@oxyhq/services 22.12.4 → 22.13.0

package/lib/commonjs/ui/context/commitSessionFlow.js

@@ -4,7 +4,10 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.commitDeviceSetAndResolve = commitDeviceSetAndResolve;
+exports.maybeSyncHubAfterCommit = maybeSyncHubAfterCommit;
 var _core = require("@oxyhq/core");
+var _legacyRedirectLanes = require("../oauth/legacyRedirectLanes.js");
+var _isWebBrowser = require("../utils/isWebBrowser.js");
 var _oxyContextHelpers = require("./oxyContextHelpers.js");
 const LOG_CONTEXT = {
   component: 'OxyContext',
@@ -74,6 +77,9 @@ async function commitDeviceSetAndResolve(deps) {
       }
       fullUser = fallbackUser;
     }
+    if (!fullUser) {
+      fullUser = fallbackUser;
+    }
     if (fullUser) {
       loginSuccess(fullUser);
       onAuthStateChange?.(fullUser);
@@ -98,4 +104,44 @@ async function commitDeviceSetAndResolve(deps) {
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+async function maybeSyncHubAfterCommit(deps) {
+  const {
+    activate,
+    hubSyncRequested,
+    hubSyncEnabled,
+    webAuthMode,
+    syncHub
+  } = deps;
+  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
+  if (!(0, _legacyRedirectLanes.allowsAutomaticIdpRedirect)(webAuthMode)) return false;
+  if (!(0, _isWebBrowser.isWebBrowser)()) return false;
+  try {
+    return await syncHub();
+  } catch (hubError) {
+    if (__DEV__) {
+      _core.logger.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
+    }
+    return false;
+  }
+}
 //# sourceMappingURL=commitSessionFlow.js.map

package/lib/commonjs/ui/context/commitSessionFlow.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_oxyContextHelpers","LOG_CONTEXT","component","method","commitDeviceSetAndResolve","deps","activate","userId","fallbackUser","registerAndActivate","addCurrentAccount","startSocket","syncFromClient","getCurrentUser","loginSuccess","onAuthStateChange","markAuthResolved","reconcileDeviceSet","logReconcileError","registrationError","isUnauthorizedStatus","loggerUtil","debug","warn","hydrateAndResolve","fullUser","profileError","__DEV__","catch"],"sourceRoot":"../../../../src","sources":["ui/context/commitSessionFlow.ts"],"mappings":";;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAD,OAAA;AAEA,MAAME,WAAW,GAAG;EAAEC,SAAS,EAAE,YAAY;EAAEC,MAAM,EAAE;AAAgB,CAAU;AA6BjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,yBAAyBA,CAC7CC,IAAmC,EACpB;EACf,MAAM;IACJC,QAAQ;IACRC,MAAM;IACNC,YAAY;IACZC,mBAAmB;IACnBC,iBAAiB;IACjBC,WAAW;IACXC,cAAc;IACdC,cAAc;IACdC,YAAY;IACZC,iBAAiB;IACjBC;EACF,CAAC,GAAGX,IAAI;;EAER;EACA;EACA;EACA;EACA,MAAMY,kBAAkB,GAAG,MAAAA,CAAA,KAA2B;IACpD,IAAIX,QAAQ,EAAE;MACZ,MAAMG,mBAAmB,CAACF,MAAM,CAAC;IACnC,CAAC,MAAM;MACL,MAAMG,iBAAiB,CAAC,CAAC;IAC3B;IACA,MAAMC,WAAW,CAAC,CAAC;IACnB,MAAMC,cAAc,CAAC,CAAC;EACxB,CAAC;EAED,MAAMM,iBAAiB,GAAIC,iBAA0B,IAAW;IAC9D;IACA;IACA;IACA;IACA;IACA,IAAI,IAAAC,uCAAoB,EAACD,iBAAiB,CAAC,EAAE;MAC3CE,YAAU,CAACC,KAAK,CAAC,6DAA6D,EAAErB,WAAW,EAAEkB,iBAAiB,CAAC;MAC/G;IACF;IACAE,YAAU,CAACE,IAAI,CAAC,+CAA+C,EAAEtB,WAAW,EAAEkB,iBAAiB,CAAC;EAClG,CAAC;;EAED;EACA;EACA;EACA,MAAMK,iBAAiB,GAAG,MAAAA,CAAA,KAA2B;IACnD,IAAIC,QAAqB,GAAG,IAAI;IAChC,IAAI;MACFA,QAAQ,GAAG,MAAMZ,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,OAAOa,YAAY,EAAE;MACrB,IAAIC,OAAO,EAAE;QACXN,YAAU,CAACC,KAAK,CAAC,6DAA6D,EAAErB,WAAW,EAAEyB,YAAY,CAAC;MAC5G;MACAD,QAAQ,GAAGjB,YAAY;IACzB;IACA,IAAIiB,QAAQ,EAAE;MACZX,YAAY,CAACW,QAAQ,CAAC;MACtBV,iBAAiB,GAAGU,QAAQ,CAAC;IAC/B;IACAT,gBAAgB,CAAC,CAAC;EACpB,CAAC;EAED,IAAIV,QAAQ,EAAE;IACZ;IACA;IACA,IAAI;MACF,MAAMW,kBAAkB,CAAC,CAAC;IAC5B,CAAC,CAAC,OAAOE,iBAAiB,EAAE;MAC1BD,iBAAiB,CAACC,iBAAiB,CAAC;IACtC;IACA,MAAMK,iBAAiB,CAAC,CAAC;IACzB;EACF;;EAEA;EACA;EACA;EACA,MAAMA,iBAAiB,CAAC,CAAC;EACzB,KAAKP,kBAAkB,CAAC,CAAC,CAACW,KAAK,CAACV,iBAAiB,CAAC;AACpD","ignoreList":[]}
+{"version":3,"names":["_core","require","_legacyRedirectLanes","_isWebBrowser","_oxyContextHelpers","LOG_CONTEXT","component","method","commitDeviceSetAndResolve","deps","activate","userId","fallbackUser","registerAndActivate","addCurrentAccount","startSocket","syncFromClient","getCurrentUser","loginSuccess","onAuthStateChange","markAuthResolved","reconcileDeviceSet","logReconcileError","registrationError","isUnauthorizedStatus","loggerUtil","debug","warn","hydrateAndResolve","fullUser","profileError","__DEV__","catch","maybeSyncHubAfterCommit","hubSyncRequested","hubSyncEnabled","webAuthMode","syncHub","allowsAutomaticIdpRedirect","isWebBrowser","hubError"],"sourceRoot":"../../../../src","sources":["ui/context/commitSessionFlow.ts"],"mappings":";;;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,oBAAA,GAAAD,OAAA;AAEA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,kBAAA,GAAAH,OAAA;AAEA,MAAMI,WAAW,GAAG;EAAEC,SAAS,EAAE,YAAY;EAAEC,MAAM,EAAE;AAAgB,CAAU;AA6BjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,yBAAyBA,CAC7CC,IAAmC,EACpB;EACf,MAAM;IACJC,QAAQ;IACRC,MAAM;IACNC,YAAY;IACZC,mBAAmB;IACnBC,iBAAiB;IACjBC,WAAW;IACXC,cAAc;IACdC,cAAc;IACdC,YAAY;IACZC,iBAAiB;IACjBC;EACF,CAAC,GAAGX,IAAI;;EAER;EACA;EACA;EACA;EACA,MAAMY,kBAAkB,GAAG,MAAAA,CAAA,KAA2B;IACpD,IAAIX,QAAQ,EAAE;MACZ,MAAMG,mBAAmB,CAACF,MAAM,CAAC;IACnC,CAAC,MAAM;MACL,MAAMG,iBAAiB,CAAC,CAAC;IAC3B;IACA,MAAMC,WAAW,CAAC,CAAC;IACnB,MAAMC,cAAc,CAAC,CAAC;EACxB,CAAC;EAED,MAAMM,iBAAiB,GAAIC,iBAA0B,IAAW;IAC9D;IACA;IACA;IACA;IACA;IACA,IAAI,IAAAC,uCAAoB,EAACD,iBAAiB,CAAC,EAAE;MAC3CE,YAAU,CAACC,KAAK,CAAC,6DAA6D,EAAErB,WAAW,EAAEkB,iBAAiB,CAAC;MAC/G;IACF;IACAE,YAAU,CAACE,IAAI,CAAC,+CAA+C,EAAEtB,WAAW,EAAEkB,iBAAiB,CAAC;EAClG,CAAC;;EAED;EACA;EACA;EACA,MAAMK,iBAAiB,GAAG,MAAAA,CAAA,KAA2B;IACnD,IAAIC,QAAqB,GAAG,IAAI;IAChC,IAAI;MACFA,QAAQ,GAAG,MAAMZ,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,OAAOa,YAAY,EAAE;MACrB,IAAIC,OAAO,EAAE;QACXN,YAAU,CAACC,KAAK,CAAC,6DAA6D,EAAErB,WAAW,EAAEyB,YAAY,CAAC;MAC5G;MACAD,QAAQ,GAAGjB,YAAY;IACzB;IACA,IAAI,CAACiB,QAAQ,EAAE;MACbA,QAAQ,GAAGjB,YAAY;IACzB;IACA,IAAIiB,QAAQ,EAAE;MACZX,YAAY,CAACW,QAAQ,CAAC;MACtBV,iBAAiB,GAAGU,QAAQ,CAAC;IAC/B;IACAT,gBAAgB,CAAC,CAAC;EACpB,CAAC;EAED,IAAIV,QAAQ,EAAE;IACZ;IACA;IACA,IAAI;MACF,MAAMW,kBAAkB,CAAC,CAAC;IAC5B,CAAC,CAAC,OAAOE,iBAAiB,EAAE;MAC1BD,iBAAiB,CAACC,iBAAiB,CAAC;IACtC;IACA,MAAMK,iBAAiB,CAAC,CAAC;IACzB;EACF;;EAEA;EACA;EACA;EACA,MAAMA,iBAAiB,CAAC,CAAC;EACzB,KAAKP,kBAAkB,CAAC,CAAC,CAACW,KAAK,CAACV,iBAAiB,CAAC;AACpD;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeW,uBAAuBA,CAC3CxB,IAAiC,EACf;EAClB,MAAM;IAAEC,QAAQ;IAAEwB,gBAAgB;IAAEC,cAAc;IAAEC,WAAW;IAAEC;EAAQ,CAAC,GAAG5B,IAAI;EAEjF,IAAI,CAACC,QAAQ,IAAI,CAACwB,gBAAgB,IAAI,CAACC,cAAc,EAAE,OAAO,KAAK;EACnE,IAAI,CAAC,IAAAG,+CAA0B,EAACF,WAAW,CAAC,EAAE,OAAO,KAAK;EAC1D,IAAI,CAAC,IAAAG,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,IAAI;IACF,OAAO,MAAMF,OAAO,CAAC,CAAC;EACxB,CAAC,CAAC,OAAOG,QAAQ,EAAE;IACjB,IAAIT,OAAO,EAAE;MACXN,YAAU,CAACC,KAAK,CAAC,2CAA2C,EAAErB,WAAW,EAAEmC,QAAQ,CAAC;IACtF;IACA,OAAO,KAAK;EACd;AACF","ignoreList":[]}

package/lib/commonjs/ui/context/hooks/useAuthOperations.js

@@ -48,7 +48,9 @@ const useAuthOperations = ({
   loginFailure,
   logoutStore,
   setAuthState,
-  logger
+  logger,
+  identityBinding,
+  refreshPinnedAccountId
 }) => {
   /**
    * Internal function to perform challenge-response sign in.
@@ -103,6 +105,17 @@ const useAuthOperations = ({
         logger?.('Failed to persist auth state after sign-in', persistError);
       }
     }
+    if (identityBinding) {
+      try {
+        await identityBinding.pinStore.save({
+          publicKey: publicKey.toLowerCase(),
+          accountId: sessionResponse.user.id
+        });
+        await refreshPinnedAccountId?.();
+      } catch (pinError) {
+        logger?.('Failed to persist identity pin after sign-in', pinError);
+      }
+    }
 
