@oxyhq/services 22.12.4 → 22.12.7

package/lib/module/ui/context/commitSessionFlow.js

@@ -1,6 +1,8 @@
 "use strict";
 
 import { logger as loggerUtil } from '@oxyhq/core';
+import { allowsAutomaticIdpRedirect } from "../oauth/legacyRedirectLanes.js";
+import { isWebBrowser } from "../utils/isWebBrowser.js";
 import { isUnauthorizedStatus } from "./oxyContextHelpers.js";
 const LOG_CONTEXT = {
   component: 'OxyContext',
@@ -94,4 +96,44 @@ export async function commitDeviceSetAndResolve(deps) {
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+export async function maybeSyncHubAfterCommit(deps) {
+  const {
+    activate,
+    hubSyncRequested,
+    hubSyncEnabled,
+    webAuthMode,
+    syncHub
+  } = deps;
+  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
+  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
+  if (!isWebBrowser()) return false;
+  try {
+    return await syncHub();
+  } catch (hubError) {
+    if (__DEV__) {
+      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
+    }
+    return false;
+  }
+}
 //# sourceMappingURL=commitSessionFlow.js.map

package/lib/module/ui/context/commitSessionFlow.js.map

@@ -1 +1 @@
-{"version":3,"names":["logger","loggerUtil","isUnauthorizedStatus","LOG_CONTEXT","component","method","commitDeviceSetAndResolve","deps","activate","userId","fallbackUser","registerAndActivate","addCurrentAccount","startSocket","syncFromClient","getCurrentUser","loginSuccess","onAuthStateChange","markAuthResolved","reconcileDeviceSet","logReconcileError","registrationError","debug","warn","hydrateAndResolve","fullUser","profileError","__DEV__","catch"],"sourceRoot":"../../../../src","sources":["ui/context/commitSessionFlow.ts"],"mappings":";;AACA,SAASA,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAClD,SAASC,oBAAoB,QAAQ,wBAAqB;AAE1D,MAAMC,WAAW,GAAG;EAAEC,SAAS,EAAE,YAAY;EAAEC,MAAM,EAAE;AAAgB,CAAU;AA6BjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,IAAmC,EACpB;EACf,MAAM;IACJC,QAAQ;IACRC,MAAM;IACNC,YAAY;IACZC,mBAAmB;IACnBC,iBAAiB;IACjBC,WAAW;IACXC,cAAc;IACdC,cAAc;IACdC,YAAY;IACZC,iBAAiB;IACjBC;EACF,CAAC,GAAGX,IAAI;;EAER;EACA;EACA;EACA;EACA,MAAMY,kBAAkB,GAAG,MAAAA,CAAA,KAA2B;IACpD,IAAIX,QAAQ,EAAE;MACZ,MAAMG,mBAAmB,CAACF,MAAM,CAAC;IACnC,CAAC,MAAM;MACL,MAAMG,iBAAiB,CAAC,CAAC;IAC3B;IACA,MAAMC,WAAW,CAAC,CAAC;IACnB,MAAMC,cAAc,CAAC,CAAC;EACxB,CAAC;EAED,MAAMM,iBAAiB,GAAIC,iBAA0B,IAAW;IAC9D;IACA;IACA;IACA;IACA;IACA,IAAInB,oBAAoB,CAACmB,iBAAiB,CAAC,EAAE;MAC3CpB,UAAU,CAACqB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEkB,iBAAiB,CAAC;MAC/G;IACF;IACApB,UAAU,CAACsB,IAAI,CAAC,+CAA+C,EAAEpB,WAAW,EAAEkB,iBAAiB,CAAC;EAClG,CAAC;;EAED;EACA;EACA;EACA,MAAMG,iBAAiB,GAAG,MAAAA,CAAA,KAA2B;IACnD,IAAIC,QAAqB,GAAG,IAAI;IAChC,IAAI;MACFA,QAAQ,GAAG,MAAMV,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,OAAOW,YAAY,EAAE;MACrB,IAAIC,OAAO,EAAE;QACX1B,UAAU,CAACqB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEuB,YAAY,CAAC;MAC5G;MACAD,QAAQ,GAAGf,YAAY;IACzB;IACA,IAAIe,QAAQ,EAAE;MACZT,YAAY,CAACS,QAAQ,CAAC;MACtBR,iBAAiB,GAAGQ,QAAQ,CAAC;IAC/B;IACAP,gBAAgB,CAAC,CAAC;EACpB,CAAC;EAED,IAAIV,QAAQ,EAAE;IACZ;IACA;IACA,IAAI;MACF,MAAMW,kBAAkB,CAAC,CAAC;IAC5B,CAAC,CAAC,OAAOE,iBAAiB,EAAE;MAC1BD,iBAAiB,CAACC,iBAAiB,CAAC;IACtC;IACA,MAAMG,iBAAiB,CAAC,CAAC;IACzB;EACF;;EAEA;EACA;EACA;EACA,MAAMA,iBAAiB,CAAC,CAAC;EACzB,KAAKL,kBAAkB,CAAC,CAAC,CAACS,KAAK,CAACR,iBAAiB,CAAC;AACpD","ignoreList":[]}
+{"version":3,"names":["logger","loggerUtil","allowsAutomaticIdpRedirect","isWebBrowser","isUnauthorizedStatus","LOG_CONTEXT","component","method","commitDeviceSetAndResolve","deps","activate","userId","fallbackUser","registerAndActivate","addCurrentAccount","startSocket","syncFromClient","getCurrentUser","loginSuccess","onAuthStateChange","markAuthResolved","reconcileDeviceSet","logReconcileError","registrationError","debug","warn","hydrateAndResolve","fullUser","profileError","__DEV__","catch","maybeSyncHubAfterCommit","hubSyncRequested","hubSyncEnabled","webAuthMode","syncHub","hubError"],"sourceRoot":"../../../../src","sources":["ui/context/commitSessionFlow.ts"],"mappings":";;AACA,SAASA,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAClD,SAASC,0BAA0B,QAAQ,iCAA8B;AAEzE,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,oBAAoB,QAAQ,wBAAqB;AAE1D,MAAMC,WAAW,GAAG;EAAEC,SAAS,EAAE,YAAY;EAAEC,MAAM,EAAE;AAAgB,CAAU;AA6BjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,IAAmC,EACpB;EACf,MAAM;IACJC,QAAQ;IACRC,MAAM;IACNC,YAAY;IACZC,mBAAmB;IACnBC,iBAAiB;IACjBC,WAAW;IACXC,cAAc;IACdC,cAAc;IACdC,YAAY;IACZC,iBAAiB;IACjBC;EACF,CAAC,GAAGX,IAAI;;EAER;EACA;EACA;EACA;EACA,MAAMY,kBAAkB,GAAG,MAAAA,CAAA,KAA2B;IACpD,IAAIX,QAAQ,EAAE;MACZ,MAAMG,mBAAmB,CAACF,MAAM,CAAC;IACnC,CAAC,MAAM;MACL,MAAMG,iBAAiB,CAAC,CAAC;IAC3B;IACA,MAAMC,WAAW,CAAC,CAAC;IACnB,MAAMC,cAAc,CAAC,CAAC;EACxB,CAAC;EAED,MAAMM,iBAAiB,GAAIC,iBAA0B,IAAW;IAC9D;IACA;IACA;IACA;IACA;IACA,IAAInB,oBAAoB,CAACmB,iBAAiB,CAAC,EAAE;MAC3CtB,UAAU,CAACuB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEkB,iBAAiB,CAAC;MAC/G;IACF;IACAtB,UAAU,CAACwB,IAAI,CAAC,+CAA+C,EAAEpB,WAAW,EAAEkB,iBAAiB,CAAC;EAClG,CAAC;;EAED;EACA;EACA;EACA,MAAMG,iBAAiB,GAAG,MAAAA,CAAA,KAA2B;IACnD,IAAIC,QAAqB,GAAG,IAAI;IAChC,IAAI;MACFA,QAAQ,GAAG,MAAMV,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,OAAOW,YAAY,EAAE;MACrB,IAAIC,OAAO,EAAE;QACX5B,UAAU,CAACuB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEuB,YAAY,CAAC;MAC5G;MACAD,QAAQ,GAAGf,YAAY;IACzB;IACA,IAAIe,QAAQ,EAAE;MACZT,YAAY,CAACS,QAAQ,CAAC;MACtBR,iBAAiB,GAAGQ,QAAQ,CAAC;IAC/B;IACAP,gBAAgB,CAAC,CAAC;EACpB,CAAC;EAED,IAAIV,QAAQ,EAAE;IACZ;IACA;IACA,IAAI;MACF,MAAMW,kBAAkB,CAAC,CAAC;IAC5B,CAAC,CAAC,OAAOE,iBAAiB,EAAE;MAC1BD,iBAAiB,CAACC,iBAAiB,CAAC;IACtC;IACA,MAAMG,iBAAiB,CAAC,CAAC;IACzB;EACF;;EAEA;EACA;EACA;EACA,MAAMA,iBAAiB,CAAC,CAAC;EACzB,KAAKL,kBAAkB,CAAC,CAAC,CAACS,KAAK,CAACR,iBAAiB,CAAC;AACpD;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeS,uBAAuBA,CAC3CtB,IAAiC,EACf;EAClB,MAAM;IAAEC,QAAQ;IAAEsB,gBAAgB;IAAEC,cAAc;IAAEC,WAAW;IAAEC;EAAQ,CAAC,GAAG1B,IAAI;EAEjF,IAAI,CAACC,QAAQ,IAAI,CAACsB,gBAAgB,IAAI,CAACC,cAAc,EAAE,OAAO,KAAK;EACnE,IAAI,CAAC/B,0BAA0B,CAACgC,WAAW,CAAC,EAAE,OAAO,KAAK;EAC1D,IAAI,CAAC/B,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,IAAI;IACF,OAAO,MAAMgC,OAAO,CAAC,CAAC;EACxB,CAAC,CAAC,OAAOC,QAAQ,EAAE;IACjB,IAAIP,OAAO,EAAE;MACX5B,UAAU,CAACuB,KAAK,CAAC,2CAA2C,EAAEnB,WAAW,EAAE+B,QAAQ,CAAC;IACtF;IACA,OAAO,KAAK;EACd;AACF","ignoreList":[]}

