@oxyhq/services 22.12.5 → 22.13.1

package/lib/module/ui/context/commitSessionFlow.js

@@ -1,6 +1,8 @@
 "use strict";
 
 import { logger as loggerUtil } from '@oxyhq/core';
+import { allowsAutomaticIdpRedirect } from "../oauth/legacyRedirectLanes.js";
+import { isWebBrowser } from "../utils/isWebBrowser.js";
 import { isUnauthorizedStatus } from "./oxyContextHelpers.js";
 const LOG_CONTEXT = {
   component: 'OxyContext',
@@ -70,6 +72,9 @@ export async function commitDeviceSetAndResolve(deps) {
       }
       fullUser = fallbackUser;
     }
+    if (!fullUser) {
+      fullUser = fallbackUser;
+    }
     if (fullUser) {
       loginSuccess(fullUser);
       onAuthStateChange?.(fullUser);
@@ -94,4 +99,44 @@ export async function commitDeviceSetAndResolve(deps) {
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+export async function maybeSyncHubAfterCommit(deps) {
+  const {
+    activate,
+    hubSyncRequested,
+    hubSyncEnabled,
+    webAuthMode,
+    syncHub
+  } = deps;
+  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
+  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
+  if (!isWebBrowser()) return false;
+  try {
+    return await syncHub();
+  } catch (hubError) {
+    if (__DEV__) {
+      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
+    }
+    return false;
+  }
+}
 //# sourceMappingURL=commitSessionFlow.js.map

package/lib/module/ui/context/commitSessionFlow.js.map

@@ -1 +1 @@
-{"version":3,"names":["logger","loggerUtil","isUnauthorizedStatus","LOG_CONTEXT","component","method","commitDeviceSetAndResolve","deps","activate","userId","fallbackUser","registerAndActivate","addCurrentAccount","startSocket","syncFromClient","getCurrentUser","loginSuccess","onAuthStateChange","markAuthResolved","reconcileDeviceSet","logReconcileError","registrationError","debug","warn","hydrateAndResolve","fullUser","profileError","__DEV__","catch"],"sourceRoot":"../../../../src","sources":["ui/context/commitSessionFlow.ts"],"mappings":";;AACA,SAASA,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAClD,SAASC,oBAAoB,QAAQ,wBAAqB;AAE1D,MAAMC,WAAW,GAAG;EAAEC,SAAS,EAAE,YAAY;EAAEC,MAAM,EAAE;AAAgB,CAAU;AA6BjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,IAAmC,EACpB;EACf,MAAM;IACJC,QAAQ;IACRC,MAAM;IACNC,YAAY;IACZC,mBAAmB;IACnBC,iBAAiB;IACjBC,WAAW;IACXC,cAAc;IACdC,