     // Register this recovered account+session into the server-authoritative
     // device-session set AND make it active: `registerAndActivate()` adds via
@@ -166,7 +179,7 @@ const useAuthOperations = ({
     loginSuccess(fullUser);
     onAuthStateChange?.(fullUser);
     return fullUser;
-  }, [logger, loginSuccess, onAuthStateChange, oxyServices, saveActiveSessionId, sessionClient, setActiveSessionId, store, switchSession, syncFromClient, updateSessions]);
+  }, [logger, loginSuccess, onAuthStateChange, oxyServices, saveActiveSessionId, sessionClient, setActiveSessionId, store, switchSession, syncFromClient, updateSessions, identityBinding, refreshPinnedAccountId]);
 
   /**
    * Sign in with existing public key

package/lib/commonjs/ui/context/hooks/useAuthOperations.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","_core","_sessionHelpers","_errorHandlers","LOGIN_ERROR_CODE","LOGOUT_ERROR_CODE","LOGOUT_ALL_ERROR_CODE","clearPersistedAuthSafe","store","logger","clear","catch","clearError","useAuthOperations","oxyServices","activeSessionId","setActiveSessionId","updateSessions","saveActiveSessionId","clearSessionState","switchSession","sessionClient","syncFromClient","onAuthStateChange","onError","loginSuccess","loginFailure","logoutStore","setAuthState","performSignIn","useCallback","publicKey","deviceFingerprintObj","DeviceManager","getDeviceFingerprint","deviceFingerprint","JSON","stringify","deviceInfo","getDeviceInfo","deviceName","getDefaultDeviceName","challengeResponse","requestChallenge","challenge","signature","timestamp","SignatureService","signChallenge","fullUser","sessionResponse","verifyChallenge","deviceSecret","deviceId","save","sessionId","userId","user","id","accessToken","expiresAt","persistError","registerAndActivate","registrationError","getCurrentUser","allDeviceSessions","fetchSessionsWithFallback","fallbackDeviceId","fallbackUserId","error","__DEV__","existingSession","find","session","toString","logoutSession","logoutError","filter","merge","signIn","isLoading","message","handleAuthError","defaultMessage","code","setAuthError","msg","logout","targetSessionId","sessionToLogout","targetAccountId","getState","accounts","account","accountId","Error","signOut","remainingAccounts","length","isInvalid","isInvalidSessionError","status","undefined","logoutAll","all","exports"],"sourceRoot":"../../../../../src","sources":["ui/context/hooks/useAuthOperations.ts"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,eAAA,GAAAF,OAAA;AACA,IAAAG,cAAA,GAAAH,OAAA;AAkDA,MAAMI,gBAAgB,GAAG,aAAa;AACtC,MAAMC,iBAAiB,GAAG,cAAc;AACxC,MAAMC,qBAAqB,GAAG,kBAAkB;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,sBAAsBA,CACpCC,KAAqB,EACrBC,MAAmD,EAC7C;EACND,KAAK,CAACE,KAAK,CAAC,CAAC,CAACC,KAAK,CAAEC,UAAU,IAAK;IAClCH,MAAM,GAAG,kDAAkD,EAAEG,UAAU,CAAC;EAC1E,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACO,MAAMC,iBAAiB,GAAGA,CAAC;EAChCC,WAAW;EACXN,KAAK;EACLO,eAAe;EACfC,kBAAkB;EAClBC,cAAc;EACdC,mBAAmB;EACnBC,iBAAiB;EACjBC,aAAa;EACbC,aAAa;EACbC,cAAc;EACdC,iBAAiB;EACjBC,OAAO;EACPC,YAAY;EACZC,YAAY;EACZC,WAAW;EACXC,YAAY;EACZnB;AACwB,CAAC,KAA8B;EACvD;AACF;AACA;EACE,MAAMoB,aAAa,GAAG,IAAAC,kBAAW,EAC/B,MAAOC,SAAiB,IAAoB;IAC1C,MAAMC,oBAAoB,GAAGC,mBAAa,CAACC,oBAAoB,CAAC,CAAC;IACjE,MAAMC,iBAAiB,GAAGC,IAAI,CAACC,SAAS,CAACL,oBAAoB,CAAC;IAC9D,MAAMM,UAAU,GAAG,MAAML,mBAAa,CAACM,aAAa,CAAC,CAAC;IACtD,MAAMC,UAAU,GAAGF,UAAU,CAACE,UAAU,IAAIP,mBAAa,CAACQ,oBAAoB,CAAC,CAAC;IAEhF,MAAMC,iBAAiB,GAAG,MAAM5B,WAAW,CAAC6B,gBAAgB,CAACZ,SAAS,CAAC;IACvE,MAAMa,SAAS,GAAGF,iBAAiB,CAACE,SAAS;;IAE7C;IACA;IACA;;IAEA;IACA,MAAM;MAAEA,SAAS,EAAEC,SAAS;MAAEC;IAAU,CAAC,GAAG,MAAMC,sBAAgB,CAACC,aAAa,CAACJ,SAAS,CAAC;IAE3F,IAAIK,QAAc;IAClB,IAAIC,eAAqC;;IAEzC;IACA;IACA;IACAA,eAAe,GAAG,MAAMpC,WAAW,CAACqC,eAAe,CACjDpB,SAAS,EACTa,SAAS,EACTC,SAAS,EACTC,SAAS,EACTN,UAAU,EACVL,iBACF,CAAC;;IAED;IACA;IACA;IACA;IACA;IACA;IACA,MAAMiB,YAAY,GAAGF,eAAe,CAACE,YAAY;IACjD,IAAIF,eAAe,CAACG,QAAQ,IAAID,YAAY,EAAE;MAC5C,IAAI;QACF,MAAM5C,KAAK,CAAC8C,IAAI,CAAC;UACfC,SAAS,EAAEL,eAAe,CAACK,SAAS;UACpCC,MAAM,EAAEN,eAAe,CAACO,IAAI,CAACC,EAAE;UAC/BL,QAAQ,EAAEH,eAAe,CAACG,QAAQ;UAClCD,YAAY;UACZ,IAAIF,eAAe,CAACS,WAAW,GAAG;YAAEA,WAAW,EAAET,eAAe,CAACS;UAAY,CAAC,GAAG,CAAC,CAAC,CAAC;UACpF,IAAIT,eAAe,CAACU,SAAS,GAAG;YAAEA,SAAS,EAAEV,eAAe,CAACU;UAAU,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOC,YAAY,EAAE;QACrBpD,MAAM,GAAG,4CAA4C,EAAEoD,YAAY,CAAC;MACtE;IACF;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAI;MACF,MAAMxC,aAAa,CAACyC,mBAAmB,CAACZ,eAAe,CAACO,IAAI,CAACC,EAAE,CAAC;MAChE,MAAMpC,cAAc,CAAC,CAAC;IACxB,CAAC,CAAC,OAAOyC,iBAAiB,EAAE;MAC1BtD,MAAM,GAAG,oDAAoD,EAAEsD,iBAAiB,CAAC;IACnF;;IAEA;IACA;IACA;IACA;IACAd,QAAQ,GAAG,MAAMnC,WAAW,CAACkD,cAAc,CAAC,CAAC;;IAE7C;IACA,IAAIC,iBAAkC,GAAG,EAAE;IAC3C,IAAI;MACFA,iBAAiB,GAAG,MAAM,IAAAC,yCAAyB,EAACpD,WAAW,EAAEoC,eAAe,CAACK,SAAS,EAAE;QAC1FY,gBAAgB,EAAEjB,eAAe,CAACG,QAAQ;QAC1Ce,cAAc,EAAEnB,QAAQ,CAACS,EAAE;QAC3BjD;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,OAAO4D,KAAK,EAAE;MACd,IAAIC,OAAO,IAAI7D,MAAM,EAAE;QACrBA,MAAM,CAAC,6CAA6C,EAAE4D,KAAK,CAAC;MAC9D;IACF;;IAEA;IACA,MAAME,eAAe,GAAGN,iBAAiB,CAACO,IAAI,CAC3CC,OAAO,IACNA,OAAO,CAACjB,MAAM,EAAEkB,QAAQ,CAAC,CAAC,KAAKzB,QAAQ,CAACS,EAAE,EAAEgB,QAAQ,CAAC,CAAC,IACtDD,OAAO,CAAClB,SAAS,KAAKL,eAAe,CAACK,SAC1C,CAAC;IAED,IAAIgB,eAAe,EAAE;MACnB;MACA,IAAI;QACF,MAAMzD,WAAW,CAAC6D,aAAa,CAACzB,eAAe,CAACK,SAAS,EAAEL,eAAe,CAACK,SAAS,CAAC;MACvF,CAAC,CAAC,OAAOqB,WAAW,EAAE;QACpB;QACA,IAAIN,OAAO,IAAI7D,MAAM,EAAE;UACrBA,MAAM,CAAC,4DAA4D,EAAEmE,WAAW,CAAC;QACnF;MACF;MACA,MAAMxD,aAAa,CAACmD,eAAe,CAAChB,SAAS,CAAC;MAC9CtC,cAAc,CACZgD,iBAAiB,CAACY,MAAM,CAAEJ,OAAO,IAAKA,OAAO,CAAClB,SAAS,KAAKL,eAAe,CAACK,SAAS,CAAC,EACtF;QAAEuB,KAAK,EAAE;MAAM,CACjB,CAAC;MACDvD,iBAAiB,GAAG0B,QAAQ,CAAC;MAC7B,OAAOA,QAAQ;IACjB;IAEAjC,kBAAkB,CAACkC,eAAe,CAACK,SAAS,CAAC;IAC7C,MAAMrC,mBAAmB,CAACgC,eAAe,CAACK,SAAS,CAAC;IACpDtC,cAAc,CAACgD,iBAAiB,EAAE;MAAEa,KAAK,EAAE;IAAK,CAAC,CAAC;IAElDrD,YAAY,CAACwB,QAAQ,CAAC;IACtB1B,iBAAiB,GAAG0B,QAAQ,CAAC;IAE7B,OAAOA,QAAQ;EACjB,CAAC,EACD,CACExC,MAAM,EACNgB,YAAY,EACZF,iBAAiB,EACjBT,WAAW,EACXI,mBAAmB,EACnBG,aAAa,EACbL,kBAAkB,EAClBR,KAAK,EACLY,aAAa,EACbE,cAAc,EACdL,cAAc,CAElB,CAAC;;EAED;AACF;AACA;EACE,MAAM8D,MAAM,GAAG,IAAAjD,kBAAW,EACxB,OAAOC,SAAiB,EAAES,UAAmB,KAAoB;IAC/DZ,YAAY,CAAC;MAAEoD,SAAS,EAAE,IAAI;MAAEX,KAAK,EAAE;IAAK,CAAC,CAAC;IAE9C,IAAI;MACF,OAAO,MAAMxC,aAAa,CAACE,SAAS,CAAC;IACvC,CAAC,CAAC,OAAOsC,KAAK,EAAE;MACd,MAAMY,OAAO,GAAG,IAAAC,8BAAe,EAACb,KAAK,EAAE;QACrCc,cAAc,EAAE,gBAAgB;QAChCC,IAAI,EAAEhF,gBAAgB;QACtBoB,OAAO;QACP6D,YAAY,EAAGC,GAAW,IAAK1D,YAAY,CAAC;UAAEyC,KAAK,EAAEiB;QAAI,CAAC,CAAC;QAC3D7E;MACF,CAAC,CAAC;MACFiB,YAAY,CAACuD,OAAO,CAAC;MACrB,MAAMZ,KAAK;IACb,CAAC,SAAS;MACRzC,YAAY,CAAC;QAAEoD,SAAS,EAAE;MAAM,CAAC,CAAC;IACpC;EACF,CAAC,EACD,CAACpD,YAAY,EAAEC,aAAa,EAAEH,YAAY,EAAEF,OAAO,EAAEf,MAAM,CAC7D,CAAC;;EAED;AACF;AACA;EACE,MAAM8E,MAAM,GAAG,IAAAzD,kBAAW,EACxB,MAAO0D,eAAwB,IAAoB;IACjD,IAAI,CAACzE,eAAe,EAAE;IAEtB,IAAI;MACF,MAAM0E,eAAe,GAAGD,eAAe,IAAIzE,eAAe;;MAE1D;MACA;MACA;MACA;MACA,MAAM2E,eAAe,GAAGrE,aAAa,CAClCsE,QAAQ,CAAC,CAAC,EACTC,QAAQ,CAACpB,IAAI,CAAEqB,OAAO,IAAKA,OAAO,CAACtC,SAAS,KAAKkC,eAAe,CAAC,EAAEK,SAAS;MAChF,IAAI,CAACJ,eAAe,EAAE;QACpB,MAAM,IAAIK,KAAK,CAAC,wCAAwCN,eAAe,GAAG,CAAC;MAC7E;MAEA,MAAMpE,aAAa,CAAC2E,OAAO,CAAC;QAAEF,SAAS,EAAEJ;MAAgB,CAAC,CAAC;;MAE3D;MACA;MACA;MACA;MACA,MAAMO,iBAAiB,GAAG5E,aAAa,CAACsE,QAAQ,CAAC,CAAC,EAAEC,QAAQ,IAAI,EAAE;MAClE,MAAMtE,cAAc,CAAC,CAAC;MAEtB,IAAImE,eAAe,KAAK1E,eAAe,IAAIkF,iBAAiB,CAACC,MAAM,KAAK,CAAC,EAAE;QACzE;QACA;QACA;QACA3F,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;MAC3B;IACF,CAAC,CAAC,OAAOkD,KAAK,EAAE;MACd,MAAM8B,SAAS,GAAG,IAAAC,oCAAqB,EAAC/B,KAAK,CAAC;MAE9C,IAAI8B,SAAS,IAAIX,eAAe,KAAKzE,eAAe,EAAE;QACpD;QACAR,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;QACzB;MACF;MAEA,IAAA+D,8BAAe,EAACb,KAAK,EAAE;QACrBc,cAAc,EAAE,eAAe;QAC/BC,IAAI,EAAE/E,iBAAiB;QACvBmB,OAAO;QACP6D,YAAY,EAAGC,GAAW,IAAK1D,YAAY,CAAC;UAAEyC,KAAK,EAAEiB;QAAI,CAAC,CAAC;QAC3D7E,MAAM;QACN4F,MAAM,EAAEF,SAAS,GAAG,GAAG,GAAGG;MAC5B,CAAC,CAAC;IACJ;EACF,CAAC,EACD,CACEvF,eAAe,EACfI,iBAAiB,EACjBX,KAAK,EACLC,MAAM,EACNe,OAAO,EACPH,aAAa,EACbO,YAAY,EACZN,cAAc,CAElB,CAAC;;EAED;AACF;AACA;EACE,MAAMiF,SAAS,GAAG,IAAAzE,kBAAW,EAAC,YAA2B;IACvD,IAAI,CAACf,eAAe,EAAE;MACpB,MAAMsD,KAAK,GAAG,IAAI0B,KAAK,CAAC,yBAAyB,CAAC;MAClDnE,YAAY,CAAC;QAAEyC,KAAK,EAAEA,KAAK,CAACY;MAAQ,CAAC,CAAC;MACtCzD,OAAO,GAAG;QAAEyD,OAAO,EAAEZ,KAAK,CAACY,OAAO;QAAEG,IAAI,EAAE9E,qBAAqB;QAAE+F,MAAM,EAAE;MAAI,CAAC,CAAC;MAC/E,MAAMhC,KAAK;IACb;IAEA,IAAI;MACF;MACA;MACA;MACA;MACA,MAAMhD,aAAa,CAAC2E,OAAO,CAAC;QAAEQ,GAAG,EAAE;MAAK,CAAC,CAAC;MAC1C;MACA;MACA;MACAjG,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;MACrC,MAAMU,iBAAiB,CAAC,CAAC;IAC3B,CAAC,CAAC,OAAOkD,KAAK,EAAE;MACd,IAAAa,8BAAe,EAACb,KAAK,EAAE;QACrBc,cAAc,EAAE,mBAAmB;QACnCC,IAAI,EAAE9E,qBAAqB;QAC3BkB,OAAO;QACP6D,YAAY,EAAGC,GAAW,IAAK1D,YAAY,CAAC;UAAEyC,KAAK,EAAEiB;QAAI,CAAC,CAAC;QAC3D7E;MACF,CAAC,CAAC;MACF,MAAM4D,KAAK,YAAY0B,KAAK,GAAG1B,KAAK,GAAG,IAAI0B,KAAK,CAAC,mBAAmB,CAAC;IACvE;EACF,CAAC,EAAE,CAAChF,eAAe,EAAEI,iBAAiB,EAAEX,KAAK,EAAEC,MAAM,EAAEe,OAAO,EAAEH,aAAa,EAAEO,YAAY,CAAC,CAAC;EAE7F,OAAO;IACLmD,MAAM;IACNQ,MAAM;IACNgB;EACF,CAAC;AACH,CAAC;AAACE,OAAA,CAAA5F,iBAAA,GAAAA,iBAAA","ignoreList":[]}
+{"version":3,"names":["_react","require","_core","_sessionHelpers","_errorHandlers","LOGIN_ERROR_CODE","LOGOUT_ERROR_CODE","LOGOUT_ALL_ERROR_CODE","clearPersistedAuthSafe","store","logger","clear","catch","clearError","useAuthOperations","oxyServices","activeSessionId","setActiveSessionId","updateSessions","saveActiveSessionId","clearSessionState","switchSession","sessionClient","syncFromClient","onAuthStateChange","onError","loginSuccess","loginFailure","logoutStore","setAuthState","identityBinding","refreshPinnedAccountId","performSignIn","useCallback","publicKey","deviceFingerprintObj","DeviceManager","getDeviceFingerprint","deviceFingerprint","JSON","stringify","deviceInfo","getDeviceInfo","deviceName","getDefaultDeviceName","challengeResponse","requestChallenge","challenge","signature","timestamp","SignatureService","signChallenge","fullUser","sessionResponse","verifyChallenge","deviceSecret","deviceId","save","sessionId","userId","user","id","accessToken","expiresAt","persistError","pinStore","toLowerCase","accountId","pinError","registerAndActivate","registrationError","getCurrentUser","allDeviceSessions","fetchSessionsWithFallback","fallbackDeviceId","fallbackUserId","error","__DEV__","existingSession","find","session","toString","logoutSession","logoutError","filter","merge","signIn","isLoading","message","handleAuthError","defaultMessage","code","setAuthError","msg","logout","targetSessionId","sessionToLogout","targetAccountId","getState","accounts","account","Error","signOut","remainingAccounts","length","isInvalid","isInvalidSessionError","status","undefined","logoutAll","all","exports"],"sourceRoot":"../../../../../src","sources":["ui/context/hooks/useAuthOperations.ts"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,eAAA,GAAAF,OAAA;AACA,IAAAG,cAAA,GAAAH,OAAA;AA2DA,MAAMI,gBAAgB,GAAG,aAAa;AACtC,MAAMC,iBAAiB,GAAG,cAAc;AACxC,MAAMC,qBAAqB,GAAG,kBAAkB;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,sBAAsBA,CACpCC,KAAqB,EACrBC,MAAmD,EAC7C;EACND,KAAK,CAACE,KAAK,CAAC,CAAC,CAACC,KAAK,CAAEC,UAAU,IAAK;IAClCH,MAAM,GAAG,kDAAkD,EAAEG,UAAU,CAAC;EAC1E,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACO,MAAMC,iBAAiB,GAAGA,CAAC;EAChCC,WAAW;EACXN,KAAK;EACLO,eAAe;EACfC,kBAAkB;EAClBC,cAAc;EACdC,mBAAmB;EACnBC,iBAAiB;EACjBC,aAAa;EACbC,aAAa;EACbC,cAAc;EACdC,iBAAiB;EACjBC,OAAO;EACPC,YAAY;EACZC,YAAY;EACZC,WAAW;EACXC,YAAY;EACZnB,MAAM;EACNoB,eAAe;EACfC;AACwB,CAAC,KAA8B;EACvD;AACF;AACA;EACE,MAAMC,aAAa,GAAG,IAAAC,kBAAW,EAC/B,MAAOC,SAAiB,IAAoB;IAC1C,MAAMC,oBAAoB,GAAGC,mBAAa,CAACC,oBAAoB,CAAC,CAAC;IACjE,MAAMC,iBAAiB,GAAGC,IAAI,CAACC,SAAS,CAACL,oBAAoB,CAAC;IAC9D,MAAMM,UAAU,GAAG,MAAML,mBAAa,CAACM,aAAa,CAAC,CAAC;IACtD,MAAMC,UAAU,GAAGF,UAAU,CAACE,UAAU,IAAIP,mBAAa,CAACQ,oBAAoB,CAAC,CAAC;IAEhF,MAAMC,iBAAiB,GAAG,MAAM9B,WAAW,CAAC+B,gBAAgB,CAACZ,SAAS,CAAC;IACvE,MAAMa,SAAS,GAAGF,iBAAiB,CAACE,SAAS;;IAE7C;IACA;IACA;;IAEA;IACA,MAAM;MAAEA,SAAS,EAAEC,SAAS;MAAEC;IAAU,CAAC,GAAG,MAAMC,sBAAgB,CAACC,aAAa,CAACJ,SAAS,CAAC;IAE3F,IAAIK,QAAc;IAClB,IAAIC,eAAqC;;IAEzC;IACA;IACA;IACAA,eAAe,GAAG,MAAMtC,WAAW,CAACuC,eAAe,CACjDpB,SAAS,EACTa,SAAS,EACTC,SAAS,EACTC,SAAS,EACTN,UAAU,EACVL,iBACF,CAAC;;IAED;IACA;IACA;IACA;IACA;IACA;IACA,MAAMiB,YAAY,GAAGF,eAAe,CAACE,YAAY;IACjD,IAAIF,eAAe,CAACG,QAAQ,IAAID,YAAY,EAAE;MAC5C,IAAI;QACF,MAAM9C,KAAK,CAACgD,IAAI,CAAC;UACfC,SAAS,EAAEL,eAAe,CAACK,SAAS;UACpCC,MAAM,EAAEN,eAAe,CAACO,IAAI,CAACC,EAAE;UAC/BL,QAAQ,EAAEH,eAAe,CAACG,QAAQ;UAClCD,YAAY;UACZ,IAAIF,eAAe,CAACS,WAAW,GAAG;YAAEA,WAAW,EAAET,eAAe,CAACS;UAAY,CAAC,GAAG,CAAC,CAAC,CAAC;UACpF,IAAIT,eAAe,CAACU,SAAS,GAAG;YAAEA,SAAS,EAAEV,eAAe,CAACU;UAAU,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOC,YAAY,EAAE;QACrBtD,MAAM,GAAG,4CAA4C,EAAEsD,YAAY,CAAC;MACtE;IACF;IAEA,IAAIlC,eAAe,EAAE;MACnB,IAAI;QACF,MAAMA,eAAe,CAACmC,QAAQ,CAACR,IAAI,CAAC;UAClCvB,SAAS,EAAEA,SAAS,CAACgC,WAAW,CAAC,CAAC;UAClCC,SAAS,EAAEd,eAAe,CAACO,IAAI,CAACC;QAClC,CAAC,CAAC;QACF,MAAM9B,sBAAsB,GAAG,CAAC;MAClC,CAAC,CAAC,OAAOqC,QAAQ,EAAE;QACjB1D,MAAM,GAAG,8CAA8C,EAAE0D,QAAQ,CAAC;MACpE;IACF;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAI;MACF,MAAM9C,aAAa,CAAC+C,mBAAmB,CAAChB,eAAe,CAACO,IAAI,CAACC,EAAE,CAAC;MAChE,MAAMtC,cAAc,CAAC,CAAC;IACxB,CAAC,CAAC,OAAO+C,iBAAiB,EAAE;MAC1B5D,MAAM,GAAG,oDAAoD,EAAE4D,iBAAiB,CAAC;IACnF;;IAEA;IACA;IACA;IACA;IACAlB,QAAQ,GAAG,MAAMrC,WAAW,CAACwD,cAAc,CAAC,CAAC;;IAE7C;IACA,IAAIC,iBAAkC,GAAG,EAAE;IAC3C,IAAI;MACFA,iBAAiB,GAAG,MAAM,IAAAC,yCAAyB,EAAC1D,WAAW,EAAEsC,eAAe,CAACK,SAAS,EAAE;QAC1FgB,gBAAgB,EAAErB,eAAe,CAACG,QAAQ;QAC1CmB,cAAc,EAAEvB,QAAQ,CAACS,EAAE;QAC3BnD;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOkE,KAAK,EAAE;MACd,IAAIC,OAAO,IAAInE,MAAM,EAAE;QACrBA,MAAM,CAAC,6CAA6C,EAAEkE,KAAK,CAAC;MAC9D;IACF;;IAEA;IACA,MAAME,eAAe,GAAGN,iBAAiB,CAACO,IAAI,CAC3CC,OAAO,IACNA,OAAO,CAACrB,MAAM,EAAEsB,QAAQ,CAAC,CAAC,KAAK7B,QAAQ,CAACS,EAAE,EAAEoB,QAAQ,CAAC,CAAC,IACtDD,OAAO,CAACtB,SAAS,KAAKL,eAAe,CAACK,SAC1C,CAAC;IAED,IAAIoB,eAAe,EAAE;MACnB;MACA,IAAI;QACF,MAAM/D,WAAW,CAACmE,aAAa,CAAC7B,eAAe,CAACK,SAAS,EAAEL,eAAe,CAACK,SAAS,CAAC;MACvF,CAAC,CAAC,OAAOyB,WAAW,EAAE;QACpB;QACA,IAAIN,OAAO,IAAInE,MAAM,EAAE;UACrBA,MAAM,CAAC,4DAA4D,EAAEyE,WAAW,CAAC;QACnF;MACF;MACA,MAAM9D,aAAa,CAACyD,eAAe,CAACpB,SAAS,CAAC;MAC9CxC,cAAc,CACZsD,iBAAiB,CAACY,MAAM,CAAEJ,OAAO,IAAKA,OAAO,CAACtB,SAAS,KAAKL,eAAe,CAACK,SAAS,CAAC,EACtF;QAAE2B,KAAK,EAAE;MAAM,CACjB,CAAC;MACD7D,iBAAiB,GAAG4B,QAAQ,CAAC;MAC7B,OAAOA,QAAQ;IACjB;IAEAnC,kBAAkB,CAACoC,eAAe,CAACK,SAAS,CAAC;IAC7C,MAAMvC,mBAAmB,CAACkC,eAAe,CAACK,SAAS,CAAC;IACpDxC,cAAc,CAACsD,iBAAiB,EAAE;MAAEa,KAAK,EAAE;IAAK,CAAC,CAAC;IAElD3D,YAAY,CAAC0B,QAAQ,CAAC;IACtB5B,iBAAiB,GAAG4B,QAAQ,CAAC;IAE7B,OAAOA,QAAQ;EACjB,CAAC,EACD,CACE1C,MAAM,EACNgB,YAAY,EACZF,iBAAiB,EACjBT,WAAW,EACXI,mBAAmB,EACnBG,aAAa,EACbL,kBAAkB,EAClBR,KAAK,EACLY,aAAa,EACbE,cAAc,EACdL,cAAc,EACdY,eAAe,EACfC,sBAAsB,CAE1B,CAAC;;EAED;AACF;AACA;EACE,MAAMuD,MAAM,GAAG,IAAArD,kBAAW,EACxB,OAAOC,SAAiB,EAAES,UAAmB,KAAoB;IAC/Dd,YAAY,CAAC;MAAE0D,SAAS,EAAE,IAAI;MAAEX,KAAK,EAAE;IAAK,CAAC,CAAC;IAE9C,IAAI;MACF,OAAO,MAAM5C,aAAa,CAACE,SAAS,CAAC;IACvC,CAAC,CAAC,OAAO0C,KAAK,EAAE;MACd,MAAMY,OAAO,GAAG,IAAAC,8BAAe,EAACb,KAAK,EAAE;QACrCc,cAAc,EAAE,gBAAgB;QAChCC,IAAI,EAAEtF,gBAAgB;QACtBoB,OAAO;QACPmE,YAAY,EAAGC,GAAW,IAAKhE,YAAY,CAAC;UAAE+C,KAAK,EAAEiB;QAAI,CAAC,CAAC;QAC3DnF;MACF,CAAC,CAAC;MACFiB,YAAY,CAAC6D,OAAO,CAAC;MACrB,MAAMZ,KAAK;IACb,CAAC,SAAS;MACR/C,YAAY,CAAC;QAAE0D,SAAS,EAAE;MAAM,CAAC,CAAC;IACpC;EACF,CAAC,EACD,CAAC1D,YAAY,EAAEG,aAAa,EAAEL,YAAY,EAAEF,OAAO,EAAEf,MAAM,CAC7D,CAAC;;EAED;AACF;AACA;EACE,MAAMoF,MAAM,GAAG,IAAA7D,kBAAW,EACxB,MAAO8D,eAAwB,IAAoB;IACjD,IAAI,CAAC/E,eAAe,EAAE;IAEtB,IAAI;MACF,MAAMgF,eAAe,GAAGD,eAAe,IAAI/E,eAAe;;MAE1D;MACA;MACA;MACA;MACA,MAAMiF,eAAe,GAAG3E,aAAa,CAClC4E,QAAQ,CAAC,CAAC,EACTC,QAAQ,CAACpB,IAAI,CAAEqB,OAAO,IAAKA,OAAO,CAAC1C,SAAS,KAAKsC,eAAe,CAAC,EAAE7B,SAAS;MAChF,IAAI,CAAC8B,eAAe,EAAE;QACpB,MAAM,IAAII,KAAK,CAAC,wCAAwCL,eAAe,GAAG,CAAC;MAC7E;MAEA,MAAM1E,aAAa,CAACgF,OAAO,CAAC;QAAEnC,SAAS,EAAE8B;MAAgB,CAAC,CAAC;;MAE3D;MACA;MACA;MACA;MACA,MAAMM,iBAAiB,GAAGjF,aAAa,CAAC4E,QAAQ,CAAC,CAAC,EAAEC,QAAQ,IAAI,EAAE;MAClE,MAAM5E,cAAc,CAAC,CAAC;MAEtB,IAAIyE,eAAe,KAAKhF,eAAe,IAAIuF,iBAAiB,CAACC,MAAM,KAAK,CAAC,EAAE;QACzE;QACA;QACA;QACAhG,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;MAC3B;IACF,CAAC,CAAC,OAAOwD,KAAK,EAAE;MACd,MAAM6B,SAAS,GAAG,IAAAC,oCAAqB,EAAC9B,KAAK,CAAC;MAE9C,IAAI6B,SAAS,IAAIV,eAAe,KAAK/E,eAAe,EAAE;QACpD;QACAR,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;QACzB;MACF;MAEA,IAAAqE,8BAAe,EAACb,KAAK,EAAE;QACrBc,cAAc,EAAE,eAAe;QAC/BC,IAAI,EAAErF,iBAAiB;QACvBmB,OAAO;QACPmE,YAAY,EAAGC,GAAW,IAAKhE,YAAY,CAAC;UAAE+C,KAAK,EAAEiB;QAAI,CAAC,CAAC;QAC3DnF,MAAM;QACNiG,MAAM,EAAEF,SAAS,GAAG,GAAG,GAAGG;MAC5B,CAAC,CAAC;IACJ;EACF,CAAC,EACD,CACE5F,eAAe,EACfI,iBAAiB,EACjBX,KAAK,EACLC,MAAM,EACNe,OAAO,EACPH,aAAa,EACbO,YAAY,EACZN,cAAc,CAElB,CAAC;;EAED;AACF;AACA;EACE,MAAMsF,SAAS,GAAG,IAAA5E,kBAAW,EAAC,YAA2B;IACvD,IAAI,CAACjB,eAAe,EAAE;MACpB,MAAM4D,KAAK,GAAG,IAAIyB,KAAK,CAAC,yBAAyB,CAAC;MAClDxE,YAAY,CAAC;QAAE+C,KAAK,EAAEA,KAAK,CAACY;MAAQ,CAAC,CAAC;MACtC/D,OAAO,GAAG;QAAE+D,OAAO,EAAEZ,KAAK,CAACY,OAAO;QAAEG,IAAI,EAAEpF,qBAAqB;QAAEoG,MAAM,EAAE;MAAI,CAAC,CAAC;MAC/E,MAAM/B,KAAK;IACb;IAEA,IAAI;MACF;MACA;MACA;MACA;MACA,MAAMtD,aAAa,CAACgF,OAAO,CAAC;QAAEQ,GAAG,EAAE;MAAK,CAAC,CAAC;MAC1C;MACA;MACA;MACAtG,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;MACrC,MAAMU,iBAAiB,CAAC,CAAC;IAC3B,CAAC,CAAC,OAAOwD,KAAK,EAAE;MACd,IAAAa,8BAAe,EAACb,KAAK,EAAE;QACrBc,cAAc,EAAE,mBAAmB;QACnCC,IAAI,EAAEpF,qBAAqB;QAC3BkB,OAAO;QACPmE,YAAY,EAAGC,GAAW,IAAKhE,YAAY,CAAC;UAAE+C,KAAK,EAAEiB;QAAI,CAAC,CAAC;QAC3DnF;MACF,CAAC,CAAC;MACF,MAAMkE,KAAK,YAAYyB,KAAK,GAAGzB,KAAK,GAAG,IAAIyB,KAAK,CAAC,mBAAmB,CAAC;IACvE;EACF,CAAC,EAAE,CAACrF,eAAe,EAAEI,iBAAiB,EAAEX,KAAK,EAAEC,MAAM,EAAEe,OAAO,EAAEH,aAAa,EAAEO,YAAY,CAAC,CAAC;EAE7F,OAAO;IACLyD,MAAM;IACNQ,MAAM;IACNe;EACF,CAAC;AACH,CAAC;AAACE,OAAA,CAAAjG,iBAAA,GAAAA,iBAAA","ignoreList":[]}