package/lib/module/ui/context/useOxyAccountGraph.js

@@ -5,10 +5,12 @@ import { logger as loggerUtil } from '@oxyhq/core';
 import { isUnauthorizedStatus } from "./oxyContextHelpers.js";
 import { resetSessionScopedStores } from "../stores/resetSessionScopedStores.js";
 import { ASSET_DOWNLOAD_URLS_QUERY_KEY } from "../hooks/useResolvedFileUrls.js";
+import { IdentityBoundSessionError } from "../session/index.js";
 export function useOxyAccountGraph({
   isAuthenticated,
   tokenReady,
   initialized,
+  identityBound,
   oxyServices,
   sessionClient,
   syncFromClient,
@@ -19,7 +21,7 @@ export function useOxyAccountGraph({
 }) {
   const [accounts, setAccounts] = useState([]);
   const refreshAccounts = useCallback(async () => {
-    if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
+    if (identityBound || !isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
       setAccounts([]);
       return;
     }
@@ -38,13 +40,13 @@ export function useOxyAccountGraph({
         }, err);
       }
     }
-  }, [isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
+  }, [identityBound, isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
   useEffect(() => {
-    if (isAuthenticated && initialized && tokenReady) {
+    if (!identityBound && isAuthenticated && initialized && tokenReady) {
       refreshAccounts();
       void accountDialogControllerRef.current?.refresh();
     }
-  }, [isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
+  }, [identityBound, isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
   const runPostAccountSwitchSideEffects = useCallback(async () => {
     resetSessionScopedStores();
     // Scoped media tokens are per-viewer — drop any cached URLs immediately so
@@ -57,6 +59,12 @@ export function useOxyAccountGraph({
     queryClient.invalidateQueries();
   }, [refreshAccounts, queryClient]);
   const switchToAccount = useCallback(async accountId => {
+    if (identityBound) {
+      // Loud rejection, never a silent no-op: a resolved promise here would
+      // read to the caller as a completed switch that simply left the user
+      // unchanged, which is exactly the confusion this mode must avoid.
+      throw new IdentityBoundSessionError('switchToAccount');
+    }
     const deviceState = sessionClient.getState();
     if (deviceState?.accounts.some(account => account.accountId === accountId)) {
       await sessionClient.switchAccount(accountId);
@@ -84,7 +92,7 @@ export function useOxyAccountGraph({
       hubSync: false
     });
     await runPostAccountSwitchSideEffects();
-  }, [oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
+  }, [identityBound, oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
   const createAccount = useCallback(async data => {
     const account = await oxyServices.createAccount(data);
     await refreshAccounts();

