@oxyhq/services 21.0.1 → 22.0.0

package/src/ui/boot/runProviderColdBoot.ts

@@ -8,6 +8,7 @@ import type { SessionClient } from '@oxyhq/core';
 import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
 import {
   consumeSilentOAuthError,
+  isSilentRestoreEligibleOrigin,
   maybeStartSilentOAuthRestore,
 } from '../utils/crossOriginRestore';
 import { tryCompleteOAuthReturn, consumeHubSyncFailure } from '../utils/oauthReturn';
@@ -22,6 +23,12 @@ export interface RunProviderColdBootOptions {
   authStore: AuthStateStore;
   clientId?: string;
   authRedirectUri?: string;
+  /**
+   * Authorize endpoint override for silent cross-origin restore. Defaults to
+   * the production Oxy IdP when unset; a local/staging deployment sets it so the
+   * silent-restore redirect targets its own IdP, never production.
+   */
+  authorizeBaseUrl?: string;
   sessionClient: SessionClient;
   syncDeviceCredentialToHost: () => Promise<void>;
   commitSession: (
@@ -46,6 +53,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     authStore,
     clientId,
     authRedirectUri,
+    authorizeBaseUrl,
     sessionClient,
     syncDeviceCredentialToHost,
     commitSession,
@@ -129,11 +137,26 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       },
     });
 
-    if (isWebBrowser() && clientId && outcome.kind !== 'session') {
+    // Silent cross-origin OAuth restore (web cross-app SSO). Gate it the SAME
+    // way the hub-sync WRITE side (`syncHubAfterSignIn`) gates: official web
+    // origins only, never the IdP hub itself, and — unlike the write side —
+    // never a loopback / local-dev origin (which must not be bounced to a hosted
+    // IdP on cold boot). The authorize endpoint is env-configurable so a
+    // local/staging app targets its own IdP instead of production.
+    const webOrigin = isWebBrowser()
+      ? (globalThis as { location?: Location }).location?.origin
+      : undefined;
+    if (
+      clientId &&
+      outcome.kind !== 'session' &&
+      webOrigin &&
+      isSilentRestoreEligibleOrigin(webOrigin)
+    ) {
       const redirected = await maybeStartSilentOAuthRestore({
         oxyServices,
         clientId,
         redirectUri: authRedirectUri,
+        authorizeBaseUrl,
       });
       if (redirected) {
         return;

package/src/ui/components/OxyAccountDialog.tsx

@@ -250,7 +250,6 @@ const OxyAccountDialog: React.FC = () => {
             handlers={handlers}
             onSignInWithOxy={() => void controller.signInWithOxy()}
             onScanQr={() => void controller.showQr()}
-            onUsePassword={() => void controller.openPasswordAtOxyAuth()}
             onSignInWithPasskey={passkeyAvailable ? () => void handleSignInWithPasskey() : undefined}
             passkeyPending={passkeyPending}
             passkeyError={passkeyError}
@@ -447,7 +446,6 @@ interface SignInViewProps {
   handlers: OxyAccountDialogHandlers;
   onSignInWithOxy: () => void;
   onScanQr: () => void;
-  onUsePassword: () => void;
   /** When present, offer a "Sign in with a passkey" button (first-party Oxy web only). */
   onSignInWithPasskey?: () => void;
   passkeyPending: boolean;
@@ -461,7 +459,6 @@ const SignInView: React.FC<SignInViewProps> = ({
   handlers,
   onSignInWithOxy,
   onScanQr,
-  onUsePassword,
   onSignInWithPasskey,
   passkeyPending,
   passkeyError,
@@ -508,12 +505,6 @@ const SignInView: React.FC<SignInViewProps> = ({
     <Button variant="secondary" onPress={onScanQr} style={styles.secondaryButton}>
       {t('accountSwitcher.scanQr') || 'Scan a QR from another device'}
     </Button>
-
-    <Pressable onPress={onUsePassword} accessibilityRole="button" style={styles.passwordLink}>
-      <Text style={[styles.linkText, { color: theme.colors.textSecondary }]}>
-        Use a password instead
-      </Text>
-    </Pressable>
   </View>
 );
 