package/lib/commonjs/ui/context/useOxyAccountGraph.js

@@ -9,10 +9,12 @@ var _core = require("@oxyhq/core");
 var _oxyContextHelpers = require("./oxyContextHelpers.js");
 var _resetSessionScopedStores = require("../stores/resetSessionScopedStores.js");
 var _useResolvedFileUrls = require("../hooks/useResolvedFileUrls.js");
+var _index = require("../session/index.js");
 function useOxyAccountGraph({
   isAuthenticated,
   tokenReady,
   initialized,
+  identityBound,
   oxyServices,
   sessionClient,
   syncFromClient,
@@ -23,7 +25,7 @@ function useOxyAccountGraph({
 }) {
   const [accounts, setAccounts] = (0, _react.useState)([]);
   const refreshAccounts = (0, _react.useCallback)(async () => {
-    if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
+    if (identityBound || !isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
       setAccounts([]);
       return;
     }
@@ -42,13 +44,13 @@ function useOxyAccountGraph({
         }, err);
       }
     }
-  }, [isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
+  }, [identityBound, isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
   (0, _react.useEffect)(() => {
-    if (isAuthenticated && initialized && tokenReady) {
+    if (!identityBound && isAuthenticated && initialized && tokenReady) {
       refreshAccounts();
       void accountDialogControllerRef.current?.refresh();
     }
-  }, [isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
+  }, [identityBound, isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
   const runPostAccountSwitchSideEffects = (0, _react.useCallback)(async () => {
     (0, _resetSessionScopedStores.resetSessionScopedStores)();
     // Scoped media tokens are per-viewer — drop any cached URLs immediately so
@@ -61,6 +63,12 @@ function useOxyAccountGraph({
     queryClient.invalidateQueries();
   }, [refreshAccounts, queryClient]);
   const switchToAccount = (0, _react.useCallback)(async accountId => {
+    if (identityBound) {
+      // Loud rejection, never a silent no-op: a resolved promise here would
+      // read to the caller as a completed switch that simply left the user
+      // unchanged, which is exactly the confusion this mode must avoid.
+      throw new _index.IdentityBoundSessionError('switchToAccount');
+    }
     const deviceState = sessionClient.getState();
     if (deviceState?.accounts.some(account => account.accountId === accountId)) {
       await sessionClient.switchAccount(accountId);
@@ -88,7 +96,7 @@ function useOxyAccountGraph({
       hubSync: false
     });
     await runPostAccountSwitchSideEffects();
-  }, [oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
+  }, [identityBound, oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
   const createAccount = (0, _react.useCallback)(async data => {
     const account = await oxyServices.createAccount(data);
     await refreshAccounts();

package/lib/commonjs/ui/context/useOxyAccountGraph.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","_core","_oxyContextHelpers","_resetSessionScopedStores","_useResolvedFileUrls","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","oxyServices","sessionClient","syncFromClient","commitSession","queryClient","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","useState","refreshAccounts","useCallback","getAccessToken","list","listAccounts","err","isUnauthorizedStatus","current","__DEV__","loggerUtil","debug","component","useEffect","refresh","runPostAccountSwitchSideEffects","resetSessionScopedStores","removeQueries","queryKey","ASSET_DOWNLOAD_URLS_QUERY_KEY","invalidateQueries","switchToAccount","accountId","deviceState","getState","some","account","switchAccount","result","user","sessionId","Error","accessToken","deviceSecret","deviceId","expiresAt","userId","id","activate","hubSync","createAccount","data"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,yBAAA,GAAAH,OAAA;AACA,IAAAI,oBAAA,GAAAJ,OAAA;AAgBO,SAASK,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,WAAW;EACXC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAG,IAAAC,eAAQ,EAAgB,EAAE,CAAC;EAE3D,MAAMC,eAAe,GAAG,IAAAC,kBAAW,EAAC,YAA2B;IAC7D,IAAI,CAACd,eAAe,IAAI,CAACC,UAAU,IAAI,CAACE,WAAW,CAACY,cAAc,CAAC,CAAC,EAAE;MACpEJ,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMK,IAAI,GAAG,MAAMb,WAAW,CAACc,YAAY,CAAC,CAAC;MAC7CN,WAAW,CAACK,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ,IAAI,IAAAC,uCAAoB,EAACD,GAAG,CAAC,EAAE;QAC7BP,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACW,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXC,YAAU,CAACC,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEN,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAAClB,eAAe,EAAEG,WAAW,EAAEF,UAAU,EAAEQ,oBAAoB,CAAC,CAAC;EAEpE,IAAAgB,gBAAS,EAAC,MAAM;IACd,IAAIzB,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAChDY,eAAe,CAAC,CAAC;MACjB,KAAKL,0BAA0B,CAACY,OAAO,EAAEM,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAAC1B,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEY,eAAe,EAAEL,0BAA0B,CAAC,CAAC;EAE3F,MAAMmB,+BAA+B,GAAG,IAAAb,kBAAW,EAAC,YAA2B;IAC7E,IAAAc,kDAAwB,EAAC,CAAC;IAC1B;IACA;IACA;IACArB,WAAW,CAACsB,aAAa,CAAC;MAAEC,QAAQ,EAAE,CAACC,kDAA6B;IAAE,CAAC,CAAC;IACxE,MAAMlB,eAAe,CAAC,CAAC;IACvBN,WAAW,CAACyB,iBAAiB,CAAC,CAAC;EACjC,CAAC,EAAE,CAACnB,eAAe,EAAEN,WAAW,CAAC,CAAC;EAElC,MAAM0B,eAAe,GAAG,IAAAnB,kBAAW,EACjC,MAAOoB,SAAiB,IAAoB;IAC1C,MAAMC,WAAW,GAAG/B,aAAa,CAACgC,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAEzB,QAAQ,CAAC2B,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACJ,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAM9B,aAAa,CAACmC,aAAa,CAACL,SAAS,CAAC;MAC5C,MAAM7B,cAAc,CAAC,CAAC;MACtB,MAAMsB,+BAA+B,CAAC,CAAC;MACvC;IACF;IAEA,MAAMa,MAAM,GAAG,MAAMrC,WAAW,CAAC8B,eAAe,CAACC,SAAS,CAAC;IAC3D,IAAI,CAACM,MAAM,EAAEC,IAAI,IAAI,CAACD,MAAM,EAAEE,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAMrC,aAAa,CACjB;MACEoC,SAAS,EAAEF,MAAM,CAACE,SAAS;MAC3BE,WAAW,EAAEJ,MAAM,CAACI,WAAW;MAC/BC,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACC,IAAI,CAACQ,EAAE;MACtBR,IAAI,EAAED,MAAM,CAACC;IACf,CAAC;IACD;IACA;IACA;MAAES,QAAQ,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAM,CACnC,CAAC;IACD,MAAMxB,+BAA+B,CAAC,CAAC;EACzC,CAAC,EACD,CAACxB,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,EAAEqB,+BAA+B,CAC7F,CAAC;EAED,MAAMyB,aAAa,GAAG,IAAAtC,kBAAW,EAC/B,MAAOuC,IAAwB,IAA2B;IACxD,MAAMf,OAAO,GAAG,MAAMnC,WAAW,CAACiD,aAAa,CAACC,IAAI,CAAC;IACrD,MAAMxC,eAAe,CAAC,CAAC;IACvB,OAAOyB,OAAO;EAChB,CAAC,EACD,CAACnC,WAAW,EAAEU,eAAe,CAC/B,CAAC;EAED,OAAO;IACLH,QAAQ;IACRG,eAAe;IACfoB,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_react","require","_core","_oxyContextHelpers","_resetSessionScopedStores","_useResolvedFileUrls","_index","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","identityBound","oxyServices","sessionClient","syncFromClient","commitSession","queryClient","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","useState","refreshAccounts","useCallback","getAccessToken","list","listAccounts","err","isUnauthorizedStatus","current","__DEV__","loggerUtil","debug","component","useEffect","refresh","runPostAccountSwitchSideEffects","resetSessionScopedStores","removeQueries","queryKey","ASSET_DOWNLOAD_URLS_QUERY_KEY","invalidateQueries","switchToAccount","accountId","IdentityBoundSessionError","deviceState","getState","some","account","switchAccount","result","user","sessionId","Error","accessToken","deviceSecret","deviceId","expiresAt","userId","id","activate","hubSync","createAccount","data"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,yBAAA,GAAAH,OAAA;AACA,IAAAI,oBAAA,GAAAJ,OAAA;AACA,IAAAK,MAAA,GAAAL,OAAA;AAsBO,SAASM,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,aAAa;EACbC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,WAAW;EACXC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAG,IAAAC,eAAQ,EAAgB,EAAE,CAAC;EAE3D,MAAMC,eAAe,GAAG,IAAAC,kBAAW,EAAC,YAA2B;IAC7D,IAAIZ,aAAa,IAAI,CAACH,eAAe,IAAI,CAACC,UAAU,IAAI,CAACG,WAAW,CAACY,cAAc,CAAC,CAAC,EAAE;MACrFJ,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMK,IAAI,GAAG,MAAMb,WAAW,CAACc,YAAY,CAAC,CAAC;MAC7CN,WAAW,CAACK,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ,IAAI,IAAAC,uCAAoB,EAACD,GAAG,CAAC,EAAE;QAC7BP,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACW,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXC,YAAU,CAACC,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEN,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAAChB,aAAa,EAAEH,eAAe,EAAEI,WAAW,EAAEH,UAAU,EAAES,oBAAoB,CAAC,CAAC;EAEnF,IAAAgB,gBAAS,EAAC,MAAM;IACd,IAAI,CAACvB,aAAa,IAAIH,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAClEa,eAAe,CAAC,CAAC;MACjB,KAAKL,0BAA0B,CAACY,OAAO,EAAEM,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACxB,aAAa,EAAEH,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEa,eAAe,EAAEL,0BAA0B,CAAC,CAAC;EAE1G,MAAMmB,+BAA+B,GAAG,IAAAb,kBAAW,EAAC,YAA2B;IAC7E,IAAAc,kDAAwB,EAAC,CAAC;IAC1B;IACA;IACA;IACArB,WAAW,CAACsB,aAAa,CAAC;MAAEC,QAAQ,EAAE,CAACC,kDAA6B;IAAE,CAAC,CAAC;IACxE,MAAMlB,eAAe,CAAC,CAAC;IACvBN,WAAW,CAACyB,iBAAiB,CAAC,CAAC;EACjC,CAAC,EAAE,CAACnB,eAAe,EAAEN,WAAW,CAAC,CAAC;EAElC,MAAM0B,eAAe,GAAG,IAAAnB,kBAAW,EACjC,MAAOoB,SAAiB,IAAoB;IAC1C,IAAIhC,aAAa,EAAE;MACjB;MACA;MACA;MACA,MAAM,IAAIiC,gCAAyB,CAAC,iBAAiB,CAAC;IACxD;IACA,MAAMC,WAAW,GAAGhC,aAAa,CAACiC,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAE1B,QAAQ,CAAC4B,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACL,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAM9B,aAAa,CAACoC,aAAa,CAACN,SAAS,CAAC;MAC5C,MAAM7B,cAAc,CAAC,CAAC;MACtB,MAAMsB,+BAA+B,CAAC,CAAC;MACvC;IACF;IAEA,MAAMc,MAAM,GAAG,MAAMtC,WAAW,CAAC8B,eAAe,CAACC,SAAS,CAAC;IAC3D,IAAI,CAACO,MAAM,EAAEC,IAAI,IAAI,CAACD,MAAM,EAAEE,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAMtC,aAAa,CACjB;MACEqC,SAAS,EAAEF,MAAM,CAACE,SAAS;MAC3BE,WAAW,EAAEJ,MAAM,CAACI,WAAW;MAC/BC,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACC,IAAI,CAACQ,EAAE;MACtBR,IAAI,EAAED,MAAM,CAACC;IACf,CAAC;IACD;IACA;IACA;MAAES,QAAQ,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAM,CACnC,CAAC;IACD,MAAMzB,+BAA+B,CAAC,CAAC;EACzC,CAAC,EACD,CAACzB,aAAa,EAAEC,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,EAAEqB,+BAA+B,CAC5G,CAAC;EAED,MAAM0B,aAAa,GAAG,IAAAvC,kBAAW,EAC/B,MAAOwC,IAAwB,IAA2B;IACxD,MAAMf,OAAO,GAAG,MAAMpC,WAAW,CAACkD,aAAa,CAACC,IAAI,CAAC;IACrD,MAAMzC,eAAe,CAAC,CAAC;IACvB,OAAO0B,OAAO;EAChB,CAAC,EACD,CAACpC,WAAW,EAAEU,eAAe,CAC/B,CAAC;EAED,OAAO;IACLH,QAAQ;IACRG,eAAe;IACfoB,eAAe;IACfoB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/hooks/useSwitchableAccounts.js

