@oxyhq/services 22.12.5 → 22.13.0

package/lib/module/ui/session/identityBinding.js

@@ -0,0 +1,89 @@
+"use strict";
+
+/**
+ * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
+ *
+ * `@oxyhq/core` owns everything platform-agnostic about an identity-bound
+ * session: the pin store shapes, `resolveIdentityPin`,
+ * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
+ * deliberately leaves out is WHICH pin store a given runtime should use, so this
+ * module supplies it — web `localStorage` vs the same native SecureStore adapter
+ * the device credential already persists through — and adds the one piece of
+ * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
+ * account id.
+ *
+ * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
+ * on the socket/apply path, while resolving the pin is asynchronous (a storage
+ * read plus a keychain read, through `resolveIdentityPin`). The provider
+ * resolves it before the cold boot and after every (re-)established identity
+ * session; every read after that is free.
+ */
+import { createNativeIdentityPinStore, createWebIdentityPinStore, resolveIdentityPin } from '@oxyhq/core';
+import { isReactNative } from "../utils/storageHelpers.js";
+import { createNativeSecureKeyValueStorage } from "./nativeSecureStorage.js";
+
+/**
+ * The provider-scoped identity binding: the core {@link IdentityBinding} handed
+ * to the cold boot and the re-mint handler, plus the resolved pin the projection
+ * and `SessionClient` bind to.
+ */
+
+/**
+ * Thrown by every account-graph mutation while the provider runs in
+ * `sessionMode: 'identity'`.
+ *
+ * An identity-bound app's user is the owner of the local identity key — fixed,
+ * for the lifetime of that key. Switching it is not a temporarily-unavailable
+ * operation that could be retried, it is not part of this mode's contract at
+ * all, so the surfaces reject loudly rather than resolving to a no-op that would
+ * read to the caller as a successful switch.
+ */
+export class IdentityBoundSessionError extends Error {
+  name = 'IdentityBoundSessionError';
+  code = 'identity_bound_session';
+  constructor(operation) {
+    super(`"${operation}" is unavailable while the session is identity-bound (sessionMode: "identity"): this app authenticates as the owner of the local identity key and cannot switch accounts.`);
+    this.operation = operation;
+  }
+}
+
+/**
+ * Build the identity binding for this runtime. Called ONCE per provider mount,
+ * and ONLY when `sessionMode: 'identity'` — account-mode providers never
+ * construct a pin store.
+ */
+export function createIdentitySessionBinding() {
+  const pinStore = isReactNative() ? createNativeIdentityPinStore(createNativeSecureKeyValueStorage()) : createWebIdentityPinStore();
+  const binding = {
+    pinStore
+  };
+
+  // Only a RESOLVED (non-null) pin is memoised. A `null` outcome is either "not
+  // pinned yet" or an indeterminate key read (locked keychain), and caching
+  // either one would leave this client permanently unpinned for the rest of the
+  // process — the exact state in which it would start following the device's
+  // mutable active account.
+  let pinnedAccountId = null;
+  let inFlight = null;
+  const resolve = () => {
+    if (!inFlight) {
+      inFlight = resolveIdentityPin(binding).then(pin => {
+        pinnedAccountId = pin?.accountId ?? null;
+        return pinnedAccountId;
+      }).finally(() => {
+        inFlight = null;
+      });
+    }
+    return inFlight;
+  };
+  return {
+    binding,
+    getPinnedAccountId: () => pinnedAccountId,
+    ensurePinnedAccountId: () => pinnedAccountId !== null ? Promise.resolve(pinnedAccountId) : resolve(),
+    refreshPinnedAccountId: () => {
+      pinnedAccountId = null;
+      return resolve();
+    }
+  };
+}
+//# sourceMappingURL=identityBinding.js.map

package/lib/module/ui/session/identityBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createNativeIdentityPinStore","createWebIdentityPinStore","resolveIdentityPin","isReactNative","createNativeSecureKeyValueStorage","IdentityBoundSessionError","Error","name","code","constructor","operation","createIdentitySessionBinding","pinStore","binding","pinnedAccountId","inFlight","resolve","then","pin","accountId","finally","getPinnedAccountId","ensurePinnedAccountId","Promise","refreshPinnedAccountId"],"sourceRoot":"../../../../src","sources":["ui/session/identityBinding.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEA,4BAA4B,EAC5BC,yBAAyB,EACzBC,kBAAkB,QAEb,aAAa;AACpB,SAASC,aAAa,QAAQ,4BAAyB;AACvD,SAASC,iCAAiC,QAAQ,0BAAuB;;AAEzE;AACA;AACA;AACA;AACA;;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAyB,SAASC,KAAK,CAAC;EACjCC,IAAI,GAAG,2BAA2B;EAC3CC,IAAI,GAAG,wBAAwB;EACxCC,WAAWA,CAAUC,SAAiB,EAAE;IACtC,KAAK,CACH,IAAIA,SAAS,2KACf,CAAC;IAAC,KAHiBA,SAAiB,GAAjBA,SAAiB;EAItC;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,4BAA4BA,CAAA,EAA2B;EACrE,MAAMC,QAAQ,GAAGT,aAAa,CAAC,CAAC,GAC5BH,4BAA4B,CAACI,iCAAiC,CAAC,CAAC,CAAC,GACjEH,yBAAyB,CAAC,CAAC;EAC/B,MAAMY,OAAwB,GAAG;IAAED;EAAS,CAAC;;EAE7C;EACA;EACA;EACA;EACA;EACA,IAAIE,eAA8B,GAAG,IAAI;EACzC,IAAIC,QAAuC,GAAG,IAAI;EAElD,MAAMC,OAAO,GAAGA,CAAA,KAA8B;IAC5C,IAAI,CAACD,QAAQ,EAAE;MACbA,QAAQ,GAAGb,kBAAkB,CAACW,OAAO,CAAC,CACnCI,IAAI,CAAEC,GAAG,IAAK;QACbJ,eAAe,GAAGI,GAAG,EAAEC,SAAS,IAAI,IAAI;QACxC,OAAOL,eAAe;MACxB,CAAC,CAAC,CACDM,OAAO,CAAC,MAAM;QACbL,QAAQ,GAAG,IAAI;MACjB,CAAC,CAAC;IACN;IACA,OAAOA,QAAQ;EACjB,CAAC;EAED,OAAO;IACLF,OAAO;IACPQ,kBAAkB,EAAEA,CAAA,KAAMP,eAAe;IACzCQ,qBAAqB,EAAEA,CAAA,KACrBR,eAAe,KAAK,IAAI,GAAGS,OAAO,CAACP,OAAO,CAACF,eAAe,CAAC,GAAGE,OAAO,CAAC,CAAC;IACzEQ,sBAAsB,EAAEA,CAAA,KAAM;MAC5BV,eAAe,GAAG,IAAI;MACtB,OAAOE,OAAO,CAAC,CAAC;IAClB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/index.js

