` verdict)