@@ -738,11 +729,6 @@ const styles = StyleSheet.create({
     borderRadius: 14,
     marginTop: 10,
   },
-  passwordLink: {
-    alignSelf: 'center',
-    paddingVertical: 10,
-    marginTop: 12,
-  },
   dividerRow: {
     flexDirection: 'row',
     alignItems: 'center',

package/src/ui/components/OxyProvider.tsx

@@ -114,6 +114,7 @@ const OxyProvider: FC<OxyProviderProps> = ({
     baseURL,
     authWebUrl,
     authRedirectUri,
+    authorizeBaseUrl,
     queryClient: providedQueryClient,
     requireAuth = 'off',
     hubSync = true,
@@ -309,6 +310,7 @@ const OxyProvider: FC<OxyProviderProps> = ({
                     baseURL={baseURL}
                     authWebUrl={authWebUrl}
                     authRedirectUri={authRedirectUri}
+                    authorizeBaseUrl={authorizeBaseUrl}
                     storageKeyPrefix={storageKeyPrefix}
                     clientId={clientId}
                     hubSync={hubSync}

package/src/ui/context/OxyContext.tsx

@@ -27,7 +27,6 @@ import {
   logger as loggerUtil,
   syncHubAfterSignIn,
 } from '@oxyhq/core';
-import type { SecurityAlert } from '@oxyhq/contracts';
 import {
   registerAccountDialogControls,
   notifyAccountDialogVisibility,
@@ -59,7 +58,6 @@ import {
 } from '../session';
 import type {
   OxyContextState,
-  PasswordSignInResult,
   OxyContextProviderProps,
   CommitInput,
 } from './oxyContextTypes';
@@ -74,7 +72,7 @@ import {
 import { queryKeys } from '../hooks/queries/queryKeys';
 import { useOxyAccountGraph } from './useOxyAccountGraph';
 
-export type { OxyContextState, PasswordSignInResult, OxyContextProviderProps } from './oxyContextTypes';
+export type { OxyContextState, OxyContextProviderProps } from './oxyContextTypes';
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
@@ -84,6 +82,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   baseURL,
   authWebUrl,
   authRedirectUri,
+  authorizeBaseUrl,
   storageKeyPrefix = 'oxy_session',
   clientId: clientIdProp,
   hubSync = true,
@@ -622,7 +621,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       oxyServices,
       sessionClient,
       clientId,
-      authRedirectUri,
       locale: currentLanguage,
       // Same statically-injected `io` as the SessionClient: gives the QR flow an
       // instant `/auth-session` `auth_update` wake instead of a slow poll.
@@ -676,72 +674,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     notifyAccountDialogVisibility(accountDialogOpen);
   }, [accountDialogOpen]);
 