@@ -6,12 +6,15 @@
  * `@oxyhq/core` owns the platform-agnostic `SessionClient`, its host adapter,
  * and the pure `DeviceSessionState → services` projection helpers; those are
  * re-exported straight from core here so `OxyContext` has one import site.
- * `@oxyhq/services` supplies only the two platform pieces: the thin
+ * `@oxyhq/services` supplies only the platform pieces: the thin
  * `createSessionClient` factory (injects socket.io-client `io` + the
- * device-first token transport) and the `AuthStateStore` factory.
+ * device-first token transport), the `AuthStateStore` factory, and — for
+ * `sessionMode: 'identity'` — the identity binding (platform pin store + the
+ * memoised pinned account id).
  */
 export { createSessionClient } from "./createSessionClient.js";
 export { createTokenTransport } from "./tokenTransport.js";
 export { createPlatformAuthStateStore } from "./authStore.js";
+export { createIdentitySessionBinding, IdentityBoundSessionError } from "./identityBinding.js";
 export { createSessionClientHost, accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions } from '@oxyhq/core';
 //# sourceMappingURL=index.js.map

package/lib/module/ui/session/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["createSessionClient","createTokenTransport","createPlatformAuthStateStore","createSessionClientHost","accountIdsOf","activeSessionIdOf","activeUserOf","deviceStateToClientSessions"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAQ,0BAAuB;AAC3D,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,4BAA4B,QAAQ,gBAAa;AAC1D,SACEC,uBAAuB,EACvBC,YAAY,EACZC,iBAAiB,EACjBC,YAAY,EACZC,2BAA2B,QACtB,aAAa","ignoreList":[]}
+{"version":3,"names":["createSessionClient","createTokenTransport","createPlatformAuthStateStore","createIdentitySessionBinding","IdentityBoundSessionError","createSessionClientHost","accountIdsOf","activeSessionIdOf","activeUserOf","deviceStateToClientSessions"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAQ,0BAAuB;AAC3D,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,4BAA4B,QAAQ,gBAAa;AAC1D,SAASC,4BAA4B,EAAEC,yBAAyB,QAAQ,sBAAmB;AAE3F,SACEC,uBAAuB,EACvBC,YAAY,EACZC,iBAAiB,EACjBC,YAAY,EACZC,2BAA2B,QACtB,aAAa","ignoreList":[]}

package/lib/module/ui/session/nativeSecureStorage.js

@@ -0,0 +1,88 @@
+"use strict";
+
+/**
+ * The native secure key/value seam every durable `@oxyhq/core` store in this
+ * package is built on.
+ *
+ * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
+ * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
+ * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
+ * module supplies that injection ONCE, so those stores can never drift onto
+ * different backings — a device credential in SecureStore and a pin in
+ * AsyncStorage would resolve differently after a keystore reset.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+
+import { createPlatformStorage } from "../utils/storageHelpers.js";
+
+// Variable indirection so Metro's static analyzer never traces expo-secure-store
+// into the web bundle; the module is native-only and optional.
+const SECURE_STORE_MODULE = 'expo-secure-store';
+let secureStorePromise = null;
+
+/**
+ * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
+ * unavailable — callers then fall back to AsyncStorage. Never throws.
+ */
+function loadSecureStore() {
+  if (!secureStorePromise) {
+    const moduleName = SECURE_STORE_MODULE;
+    secureStorePromise = import(moduleName).then(mod => {
+      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
+        return {
+          getItemAsync: mod.getItemAsync.bind(mod),
+          setItemAsync: mod.setItemAsync.bind(mod),
+          deleteItemAsync: mod.deleteItemAsync.bind(mod)
+        };
+      }
+      return null;
+    }).catch(() => null);
+  }
+  return secureStorePromise;
+}
+
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+export function createNativeSecureKeyValueStorage() {
+  let asyncStorage = null;
+  const getAsyncStorage = async () => {
+    if (!asyncStorage) {
+      asyncStorage = await createPlatformStorage();
+    }
+    return asyncStorage;
+  };
+  return {
+    getItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        return secure.getItemAsync(key);
+      }
+      return (await getAsyncStorage()).getItem(key);
+    },
+    setItem: async (key, value) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.setItemAsync(key, value);
+        return;
+      }
+      await (await getAsyncStorage()).setItem(key, value);
+    },
+    removeItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.deleteItemAsync(key);
+        return;
+      }
+      await (await getAsyncStorage()).removeItem(key);
+    }
+  };
+}
+//# sourceMappingURL=nativeSecureStorage.js.map

package/lib/module/ui/session/nativeSecureStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPlatformStorage","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","then","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,qBAAqB,QAAQ,4BAAyB;;AAE/D;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,MAAM,CAACE,UAAU,CAAC,CACpCC,IAAI,CAAEC,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOT,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASU,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAMb,qBAAqB,CAAC,CAAC;IAC9C;IACA,OAAOa,YAAY;EACrB,CAAC;EACD,OAAO;IACLE,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,OAAOA,MAAM,CAACV,YAAY,CAACS,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEC,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,YAAY,CAACQ,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAML,eAAe,CAAC,CAAC,EAAEI,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACR,eAAe,CAACO,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEM,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/tokenTransport.js

@@ -23,10 +23,20 @@ import { logger } from '@oxyhq/core';
  *
  * A failure is logged and swallowed: this method must never throw out (it runs
  * inside the socket state handler).
+ *
+ * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
+ * on `state.activeAccountId` is precisely what an identity-bound client must
+ * never do — its token is minted for the PINNED account by the cold boot /
+ * re-mint lane. `SessionClient` already bypasses the transport entirely while
+ * pinned; this guard is the services-side half of that contract, so no future
+ * wiring can reintroduce the convergence from this end.
  */
-export function createTokenTransport(oxyServices) {
+export function createTokenTransport(oxyServices, getPinnedAccountId) {
   return {
     async ensureActiveToken(state) {
+      if ((getPinnedAccountId?.() ?? null) !== null) {
+        return;
+      }
       try {
         // Skip the mint ONLY when the planted bearer already identifies the
         // active account. `getCurrentUserId()` decodes the bearer's `userId`/`id`

package/lib/module/ui/session/tokenTransport.js.map

@@ -1 +1 @@
-{"version":3,"names":["logger","createTokenTransport","oxyServices","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;AAAA,SAASA,MAAM,QAA+C,aAAa;AAG3E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAACC,WAAwB,EAAkB;EAC7E,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI;QACF;QACA;QACA;QACA,MAAMC,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIH,WAAW,CAACI,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdP,MAAM,CAACQ,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMG,KAAK,GAAG,MAAMR,WAAW,CAACS,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVV,MAAM,CAACa,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEV,KAAK,CAACU;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOP,KAAK,EAAE;QACdP,MAAM,CAACQ,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["logger","createTokenTransport","oxyServices","getPinnedAccountId","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;AAAA,SAASA,MAAM,QAA+C,aAAa;AAG3E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAClCC,WAAwB,EACxBC,kBAAwC,EACxB;EAChB,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI,CAACF,kBAAkB,GAAG,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE;QAC7C;MACF;MACA,IAAI;QACF;QACA;QACA;QACA,MAAMG,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIJ,WAAW,CAACK,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdR,MAAM,CAACS,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMG,KAAK,GAAG,MAAMT,WAAW,CAACU,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVX,MAAM,CAACc,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEV,KAAK,CAACU;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOP,KAAK,EAAE;QACdR,MAAM,CAACS,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/utils/crossOriginRestore.js