@@ -22,7 +22,12 @@ const EMPTY_SNAPSHOT = {
     authorizeCode: null,
     qrPayload: null,
     expiresAt: null,
-    error: null
+    error: null,
+    route: null,
+    routeFailed: false,
+    pushSentAt: null,
+    openedAt: null,
+    progress: 'idle'
   },
   commonsAvailability: 'unknown'
 };

package/lib/commonjs/ui/hooks/useSwitchableAccounts.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","_OxyContext","EMPTY_SNAPSHOT","view","accounts","activeAccountId","loading","error","switchingAccountId","signIn","phase","authorizeCode","qrPayload","expiresAt","commonsAvailability","useSwitchableAccounts","accountDialogController","controller","useOxy","subscribe","useCallback","listener","undefined","getSnapshot","snapshot","useSyncExternalStore","currentSessionId","useMemo","active","find","account","accountId","sessionId","isLoading"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSwitchableAccounts.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAEA,IAAAC,WAAA,GAAAD,OAAA;AAWA;AACA;AACA;AACA;AACA,MAAME,cAAqC,GAAG;EAC1CC,IAAI,EAAE,UAAU;EAChBC,QAAQ,EAAE,EAAE;EACZC,eAAe,EAAE,IAAI;EACrBC,OAAO,EAAE,KAAK;EACdC,KAAK,EAAE,IAAI;EACXC,kBAAkB,EAAE,IAAI;EACxBC,MAAM,EAAE;IAAEC,KAAK,EAAE,MAAM;IAAEC,aAAa,EAAE,IAAI;IAAEC,SAAS,EAAE,IAAI;IAAEC,SAAS,EAAE,IAAI;IAAEN,KAAK,EAAE;EAAK,CAAC;EAC7FO,mBAAmB,EAAE;AACzB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,qBAAqBA,CAAA,EAAgC;EACjE,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EAExD,MAAMC,SAAS,GAAG,IAAAC,kBAAW,EACxBC,QAAoB,IAAMJ,UAAU,GAAGA,UAAU,CAACE,SAAS,CAACE,QAAQ,CAAC,GAAG,MAAMC,SAAU,EACzF,CAACL,UAAU,CACf,CAAC;EACD,MAAMM,WAAW,GAAG,IAAAH,kBAAW,EAC3B,MAAOH,UAAU,GAAGA,UAAU,CAACM,WAAW,CAAC,CAAC,GAAGrB,cAAe,EAC9D,CAACe,UAAU,CACf,CAAC;EACD,MAAMO,QAAQ,GAAG,IAAAC,2BAAoB,EAACN,SAAS,EAAEI,WAAW,EAAEA,WAAW,CAAC;EAE1E,MAAMG,gBAAgB,GAAG,IAAAC,cAAO,EAAgB,MAAM;IAClD,MAAMC,MAAM,GAAGJ,QAAQ,CAACpB,QAAQ,CAACyB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,SAAS,KAAKP,QAAQ,CAACnB,eAAe,CAAC;IAClG,OAAOuB,MAAM,EAAEI,SAAS,IAAI,IAAI;EACpC,CAAC,EAAE,CAACR,QAAQ,CAAC,CAAC;EAEd,OAAO;IACHpB,QAAQ,EAAEoB,QAAQ,CAACpB,QAAQ;IAC3B6B,SAAS,EAAET,QAAQ,CAAClB,OAAO;IAC3BoB;EACJ,CAAC;AACL","ignoreList":[]}
+{"version":3,"names":["_react","require","_OxyContext","EMPTY_SNAPSHOT","view","accounts","activeAccountId","loading","error","switchingAccountId","signIn","phase","authorizeCode","qrPayload","expiresAt","route","routeFailed","pushSentAt","openedAt","progress","commonsAvailability","useSwitchableAccounts","accountDialogController","controller","useOxy","subscribe","useCallback","listener","undefined","getSnapshot","snapshot","useSyncExternalStore","currentSessionId","useMemo","active","find","account","accountId","sessionId","isLoading"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSwitchableAccounts.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAEA,IAAAC,WAAA,GAAAD,OAAA;AAWA;AACA;AACA;AACA;AACA,MAAME,cAAqC,GAAG;EAC1CC,IAAI,EAAE,UAAU;EAChBC,QAAQ,EAAE,EAAE;EACZC,eAAe,EAAE,IAAI;EACrBC,OAAO,EAAE,KAAK;EACdC,KAAK,EAAE,IAAI;EACXC,kBAAkB,EAAE,IAAI;EACxBC,MAAM,EAAE;IACJC,KAAK,EAAE,MAAM;IACbC,aAAa,EAAE,IAAI;IACnBC,SAAS,EAAE,IAAI;IACfC,SAAS,EAAE,IAAI;IACfN,KAAK,EAAE,IAAI;IACXO,KAAK,EAAE,IAAI;IACXC,WAAW,EAAE,KAAK;IAClBC,UAAU,EAAE,IAAI;IAChBC,QAAQ,EAAE,IAAI;IACdC,QAAQ,EAAE;EACd,CAAC;EACDC,mBAAmB,EAAE;AACzB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,qBAAqBA,CAAA,EAAgC;EACjE,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EAExD,MAAMC,SAAS,GAAG,IAAAC,kBAAW,EACxBC,QAAoB,IAAMJ,UAAU,GAAGA,UAAU,CAACE,SAAS,CAACE,QAAQ,CAAC,GAAG,MAAMC,SAAU,EACzF,CAACL,UAAU,CACf,CAAC;EACD,MAAMM,WAAW,GAAG,IAAAH,kBAAW,EAC3B,MAAOH,UAAU,GAAGA,UAAU,CAACM,WAAW,CAAC,CAAC,GAAG1B,cAAe,EAC9D,CAACoB,UAAU,CACf,CAAC;EACD,MAAMO,QAAQ,GAAG,IAAAC,2BAAoB,EAACN,SAAS,EAAEI,WAAW,EAAEA,WAAW,CAAC;EAE1E,MAAMG,gBAAgB,GAAG,IAAAC,cAAO,EAAgB,MAAM;IAClD,MAAMC,MAAM,GAAGJ,QAAQ,CAACzB,QAAQ,CAAC8B,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,SAAS,KAAKP,QAAQ,CAACxB,eAAe,CAAC;IAClG,OAAO4B,MAAM,EAAEI,SAAS,IAAI,IAAI;EACpC,CAAC,EAAE,CAACR,QAAQ,CAAC,CAAC;EAEd,OAAO;IACHzB,QAAQ,EAAEyB,QAAQ,CAACzB,QAAQ;IAC3BkC,SAAS,EAAET,QAAQ,CAACvB,OAAO;IAC3ByB;EACJ,CAAC;AACL","ignoreList":[]}