package/lib/module/ui/context/useOxyAccountGraph.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useEffect","useState","logger","loggerUtil","isUnauthorizedStatus","resetSessionScopedStores","ASSET_DOWNLOAD_URLS_QUERY_KEY","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","oxyServices","sessionClient","syncFromClient","commitSession","queryClient","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","refreshAccounts","getAccessToken","list","listAccounts","err","current","__DEV__","debug","component","refresh","runPostAccountSwitchSideEffects","removeQueries","queryKey","invalidateQueries","switchToAccount","accountId","deviceState","getState","some","account","switchAccount","result","user","sessionId","Error","accessToken","deviceSecret","deviceId","expiresAt","userId","id","activate","hubSync","createAccount","data"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,QAAQ,QAAwB,OAAO;AAGxE,SAASC,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAElD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,wBAAwB,QAAQ,uCAAoC;AAC7E,SAASC,6BAA6B,QAAQ,iCAA8B;AAgB5E,OAAO,SAASC,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,WAAW;EACXC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAGlB,QAAQ,CAAgB,EAAE,CAAC;EAE3D,MAAMmB,eAAe,GAAGrB,WAAW,CAAC,YAA2B;IAC7D,IAAI,CAACS,eAAe,IAAI,CAACC,UAAU,IAAI,CAACE,WAAW,CAACU,cAAc,CAAC,CAAC,EAAE;MACpEF,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMG,IAAI,GAAG,MAAMX,WAAW,CAACY,YAAY,CAAC,CAAC;MAC7CJ,WAAW,CAACG,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ,IAAIpB,oBAAoB,CAACoB,GAAG,CAAC,EAAE;QAC7BL,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACQ,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXvB,UAAU,CAACwB,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEJ,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAAChB,eAAe,EAAEG,WAAW,EAAEF,UAAU,EAAEQ,oBAAoB,CAAC,CAAC;EAEpEjB,SAAS,CAAC,MAAM;IACd,IAAIQ,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAChDW,eAAe,CAAC,CAAC;MACjB,KAAKJ,0BAA0B,CAACS,OAAO,EAAEI,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACrB,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEW,eAAe,EAAEJ,0BAA0B,CAAC,CAAC;EAE3F,MAAMc,+BAA+B,GAAG/B,WAAW,CAAC,YAA2B;IAC7EM,wBAAwB,CAAC,CAAC;IAC1B;IACA;IACA;IACAU,WAAW,CAACgB,aAAa,CAAC;MAAEC,QAAQ,EAAE,CAAC1B,6BAA6B;IAAE,CAAC,CAAC;IACxE,MAAMc,eAAe,CAAC,CAAC;IACvBL,WAAW,CAACkB,iBAAiB,CAAC,CAAC;EACjC,CAAC,EAAE,CAACb,eAAe,EAAEL,WAAW,CAAC,CAAC;EAElC,MAAMmB,eAAe,GAAGnC,WAAW,CACjC,MAAOoC,SAAiB,IAAoB;IAC1C,MAAMC,WAAW,GAAGxB,aAAa,CAACyB,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAElB,QAAQ,CAACoB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACJ,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAMvB,aAAa,CAAC4B,aAAa,CAACL,SAAS,CAAC;MAC5C,MAAMtB,cAAc,CAAC,CAAC;MACtB,MAAMiB,+BAA+B,CAAC,CAAC;MACvC;IACF;IAEA,MAAMW,MAAM,GAAG,MAAM9B,WAAW,CAACuB,eAAe,CAACC,SAAS,CAAC;IAC3D,IAAI,CAACM,MAAM,EAAEC,IAAI,IAAI,CAACD,MAAM,EAAEE,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAM9B,aAAa,CACjB;MACE6B,SAAS,EAAEF,MAAM,CAACE,SAAS;MAC3BE,WAAW,EAAEJ,MAAM,CAACI,WAAW;MAC/BC,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACC,IAAI,CAACQ,EAAE;MACtBR,IAAI,EAAED,MAAM,CAACC;IACf,CAAC;IACD;IACA;IACA;MAAES,QAAQ,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAM,CACnC,CAAC;IACD,MAAMtB,+BAA+B,CAAC,CAAC;EACzC,CAAC,EACD,CAACnB,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,EAAEgB,+BAA+B,CAC7F,CAAC;EAED,MAAMuB,aAAa,GAAGtD,WAAW,CAC/B,MAAOuD,IAAwB,IAA2B;IACxD,MAAMf,OAAO,GAAG,MAAM5B,WAAW,CAAC0C,aAAa,CAACC,IAAI,CAAC;IACrD,MAAMlC,eAAe,CAAC,CAAC;IACvB,OAAOmB,OAAO;EAChB,CAAC,EACD,CAAC5B,WAAW,EAAES,eAAe,CAC/B,CAAC;EAED,OAAO;IACLF,QAAQ;IACRE,eAAe;IACfc,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["useCallback","useEffect","useState","logger","loggerUtil","isUnauthorizedStatus","resetSessionScopedStores","ASSET_DOWNLOAD_URLS_QUERY_KEY","IdentityBoundSessionError","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","identityBound","oxyServices","sessionClient","syncFromClient","commitSession","queryClient","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","refreshAccounts","getAccessToken","list","listAccounts","err","current","__DEV__","debug","component","refresh","runPostAccountSwitchSideEffects","removeQueries","queryKey","invalidateQueries","switchToAccount","accountId","deviceState","getState","some","account","switchAccount","result","user","sessionId","Error","accessToken","deviceSecret","deviceId","expiresAt","userId","id","activate","hubSync","createAccount","data"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,QAAQ,QAAwB,OAAO;AAGxE,SAASC,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAElD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,wBAAwB,QAAQ,uCAAoC;AAC7E,SAASC,6BAA6B,QAAQ,iCAA8B;AAC5E,SAASC,yBAAyB,QAAQ,qBAAY;AAsBtD,OAAO,SAASC,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,aAAa;EACbC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,WAAW;EACXC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAGpB,QAAQ,CAAgB,EAAE,CAAC;EAE3D,MAAMqB,eAAe,GAAGvB,WAAW,CAAC,YAA2B;IAC7D,IAAIa,aAAa,IAAI,CAACH,eAAe,IAAI,CAACC,UAAU,IAAI,CAACG,WAAW,CAACU,cAAc,CAAC,CAAC,EAAE;MACrFF,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMG,IAAI,GAAG,MAAMX,WAAW,CAACY,YAAY,CAAC,CAAC;MAC7CJ,WAAW,CAACG,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ,IAAItB,oBAAoB,CAACsB,GAAG,CAAC,EAAE;QAC7BL,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACQ,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXzB,UAAU,CAAC0B,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEJ,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAACd,aAAa,EAAEH,eAAe,EAAEI,WAAW,EAAEH,UAAU,EAAES,oBAAoB,CAAC,CAAC;EAEnFnB,SAAS,CAAC,MAAM;IACd,IAAI,CAACY,aAAa,IAAIH,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAClEY,eAAe,CAAC,CAAC;MACjB,KAAKJ,0BAA0B,CAACS,OAAO,EAAEI,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACnB,aAAa,EAAEH,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEY,eAAe,EAAEJ,0BAA0B,CAAC,CAAC;EAE1G,MAAMc,+BAA+B,GAAGjC,WAAW,CAAC,YAA2B;IAC7EM,wBAAwB,CAAC,CAAC;IAC1B;IACA;IACA;IACAY,WAAW,CAACgB,aAAa,CAAC;MAAEC,QAAQ,EAAE,CAAC5B,6BAA6B;IAAE,CAAC,CAAC;IACxE,MAAMgB,eAAe,CAAC,CAAC;IACvBL,WAAW,CAACkB,iBAAiB,CAAC,CAAC;EACjC,CAAC,EAAE,CAACb,eAAe,EAAEL,WAAW,CAAC,CAAC;EAElC,MAAMmB,eAAe,GAAGrC,WAAW,CACjC,MAAOsC,SAAiB,IAAoB;IAC1C,IAAIzB,aAAa,EAAE;MACjB;MACA;MACA;MACA,MAAM,IAAIL,yBAAyB,CAAC,iBAAiB,CAAC;IACxD;IACA,MAAM+B,WAAW,GAAGxB,aAAa,CAACyB,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAElB,QAAQ,CAACoB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACJ,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAMvB,aAAa,CAAC4B,aAAa,CAACL,SAAS,CAAC;MAC5C,MAAMtB,cAAc,CAAC,CAAC;MACtB,MAAMiB,+BAA+B,CAAC,CAAC;MACvC;IACF;IAEA,MAAMW,MAAM,GAAG,MAAM9B,WAAW,CAACuB,eAAe,CAACC,SAAS,CAAC;IAC3D,IAAI,CAACM,MAAM,EAAEC,IAAI,IAAI,CAACD,MAAM,EAAEE,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAM9B,aAAa,CACjB;MACE6B,SAAS,EAAEF,MAAM,CAACE,SAAS;MAC3BE,WAAW,EAAEJ,MAAM,CAACI,WAAW;MAC/BC,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACC,IAAI,CAACQ,EAAE;MACtBR,IAAI,EAAED,MAAM,CAACC;IACf,CAAC;IACD;IACA;IACA;MAAES,QAAQ,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAM,CACnC,CAAC;IACD,MAAMtB,+BAA+B,CAAC,CAAC;EACzC,CAAC,EACD,CAACpB,aAAa,EAAEC,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,EAAEgB,+BAA+B,CAC5G,CAAC;EAED,MAAMuB,aAAa,GAAGxD,WAAW,CAC/B,MAAOyD,IAAwB,IAA2B;IACxD,MAAMf,OAAO,GAAG,MAAM5B,WAAW,CAAC0C,aAAa,CAACC,IAAI,CAAC;IACrD,MAAMlC,eAAe,CAAC,CAAC;IACvB,OAAOmB,OAAO;EAChB,CAAC,EACD,CAAC5B,WAAW,EAAES,eAAe,CAC/B,CAAC;EAED,OAAO;IACLF,QAAQ;IACRE,eAAe;IACfc,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/hooks/useSwitchableAccounts.js