@@ -1,6 +1,6 @@
 "use strict";
 
-import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, persistOAuthHandshake, normalizeOAuthRedirectUri, logger } from '@oxyhq/core';
+import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, clearOAuthHandshake, persistOAuthHandshake, canonicalizeOAuthRedirectUri, logger } from '@oxyhq/core';
 import { isWebBrowser } from "./isWebBrowser.js";
 import { replaceUrlAfterOAuthReturn } from "./oauthReturn.js";
 import { redirectToAuthorize } from "../components/oauthNavigation.js";
@@ -76,10 +76,10 @@ export async function maybeStartSilentOAuthRestore(opts) {
       codeChallenge
     } = await generatePkcePair();
     const state = await generateOAuthState();
-    if (!persistOAuthHandshake(state, codeVerifier)) {
+    const redirectUri = canonicalizeOAuthRedirectUri(opts.redirectUri ?? location.origin);
+    if (!persistOAuthHandshake(state, codeVerifier, redirectUri)) {
       return false;
     }
-    const redirectUri = normalizeOAuthRedirectUri(opts.redirectUri ?? location.origin);
     const authorizeUrl = buildOAuthAuthorizeUrl({
       authorizeBaseUrl: opts.authorizeBaseUrl,
       clientId: opts.clientId,
@@ -125,6 +125,7 @@ export function consumeSilentOAuthError() {
     // redirected to.
     replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
   }
+  clearOAuthHandshake();
   return error;
 }
 //# sourceMappingURL=crossOriginRestore.js.map

package/lib/module/ui/utils/crossOriginRestore.js.map

@@ -1 +1 @@
-{"version":3,"names":["buildOAuthAuthorizeUrl","generateOAuthState","generatePkcePair","isIdpHubOrigin","isLoopbackOrigin","isOfficialWebOrigin","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","persistOAuthHandshake","normalizeOAuthRedirectUri","logger","isWebBrowser","replaceUrlAfterOAuthReturn","redirectToAuthorize","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","maybeStartSilentOAuthRestore","opts","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","state","redirectUri","authorizeUrl","authorizeBaseUrl","clientId","scope","prompt","error","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","pathname","hash"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;AACA,SACEA,sBAAsB,EACtBC,kBAAkB,EAClBC,gBAAgB,EAChBC,cAAc,EACdC,gBAAgB,EAChBC,mBAAmB,EACnBC,sCAAsC,EACtCC,8BAA8B,EAC9BC,qBAAqB,EACrBC,yBAAyB,EACzBC,MAAM,QACD,aAAa;AACpB,SAASC,YAAY,QAAQ,mBAAgB;AAC7C,SAASC,0BAA0B,QAAQ,kBAAe;AAC1D,SAASC,mBAAmB,QAAQ,kCAA+B;AAEnE,SAASC,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACA,OAAO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACd,sCAAsC,CAAC,IACnDY,KAAK,CAACE,OAAO,CAACb,8BAA8B,CAChD,CAAC;AACH;;AAEA;AACA,OAAO,SAASc,+BAA+BA,CAAA,EAAS;EACtD,MAAMH,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACI,OAAO,CAAChB,sCAAsC,EAAE,GAAG,CAAC;EAC1DY,KAAK,CAACI,OAAO,CAACf,8BAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACA,OAAO,SAASgB,6BAA6BA,CAAA,EAAS;EACpD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMM,GAAG,IAAI,CAAClB,sCAAsC,EAAEC,8BAA8B,CAAC,EAAE;IAC1FW,KAAK,CAACO,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAIvB,gBAAgB,CAACuB,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAIxB,cAAc,CAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAOE,mBAAmB,CAACsB,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACA,OAAO,eAAeC,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAClB,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMmB,QAAQ,GAAIf,UAAU,CAA6Be,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACJ,6BAA6B,CAACI,QAAQ,CAACH,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIV,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMc,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAMlC,gBAAgB,CAAC,CAAC;IAChE,MAAMmC,KAAK,GAAG,MAAMpC,kBAAkB,CAAC,CAAC;IACxC,IAAI,CAACO,qBAAqB,CAAC6B,KAAK,EAAEF,YAAY,CAAC,EAAE;MAC/C,OAAO,KAAK;IACd;IAEA,MAAMG,WAAW,GAAG7B,yBAAyB,CAC3CoB,IAAI,CAACS,WAAW,IAAIR,QAAQ,CAACH,MAC/B,CAAC;IAED,MAAMY,YAAY,GAAGvC,sBAAsB,CAAC;MAC1CwC,gBAAgB,EAAEX,IAAI,CAACW,gBAAgB;MACvCC,QAAQ,EAAEZ,IAAI,CAACY,QAAQ;MACvBH,WAAW;MACXD,KAAK;MACLD,aAAa;MACbM,KAAK,EAAEb,IAAI,CAACa,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEFtB,+BAA+B,CAAC,CAAC;IACjCR,mBAAmB,CAAC0B,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOK,KAAK,EAAE;IACdlC,MAAM,CAACmC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEF,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASG,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAACpC,YAAY,CAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMmB,QAAQ,GAAIf,UAAU,CAAgDe,QAAQ;EACpF,MAAMkB,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMW,KAAK,GAAGb,MAAM,CAACkB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIL,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAvB,+BAA+B,CAAC,CAAC;EAEjC,IAAI2B,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACtB,QAAQ,CAACuB,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA3C,0BAA0B,CAAC,GAAGuC,GAAG,CAACK,QAAQ,GAAGL,GAAG,CAAClB,MAAM,GAAGkB,GAAG,CAACM,IAAI,EAAE,CAAC;EACvE;EACA,OAAOb,KAAK;AACd","ignoreList":[]}
+{"version":3,"names":["buildOAuthAuthorizeUrl","generateOAuthState","generatePkcePair","isIdpHubOrigin","isLoopbackOrigin","isOfficialWebOrigin","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","clearOAuthHandshake","persistOAuthHandshake","canonicalizeOAuthRedirectUri","logger","isWebBrowser","replaceUrlAfterOAuthReturn","redirectToAuthorize","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","maybeStartSilentOAuthRestore","opts","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","state","redirectUri","authorizeUrl","authorizeBaseUrl","clientId","scope","prompt","error","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","pathname","hash"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;AACA,SACEA,sBAAsB,EACtBC,kBAAkB,EAClBC,gBAAgB,EAChBC,cAAc,EACdC,gBAAgB,EAChBC,mBAAmB,EACnBC,sCAAsC,EACtCC,8BAA8B,EAC9BC,mBAAmB,EACnBC,qBAAqB,EACrBC,4BAA4B,EAC5BC,MAAM,QACD,aAAa;AACpB,SAASC,YAAY,QAAQ,mBAAgB;AAC7C,SAASC,0BAA0B,QAAQ,kBAAe;AAC1D,SAASC,mBAAmB,QAAQ,kCAA+B;AAEnE,SAASC,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACA,OAAO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACf,sCAAsC,CAAC,IACnDa,KAAK,CAACE,OAAO,CAACd,8BAA8B,CAChD,CAAC;AACH;;AAEA;AACA,OAAO,SAASe,+BAA+BA,CAAA,EAAS;EACtD,MAAMH,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACI,OAAO,CAACjB,sCAAsC,EAAE,GAAG,CAAC;EAC1Da,KAAK,CAACI,OAAO,CAAChB,8BAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACA,OAAO,SAASiB,6BAA6BA,CAAA,EAAS;EACpD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMM,GAAG,IAAI,CAACnB,sCAAsC,EAAEC,8BAA8B,CAAC,EAAE;IAC1FY,KAAK,CAACO,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAIxB,gBAAgB,CAACwB,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAIzB,cAAc,CAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAOE,mBAAmB,CAACuB,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACA,OAAO,eAAeC,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAClB,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMmB,QAAQ,GAAIf,UAAU,CAA6Be,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACJ,6BAA6B,CAACI,QAAQ,CAACH,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIV,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMc,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAMnC,gBAAgB,CAAC,CAAC;IAChE,MAAMoC,KAAK,GAAG,MAAMrC,kBAAkB,CAAC,CAAC;IACxC,MAAMsC,WAAW,GAAG7B,4BAA4B,CAC9CoB,IAAI,CAACS,WAAW,IAAIR,QAAQ,CAACH,MAC/B,CAAC;IACD,IAAI,CAACnB,qBAAqB,CAAC6B,KAAK,EAAEF,YAAY,EAAEG,WAAW,CAAC,EAAE;MAC5D,OAAO,KAAK;IACd;IAEA,MAAMC,YAAY,GAAGxC,sBAAsB,CAAC;MAC1CyC,gBAAgB,EAAEX,IAAI,CAACW,gBAAgB;MACvCC,QAAQ,EAAEZ,IAAI,CAACY,QAAQ;MACvBH,WAAW;MACXD,KAAK;MACLD,aAAa;MACbM,KAAK,EAAEb,IAAI,CAACa,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEFtB,+BAA+B,CAAC,CAAC;IACjCR,mBAAmB,CAAC0B,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOK,KAAK,EAAE;IACdlC,MAAM,CAACmC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEF,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASG,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAACpC,YAAY,CAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMmB,QAAQ,GAAIf,UAAU,CAAgDe,QAAQ;EACpF,MAAMkB,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMW,KAAK,GAAGb,MAAM,CAACkB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIL,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAvB,+BAA+B,CAAC,CAAC;EAEjC,IAAI2B,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACtB,QAAQ,CAACuB,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA3C,0BAA0B,CAAC,GAAGuC,GAAG,CAACK,QAAQ,GAAGL,GAAG,CAAClB,MAAM,GAAGkB,GAAG,CAACM,IAAI,EAAE,CAAC;EACvE;EACAlD,mBAAmB,CAAC,CAAC;EACrB,OAAOqC,KAAK;AACd","ignoreList":[]}