-  // Keyless password sign-in: username/email + password.
-  const signInWithPassword = useCallback(
-    async (
-      identifier: string,
-      password: string,
-      opts?: { deviceName?: string; deviceFingerprint?: string },
-    ): Promise<PasswordSignInResult> => {
-      const persisted = await authStore.load();
-      const result = await oxyServices.passwordSignIn(identifier, password, {
-        deviceName: opts?.deviceName,
-        deviceFingerprint: opts?.deviceFingerprint,
-        deviceId: persisted?.deviceId,
-      });
-      if ('twoFactorRequired' in result) {
-        return { status: '2fa_required', loginToken: result.loginToken };
-      }
-      // `passwordSignIn` already planted the access token on the session arm.
-      await commitSession(
-        {
-          sessionId: result.sessionId,
-          accessToken: result.accessToken,
-          deviceSecret: result.deviceSecret,
-          deviceId: result.deviceId,
-          expiresAt: result.expiresAt,
-          userId: result.user.id,
-          user: result.user,
-        },
-        { activate: true, hubSync: true },
-      );
-      return { status: 'ok', ...(result.securityAlert ? { securityAlert: result.securityAlert } : {}) };
-    },
-    [oxyServices, commitSession],
-  );
-
-  const completeTwoFactorSignIn = useCallback(
-    async (params: {
-      loginToken: string;
-      token?: string;
-      backupCode?: string;
-      deviceName?: string;
-    }): Promise<{ securityAlert?: SecurityAlert }> => {
-      const persisted = await authStore.load();
-      const result = await oxyServices.completeTwoFactorSignIn({
-        loginToken: params.loginToken,
-        token: params.token,
-        backupCode: params.backupCode,
-        deviceName: params.deviceName,
-        deviceId: persisted?.deviceId,
-      });
-      await commitSession(
-        {
-          sessionId: result.sessionId,
-          accessToken: result.accessToken,
-          deviceSecret: result.deviceSecret,
-          deviceId: result.deviceId,
-          expiresAt: result.expiresAt,
-          userId: result.user.id,
-          user: result.user,
-        },
-        { activate: true, hubSync: true },
-      );
-      return { securityAlert: result.securityAlert };
-    },
-    [oxyServices, commitSession],
-  );
-
   // ── Passkey (WebAuthn) ─────────────────────────────────────────────────────
   // Web-only sign-in / registration via the browser WebAuthn ceremony. The fixed
   // `options → ceremony → verify → commit` ordering lives in the pure
@@ -750,16 +682,20 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // `commitSession` funnel). All three GATE on `isPasskeySupported()` so a native
   // / unsupported surface throws loudly instead of stalling in a ceremony.
 
-  // Usernameless (discoverable) passkey sign-in.
+  // Passkey sign-in. No `username` → usernameless (discoverable) flow. With a
+  // `username` → username-first: the server scopes `allowCredentials` to that
+  // user's passkeys so a non-discoverable hardware key (U2F/security key) can
+  // be selected.
   const signInWithPasskey = useCallback(
-    async (opts?: { deviceName?: string; deviceFingerprint?: string }): Promise<void> => {
+    async (opts?: { username?: string; deviceName?: string; deviceFingerprint?: string }): Promise<void> => {
       const persisted = await authStore.load();
       await runPasskeyLogin({
         isSupported: isPasskeySupported,
-        getLoginOptions: () => oxyServices.webauthnLoginOptions(),
+        getLoginOptions: (username) => oxyServices.webauthnLoginOptions(username),
         runCeremony: runAuthenticationCeremony,
         loginVerify: (response, envelope) => oxyServices.webauthnLoginVerify(response, envelope),
         commit: (input) => commitSession(input, { activate: true, hubSync: true }),
+        username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
         deviceFingerprint: opts?.deviceFingerprint,
@@ -802,6 +738,17 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     [oxyServices, queryClient],
   );
 