package/lib/commonjs/ui/index.js

@@ -27,12 +27,6 @@ Object.defineProperty(exports, "FollowButton", {
     return _FollowButton.default;
   }
 });
-Object.defineProperty(exports, "FontLoader", {
-  enumerable: true,
-  get: function () {
-    return _FontLoader.FontLoader;
-  }
-});
 Object.defineProperty(exports, "LogoIcon", {
   enumerable: true,
   get: function () {
@@ -117,12 +111,6 @@ Object.defineProperty(exports, "isTimeoutOrNetworkError", {
     return _errorHandlers.isTimeoutOrNetworkError;
   }
 });
-Object.defineProperty(exports, "setupFonts", {
-  enumerable: true,
-  get: function () {
-    return _FontLoader.setupFonts;
-  }
-});
 Object.defineProperty(exports, "useAccountStore", {
   enumerable: true,
   get: function () {
@@ -173,7 +161,6 @@ var _LogoText = require("./components/logo/LogoText.js");
 var _RequireOxyAuth = require("./components/RequireOxyAuth.js");
 var _FollowButton = _interopRequireDefault(require("./components/FollowButton.js"));
 var _OxyPayButton = _interopRequireDefault(require("./components/OxyPayButton.js"));
-var _FontLoader = require("./components/FontLoader");
 var _ProfileButton = _interopRequireDefault(require("./components/ProfileButton.js"));
 var _OxyContext = require("./context/OxyContext.js");
 var _useAuth = require("./hooks/useAuth.js");

package/lib/commonjs/ui/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_OxyProvider","_interopRequireDefault","require","_OxySignInButton","_OxyAuthPrompt","_LogoIcon","_LogoText","_RequireOxyAuth","_FollowButton","_OxyPayButton","_FontLoader","_ProfileButton","_OxyContext","_useAuth","_useFollow","_useStorage","_ProfileScreen","_ManageAccountScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_authStore","_accountStore","_errorHandlers","e","__esModule","default"],"sourceRoot":"../../../src","sources":["ui/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,cAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,SAAA,GAAAH,OAAA;AACA,IAAAI,SAAA,GAAAJ,OAAA;AACA,IAAAK,eAAA,GAAAL,OAAA;AAEA,IAAAM,aAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,aAAA,GAAAR,sBAAA,CAAAC,OAAA;AACA,IAAAQ,WAAA,GAAAR,OAAA;AACA,IAAAS,cAAA,GAAAV,sBAAA,CAAAC,OAAA;AAGA,IAAAU,WAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAIA,IAAAc,cAAA,GAAAf,sBAAA,CAAAC,OAAA;AACA,IAAAe,oBAAA,GAAAhB,sBAAA,CAAAC,OAAA;AACA,IAAAgB,oBAAA,GAAAjB,sBAAA,CAAAC,OAAA;AACA,IAAAiB,qBAAA,GAAAlB,sBAAA,CAAAC,OAAA;AACA,IAAAkB,sBAAA,GAAAnB,sBAAA,CAAAC,OAAA;AAGA,IAAAmB,UAAA,GAAAnB,OAAA;AACA,IAAAoB,aAAA,GAAApB,OAAA;AAGA,IAAAqB,cAAA,GAAArB,OAAA;AAK+B,SAAAD,uBAAAuB,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA","ignoreList":[]}
+{"version":3,"names":["_OxyProvider","_interopRequireDefault","require","_OxySignInButton","_OxyAuthPrompt","_LogoIcon","_LogoText","_RequireOxyAuth","_FollowButton","_OxyPayButton","_ProfileButton","_OxyContext","_useAuth","_useFollow","_useStorage","_ProfileScreen","_ManageAccountScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_authStore","_accountStore","_errorHandlers","e","__esModule","default"],"sourceRoot":"../../../src","sources":["ui/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,cAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,SAAA,GAAAH,OAAA;AACA,IAAAI,SAAA,GAAAJ,OAAA;AACA,IAAAK,eAAA,GAAAL,OAAA;AAEA,IAAAM,aAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,aAAA,GAAAR,sBAAA,CAAAC,OAAA;AACA,IAAAQ,cAAA,GAAAT,sBAAA,CAAAC,OAAA;AAGA,IAAAS,WAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AACA,IAAAW,UAAA,GAAAX,OAAA;AACA,IAAAY,WAAA,GAAAZ,OAAA;AAIA,IAAAa,cAAA,GAAAd,sBAAA,CAAAC,OAAA;AACA,IAAAc,oBAAA,GAAAf,sBAAA,CAAAC,OAAA;AACA,IAAAe,oBAAA,GAAAhB,sBAAA,CAAAC,OAAA;AACA,IAAAgB,qBAAA,GAAAjB,sBAAA,CAAAC,OAAA;AACA,IAAAiB,sBAAA,GAAAlB,sBAAA,CAAAC,OAAA;AAGA,IAAAkB,UAAA,GAAAlB,OAAA;AACA,IAAAmB,aAAA,GAAAnB,OAAA;AAGA,IAAAoB,cAAA,GAAApB,OAAA;AAK+B,SAAAD,uBAAAsB,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA","ignoreList":[]}

package/lib/commonjs/ui/oauth/browserAuthTransport.js

@@ -0,0 +1,170 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.startWebOAuthSignIn = startWebOAuthSignIn;
+var _core = require("@oxyhq/core");
+var _oauthNavigation = require("../components/oauthNavigation.js");
+var _isWebBrowser = require("../utils/isWebBrowser.js");
+var _completeOAuthCode = require("./completeOAuthCode.js");
+var _oauthHandshake = require("./oauthHandshake.js");
+var _oauthPopup = require("./oauthPopup.js");
+/**
+ * The single web entry point for third-party "Sign in with Oxy".
+ *
+ * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
+ * result — so callers (`OxySignInButton`, and any RP with its own button) never
+ * touch `window.open`, `postMessage`, or the token exchange themselves.
+ *
+ * Popup mode keeps the relying party mounted: its route, scroll position, and
+ * unsaved state survive because the tab never navigates. Redirect mode is the
+ * compatibility fallback, and is also where popup mode lands when the browser
+ * blocks the window — a blocked popup must still sign the user in, not dead-end.
+ *
+ * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
+ * remains the native lane and is untouched by this module.
+ */
+
+/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
+
+/** Per-press inputs for {@link startWebOAuthSignIn}. */
+
+async function startWebOAuthSignIn(context, options) {
+  if (!(0, _isWebBrowser.isWebBrowser)()) {
+    (0, _oauthPopup.closeOAuthPopup)(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'no-browser'
+    };
+  }
+  if (context.identityBound) {
+    (0, _oauthPopup.closeOAuthPopup)(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'identity-bound'
+    };
+  }
+  if (!context.clientId) {
+    (0, _oauthPopup.closeOAuthPopup)(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'missing-client-id'
+    };
+  }
+
+  // Claim the window BEFORE the first `await` below, so a caller that invoked us
+  // straight from the click still has gesture attribution. An explicit `null`
+  // means the caller already tried and was blocked.
+  const popup = context.mode === 'popup' && options.popup === undefined ? (0, _oauthPopup.openOAuthPopup)() : options.popup ?? null;
+  if (context.mode === 'redirect') {
+    (0, _oauthPopup.closeOAuthPopup)(popup);
+    return startRedirectSignIn(context, options, 'redirect-mode');
+  }
+  if (!popup) {
+    _core.logger.warn('OAuth sign-in popup was blocked; falling back to a full-page redirect', {
+      component: 'browserAuthTransport'
+    });
+    return startRedirectSignIn(context, options, 'popup-blocked');
+  }
+  try {
+    const prepared = await (0, _oauthHandshake.prepareAuthorizeRequest)({
+      clientId: context.clientId,
+      redirectUri: options.redirectUri,
+      authorizeBaseUrl: context.authorizeBaseUrl,
+      scope: options.scope,
+      responseMode: 'web_message'
+    });
+    if (!(0, _oauthPopup.navigateOAuthPopup)(popup, prepared.authorizeUrl)) {
+      return startRedirectSignIn(context, options, 'popup-navigation-failed');
+    }
+    const outcome = await (0, _oauthPopup.awaitOAuthPopupResult)({
+      popup,
+      expectedOrigin: prepared.authorizeOrigin,
+      expectedState: prepared.handshake.state,
+      redirectUri: options.redirectUri,
+      ...(options.timeoutMs !== undefined ? {
+        timeoutMs: options.timeoutMs
+      } : {})
+    });
+    switch (outcome.kind) {
+      case 'code':
+        {
+          const completion = await (0, _completeOAuthCode.completeOAuthCode)({
+            oxyServices: context.oxyServices,
+            clientId: context.clientId,
+            code: outcome.code,
+            returnedState: outcome.state,
+            handshake: prepared.handshake,
+            redirectUri: options.redirectUri,
+            commitSession: context.commitSession
+          });
+          return completion.ok ? {
+            status: 'signed-in'
+          } : {
+            status: 'failed',
+            reason: completion.reason
+          };
+        }
+      case 'oauth-error':
+        return {
+          status: 'failed',
+          reason: 'idp-error',
+          description: outcome.errorDescription ?? outcome.error
+        };
+      case 'state-mismatch':
+        return {
+          status: 'failed',
+          reason: 'state-mismatch'
+        };
+      case 'closed':
+        return {
+          status: 'cancelled'
+        };
+      case 'timed-out':
+        return {
+          status: 'timed-out'
+        };
+      case 'unsupported':
+        return {
+          status: 'unsupported',
+          reason: 'no-browser'
+        };
+    }
+  } finally {
+    // Covers throws after open (prepare/exchange/commit) and every settled outcome.
+    (0, _oauthPopup.closeOAuthPopup)(popup);
+  }
+}
+
+/**
+ * Full-page hand-off to the IdP. The document is destroyed by the navigation, so
+ * the handshake MUST reach `sessionStorage` first — without it the return trip
+ * cannot validate `state`, and starting the redirect anyway would strand the
+ * user at a callback that can only refuse them.
+ */
+async function startRedirectSignIn(context, options, via) {
+  // Narrowed by the caller; repeated here so this helper is safe on its own.
+  if (!context.clientId) return {
+    status: 'unsupported',
+    reason: 'missing-client-id'
+  };
+  const prepared = await (0, _oauthHandshake.prepareAuthorizeRequest)({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope
+  });
+  if (!(0, _core.persistOAuthHandshake)(prepared.handshake.state, prepared.handshake.codeVerifier, options.redirectUri)) {
+    return {
+      status: 'failed',
+      reason: 'handshake-storage'
+    };
+  }
+  (0, _oauthNavigation.redirectToAuthorize)(prepared.authorizeUrl);
+  return {
+    status: 'redirecting',
+    via
+  };
+}
+//# sourceMappingURL=browserAuthTransport.js.map