package/lib/module/ui/utils/deliveryPlatform.js

@@ -0,0 +1,55 @@
+"use strict";
+
+/**
+ * Classify the surface a "Sign in with Oxy" request is initiated from, for
+ * `AccountDialogController`'s `platform` option (issue #691, Phase 4/5).
+ *
+ * `@oxyhq/core` deliberately refuses to do this itself — it never touches a
+ * platform global — so the consumer that OWNS the environment classifies it and
+ * hands the verdict in. The verdict feeds `selectCommonsDelivery`, where it
+ * decides one thing only: whether this device may take the `'open-commons'`
+ * deep-link route. Getting it wrong in the "mobile" direction is the costly
+ * error (a custom-scheme navigation that does not resolve is a dead end with no
+ * automatic way back), so every ambiguous signal resolves AWAY from `'mobile'`.
+ *
+ * No user-agent string is parsed. The two signals used are declarative and
+ * standardized:
+ *   1. `navigator.userAgentData.mobile` — the User-Agent Client Hints boolean.
+ *      Authoritative where implemented (Chromium), in both directions.
+ *   2. The PRIMARY pointer (`(pointer: coarse)`) plus a touch digitizer.
+ *      A phone/tablet reports a coarse primary pointer; a touchscreen laptop
+ *      still reports its mouse as primary, so it is not misclassified.
+ */
+
+import { isWebBrowser } from "./isWebBrowser.js";
+
+/**
+ * The `navigator.userAgentData` slice this module reads. Declared locally
+ * because `NavigatorUAData` is not in TypeScript's DOM lib yet; only the one
+ * field consumed here is modelled, and it stays optional so an implementation
+ * without it is simply "no answer" rather than a type lie.
+ */
+
+/**
+ * Which surface this app is running on, as `selectCommonsDelivery` models it.
+ *
+ *  - Native (Expo/RN) is always `'mobile'`: it is an Oxy app installed on a
+ *    phone/tablet, exactly the case where a verified Commons link can resolve
+ *    on this very device.
+ *  - A web browser is classified from the signals above.
+ *  - Anything else — a browser-like environment with neither signal — is
+ *    `'unknown'`, a first-class value that never opts into the deep link.
+ */
+export function resolveDeliveryPlatform() {
+  if (!isWebBrowser()) return 'mobile';
+  const nav = typeof navigator === 'undefined' ? undefined : navigator;
+  const uaMobile = nav?.userAgentData?.mobile;
+  if (typeof uaMobile === 'boolean') return uaMobile ? 'mobile' : 'desktop';
+  if (typeof window !== 'undefined' && typeof window.matchMedia === 'function') {
+    const coarsePrimaryPointer = window.matchMedia('(pointer: coarse)').matches;
+    const hasTouchDigitizer = (nav?.maxTouchPoints ?? 0) > 0;
+    return coarsePrimaryPointer && hasTouchDigitizer ? 'mobile' : 'desktop';
+  }
+  return 'unknown';
+}
+//# sourceMappingURL=deliveryPlatform.js.map