@@ -18,7 +18,12 @@ const EMPTY_SNAPSHOT = {
     authorizeCode: null,
     qrPayload: null,
     expiresAt: null,
-    error: null
+    error: null,
+    route: null,
+    routeFailed: false,
+    pushSentAt: null,
+    openedAt: null,
+    progress: 'idle'
   },
   commonsAvailability: 'unknown'
 };

package/lib/module/ui/hooks/useSwitchableAccounts.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useMemo","useSyncExternalStore","useOxy","EMPTY_SNAPSHOT","view","accounts","activeAccountId","loading","error","switchingAccountId","signIn","phase","authorizeCode","qrPayload","expiresAt","commonsAvailability","useSwitchableAccounts","accountDialogController","controller","subscribe","listener","undefined","getSnapshot","snapshot","currentSessionId","active","find","account","accountId","sessionId","isLoading"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSwitchableAccounts.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,OAAO,EAAEC,oBAAoB,QAAQ,OAAO;AAElE,SAASC,MAAM,QAAQ,0BAAuB;AAW9C;AACA;AACA;AACA;AACA,MAAMC,cAAqC,GAAG;EAC1CC,IAAI,EAAE,UAAU;EAChBC,QAAQ,EAAE,EAAE;EACZC,eAAe,EAAE,IAAI;EACrBC,OAAO,EAAE,KAAK;EACdC,KAAK,EAAE,IAAI;EACXC,kBAAkB,EAAE,IAAI;EACxBC,MAAM,EAAE;IAAEC,KAAK,EAAE,MAAM;IAAEC,aAAa,EAAE,IAAI;IAAEC,SAAS,EAAE,IAAI;IAAEC,SAAS,EAAE,IAAI;IAAEN,KAAK,EAAE;EAAK,CAAC;EAC7FO,mBAAmB,EAAE;AACzB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,qBAAqBA,CAAA,EAAgC;EACjE,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAGhB,MAAM,CAAC,CAAC;EAExD,MAAMiB,SAAS,GAAGpB,WAAW,CACxBqB,QAAoB,IAAMF,UAAU,GAAGA,UAAU,CAACC,SAAS,CAACC,QAAQ,CAAC,GAAG,MAAMC,SAAU,EACzF,CAACH,UAAU,CACf,CAAC;EACD,MAAMI,WAAW,GAAGvB,WAAW,CAC3B,MAAOmB,UAAU,GAAGA,UAAU,CAACI,WAAW,CAAC,CAAC,GAAGnB,cAAe,EAC9D,CAACe,UAAU,CACf,CAAC;EACD,MAAMK,QAAQ,GAAGtB,oBAAoB,CAACkB,SAAS,EAAEG,WAAW,EAAEA,WAAW,CAAC;EAE1E,MAAME,gBAAgB,GAAGxB,OAAO,CAAgB,MAAM;IAClD,MAAMyB,MAAM,GAAGF,QAAQ,CAAClB,QAAQ,CAACqB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,SAAS,KAAKL,QAAQ,CAACjB,eAAe,CAAC;IAClG,OAAOmB,MAAM,EAAEI,SAAS,IAAI,IAAI;EACpC,CAAC,EAAE,CAACN,QAAQ,CAAC,CAAC;EAEd,OAAO;IACHlB,QAAQ,EAAEkB,QAAQ,CAAClB,QAAQ;IAC3ByB,SAAS,EAAEP,QAAQ,CAAChB,OAAO;IAC3BiB;EACJ,CAAC;AACL","ignoreList":[]}
+{"version":3,"names":["useCallback","useMemo","useSyncExternalStore","useOxy","EMPTY_SNAPSHOT","view","accounts","activeAccountId","loading","error","switchingAccountId","signIn","phase","authorizeCode","qrPayload","expiresAt","route","routeFailed","pushSentAt","openedAt","progress","commonsAvailability","useSwitchableAccounts","accountDialogController","controller","subscribe","listener","undefined","getSnapshot","snapshot","currentSessionId","active","find","account","accountId","sessionId","isLoading"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSwitchableAccounts.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,OAAO,EAAEC,oBAAoB,QAAQ,OAAO;AAElE,SAASC,MAAM,QAAQ,0BAAuB;AAW9C;AACA;AACA;AACA;AACA,MAAMC,cAAqC,GAAG;EAC1CC,IAAI,EAAE,UAAU;EAChBC,QAAQ,EAAE,EAAE;EACZC,eAAe,EAAE,IAAI;EACrBC,OAAO,EAAE,KAAK;EACdC,KAAK,EAAE,IAAI;EACXC,kBAAkB,EAAE,IAAI;EACxBC,MAAM,EAAE;IACJC,KAAK,EAAE,MAAM;IACbC,aAAa,EAAE,IAAI;IACnBC,SAAS,EAAE,IAAI;IACfC,SAAS,EAAE,IAAI;IACfN,KAAK,EAAE,IAAI;IACXO,KAAK,EAAE,IAAI;IACXC,WAAW,EAAE,KAAK;IAClBC,UAAU,EAAE,IAAI;IAChBC,QAAQ,EAAE,IAAI;IACdC,QAAQ,EAAE;EACd,CAAC;EACDC,mBAAmB,EAAE;AACzB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,qBAAqBA,CAAA,EAAgC;EACjE,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAGrB,MAAM,CAAC,CAAC;EAExD,MAAMsB,SAAS,GAAGzB,WAAW,CACxB0B,QAAoB,IAAMF,UAAU,GAAGA,UAAU,CAACC,SAAS,CAACC,QAAQ,CAAC,GAAG,MAAMC,SAAU,EACzF,CAACH,UAAU,CACf,CAAC;EACD,MAAMI,WAAW,GAAG5B,WAAW,CAC3B,MAAOwB,UAAU,GAAGA,UAAU,CAACI,WAAW,CAAC,CAAC,GAAGxB,cAAe,EAC9D,CAACoB,UAAU,CACf,CAAC;EACD,MAAMK,QAAQ,GAAG3B,oBAAoB,CAACuB,SAAS,EAAEG,WAAW,EAAEA,WAAW,CAAC;EAE1E,MAAME,gBAAgB,GAAG7B,OAAO,CAAgB,MAAM;IAClD,MAAM8B,MAAM,GAAGF,QAAQ,CAACvB,QAAQ,CAAC0B,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,SAAS,KAAKL,QAAQ,CAACtB,eAAe,CAAC;IAClG,OAAOwB,MAAM,EAAEI,SAAS,IAAI,IAAI;EACpC,CAAC,EAAE,CAACN,QAAQ,CAAC,CAAC;EAEd,OAAO;IACHvB,QAAQ,EAAEuB,QAAQ,CAACvB,QAAQ;IAC3B8B,SAAS,EAAEP,QAAQ,CAACrB,OAAO;IAC3BsB;EACJ,CAAC;AACL","ignoreList":[]}