+  // Remove a passkey from the already-signed-in account by credential id. Not a
+  // ceremony — a plain unlink — so it needs no `isPasskeySupported` gate; it just
+  // refreshes the linked auth-methods list on success.
+  const removePasskey = useCallback(
+    async (credentialId: string): Promise<void> => {
+      await oxyServices.removePasskey(credentialId);
+      void queryClient.invalidateQueries({ queryKey: queryKeys.authMethods.all });
+    },
+    [oxyServices, queryClient],
+  );
+
   // ── Cold boot ────────────────────────────────────────────────────────────
   // Device-first session restore via `runProviderColdBoot` (see boot/runProviderColdBoot.ts).
   const runColdBoot = useCallback(async (): Promise<void> => {
@@ -810,6 +757,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       authStore,
       clientId: clientIdProp,
       authRedirectUri,
+      authorizeBaseUrl,
       sessionClient,
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
@@ -821,6 +769,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     authStore,
     clientIdProp,
     authRedirectUri,
+    authorizeBaseUrl,
     syncDeviceCredentialToHost,
     sessionClient,
   ]);
@@ -950,11 +899,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       hasIdentity,
       getPublicKey,
       signIn,
-      signInWithPassword,
-      completeTwoFactorSignIn,
       signInWithPasskey,
       registerWithPasskey,
       addPasskey,
+      removePasskey,
       revokeSuspiciousSignIn,
       handleWebSession,
       logout,
@@ -1005,11 +953,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       hasIdentity,
       getPublicKey,
       signIn,
-      signInWithPassword,
-      completeTwoFactorSignIn,
       signInWithPasskey,
       registerWithPasskey,
       addPasskey,
+      removePasskey,
       revokeSuspiciousSignIn,
       handleWebSession,
       logout,
@@ -1078,11 +1025,10 @@ const LOADING_STATE: OxyContextState = {
   hasIdentity: () => Promise.resolve(false),
   getPublicKey: () => Promise.resolve(null),
   signIn: () => rejectMissingProvider<User>(),
-  signInWithPassword: () => rejectMissingProvider<PasswordSignInResult>(),
-  completeTwoFactorSignIn: () => rejectMissingProvider<{ securityAlert?: SecurityAlert }>(),
   signInWithPasskey: () => rejectMissingProvider<void>(),
   registerWithPasskey: () => rejectMissingProvider<void>(),
   addPasskey: () => rejectMissingProvider<void>(),
+  removePasskey: () => rejectMissingProvider<void>(),
   revokeSuspiciousSignIn: () => rejectMissingProvider<void>(),
   handleWebSession: () => rejectMissingProvider<void>(),
   logout: () => rejectMissingProvider<void>(),

package/src/ui/context/__tests__/passkeyFlow.test.ts

@@ -9,7 +9,7 @@
  * deps-injection style `commitSessionFlow.test.ts` uses.
  */
 
-import type { LoginResult, LoginSessionResult } from '@oxyhq/contracts';
+import type { LoginSessionResult } from '@oxyhq/contracts';
 import {
   runPasskeyLogin,
   runPasskeyRegister,
@@ -45,7 +45,6 @@ const expectedCommitInput: CommitInput = {
   user: { id: SESSION_USER_ID, username: 'pkuser' },
 };
 
-const twoFactorResult: LoginResult = { twoFactorRequired: true, loginToken: 'lt_should_not_happen' };
 const linkResult: PasskeyRegisterVerifyResult = { success: true, message: 'Passkey added' };
 
 describe('runPasskeyLogin', () => {
@@ -92,25 +91,33 @@ describe('runPasskeyLogin', () => {
     expect(deps.commit).toHaveBeenCalledWith(expectedCommitInput);
   });
 
-  it('throws and touches nothing when passkeys are unsupported', async () => {
+  it('forwards the username to getLoginOptions for the username-first (hardware-key) path', async () => {
     const order: string[] = [];
-    const deps = buildDeps(order, { isSupported: jest.fn(() => false) });
+    const deps = buildDeps(order, { username: 'alice' });
 
-    await expect(runPasskeyLogin(deps)).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
-    expect(deps.getLoginOptions).not.toHaveBeenCalled();
-    expect(deps.commit).not.toHaveBeenCalled();
+    await runPasskeyLogin(deps);
+
+    // The username scopes login options to that user's passkeys — the path a
+    // non-discoverable U2F/security key needs.
+    expect(deps.getLoginOptions).toHaveBeenCalledWith('alice');
   });
 
-  it('refuses a 2FA arm (a passkey assertion is the strong factor) and never commits', async () => {
+  it('passes undefined to getLoginOptions for the usernameless (discoverable) path', async () => {
     const order: string[] = [];
-    const deps = buildDeps(order, {
-      loginVerify: jest.fn(async () => {
-        order.push('loginVerify');
-        return twoFactorResult;
-      }),
-    });
+    const deps = buildDeps(order);
 