package/lib/module/ui/utils/deliveryPlatform.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isWebBrowser","resolveDeliveryPlatform","nav","navigator","undefined","uaMobile","userAgentData","mobile","window","matchMedia","coarsePrimaryPointer","matches","hasTouchDigitizer","maxTouchPoints"],"sourceRoot":"../../../../src","sources":["ui/utils/deliveryPlatform.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,mBAAgB;;AAE7C;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,uBAAuBA,CAAA,EAA4B;EACjE,IAAI,CAACD,YAAY,CAAC,CAAC,EAAE,OAAO,QAAQ;EAEpC,MAAME,GAA2C,GAC/C,OAAOC,SAAS,KAAK,WAAW,GAAGC,SAAS,GAAGD,SAAS;EAE1D,MAAME,QAAQ,GAAGH,GAAG,EAAEI,aAAa,EAAEC,MAAM;EAC3C,IAAI,OAAOF,QAAQ,KAAK,SAAS,EAAE,OAAOA,QAAQ,GAAG,QAAQ,GAAG,SAAS;EAEzE,IAAI,OAAOG,MAAM,KAAK,WAAW,IAAI,OAAOA,MAAM,CAACC,UAAU,KAAK,UAAU,EAAE;IAC5E,MAAMC,oBAAoB,GAAGF,MAAM,CAACC,UAAU,CAAC,mBAAmB,CAAC,CAACE,OAAO;IAC3E,MAAMC,iBAAiB,GAAG,CAACV,GAAG,EAAEW,cAAc,IAAI,CAAC,IAAI,CAAC;IACxD,OAAOH,oBAAoB,IAAIE,iBAAiB,GAAG,QAAQ,GAAG,SAAS;EACzE;EAEA,OAAO,SAAS;AAClB","ignoreList":[]}

package/lib/module/ui/utils/oauthReturn.js

@@ -1,10 +1,19 @@
 "use strict";
 
-import { clearOAuthHandshake, consumeOAuthReturnPath, logger, normalizeOAuthRedirectUri, readOAuthHandshake } from '@oxyhq/core';
+import { clearOAuthHandshake, consumeOAuthReturnPath, logger, canonicalizeOAuthRedirectUri, readOAuthHandshake } from '@oxyhq/core';
+import { completeOAuthCode } from "../oauth/completeOAuthCode.js";
 import { isWebBrowser } from "./isWebBrowser.js";
+
 /**
- * When the RP lands with `?code=` after password sign-in at auth.oxy.so, exchange
- * the code for a device-first session before cold boot runs.
+ * When the RP lands with `?code=` after signing in at auth.oxy.so, exchange the
+ * code for a device-first session before cold boot runs.
+ *
+ * This is the REDIRECT transport's return leg. It owns only what is specific to
+ * a full-page round trip — reading the code off the URL, recovering the
+ * handshake `sessionStorage` carried across the navigation, and cleaning both up
+ * afterwards — and delegates state validation, the PKCE exchange, and the
+ * session commit to `completeOAuthCode`, the same function the popup transport
+ * runs.
  */
 export async function tryCompleteOAuthReturn(opts) {
   if (!isWebBrowser()) return false;
@@ -15,6 +24,7 @@ export async function tryCompleteOAuthReturn(opts) {
   const oauthError = params.get('error');
   if (oauthError) {
     stripOAuthParamsFromUrl();
+    clearOAuthHandshake();
     return false;
   }
   if (!code) return false;
@@ -24,50 +34,28 @@ export async function tryCompleteOAuthReturn(opts) {
       component: 'oauthReturn'
     });
     stripOAuthParamsFromUrl();
-    return false;
-  }
-  const returnedState = params.get('state');
-  const handshake = readOAuthHandshake();
-  if (!handshake || !returnedState || handshake.state !== returnedState) {
-    logger.warn('OAuth return ignored: missing or mismatched handshake', {
-      component: 'oauthReturn'
-    });
-    // Consume the return path before clearing the handshake — clearOAuthHandshake
-    // drops the persisted path along with the PKCE keys.
-    stripOAuthParamsFromUrl();
-    clearOAuthHandshake();
-    return false;
-  }
-  const redirectUri = normalizeOAuthRedirectUri(opts.authRedirectUri ?? location.origin);
-  try {
-    const result = await opts.oxyServices.exchangeOAuthCode({
-      code,
-      clientId,
-      redirectUri,
-      codeVerifier: handshake.codeVerifier
-    });
-    // Strip OAuth params before commit so a stale `?code=` cannot re-enter the exchange loop.
-    // Read the return path first — clearOAuthHandshake drops it with the PKCE keys.
-    stripOAuthParamsFromUrl();
-    clearOAuthHandshake();
-    await opts.commitSession({
-      sessionId: result.sessionId,
-      accessToken: result.accessToken,
-      deviceId: result.deviceId,
-      deviceSecret: result.deviceSecret,
-      userId: result.user.id,
-      expiresAt: result.expiresAt,
-      user: result.user
-    });
-    return true;
-  } catch (error) {
-    logger.warn('OAuth return exchange failed', {
-      component: 'oauthReturn'
-    }, error);
-    stripOAuthParamsFromUrl();
     clearOAuthHandshake();
     return false;
   }
+  const handshake = readOAuthHandshake();
+  const redirectUri = canonicalizeOAuthRedirectUri(handshake?.redirectUri ?? opts.authRedirectUri ?? location.origin);
+  const result = await completeOAuthCode({
+    oxyServices: opts.oxyServices,
+    clientId,
+    code,
+    returnedState: params.get('state'),
+    handshake,
+    redirectUri,
+    commitSession: opts.commitSession,
+    // Strip the params before the commit so a stale `?code=` cannot re-enter the
+    // exchange loop, and read the return path FIRST — clearOAuthHandshake drops
+    // it along with the PKCE keys.
+    cleanup: () => {
+      stripOAuthParamsFromUrl();
+      clearOAuthHandshake();
+    }
+  });
+  return result.ok;
 }
 