cAAc;IACdC,YAAY;IACZC,iBAAiB;IACjBC;EACF,CAAC,GAAGX,IAAI;;EAER;EACA;EACA;EACA;EACA,MAAMY,kBAAkB,GAAG,MAAAA,CAAA,KAA2B;IACpD,IAAIX,QAAQ,EAAE;MACZ,MAAMG,mBAAmB,CAACF,MAAM,CAAC;IACnC,CAAC,MAAM;MACL,MAAMG,iBAAiB,CAAC,CAAC;IAC3B;IACA,MAAMC,WAAW,CAAC,CAAC;IACnB,MAAMC,cAAc,CAAC,CAAC;EACxB,CAAC;EAED,MAAMM,iBAAiB,GAAIC,iBAA0B,IAAW;IAC9D;IACA;IACA;IACA;IACA;IACA,IAAInB,oBAAoB,CAACmB,iBAAiB,CAAC,EAAE;MAC3CpB,UAAU,CAACqB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEkB,iBAAiB,CAAC;MAC/G;IACF;IACApB,UAAU,CAACsB,IAAI,CAAC,+CAA+C,EAAEpB,WAAW,EAAEkB,iBAAiB,CAAC;EAClG,CAAC;;EAED;EACA;EACA;EACA,MAAMG,iBAAiB,GAAG,MAAAA,CAAA,KAA2B;IACnD,IAAIC,QAAqB,GAAG,IAAI;IAChC,IAAI;MACFA,QAAQ,GAAG,MAAMV,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,OAAOW,YAAY,EAAE;MACrB,IAAIC,OAAO,EAAE;QACX1B,UAAU,CAACqB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEuB,YAAY,CAAC;MAC5G;MACAD,QAAQ,GAAGf,YAAY;IACzB;IACA,IAAIe,QAAQ,EAAE;MACZT,YAAY,CAACS,QAAQ,CAAC;MACtBR,iBAAiB,GAAGQ,QAAQ,CAAC;IAC/B;IACAP,gBAAgB,CAAC,CAAC;EACpB,CAAC;EAED,IAAIV,QAAQ,EAAE;IACZ;IACA;IACA,IAAI;MACF,MAAMW,kBAAkB,CAAC,CAAC;IAC5B,CAAC,CAAC,OAAOE,iBAAiB,EAAE;MAC1BD,iBAAiB,CAACC,iBAAiB,CAAC;IACtC;IACA,MAAMG,iBAAiB,CAAC,CAAC;IACzB;EACF;;EAEA;EACA;EACA;EACA,MAAMA,iBAAiB,CAAC,CAAC;EACzB,KAAKL,kBAAkB,CAAC,CAAC,CAACS,KAAK,CAACR,iBAAiB,CAAC;AACpD","ignoreList":[]}
+{"version":3,"names":["logger","loggerUtil","allowsAutomaticIdpRedirect","isWebBrowser","isUnauthorizedStatus","LOG_CONTEXT","component","method","commitDeviceSetAndResolve","deps","activate","userId","fallbackUser","registerAndActivate","addCurrentAccount","startSocket","syncFromClient","getCurrentUser","loginSuccess","onAuthStateChange","markAuthResolved","reconcileDeviceSet","logReconcileError","registrationError","debug","warn","hydrateAndResolve","fullUser","profileError","__DEV__","catch","maybeSyncHubAfterCommit","hubSyncRequested","hubSyncEnabled","webAuthMode","syncHub","hubError"],"sourceRoot":"../../../../src","sources":["ui/context/commitSessionFlow.ts"],"mappings":";;AACA,SAASA,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAClD,SAASC,0BAA0B,QAAQ,iCAA8B;AAEzE,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,oBAAoB,QAAQ,wBAAqB;AAE1D,MAAMC,WAAW,GAAG;EAAEC,SAAS,EAAE,YAAY;EAAEC,MAAM,EAAE;AAAgB,CAAU;AA6BjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,IAAmC,EACpB;EACf,MAAM;IACJC,QAAQ;IACRC,MAAM;IACNC,YAAY;IACZC,mBAAmB;IACnBC,iBAAiB;IACjBC,WAAW;IACXC,cAAc;IACdC,cAAc;IACdC,YAAY;IACZC,iBAAiB;IACjBC;EACF,CAAC,GAAGX,IAAI;;EAER;EACA;EACA;EACA;EACA,MAAMY,kBAAkB,GAAG,MAAAA,CAAA,KAA2B;IACpD,IAAIX,QAAQ,EAAE;MACZ,MAAMG,mBAAmB,CAACF,MAAM,CAAC;IACnC,CAAC,MAAM;MACL,MAAMG,iBAAiB,CAAC,CAAC;IAC3B;IACA,MAAMC,WAAW,CAAC,CAAC;IACnB,MAAMC,cAAc,CAAC,CAAC;EACxB,CAAC;EAED,MAAMM,iBAAiB,GAAIC,iBAA0B,IAAW;IAC9D;IACA;IACA;IACA;IACA;IACA,IAAInB,oBAAoB,CAACmB,iBAAiB,CAAC,EAAE;MAC3CtB,UAAU,CAACuB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEkB,iBAAiB,CAAC;MAC/G;IACF;IACAtB,UAAU,CAACwB,IAAI,CAAC,+CAA+C,EAAEpB,WAAW,EAAEkB,iBAAiB,CAAC;EAClG,CAAC;;EAED;EACA;EACA;EACA,MAAMG,iBAAiB,GAAG,MAAAA,CAAA,KAA2B;IACnD,IAAIC,QAAqB,GAAG,IAAI;IAChC,IAAI;MACFA,QAAQ,GAAG,MAAMV,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,OAAOW,YAAY,EAAE;MACrB,IAAIC,OAAO,EAAE;QACX5B,UAAU,CAACuB,KAAK,CAAC,6DAA6D,EAAEnB,WAAW,EAAEuB,YAAY,CAAC;MAC5G;MACAD,QAAQ,GAAGf,YAAY;IACzB;IACA,IAAI,CAACe,QAAQ,EAAE;MACbA,QAAQ,GAAGf,YAAY;IACzB;IACA,IAAIe,QAAQ,EAAE;MACZT,YAAY,CAACS,QAAQ,CAAC;MACtBR,iBAAiB,GAAGQ,QAAQ,CAAC;IAC/B;IACAP,gBAAgB,CAAC,CAAC;EACpB,CAAC;EAED,IAAIV,QAAQ,EAAE;IACZ;IACA;IACA,IAAI;MACF,MAAMW,kBAAkB,CAAC,CAAC;IAC5B,CAAC,CAAC,OAAOE,iBAAiB,EAAE;MAC1BD,iBAAiB,CAACC,iBAAiB,CAAC;IACtC;IACA,MAAMG,iBAAiB,CAAC,CAAC;IACzB;EACF;;EAEA;EACA;EACA;EACA,MAAMA,iBAAiB,CAAC,CAAC;EACzB,KAAKL,kBAAkB,CAAC,CAAC,CAACS,KAAK,CAACR,iBAAiB,CAAC;AACpD;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeS,uBAAuBA,CAC3CtB,IAAiC,EACf;EAClB,MAAM;IAAEC,QAAQ;IAAEsB,gBAAgB;IAAEC,cAAc;IAAEC,WAAW;IAAEC;EAAQ,CAAC,GAAG1B,IAAI;EAEjF,IAAI,CAACC,QAAQ,IAAI,CAACsB,gBAAgB,IAAI,CAACC,cAAc,EAAE,OAAO,KAAK;EACnE,IAAI,CAAC/B,0BAA0B,CAACgC,WAAW,CAAC,EAAE,OAAO,KAAK;EAC1D,IAAI,CAAC/B,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,IAAI;IACF,OAAO,MAAMgC,OAAO,CAAC,CAAC;EACxB,CAAC,CAAC,OAAOC,QAAQ,EAAE;IACjB,IAAIP,OAAO,EAAE;MACX5B,UAAU,CAACuB,KAAK,CAAC,2CAA2C,EAAEnB,WAAW,EAAE+B,QAAQ,CAAC;IACtF;IACA,OAAO,KAAK;EACd;AACF","ignoreList":[]}

package/lib/module/ui/context/hooks/useAuthOperations.js

@@ -44,7 +44,9 @@ export const useAuthOperations = ({
   loginFailure,
   logoutStore,
   setAuthState,
-  logger
+  logger,
+  identityBinding,
+  refreshPinnedAccountId
 }) => {
   /**
    * Internal function to perform challenge-response sign in.