package/lib/commonjs/ui/oauth/browserAuthTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","_oauthNavigation","_isWebBrowser","_completeOAuthCode","_oauthHandshake","_oauthPopup","startWebOAuthSignIn","context","options","isWebBrowser","closeOAuthPopup","popup","status","reason","identityBound","clientId","mode","undefined","openOAuthPopup","startRedirectSignIn","logger","warn","component","prepared","prepareAuthorizeRequest","redirectUri","authorizeBaseUrl","scope","responseMode","navigateOAuthPopup","authorizeUrl","outcome","awaitOAuthPopupResult","expectedOrigin","authorizeOrigin","expectedState","handshake","state","timeoutMs","kind","completion","completeOAuthCode","oxyServices","code","returnedState","commitSession","ok","description","errorDescription","error","via","persistOAuthHandshake","codeVerifier","redirectToAuthorize"],"sourceRoot":"../../../../src","sources":["ui/oauth/browserAuthTransport.ts"],"mappings":";;;;;;AAgBA,IAAAA,KAAA,GAAAC,OAAA;AAEA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,kBAAA,GAAAH,OAAA;AACA,IAAAI,eAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AAtBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAiBA;;AAeA;;AAwBO,eAAeM,mBAAmBA,CACvCC,OAAiC,EACjCC,OAAmC,EACJ;EAC/B,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE;IACnB,IAAAC,2BAAe,EAACF,OAAO,CAACG,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAa,CAAC;EACxD;EACA,IAAIN,OAAO,CAACO,aAAa,EAAE;IACzB,IAAAJ,2BAAe,EAACF,OAAO,CAACG,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAC5D;EACA,IAAI,CAACN,OAAO,CAACQ,QAAQ,EAAE;IACrB,IAAAL,2BAAe,EAACF,OAAO,CAACG,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC/D;;EAEA;EACA;EACA;EACA,MAAMF,KAAK,GACTJ,OAAO,CAACS,IAAI,KAAK,OAAO,IAAIR,OAAO,CAACG,KAAK,KAAKM,SAAS,GAAG,IAAAC,0BAAc,EAAC,CAAC,GAAGV,OAAO,CAACG,KAAK,IAAI,IAAI;EAEpG,IAAIJ,OAAO,CAACS,IAAI,KAAK,UAAU,EAAE;IAC/B,IAAAN,2BAAe,EAACC,KAAK,CAAC;IACtB,OAAOQ,mBAAmB,CAACZ,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EACA,IAAI,CAACG,KAAK,EAAE;IACVS,YAAM,CAACC,IAAI,CAAC,uEAAuE,EAAE;MACnFC,SAAS,EAAE;IACb,CAAC,CAAC;IACF,OAAOH,mBAAmB,CAACZ,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EAEA,IAAI;IACF,MAAMe,QAAQ,GAAG,MAAM,IAAAC,uCAAuB,EAAC;MAC7CT,QAAQ,EAAER,OAAO,CAACQ,QAAQ;MAC1BU,WAAW,EAAEjB,OAAO,CAACiB,WAAW;MAChCC,gBAAgB,EAAEnB,OAAO,CAACmB,gBAAgB;MAC1CC,KAAK,EAAEnB,OAAO,CAACmB,KAAK;MACpBC,YAAY,EAAE;IAChB,CAAC,CAAC;IAEF,IAAI,CAAC,IAAAC,8BAAkB,EAAClB,KAAK,EAAEY,QAAQ,CAACO,YAAY,CAAC,EAAE;MACrD,OAAOX,mBAAmB,CAACZ,OAAO,EAAEC,OAAO,EAAE,yBAAyB,CAAC;IACzE;IAEA,MAAMuB,OAAO,GAAG,MAAM,IAAAC,iCAAqB,EAAC;MAC1CrB,KAAK;MACLsB,cAAc,EAAEV,QAAQ,CAACW,eAAe;MACxCC,aAAa,EAAEZ,QAAQ,CAACa,SAAS,CAACC,KAAK;MACvCZ,WAAW,EAAEjB,OAAO,CAACiB,WAAW;MAChC,IAAIjB,OAAO,CAAC8B,SAAS,KAAKrB,SAAS,GAAG;QAAEqB,SAAS,EAAE9B,OAAO,CAAC8B;MAAU,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,QAAQP,OAAO,CAACQ,IAAI;MAClB,KAAK,MAAM;QAAE;UACX,MAAMC,UAAU,GAAG,MAAM,IAAAC,oCAAiB,EAAC;YACzCC,WAAW,EAAEnC,OAAO,CAACmC,WAAW;YAChC3B,QAAQ,EAAER,OAAO,CAACQ,QAAQ;YAC1B4B,IAAI,EAAEZ,OAAO,CAACY,IAAI;YAClBC,aAAa,EAAEb,OAAO,CAACM,KAAK;YAC5BD,SAAS,EAAEb,QAAQ,CAACa,SAAS;YAC7BX,WAAW,EAAEjB,OAAO,CAACiB,WAAW;YAChCoB,aAAa,EAAEtC,OAAO,CAACsC;UACzB,CAAC,CAAC;UACF,OAAOL,UAAU,CAACM,EAAE,GAChB;YAAElC,MAAM,EAAE;UAAY,CAAC,GACvB;YAAEA,MAAM,EAAE,QAAQ;YAAEC,MAAM,EAAE2B,UAAU,CAAC3B;UAAO,CAAC;QACrD;MACA,KAAK,aAAa;QAChB,OAAO;UACLD,MAAM,EAAE,QAAQ;UAChBC,MAAM,EAAE,WAAW;UACnBkC,WAAW,EAAEhB,OAAO,CAACiB,gBAAgB,IAAIjB,OAAO,CAACkB;QACnD,CAAC;MACH,KAAK,gBAAgB;QACnB,OAAO;UAAErC,MAAM,EAAE,QAAQ;UAAEC,MAAM,EAAE;QAAiB,CAAC;MACvD,KAAK,QAAQ;QACX,OAAO;UAAED,MAAM,EAAE;QAAY,CAAC;MAChC,KAAK,WAAW;QACd,OAAO;UAAEA,MAAM,EAAE;QAAY,CAAC;MAChC,KAAK,aAAa;QAChB,OAAO;UAAEA,MAAM,EAAE,aAAa;UAAEC,MAAM,EAAE;QAAa,CAAC;IAC1D;EACF,CAAC,SAAS;IACR;IACA,IAAAH,2BAAe,EAACC,KAAK,CAAC;EACxB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeQ,mBAAmBA,CAChCZ,OAAiC,EACjCC,OAAmC,EACnC0C,GAA2B,EACI;EAC/B;EACA,IAAI,CAAC3C,OAAO,CAACQ,QAAQ,EAAE,OAAO;IAAEH,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAoB,CAAC;EAEpF,MAAMU,QAAQ,GAAG,MAAM,IAAAC,uCAAuB,EAAC;IAC7CT,QAAQ,EAAER,OAAO,CAACQ,QAAQ;IAC1BU,WAAW,EAAEjB,OAAO,CAACiB,WAAW;IAChCC,gBAAgB,EAAEnB,OAAO,CAACmB,gBAAgB;IAC1CC,KAAK,EAAEnB,OAAO,CAACmB;EACjB,CAAC,CAAC;EAEF,IAAI,CAAC,IAAAwB,2BAAqB,EACxB5B,QAAQ,CAACa,SAAS,CAACC,KAAK,EACxBd,QAAQ,CAACa,SAAS,CAACgB,YAAY,EAC/B5C,OAAO,CAACiB,WACV,CAAC,EAAE;IACD,OAAO;MAAEb,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC1D;EAEA,IAAAwC,oCAAmB,EAAC9B,QAAQ,CAACO,YAAY,CAAC;EAC1C,OAAO;IAAElB,MAAM,EAAE,aAAa;IAAEsC;EAAI,CAAC;AACvC","ignoreList":[]}

package/lib/commonjs/ui/oauth/completeOAuthCode.js

@@ -0,0 +1,78 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.completeOAuthCode = completeOAuthCode;
+var _core = require("@oxyhq/core");
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+
+/** Inputs for {@link completeOAuthCode}. */
+
+async function completeOAuthCode(input) {
+  let cleaned = false;
+  const runCleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    input.cleanup?.();
+  };
+  if (!input.handshake || !input.returnedState || input.handshake.state !== input.returnedState) {
+    _core.logger.warn('OAuth completion rejected: missing or mismatched state', {
+      component: 'completeOAuthCode'
+    });
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'state-mismatch'
+    };
+  }
+  try {
+    const result = await input.oxyServices.exchangeOAuthCode({
+      code: input.code,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      codeVerifier: input.handshake.codeVerifier
+    });
+    runCleanup();
+    await input.commitSession({
+      sessionId: result.sessionId,
+      accessToken: result.accessToken,
+      deviceId: result.deviceId,
+      deviceSecret: result.deviceSecret,
+      userId: result.user.id,
+      expiresAt: result.expiresAt,
+      user: result.user
+    });
+    return {
+      ok: true
+    };
+  } catch (error) {
+    _core.logger.warn('OAuth code exchange failed', {
+      component: 'completeOAuthCode'
+    }, error);
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'exchange-failed'
+    };
+  }
+}
+//# sourceMappingURL=completeOAuthCode.js.map

package/lib/commonjs/ui/oauth/completeOAuthCode.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","logger","warn","component","ok","reason","result","oxyServices","exchangeOAuthCode","code","clientId","redirectUri","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;;;;;AAqBA,IAAAA,KAAA,GAAAC,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AA2BO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FE,YAAM,CAACC,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFP,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMZ,KAAK,CAACa,WAAW,CAACC,iBAAiB,CAAC;MACvDC,IAAI,EAAEf,KAAK,CAACe,IAAI;MAChBC,QAAQ,EAAEhB,KAAK,CAACgB,QAAQ;MACxBC,WAAW,EAAEjB,KAAK,CAACiB,WAAW;MAC9BC,YAAY,EAAElB,KAAK,CAACI,SAAS,CAACc;IAChC,CAAC,CAAC;IACFhB,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACmB,aAAa,CAAC;MACxBC,SAAS,EAAER,MAAM,CAACQ,SAAS;MAC3BC,WAAW,EAAET,MAAM,CAACS,WAAW;MAC/BC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;MACzBC,YAAY,EAAEX,MAAM,CAACW,YAAY;MACjCC,MAAM,EAAEZ,MAAM,CAACa,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEf,MAAM,CAACe,SAAS;MAC3BF,IAAI,EAAEb,MAAM,CAACa;IACf,CAAC,CAAC;IACF,OAAO;MAAEf,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOkB,KAAK,EAAE;IACdrB,YAAM,CAACC,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEmB,KAAK,CAAC;IACpF1B,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}