 /**
@@ -132,18 +120,15 @@ function stripOAuthParamsFromUrl() {
 export function consumeHubSyncFailure() {
   if (!isWebBrowser()) return false;
   const location = globalThis.location;
-  const history = globalThis.history;
   if (!location) return false;
   const params = new URLSearchParams(location.search);
   if (params.get('hub_sync') !== 'failed') return false;
   logger.warn('Hub sync failed — IdP device session may be out of sync', {
     component: 'hubSync'
   });
-  if (history?.replaceState) {
-    const url = new URL(location.href);
-    url.searchParams.delete('hub_sync');
-    history.replaceState(history.state, '', `${url.pathname}${url.search}${url.hash}`);
-  }
+  const url = new URL(location.href);
+  url.searchParams.delete('hub_sync');
+  replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
   return true;
 }
 //# sourceMappingURL=oauthReturn.js.map

package/lib/module/ui/utils/oauthReturn.js.map

@@ -1 +1 @@
-{"version":3,"names":["clearOAuthHandshake","consumeOAuthReturnPath","logger","normalizeOAuthRedirectUri","readOAuthHandshake","isWebBrowser","tryCompleteOAuthReturn","opts","location","globalThis","params","URLSearchParams","search","code","get","oauthError","stripOAuthParamsFromUrl","clientId","warn","component","returnedState","handshake","state","redirectUri","authRedirectUri","origin","result","oxyServices","exchangeOAuthCode","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error","replaceUrlAfterOAuthReturn","fallbackUrl","history","replaceState","current","pathname","hash","target","dispatch","dispatchEvent","event","PopStateEvent","Event","call","url","URL","href","searchParams","delete","consumeHubSyncFailure"],"sourceRoot":"../../../../src","sources":["ui/utils/oauthReturn.ts"],"mappings":";;AACA,SACEA,mBAAmB,EACnBC,sBAAsB,EACtBC,MAAM,EACNC,yBAAyB,EACzBC,kBAAkB,QACb,aAAa;AACpB,SAASC,YAAY,QAAQ,mBAAgB;AAY7C;AACA;AACA;AACA;AACA,OAAO,eAAeC,sBAAsBA,CAACC,IAK5C,EAAoB;EACnB,IAAI,CAACF,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMG,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,MAAMC,IAAI,GAAGH,MAAM,CAACI,GAAG,CAAC,MAAM,CAAC;EAC/B,MAAMC,UAAU,GAAGL,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACtC,IAAIC,UAAU,EAAE;IACdC,uBAAuB,CAAC,CAAC;IACzB,OAAO,KAAK;EACd;EACA,IAAI,CAACH,IAAI,EAAE,OAAO,KAAK;EAEvB,MAAMI,QAAQ,GAAGV,IAAI,CAACU,QAAQ;EAC9B,IAAI,CAACA,QAAQ,EAAE;IACbf,MAAM,CAACgB,IAAI,CAAC,wCAAwC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,CAAC;IACnFH,uBAAuB,CAAC,CAAC;IACzB,OAAO,KAAK;EACd;EAEA,MAAMI,aAAa,GAAGV,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACzC,MAAMO,SAAS,GAAGjB,kBAAkB,CAAC,CAAC;EACtC,IAAI,CAACiB,SAAS,IAAI,CAACD,aAAa,IAAIC,SAAS,CAACC,KAAK,KAAKF,aAAa,EAAE;IACrElB,MAAM,CAACgB,IAAI,CAAC,uDAAuD,EAAE;MACnEC,SAAS,EAAE;IACb,CAAC,CAAC;IACF;IACA;IACAH,uBAAuB,CAAC,CAAC;IACzBhB,mBAAmB,CAAC,CAAC;IACrB,OAAO,KAAK;EACd;EAEA,MAAMuB,WAAW,GAAGpB,yBAAyB,CAC3CI,IAAI,CAACiB,eAAe,IAAIhB,QAAQ,CAACiB,MACnC,CAAC;EAED,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMnB,IAAI,CAACoB,WAAW,CAACC,iBAAiB,CAAC;MACtDf,IAAI;MACJI,QAAQ;MACRM,WAAW;MACXM,YAAY,EAAER,SAAS,CAACQ;IAC1B,CAAC,CAAC;IACF;IACA;IACAb,uBAAuB,CAAC,CAAC;IACzBhB,mBAAmB,CAAC,CAAC;IACrB,MAAMO,IAAI,CAACuB,aAAa,CAAC;MACvBC,SAAS,EAAEL,MAAM,CAACK,SAAS;MAC3BC,WAAW,EAAEN,MAAM,CAACM,WAAW;MAC/BC,QAAQ,EAAEP,MAAM,CAACO,QAAQ;MACzBC,YAAY,EAAER,MAAM,CAACQ,YAAY;MACjCC,MAAM,EAAET,MAAM,CAACU,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEZ,MAAM,CAACY,SAAS;MAC3BF,IAAI,EAAEV,MAAM,CAACU;IACf,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAOG,KAAK,EAAE;IACdrC,MAAM,CAACgB,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,EAAEoB,KAAK,CAAC;IAChFvB,uBAAuB,CAAC,CAAC;IACzBhB,mBAAmB,CAAC,CAAC;IACrB,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASwC,0BAA0BA,CAACC,WAAmB,EAAQ;EACpE,MAAMjC,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,MAAMkC,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClC,QAAQ,IAAI,CAACkC,OAAO,EAAEC,YAAY,EAAE;EAEzC,MAAMC,OAAO,GAAG,GAAGpC,QAAQ,CAACqC,QAAQ,GAAGrC,QAAQ,CAACI,MAAM,GAAGJ,QAAQ,CAACsC,IAAI,EAAE;EACxE,MAAMC,MAAM,GAAG9C,sBAAsB,CAAC,CAAC,IAAIwC,WAAW;EACtDC,OAAO,CAACC,YAAY,CAACD,OAAO,CAACpB,KAAK,EAAE,EAAE,EAAEyB,MAAM,CAAC;EAC/C,IAAIA,MAAM,KAAKH,OAAO,EAAE;EAExB,MAAMI,QAAQ,GAAIvC,UAAU,CAAmDwC,aAAa;EAC5F,IAAI,OAAOD,QAAQ,KAAK,UAAU,EAAE;EACpC,IAAI;IACF;IACA;IACA,MAAME,KAAK,GACT,OAAOC,aAAa,KAAK,UAAU,GAC/B,IAAIA,aAAa,CAAC,UAAU,EAAE;MAAE7B,KAAK,EAAEoB,OAAO,CAACpB;IAAM,CAAC,CAAC,GACvD,IAAI8B,KAAK,CAAC,UAAU,CAAC;IAC3BJ,QAAQ,CAACK,IAAI,CAAC5C,UAAU,EAAEyC,KAAK,CAAC;EAClC,CAAC,CAAC,OAAOX,KAAK,EAAE;IACdrC,MAAM,CAACgB,IAAI,CAAC,yCAAyC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,EAAEoB,KAAK,CAAC;EAC7F;AACF;AAEA,SAASvB,uBAAuBA,CAAA,EAAS;EACvC,MAAMR,QAAQ,GAAIC,UAAU,CAAgDD,QAAQ;EACpF,MAAMkC,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClC,QAAQ,IAAI,CAACkC,OAAO,EAAEC,YAAY,EAAE;EACzC,MAAMW,GAAG,GAAG,IAAIC,GAAG,CAAC/C,QAAQ,CAACgD,IAAI,CAAC;EAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,MAAM,CAAC;EAC/BJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;EAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;EACnClB,0BAA0B,CAAC,GAAGc,GAAG,CAACT,QAAQ,GAAGS,GAAG,CAAC1C,MAAM,GAAG0C,GAAG,CAACR,IAAI,EAAE,CAAC;AACvE;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASa,qBAAqBA,CAAA,EAAY;EAC/C,IAAI,CAACtD,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMG,QAAQ,GAAIC,UAAU,CAAgDD,QAAQ;EACpF,MAAMkC,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClC,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACI,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;EAErDZ,MAAM,CAACgB,IAAI,CAAC,yDAAyD,EAAE;IACrEC,SAAS,EAAE;EACb,CAAC,CAAC;EAEF,IAAIuB,OAAO,EAAEC,YAAY,EAAE;IACzB,MAAMW,GAAG,GAAG,IAAIC,GAAG,CAAC/C,QAAQ,CAACgD,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;IACnChB,OAAO,CAACC,YAAY,CAACD,OAAO,CAACpB,KAAK,EAAE,EAAE,EAAE,GAAGgC,GAAG,CAACT,QAAQ,GAAGS,GAAG,CAAC1C,MAAM,GAAG0C,GAAG,CAACR,IAAI,EAAE,CAAC;EACpF;EACA,OAAO,IAAI;AACb","ignoreList":[]}
+{"version":3,"names":["clearOAuthHandshake","consumeOAuthReturnPath","logger","canonicalizeOAuthRedirectUri","readOAuthHandshake","completeOAuthCode","isWebBrowser","tryCompleteOAuthReturn","opts","location","globalThis","params","URLSearchParams","search","code","get","oauthError","stripOAuthParamsFromUrl","clientId","warn","component","handshake","redirectUri","authRedirectUri","origin","result","oxyServices","returnedState","commitSession","cleanup","ok","replaceUrlAfterOAuthReturn","fallbackUrl","history","replaceState","current","pathname","hash","target","state","dispatch","dispatchEvent","event","PopStateEvent","Event","call","error","url","URL","href","searchParams","delete","consumeHubSyncFailure"],"sourceRoot":"../../../../src","sources":["ui/utils/oauthReturn.ts"],"mappings":";;AACA,SACEA,mBAAmB,EACnBC,sBAAsB,EACtBC,MAAM,EACNC,4BAA4B,EAC5BC,kBAAkB,QACb,aAAa;AACpB,SAASC,iBAAiB,QAAQ,+BAA4B;AAE9D,SAASC,YAAY,QAAQ,mBAAgB;;AAE7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,sBAAsBA,CAACC,IAK5C,EAAoB;EACnB,IAAI,CAACF,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMG,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,MAAMC,IAAI,GAAGH,MAAM,CAACI,GAAG,CAAC,MAAM,CAAC;EAC/B,MAAMC,UAAU,GAAGL,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACtC,IAAIC,UAAU,EAAE;IACdC,uBAAuB,CAAC,CAAC;IACzBjB,mBAAmB,CAAC,CAAC;IACrB,OAAO,KAAK;EACd;EACA,IAAI,CAACc,IAAI,EAAE,OAAO,KAAK;EAEvB,MAAMI,QAAQ,GAAGV,IAAI,CAACU,QAAQ;EAC9B,IAAI,CAACA,QAAQ,EAAE;IACbhB,MAAM,CAACiB,IAAI,CAAC,wCAAwC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,CAAC;IACnFH,uBAAuB,CAAC,CAAC;IACzBjB,mBAAmB,CAAC,CAAC;IACrB,OAAO,KAAK;EACd;EAEA,MAAMqB,SAAS,GAAGjB,kBAAkB,CAAC,CAAC;EACtC,MAAMkB,WAAW,GAAGnB,4BAA4B,CAC9CkB,SAAS,EAAEC,WAAW,IAAId,IAAI,CAACe,eAAe,IAAId,QAAQ,CAACe,MAC7D,CAAC;EAED,MAAMC,MAAM,GAAG,MAAMpB,iBAAiB,CAAC;IACrCqB,WAAW,EAAElB,IAAI,CAACkB,WAAW;IAC7BR,QAAQ;IACRJ,IAAI;IACJa,aAAa,EAAEhB,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;IAClCM,SAAS;IACTC,WAAW;IACXM,aAAa,EAAEpB,IAAI,CAACoB,aAAa;IACjC;IACA;IACA;IACAC,OAAO,EAAEA,CAAA,KAAM;MACbZ,uBAAuB,CAAC,CAAC;MACzBjB,mBAAmB,CAAC,CAAC;IACvB;EACF,CAAC,CAAC;EACF,OAAOyB,MAAM,CAACK,EAAE;AAClB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,0BAA0BA,CAACC,WAAmB,EAAQ;EACpE,MAAMvB,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,MAAMwB,OAAO,GAAIvB,UAAU,CAA2BuB,OAAO;EAC7D,IAAI,CAACxB,QAAQ,IAAI,CAACwB,OAAO,EAAEC,YAAY,EAAE;EAEzC,MAAMC,OAAO,GAAG,GAAG1B,QAAQ,CAAC2B,QAAQ,GAAG3B,QAAQ,CAACI,MAAM,GAAGJ,QAAQ,CAAC4B,IAAI,EAAE;EACxE,MAAMC,MAAM,GAAGrC,sBAAsB,CAAC,CAAC,IAAI+B,WAAW;EACtDC,OAAO,CAACC,YAAY,CAACD,OAAO,CAACM,KAAK,EAAE,EAAE,EAAED,MAAM,CAAC;EAC/C,IAAIA,MAAM,KAAKH,OAAO,EAAE;EAExB,MAAMK,QAAQ,GAAI9B,UAAU,CAAmD+B,aAAa;EAC5F,IAAI,OAAOD,QAAQ,KAAK,UAAU,EAAE;EACpC,IAAI;IACF;IACA;IACA,MAAME,KAAK,GACT,OAAOC,aAAa,KAAK,UAAU,GAC/B,IAAIA,aAAa,CAAC,UAAU,EAAE;MAAEJ,KAAK,EAAEN,OAAO,CAACM;IAAM,CAAC,CAAC,GACvD,IAAIK,KAAK,CAAC,UAAU,CAAC;IAC3BJ,QAAQ,CAACK,IAAI,CAACnC,UAAU,EAAEgC,KAAK,CAAC;EAClC,CAAC,CAAC,OAAOI,KAAK,EAAE;IACd5C,MAAM,CAACiB,IAAI,CAAC,yCAAyC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,EAAE0B,KAAK,CAAC;EAC7F;AACF;AAEA,SAAS7B,uBAAuBA,CAAA,EAAS;EACvC,MAAMR,QAAQ,GAAIC,UAAU,CAAgDD,QAAQ;EACpF,MAAMwB,OAAO,GAAIvB,UAAU,CAA2BuB,OAAO;EAC7D,IAAI,CAACxB,QAAQ,IAAI,CAACwB,OAAO,EAAEC,YAAY,EAAE;EACzC,MAAMa,GAAG,GAAG,IAAIC,GAAG,CAACvC,QAAQ,CAACwC,IAAI,CAAC;EAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,MAAM,CAAC;EAC/BJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;EAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;EACnCpB,0BAA0B,CAAC,GAAGgB,GAAG,CAACX,QAAQ,GAAGW,GAAG,CAAClC,MAAM,GAAGkC,GAAG,CAACV,IAAI,EAAE,CAAC;AACvE;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASe,qBAAqBA,CAAA,EAAY;EAC/C,IAAI,CAAC9C,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMG,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACI,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;EAErDb,MAAM,CAACiB,IAAI,CAAC,yDAAyD,EAAE;IACrEC,SAAS,EAAE;EACb,CAAC,CAAC;EAEF,MAAM2B,GAAG,GAAG,IAAIC,GAAG,CAACvC,QAAQ,CAACwC,IAAI,CAAC;EAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;EACnCpB,0BAA0B,CAAC,GAAGgB,GAAG,CAACX,QAAQ,GAAGW,GAAG,CAAClC,MAAM,GAAGkC,GAAG,CAACV,IAAI,EAAE,CAAC;EACrE,OAAO,IAAI;AACb","ignoreList":[]}