@@ -99,6 +101,17 @@ export const useAuthOperations = ({
         logger?.('Failed to persist auth state after sign-in', persistError);
       }
     }
+    if (identityBinding) {
+      try {
+        await identityBinding.pinStore.save({
+          publicKey: publicKey.toLowerCase(),
+          accountId: sessionResponse.user.id
+        });
+        await refreshPinnedAccountId?.();
+      } catch (pinError) {
+        logger?.('Failed to persist identity pin after sign-in', pinError);
+      }
+    }
 
     // Register this recovered account+session into the server-authoritative
     // device-session set AND make it active: `registerAndActivate()` adds via
@@ -162,7 +175,7 @@ export const useAuthOperations = ({
     loginSuccess(fullUser);
     onAuthStateChange?.(fullUser);
     return fullUser;
-  }, [logger, loginSuccess, onAuthStateChange, oxyServices, saveActiveSessionId, sessionClient, setActiveSessionId, store, switchSession, syncFromClient, updateSessions]);
+  }, [logger, loginSuccess, onAuthStateChange, oxyServices, saveActiveSessionId, sessionClient, setActiveSessionId, store, switchSession, syncFromClient, updateSessions, identityBinding, refreshPinnedAccountId]);
 
   /**
    * Sign in with existing public key

package/lib/module/ui/context/hooks/useAuthOperations.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","DeviceManager","fetchSessionsWithFallback","handleAuthError","isInvalidSessionError","SignatureService","LOGIN_ERROR_CODE","LOGOUT_ERROR_CODE","LOGOUT_ALL_ERROR_CODE","clearPersistedAuthSafe","store","logger","clear","catch","clearError","useAuthOperations","oxyServices","activeSessionId","setActiveSessionId","updateSessions","saveActiveSessionId","clearSessionState","switchSession","sessionClient","syncFromClient","onAuthStateChange","onError","loginSuccess","loginFailure","logoutStore","setAuthState","performSignIn","publicKey","deviceFingerprintObj","getDeviceFingerprint","deviceFingerprint","JSON","stringify","deviceInfo","getDeviceInfo","deviceName","getDefaultDeviceName","challengeResponse","requestChallenge","challenge","signature","timestamp","signChallenge","fullUser","sessionResponse","verifyChallenge","deviceSecret","deviceId","save","sessionId","userId","user","id","accessToken","expiresAt","persistError","registerAndActivate","registrationError","getCurrentUser","allDeviceSessions","fallbackDeviceId","fallbackUserId","error","__DEV__","existingSession","find","session","toString