package/lib/module/ui/index.js

@@ -26,7 +26,6 @@ export { LogoText } from "./components/logo/LogoText.js";
 export { RequireOxyAuth } from "./components/RequireOxyAuth.js";
 export { default as FollowButton } from "./components/FollowButton.js";
 export { default as OxyPayButton } from "./components/OxyPayButton.js";
-export { FontLoader, setupFonts } from './components/FontLoader';
 export { default as ProfileButton } from "./components/ProfileButton.js";
 
 // Context + hooks

package/lib/module/ui/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["default","OxyProvider","OxySignInButton","OxyAuthPrompt","LogoIcon","LogoText","RequireOxyAuth","FollowButton","OxyPayButton","FontLoader","setupFonts","ProfileButton","useOxy","useAuth","useFollow","useSeedFollowStatuses","useStorage","ProfileScreen","ManageAccountScreen","CreateAccountScreen","AccountMembersScreen","AccountSettingsScreen","useAuthStore","useAccountStore","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage"],"sourceRoot":"../../../src","sources":["ui/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA;AACA,SAASA,OAAO,IAAIC,WAAW,QAAQ,6BAA0B;AACjE,SAASD,OAAO,IAAIE,eAAe,QAAQ,iCAA8B;AACzE,SAASF,OAAO,IAAIG,aAAa,QAAQ,+BAA4B;AAErE,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,cAAc,QAAQ,gCAA6B;AAE5D,SAASN,OAAO,IAAIO,YAAY,QAAQ,8BAA2B;AACnE,SAASP,OAAO,IAAIQ,YAAY,QAAQ,8BAA2B;AACnE,SAASC,UAAU,EAAEC,UAAU,QAAQ,yBAAyB;AAChE,SAASV,OAAO,IAAIW,aAAa,QAAQ,+BAA4B;;AAErE;AACA,SAASC,MAAM,QAAQ,yBAAsB;AAC7C,SAASC,OAAO,QAAQ,oBAAiB;AACzC,SAASC,SAAS,EAAEC,qBAAqB,QAAQ,sBAAmB;AACpE,SAASC,UAAU,QAAQ,uBAAoB;AAG/C;AACA,SAAShB,OAAO,IAAIiB,aAAa,QAAQ,4BAAyB;AAClE,SAASjB,OAAO,IAAIkB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAASlB,OAAO,IAAImB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAASnB,OAAO,IAAIoB,oBAAoB,QAAQ,mCAAgC;AAChF,SAASpB,OAAO,IAAIqB,qBAAqB,QAAQ,oCAAiC;;AAElF;AACA,SAASC,YAAY,QAAQ,uBAAoB;AACjD,SAASC,eAAe,QAAQ,0BAAuB;;AAEvD;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,0BAAuB","ignoreList":[]}
+{"version":3,"names":["default","OxyProvider","OxySignInButton","OxyAuthPrompt","LogoIcon","LogoText","RequireOxyAuth","FollowButton","OxyPayButton","ProfileButton","useOxy","useAuth","useFollow","useSeedFollowStatuses","useStorage","ProfileScreen","ManageAccountScreen","CreateAccountScreen","AccountMembersScreen","AccountSettingsScreen","useAuthStore","useAccountStore","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage"],"sourceRoot":"../../../src","sources":["ui/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA;AACA,SAASA,OAAO,IAAIC,WAAW,QAAQ,6BAA0B;AACjE,SAASD,OAAO,IAAIE,eAAe,QAAQ,iCAA8B;AACzE,SAASF,OAAO,IAAIG,aAAa,QAAQ,+BAA4B;AAErE,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,cAAc,QAAQ,gCAA6B;AAE5D,SAASN,OAAO,IAAIO,YAAY,QAAQ,8BAA2B;AACnE,SAASP,OAAO,IAAIQ,YAAY,QAAQ,8BAA2B;AACnE,SAASR,OAAO,IAAIS,aAAa,QAAQ,+BAA4B;;AAErE;AACA,SAASC,MAAM,QAAQ,yBAAsB;AAC7C,SAASC,OAAO,QAAQ,oBAAiB;AACzC,SAASC,SAAS,EAAEC,qBAAqB,QAAQ,sBAAmB;AACpE,SAASC,UAAU,QAAQ,uBAAoB;AAG/C;AACA,SAASd,OAAO,IAAIe,aAAa,QAAQ,4BAAyB;AAClE,SAASf,OAAO,IAAIgB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAAShB,OAAO,IAAIiB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAASjB,OAAO,IAAIkB,oBAAoB,QAAQ,mCAAgC;AAChF,SAASlB,OAAO,IAAImB,qBAAqB,QAAQ,oCAAiC;;AAElF;AACA,SAASC,YAAY,QAAQ,uBAAoB;AACjD,SAASC,eAAe,QAAQ,0BAAuB;;AAEvD;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,0BAAuB","ignoreList":[]}