package/lib/typescript/commonjs/index.d.ts

@@ -25,7 +25,7 @@ export { useOxy } from './ui/context/OxyContext';
 export type { OxyContextState } from './ui/context/OxyContext';
 export { useAuth } from './ui/hooks/useAuth';
 export type { AuthState, AuthActions, UseAuthReturn } from './ui/hooks/useAuth';
-export { FontLoader, setupFonts } from './ui/components/FontLoader';
+export { IdentityBoundSessionError } from './ui/session/identityBinding';
 export { useAuthStore } from './ui/stores/authStore';
 export { useAccountStore } from './ui/stores/accountStore';
 export { useAssetStore, useAssets as useAssetsStore, useAsset, useUploadProgress, useAssetLoading, useAssetErrors, useAssetsByApp, useAssetsByEntity, useAssetUsageCount, useIsAssetLinked, } from './ui/stores/assetStore';
@@ -59,6 +59,9 @@ export type { ViewMode, SortBy, SortOrder } from './ui/hooks/useFileFiltering';
 export { OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, } from '@oxyhq/core';
 export { default as OxySignInButton } from './ui/components/OxySignInButton';
 export type { OxySignInButtonProps, OxyOAuthResult } from './ui/components/OxySignInButton';
+export { openOAuthPopup } from './ui/oauth/oauthPopup';
+export type { StartWebOAuthSignInOptions } from './ui/oauth/browserAuthTransport';
+export type { WebAuthMode, WebOAuthSignInResult, WebOAuthRedirectReason, WebOAuthFailureReason, WebOAuthUnsupportedReason, OAuthPopupHandle, } from './ui/oauth/types';
 export { OxyAuthPrompt } from './ui/components/OxyAuthPrompt';
 export type { OxyAuthPromptProps } from './ui/components/OxyAuthPrompt';
 export { OxyOAuthCallback } from './ui/components/OxyOAuthCallback';

package/lib/typescript/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAKpE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACH,aAAa,EACb,SAAS,IAAI,cAAc,EAC3B,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,sBAAsB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACH,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,yBAAyB,GAC5B,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACH,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACH,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAClB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACR,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAQjE,OAAO,EACH,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC/B,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAKrD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAKvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK/E,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC7E,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,GACf,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEhG,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAKzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAOxE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAQ1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,YAAY,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAGpF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGlF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAKtF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAMzG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAKzE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACH,aAAa,EACb,SAAS,IAAI,cAAc,EAC3B,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKjF,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,sBAAsB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACH,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,yBAAyB,GAC5B,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACH,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACH,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAClB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACR,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAQjE,OAAO,EACH,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC/B,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAKrD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAKvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK/E,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC7E,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAM5F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAClF,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,GACf,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEhG,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAKzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAOxE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAQ1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,YAAY,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAGpF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGlF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAKtF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAMzG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,sCAAsC,CAAC"}

package/lib/typescript/commonjs/ui/boot/runProviderColdBoot.d.ts

@@ -1,5 +1,6 @@
-import { type AuthStateStore, type OxyServices } from '@oxyhq/core';
+import { type AuthStateStore, type IdentityBinding, type OxyServices, type SessionMode } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
+import type { WebAuthMode } from '../oauth/types';
 import type { CommitInput } from '../context/oxyContextTypes';
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
 export declare const SESSION_HANDOFF_DEADLINE_MS = 6000;
@@ -26,6 +27,27 @@ export interface RunProviderColdBootOptions {
      * silent-restore redirect targets its own IdP, never production.
      */
     authorizeBaseUrl?: string;
+    /**
+     * Who owns the session this boot resolves. `'account'` (the default) is the
+     * device's active account — every ordinary Oxy app. `'identity'` binds the
+     * boot to the owner of this device's PRIMARY identity key and REQUIRES
+     * {@link identity}; it also disables the two web OAuth lanes below, which
+     * commit whatever account the IdP hands back.
+     */
+    sessionMode?: SessionMode;
+    /** The identity binding required by `sessionMode: 'identity'`. */
+    identity?: IdentityBinding;
+    /**
+     * How this provider's WEB sign-in reaches the IdP
+     * (`OxyProviderProps.webAuthMode`).
+     *
+     * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
+     * the automatic full-page `prompt=none` restore in step 3, so a domain with no
+     * local credential resolves SIGNED OUT instead of bouncing the top-level
+     * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
+     * @default 'redirect'
+     */
+    webAuthMode?: WebAuthMode;
     sessionClient: SessionClient;
     syncDeviceCredentialToHost: () => Promise<void>;
     commitSession: (input: CommitInput, options: {
@@ -40,8 +62,18 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete OAuth authorization-code return (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key)
+ * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
+ *    primary-identity-key lane in `sessionMode: 'identity'`)
  * 3. Silent OAuth for all web apps when mint finds no session
+ *
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
+ *
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 export declare function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void>;
 //# sourceMappingURL=runProviderColdBoot.d.ts.map

package/lib/typescript/commonjs/ui/boot/runProviderColdBoot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IzF"}
+{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+KzF"}