","logoutSession","logoutError","filter","merge","signIn","isLoading","message","defaultMessage","code","setAuthError","msg","logout","targetSessionId","sessionToLogout","targetAccountId","getState","accounts","account","accountId","Error","signOut","remainingAccounts","length","isInvalid","status","undefined","logoutAll","all"],"sourceRoot":"../../../../../src","sources":["ui/context/hooks/useAuthOperations.ts"],"mappings":";;AAAA,SAASA,WAAW,QAAQ,OAAO;AAInC,SAASC,aAAa,QAAQ,aAAa;AAC3C,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,eAAe,EAAEC,qBAAqB,QAAQ,8BAA2B;AAGlF,SAASC,gBAAgB,QAAQ,aAAa;AA+C9C,MAAMC,gBAAgB,GAAG,aAAa;AACtC,MAAMC,iBAAiB,GAAG,cAAc;AACxC,MAAMC,qBAAqB,GAAG,kBAAkB;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,sBAAsBA,CACpCC,KAAqB,EACrBC,MAAmD,EAC7C;EACND,KAAK,CAACE,KAAK,CAAC,CAAC,CAACC,KAAK,CAAEC,UAAU,IAAK;IAClCH,MAAM,GAAG,kDAAkD,EAAEG,UAAU,CAAC;EAC1E,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMC,iBAAiB,GAAGA,CAAC;EAChCC,WAAW;EACXN,KAAK;EACLO,eAAe;EACfC,kBAAkB;EAClBC,cAAc;EACdC,mBAAmB;EACnBC,iBAAiB;EACjBC,aAAa;EACbC,aAAa;EACbC,cAAc;EACdC,iBAAiB;EACjBC,OAAO;EACPC,YAAY;EACZC,YAAY;EACZC,WAAW;EACXC,YAAY;EACZnB;AACwB,CAAC,KAA8B;EACvD;AACF;AACA;EACE,MAAMoB,aAAa,GAAG/B,WAAW,CAC/B,MAAOgC,SAAiB,IAAoB;IAC1C,MAAMC,oBAAoB,GAAGhC,aAAa,CAACiC,oBAAoB,CAAC,CAAC;IACjE,MAAMC,iBAAiB,GAAGC,IAAI,CAACC,SAAS,CAACJ,oBAAoB,CAAC;IAC9D,MAAMK,UAAU,GAAG,MAAMrC,aAAa,CAACsC,aAAa,CAAC,CAAC;IACtD,MAAMC,UAAU,GAAGF,UAAU,CAACE,UAAU,IAAIvC,aAAa,CAACwC,oBAAoB,CAAC,CAAC;IAEhF,MAAMC,iBAAiB,GAAG,MAAM1B,WAAW,CAAC2B,gBAAgB,CAACX,SAAS,CAAC;IACvE,MAAMY,SAAS,GAAGF,iBAAiB,CAACE,SAAS;;IAE7C;IACA;IACA;;IAEA;IACA,MAAM;MAAEA,SAAS,EAAEC,SAAS;MAAEC;IAAU,CAAC,GAAG,MAAMzC,gBAAgB,CAAC0C,aAAa,CAACH,SAAS,CAAC;IAE3F,IAAII,QAAc;IAClB,IAAIC,eAAqC;;IAEzC;IACA;IACA;IACAA,eAAe,GAAG,MAAMjC,WAAW,CAACkC,eAAe,CACjDlB,SAAS,EACTY,SAAS,EACTC,SAAS,EACTC,SAAS,EACTN,UAAU,EACVL,iBACF,CAAC;;IAED;IACA;IACA;IACA;IACA;IACA;IACA,MAAMgB,YAAY,GAAGF,eAAe,CAACE,YAAY;IACjD,IAAIF,eAAe,CAACG,QAAQ,IAAID,YAAY,EAAE;MAC5C,IAAI;QACF,MAAMzC,KAAK,CAAC2C,IAAI,CAAC;UACfC,SAAS,EAAEL,eAAe,CAACK,SAAS;UACpCC,MAAM,EAAEN,eAAe,CAACO,IAAI,CAACC,EAAE;UAC/BL,QAAQ,EAAEH,eAAe,CAACG,QAAQ;UAClCD,YAAY;UACZ,IAAIF,eAAe,CAACS,WAAW,GAAG;YAAEA,WAAW,EAAET,eAAe,CAACS;UAAY,CAAC,GAAG,CAAC,CAAC,CAAC;UACpF,IAAIT,eAAe,CAACU,SAAS,GAAG;YAAEA,SAAS,EAAEV,eAAe,CAACU;UAAU,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOC,YAAY,EAAE;QACrBjD,MAAM,GAAG,4CAA4C,EAAEiD,YAAY,CAAC;MACtE;IACF;