package/lib/module/ui/oauth/browserAuthTransport.js

@@ -0,0 +1,165 @@
+"use strict";
+
+/**
+ * The single web entry point for third-party "Sign in with Oxy".
+ *
+ * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
+ * result — so callers (`OxySignInButton`, and any RP with its own button) never
+ * touch `window.open`, `postMessage`, or the token exchange themselves.
+ *
+ * Popup mode keeps the relying party mounted: its route, scroll position, and
+ * unsaved state survive because the tab never navigates. Redirect mode is the
+ * compatibility fallback, and is also where popup mode lands when the browser
+ * blocks the window — a blocked popup must still sign the user in, not dead-end.
+ *
+ * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
+ * remains the native lane and is untouched by this module.
+ */
+
+import { logger, persistOAuthHandshake } from '@oxyhq/core';
+import { redirectToAuthorize } from "../components/oauthNavigation.js";
+import { isWebBrowser } from "../utils/isWebBrowser.js";
+import { completeOAuthCode } from "./completeOAuthCode.js";
+import { prepareAuthorizeRequest } from "./oauthHandshake.js";
+import { awaitOAuthPopupResult, closeOAuthPopup, navigateOAuthPopup, openOAuthPopup } from "./oauthPopup.js";
+
+/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
+
+/** Per-press inputs for {@link startWebOAuthSignIn}. */
+
+export async function startWebOAuthSignIn(context, options) {
+  if (!isWebBrowser()) {
+    closeOAuthPopup(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'no-browser'
+    };
+  }
+  if (context.identityBound) {
+    closeOAuthPopup(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'identity-bound'
+    };
+  }
+  if (!context.clientId) {
+    closeOAuthPopup(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'missing-client-id'
+    };
+  }
+
+  // Claim the window BEFORE the first `await` below, so a caller that invoked us
+  // straight from the click still has gesture attribution. An explicit `null`
+  // means the caller already tried and was blocked.
+  const popup = context.mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
+  if (context.mode === 'redirect') {
+    closeOAuthPopup(popup);
+    return startRedirectSignIn(context, options, 'redirect-mode');
+  }
+  if (!popup) {
+    logger.warn('OAuth sign-in popup was blocked; falling back to a full-page redirect', {
+      component: 'browserAuthTransport'
+    });
+    return startRedirectSignIn(context, options, 'popup-blocked');
+  }
+  const prepared = await prepareAuthorizeRequest({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope,
+    responseMode: 'web_message'
+  });
+  if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
+    closeOAuthPopup(popup);
+    return startRedirectSignIn(context, options, 'popup-navigation-failed');
+  }
+  const outcome = await awaitOAuthPopupResult({
+    popup,
+    expectedOrigin: prepared.authorizeOrigin,
+    expectedState: prepared.handshake.state,
+    ...(options.timeoutMs !== undefined ? {
+      timeoutMs: options.timeoutMs
+    } : {})
+  });
+  // The IdP closes itself after delivering; this covers every other outcome
+  // (timeout, mismatch, an error the IdP reported before closing).
+  closeOAuthPopup(popup);
+  switch (outcome.kind) {
+    case 'code':
+      {
+        const completion = await completeOAuthCode({
+          oxyServices: context.oxyServices,
+          clientId: context.clientId,
+          code: outcome.code,
+          returnedState: outcome.state,
+          handshake: prepared.handshake,
+          redirectUri: options.redirectUri,
+          commitSession: context.commitSession
+        });
+        return completion.ok ? {
+          status: 'signed-in'
+        } : {
+          status: 'failed',
+          reason: completion.reason
+        };
+      }
+    case 'oauth-error':
+      return {
+        status: 'failed',
+        reason: 'idp-error',
+        description: outcome.errorDescription ?? outcome.error
+      };
+    case 'state-mismatch':
+      return {
+        status: 'failed',
+        reason: 'state-mismatch'
+      };
+    case 'closed':
+      return {
+        status: 'cancelled'
+      };
+    case 'timed-out':
+      return {
+        status: 'timed-out'
+      };
+    case 'unsupported':
+      return {
+        status: 'unsupported',
+        reason: 'no-browser'
+      };
+  }
+}
+
+/**
+ * Full-page hand-off to the IdP. The document is destroyed by the navigation, so
+ * the handshake MUST reach `sessionStorage` first — without it the return trip
+ * cannot validate `state`, and starting the redirect anyway would strand the
+ * user at a callback that can only refuse them.
+ */
+async function startRedirectSignIn(context, options, via) {
+  // Narrowed by the caller; repeated here so this helper is safe on its own.
+  if (!context.clientId) return {
+    status: 'unsupported',
+    reason: 'missing-client-id'
+  };
+  const prepared = await prepareAuthorizeRequest({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope
+  });
+  if (!persistOAuthHandshake(prepared.handshake.state, prepared.handshake.codeVerifier)) {
+    return {
+      status: 'failed',
+      reason: 'handshake-storage'
+    };
+  }
+  redirectToAuthorize(prepared.authorizeUrl);
+  return {
+    status: 'redirecting',
+    via
+  };
+}
+//# sourceMappingURL=browserAuthTransport.js.map

package/lib/module/ui/oauth/browserAuthTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["logger","persistOAuthHandshake","redirectToAuthorize","isWebBrowser","completeOAuthCode","prepareAuthorizeRequest","awaitOAuthPopupResult","closeOAuthPopup","navigateOAuthPopup","openOAuthPopup","startWebOAuthSignIn","context","options","popup","status","reason","identityBound","clientId","mode","undefined","startRedirectSignIn","warn","component","prepared","redirectUri","authorizeBaseUrl","scope","responseMode","authorizeUrl","outcome","expectedOrigin","authorizeOrigin","expectedState","handshake","state","timeoutMs","kind","completion","oxyServices","code","returnedState","commitSession","ok","description","errorDescription","error","via","codeVerifier"],"sourceRoot":"../../../../src","sources":["ui/oauth/browserAuthTransport.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,MAAM,EAAEC,qBAAqB,QAAQ,aAAa;AAE3D,SAASC,mBAAmB,QAAQ,kCAA+B;AACnE,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SAASC,uBAAuB,QAAQ,qBAAkB;AAC1D,SAASC,qBAAqB,EAAEC,eAAe,EAAEC,kBAAkB,EAAEC,cAAc,QAAQ,iBAAc;;AASzG;;AAeA;;AAwBA,OAAO,eAAeC,mBAAmBA,CACvCC,OAAiC,EACjCC,OAAmC,EACJ;EAC/B,IAAI,CAACT,YAAY,CAAC,CAAC,EAAE;IACnBI,eAAe,CAACK,OAAO,CAACC,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAa,CAAC;EACxD;EACA,IAAIJ,OAAO,CAACK,aAAa,EAAE;IACzBT,eAAe,CAACK,OAAO,CAACC,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAC5D;EACA,IAAI,CAACJ,OAAO,CAACM,QAAQ,EAAE;IACrBV,eAAe,CAACK,OAAO,CAACC,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC/D;;EAEA;EACA;EACA;EACA,MAAMF,KAAK,GACTF,OAAO,CAACO,IAAI,KAAK,OAAO,IAAIN,OAAO,CAACC,KAAK,KAAKM,SAAS,GAAGV,cAAc,CAAC,CAAC,GAAGG,OAAO,CAACC,KAAK,IAAI,IAAI;EAEpG,IAAIF,OAAO,CAACO,IAAI,KAAK,UAAU,EAAE;IAC/BX,eAAe,CAACM,KAAK,CAAC;IACtB,OAAOO,mBAAmB,CAACT,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EACA,IAAI,CAACC,KAAK,EAAE;IACVb,MAAM,CAACqB,IAAI,CAAC,uEAAuE,EAAE;MACnFC,SAAS,EAAE;IACb,CAAC,CAAC;IACF,OAAOF,mBAAmB,CAACT,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EAEA,MAAMW,QAAQ,GAAG,MAAMlB,uBAAuB,CAAC;IAC7CY,QAAQ,EAAEN,OAAO,CAACM,QAAQ;IAC1BO,WAAW,EAAEZ,OAAO,CAACY,WAAW;IAChCC,gBAAgB,EAAEd,OAAO,CAACc,gBAAgB;IAC1CC,KAAK,EAAEd,OAAO,CAACc,KAAK;IACpBC,YAAY,EAAE;EAChB,CAAC,CAAC;EAEF,IAAI,CAACnB,kBAAkB,CAACK,KAAK,EAAEU,QAAQ,CAACK,YAAY,CAAC,EAAE;IACrDrB,eAAe,CAACM,KAAK,CAAC;IACtB,OAAOO,mBAAmB,CAACT,OAAO,EAAEC,OAAO,EAAE,yBAAyB,CAAC;EACzE;EAEA,MAAMiB,OAAO,GAAG,MAAMvB,qBAAqB,CAAC;IAC1CO,KAAK;IACLiB,cAAc,EAAEP,QAAQ,CAACQ,eAAe;IACxCC,aAAa,EAAET,QAAQ,CAACU,SAAS,CAACC,KAAK;IACvC,IAAItB,OAAO,CAACuB,SAAS,KAAKhB,SAAS,GAAG;MAAEgB,SAAS,EAAEvB,OAAO,CAACuB;IAAU,CAAC,GAAG,CAAC,CAAC;EAC7E,CAAC,CAAC;EACF;EACA;EACA5B,eAAe,CAACM,KAAK,CAAC;EAEtB,QAAQgB,OAAO,CAACO,IAAI;IAClB,KAAK,MAAM;MAAE;QACX,MAAMC,UAAU,GAAG,MAAMjC,iBAAiB,CAAC;UACzCkC,WAAW,EAAE3B,OAAO,CAAC2B,WAAW;UAChCrB,QAAQ,EAAEN,OAAO,CAACM,QAAQ;UAC1BsB,IAAI,EAAEV,OAAO,CAACU,IAAI;UAClBC,aAAa,EAAEX,OAAO,CAACK,KAAK;UAC5BD,SAAS,EAAEV,QAAQ,CAACU,SAAS;UAC7BT,WAAW,EAAEZ,OAAO,CAACY,WAAW;UAChCiB,aAAa,EAAE9B,OAAO,CAAC8B;QACzB,CAAC,CAAC;QACF,OAAOJ,UAAU,CAACK,EAAE,GAChB;UAAE5B,MAAM,EAAE;QAAY,CAAC,GACvB;UAAEA,MAAM,EAAE,QAAQ;UAAEC,MAAM,EAAEsB,UAAU,CAACtB;QAAO,CAAC;MACrD;IACA,KAAK,aAAa;MAChB,OAAO;QACLD,MAAM,EAAE,QAAQ;QAChBC,MAAM,EAAE,WAAW;QACnB4B,WAAW,EAAEd,OAAO,CAACe,gBAAgB,IAAIf,OAAO,CAACgB;MACnD,CAAC;IACH,KAAK,gBAAgB;MACnB,OAAO;QAAE/B,MAAM,EAAE,QAAQ;QAAEC,MAAM,EAAE;MAAiB,CAAC;IACvD,KAAK,QAAQ;MACX,OAAO;QAAED,MAAM,EAAE;MAAY,CAAC;IAChC,KAAK,WAAW;MACd,OAAO;QAAEA,MAAM,EAAE;MAAY,CAAC;IAChC,KAAK,aAAa;MAChB,OAAO;QAAEA,MAAM,EAAE,aAAa;QAAEC,MAAM,EAAE;MAAa,CAAC;EAC1D;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeK,mBAAmBA,CAChCT,OAAiC,EACjCC,OAAmC,EACnCkC,GAA2B,EACI;EAC/B;EACA,IAAI,CAACnC,OAAO,CAACM,QAAQ,EAAE,OAAO;IAAEH,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAoB,CAAC;EAEpF,MAAMQ,QAAQ,GAAG,MAAMlB,uBAAuB,CAAC;IAC7CY,QAAQ,EAAEN,OAAO,CAACM,QAAQ;IAC1BO,WAAW,EAAEZ,OAAO,CAACY,WAAW;IAChCC,gBAAgB,EAAEd,OAAO,CAACc,gBAAgB;IAC1CC,KAAK,EAAEd,OAAO,CAACc;EACjB,CAAC,CAAC;EAEF,IAAI,CAACzB,qBAAqB,CAACsB,QAAQ,CAACU,SAAS,CAACC,KAAK,EAAEX,QAAQ,CAACU,SAAS,CAACc,YAAY,CAAC,EAAE;IACrF,OAAO;MAAEjC,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC1D;EAEAb,mBAAmB,CAACqB,QAAQ,CAACK,YAAY,CAAC;EAC1C,OAAO;IAAEd,MAAM,EAAE,aAAa;IAAEgC;EAAI,CAAC;AACvC","ignoreList":[]}