-    await expect(runPasskeyLogin(deps)).rejects.toThrow(/second factor/i);
+    await runPasskeyLogin(deps);
+
+    // No username → discoverable-credential ceremony (server returns an empty allow-list).
+    expect(deps.getLoginOptions).toHaveBeenCalledWith(undefined);
+  });
+
+  it('throws and touches nothing when passkeys are unsupported', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order, { isSupported: jest.fn(() => false) });
+
+    await expect(runPasskeyLogin(deps)).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
+    expect(deps.getLoginOptions).not.toHaveBeenCalled();
     expect(deps.commit).not.toHaveBeenCalled();
   });
 });

package/src/ui/context/oxyContextTypes.ts

@@ -1,6 +1,5 @@
 import type { ReactNode } from 'react';
 import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient } from '@oxyhq/core';
-import type { SecurityAlert } from '@oxyhq/contracts';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -41,26 +40,20 @@ export interface OxyContextState {
 
   signIn: (publicKey: string, deviceName?: string) => Promise<User>;
 
-  signInWithPassword: (
-    identifier: string,
-    password: string,
-    opts?: { deviceName?: string; deviceFingerprint?: string },
-  ) => Promise<PasswordSignInResult>;
-
-  completeTwoFactorSignIn: (params: {
-    loginToken: string;
-    token?: string;
-    backupCode?: string;
-    deviceName?: string;
-  }) => Promise<{ securityAlert?: SecurityAlert }>;
-
   /**
-   * Sign in with a passkey (WebAuthn). Usernameless / discoverable-credential
-   * flow: the browser prompts for any resident Oxy passkey. WEB-ONLY — throws on
-   * native or an unsupported browser (native passkeys are Commons' job). On
-   * `useOxy()`, NOT re-exposed on `useAuth()`.
+   * Sign in with a passkey (WebAuthn). With no `username` this is the
+   * usernameless / discoverable-credential flow: the browser prompts for any
+   * resident Oxy passkey. Pass `username` for the username-first flow — the
+   * server scopes `allowCredentials` to that user's passkeys so a
+   * NON-discoverable hardware key (e.g. a U2F/security key) can be used.
+   * WEB-ONLY — throws on native or an unsupported browser (native passkeys are
+   * Commons' job). On `useOxy()`, NOT re-exposed on `useAuth()`.
    */
-  signInWithPasskey: (opts?: { deviceName?: string; deviceFingerprint?: string }) => Promise<void>;
+  signInWithPasskey: (opts?: {
+    username?: string;
+    deviceName?: string;
+    deviceFingerprint?: string;
+  }) => Promise<void>;
 
   /**
    * Create a brand-new account whose first authentication method is a passkey.
@@ -75,6 +68,14 @@ export interface OxyContextState {
    */
   addPasskey: (params?: { deviceName?: string }) => Promise<void>;
 
+  /**
+   * Remove a passkey from the current account by its credential id
+   * (`AuthMethodEntry.credentialId`). Refreshes the linked auth-methods list on
+   * success. Works on any platform (it is a plain unlink, not a WebAuthn
+   * ceremony) but is only reachable from surfaces that list passkeys.
+   */
+  removePasskey: (credentialId: string) => Promise<void>;
+
   revokeSuspiciousSignIn: () => Promise<void>;
   handleWebSession: (session: SessionLoginResponse) => Promise<void>;
 
@@ -117,19 +118,19 @@ export interface OxyContextState {
   createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
 }
 
-/**
- * Result of {@link OxyContextState.signInWithPassword}.
- */
-export type PasswordSignInResult =
-  | { status: 'ok'; securityAlert?: SecurityAlert }
-  | { status: '2fa_required'; loginToken: string };
-
 export interface OxyContextProviderProps {
   children: ReactNode;
   oxyServices?: OxyServices;
   baseURL?: string;
   authWebUrl?: string;
   authRedirectUri?: string;
+  /**
+   * Authorize endpoint override for silent cross-origin session restore
+   * (web cross-app SSO). Defaults to the production Oxy IdP when unset; a
+   * local/staging deployment points it at its own IdP so cold boot never
+   * bounces the tab to production `auth.oxy.so`.
+   */
+  authorizeBaseUrl?: string;
   storageKeyPrefix?: string;
   clientId?: string;
   /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */

package/src/ui/context/passkeyFlow.ts

@@ -42,37 +42,45 @@ function toCommitInput(result: LoginSessionResult): CommitInput {
 /** Injected dependencies for {@link runPasskeyLogin}. */
 export interface RunPasskeyLoginDeps {
   isSupported: () => boolean;
-  getLoginOptions: () => Promise<unknown>;
+  getLoginOptions: (username?: string) => Promise<unknown>;
   runCeremony: (optionsJSON: unknown) => Promise<unknown>;
   loginVerify: (
     response: unknown,
     envelope: { deviceName?: string; deviceFingerprint?: string; deviceId?: string },
   ) => Promise<LoginResult>;
   commit: (input: CommitInput) => Promise<void>;
+  /**
+   * When present, scopes login options to that user's registered passkeys
+   * (username-first) — the path a NON-discoverable hardware key (e.g. a U2F
+   * security key) needs, since it can't be found by a usernameless ceremony.
+   * Omit for the discoverable / resident-credential path.
+   */
+  username?: string;
   deviceId?: string;
   deviceName?: string;
   deviceFingerprint?: string;
 }
 
 /**
- * Usernameless (discoverable-credential) passkey SIGN-IN: request login options,
- * run the authentication ceremony, verify, then commit the session. A passkey
- * assertion is itself the strong factor, so a 2FA arm here is a protocol error.
+ * Passkey SIGN-IN. With no `username` this is the usernameless
+ * (discoverable-credential) flow; with a `username` it is username-first —
+ * the server scopes `allowCredentials` to that user's passkeys so a
+ * non-discoverable hardware key (U2F/security key) can be selected. Either way:
+ * request login options, run the authentication ceremony, verify, then commit
+ * the session. A passkey assertion is itself the strong factor — sign-in always
+ * resolves to a completed session.
  */
 export async function runPasskeyLogin(deps: RunPasskeyLoginDeps): Promise<void> {
   if (!deps.isSupported()) {
     throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
   }
-  const options = await deps.getLoginOptions();
+  const options = await deps.getLoginOptions(deps.username);
   const response = await deps.runCeremony(options);
   const result = await deps.loginVerify(response, {
     deviceName: deps.deviceName,
     deviceFingerprint: deps.deviceFingerprint,
     deviceId: deps.deviceId,
   });
-  if ('twoFactorRequired' in result) {
-    throw new Error('Passkey sign-in unexpectedly required a second factor.');
-  }
   await deps.commit(toCommitInput(result));
 }
 
@@ -106,7 +114,7 @@ export async function runPasskeyRegister(deps: RunPasskeyRegisterDeps): Promise<
     deviceName: deps.deviceName,
   });
   // Only the signup session arm carries `sessionId`; the link branch
-  // (`{ success, message }`) and any 2FA arm do not.
+  // (`{ success, message }`) does not.
   if (!('sessionId' in result)) {
     throw new Error('Passkey registration did not establish a session.');
   }

package/src/ui/types/navigation.ts

@@ -62,6 +62,14 @@ export interface OxyProviderProps {
     baseURL?: string;
     authWebUrl?: string;
     authRedirectUri?: string;
+    /**
+     * Authorize endpoint override for silent cross-origin session restore
+     * (web cross-app SSO on cold boot). Defaults to the production Oxy IdP
+     * (`https://auth.oxy.so/authorize`) when unset. Set this from an env var
+     * (e.g. Vite `VITE_OXY_AUTHORIZE_URL`, Expo `EXPO_PUBLIC_OXY_AUTHORIZE_URL`)
+     * so a local/staging deployment targets its own IdP instead of production.
+     */
+    authorizeBaseUrl?: string;
     queryClient?: QueryClient;
     /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
     hubSync?: boolean;