package/lib/module/ui/oauth/completeOAuthCode.js

@@ -0,0 +1,75 @@
+"use strict";
+
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+
+import { logger } from '@oxyhq/core';
+
+/** Inputs for {@link completeOAuthCode}. */
+
+export async function completeOAuthCode(input) {
+  let cleaned = false;
+  const runCleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    input.cleanup?.();
+  };
+  if (!input.handshake || !input.returnedState || input.handshake.state !== input.returnedState) {
+    logger.warn('OAuth completion rejected: missing or mismatched state', {
+      component: 'completeOAuthCode'
+    });
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'state-mismatch'
+    };
+  }
+  try {
+    const result = await input.oxyServices.exchangeOAuthCode({
+      code: input.code,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      codeVerifier: input.handshake.codeVerifier
+    });
+    runCleanup();
+    await input.commitSession({
+      sessionId: result.sessionId,
+      accessToken: result.accessToken,
+      deviceId: result.deviceId,
+      deviceSecret: result.deviceSecret,
+      userId: result.user.id,
+      expiresAt: result.expiresAt,
+      user: result.user
+    });
+    return {
+      ok: true
+    };
+  } catch (error) {
+    logger.warn('OAuth code exchange failed', {
+      component: 'completeOAuthCode'
+    }, error);
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'exchange-failed'
+    };
+  }
+}
+//# sourceMappingURL=completeOAuthCode.js.map

package/lib/module/ui/oauth/completeOAuthCode.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["logger","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","warn","component","ok","reason","result","oxyServices","exchangeOAuthCode","code","clientId","redirectUri","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,MAAM,QAAQ,aAAa;;AAGpC;;AA2BA,OAAO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FP,MAAM,CAACS,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFN,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEO,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMX,KAAK,CAACY,WAAW,CAACC,iBAAiB,CAAC;MACvDC,IAAI,EAAEd,KAAK,CAACc,IAAI;MAChBC,QAAQ,EAAEf,KAAK,CAACe,QAAQ;MACxBC,WAAW,EAAEhB,KAAK,CAACgB,WAAW;MAC9BC,YAAY,EAAEjB,KAAK,CAACI,SAAS,CAACa;IAChC,CAAC,CAAC;IACFf,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACkB,aAAa,CAAC;MACxBC,SAAS,EAAER,MAAM,CAACQ,SAAS;MAC3BC,WAAW,EAAET,MAAM,CAACS,WAAW;MAC/BC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;MACzBC,YAAY,EAAEX,MAAM,CAACW,YAAY;MACjCC,MAAM,EAAEZ,MAAM,CAACa,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEf,MAAM,CAACe,SAAS;MAC3BF,IAAI,EAAEb,MAAM,CAACa;IACf,CAAC,CAAC;IACF,OAAO;MAAEf,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOkB,KAAK,EAAE;IACd7B,MAAM,CAACS,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEmB,KAAK,CAAC;IACpFzB,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEO,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}

package/lib/module/ui/oauth/legacyRedirectLanes.js

@@ -0,0 +1,44 @@
+"use strict";
+
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+export function allowsAutomaticIdpRedirect(webAuthMode) {
+  return webAuthMode === 'redirect';
+}
+//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/module/ui/oauth/legacyRedirectLanes.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}

package/lib/module/ui/oauth/oauthHandshake.js

@@ -0,0 +1,50 @@
+"use strict";
+
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+
+import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair } from '@oxyhq/core';
+
+/** Inputs for {@link prepareAuthorizeRequest}. */
+
+/** A ready-to-use authorize request plus the secrets that finish it. */
+
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+export async function prepareAuthorizeRequest(params) {
+  const [pkce, state] = await Promise.all([generatePkcePair(), generateOAuthState()]);
+  const authorizeUrl = buildOAuthAuthorizeUrl({
+    authorizeBaseUrl: params.authorizeBaseUrl,
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scope: params.scope,
+    state,
+    codeChallenge: pkce.codeChallenge,
+    ...(params.responseMode ? {
+      responseMode: params.responseMode
+    } : {})
+  });
+  return {
+    authorizeUrl,
+    authorizeOrigin: new URL(authorizeUrl).origin,
+    handshake: {
+      state,
+      codeVerifier: pkce.codeVerifier
+    }
+  };
+}
+//# sourceMappingURL=oauthHandshake.js.map

package/lib/module/ui/oauth/oauthHandshake.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["buildOAuthAuthorizeUrl","generateOAuthState","generatePkcePair","prepareAuthorizeRequest","params","pkce","state","Promise","all","authorizeUrl","authorizeBaseUrl","clientId","redirectUri","scope","codeChallenge","responseMode","authorizeOrigin","URL","origin","handshake","codeVerifier"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthHandshake.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,sBAAsB,EAAEC,kBAAkB,EAAEC,gBAAgB,QAAQ,aAAa;;AAG1F;;AAkBA;;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,uBAAuBA,CAC3CC,MAAqC,EACF;EACnC,MAAM,CAACC,IAAI,EAAEC,KAAK,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAACN,gBAAgB,CAAC,CAAC,EAAED,kBAAkB,CAAC,CAAC,CAAC,CAAC;EAEnF,MAAMQ,YAAY,GAAGT,sBAAsB,CAAC;IAC1CU,gBAAgB,EAAEN,MAAM,CAACM,gBAAgB;IACzCC,QAAQ,EAAEP,MAAM,CAACO,QAAQ;IACzBC,WAAW,EAAER,MAAM,CAACQ,WAAW;IAC/BC,KAAK,EAAET,MAAM,CAACS,KAAK;IACnBP,KAAK;IACLQ,aAAa,EAAET,IAAI,CAACS,aAAa;IACjC,IAAIV,MAAM,CAACW,YAAY,GAAG;MAAEA,YAAY,EAAEX,MAAM,CAACW;IAAa,CAAC,GAAG,CAAC,CAAC;EACtE,CAAC,CAAC;EAEF,OAAO;IACLN,YAAY;IACZO,eAAe,EAAE,IAAIC,GAAG,CAACR,YAAY,CAAC,CAACS,MAAM;IAC7CC,SAAS,EAAE;MAAEb,KAAK;MAAEc,YAAY,EAAEf,IAAI,CAACe;IAAa;EACtD,CAAC;AACH","ignoreList":[]}