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAI;MACF,MAAMrC,aAAa,CAACsC,mBAAmB,CAACZ,eAAe,CAACO,IAAI,CAACC,EAAE,CAAC;MAChE,MAAMjC,cAAc,CAAC,CAAC;IACxB,CAAC,CAAC,OAAOsC,iBAAiB,EAAE;MAC1BnD,MAAM,GAAG,oDAAoD,EAAEmD,iBAAiB,CAAC;IACnF;;IAEA;IACA;IACA;IACA;IACAd,QAAQ,GAAG,MAAMhC,WAAW,CAAC+C,cAAc,CAAC,CAAC;;IAE7C;IACA,IAAIC,iBAAkC,GAAG,EAAE;IAC3C,IAAI;MACFA,iBAAiB,GAAG,MAAM9D,yBAAyB,CAACc,WAAW,EAAEiC,eAAe,CAACK,SAAS,EAAE;QAC1FW,gBAAgB,EAAEhB,eAAe,CAACG,QAAQ;QAC1Cc,cAAc,EAAElB,QAAQ,CAACS,EAAE;QAC3B9C;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOwD,KAAK,EAAE;MACd,IAAIC,OAAO,IAAIzD,MAAM,EAAE;QACrBA,MAAM,CAAC,6CAA6C,EAAEwD,KAAK,CAAC;MAC9D;IACF;;IAEA;IACA,MAAME,eAAe,GAAGL,iBAAiB,CAACM,IAAI,CAC3CC,OAAO,IACNA,OAAO,CAAChB,MAAM,EAAEiB,QAAQ,CAAC,CAAC,KAAKxB,QAAQ,CAACS,EAAE,EAAEe,QAAQ,CAAC,CAAC,IACtDD,OAAO,CAACjB,SAAS,KAAKL,eAAe,CAACK,SAC1C,CAAC;IAED,IAAIe,eAAe,EAAE;MACnB;MACA,IAAI;QACF,MAAMrD,WAAW,CAACyD,aAAa,CAACxB,eAAe,CAACK,SAAS,EAAEL,eAAe,CAACK,SAAS,CAAC;MACvF,CAAC,CAAC,OAAOoB,WAAW,EAAE;QACpB;QACA,IAAIN,OAAO,IAAIzD,MAAM,EAAE;UACrBA,MAAM,CAAC,4DAA4D,EAAE+D,WAAW,CAAC;QACnF;MACF;MACA,MAAMpD,aAAa,CAAC+C,eAAe,CAACf,SAAS,CAAC;MAC9CnC,cAAc,CACZ6C,iBAAiB,CAACW,MAAM,CAAEJ,OAAO,IAAKA,OAAO,CAACjB,SAAS,KAAKL,eAAe,CAACK,SAAS,CAAC,EACtF;QAAEsB,KAAK,EAAE;MAAM,CACjB,CAAC;MACDnD,iBAAiB,GAAGuB,QAAQ,CAAC;MAC7B,OAAOA,QAAQ;IACjB;IAEA9B,kBAAkB,CAAC+B,eAAe,CAACK,SAAS,CAAC;IAC7C,MAAMlC,mBAAmB,CAAC6B,eAAe,CAACK,SAAS,CAAC;IACpDnC,cAAc,CAAC6C,iBAAiB,EAAE;MAAEY,KAAK,EAAE;IAAK,CAAC,CAAC;IAElDjD,YAAY,CAACqB,QAAQ,CAAC;IACtBvB,iBAAiB,GAAGuB,QAAQ,CAAC;IAE7B,OAAOA,QAAQ;EACjB,CAAC,EACD,CACErC,MAAM,EACNgB,YAAY,EACZF,iBAAiB,EACjBT,WAAW,EACXI,mBAAmB,EACnBG,aAAa,EACbL,kBAAkB,EAClBR,KAAK,EACLY,aAAa,EACbE,cAAc,EACdL,cAAc,CAElB,CAAC;;EAED;AACF;AACA;EACE,MAAM0D,MAAM,GAAG7E,WAAW,CACxB,OAAOgC,SAAiB,EAAEQ,UAAmB,KAAoB;IAC/DV,YAAY,CAAC;MAAEgD,SAAS,EAAE,IAAI;MAAEX,KAAK,EAAE;IAAK,CAAC,CAAC;IAE9C,IAAI;MACF,OAAO,MAAMpC,aAAa,CAACC,SAAS,CAAC;IACvC,CAAC,CAAC,OAAOmC,KAAK,EAAE;MACd,MAAMY,OAAO,GAAG5E,eAAe,CAACgE,KAAK,EAAE;QACrCa,cAAc,EAAE,gBAAgB;QAChCC,IAAI,EAAE3E,gBAAgB;QACtBoB,OAAO;QACPwD,YAAY,EAAGC,GAAW,IAAKrD,YAAY,CAAC;UAAEqC,KAAK,EAAEgB;QAAI,CAAC,CAAC;QAC3DxE;MACF,CAAC,CAAC;MACFiB,YAAY,CAACmD,OAAO,CAAC;MACrB,MAAMZ,KAAK;IACb,CAAC,SAAS;MACRrC,YAAY,CAAC;QAAEgD,SAAS,EAAE;MAAM,CAAC,CAAC;IACpC;EACF,CAAC,EACD,CAAChD,YAAY,EAAEC,aAAa,EAAEH,YAAY,EAAEF,OAAO,EAAEf,MAAM,CAC7D,CAAC;;EAED;AACF;AACA;EACE,MAAMyE,MAAM,GAAGpF,WAAW,CACxB,MAAOqF,eAAwB,IAAoB;IACjD,IAAI,CAACpE,eAAe,EAAE;IAEtB,IAAI;MACF,MAAMqE,eAAe,GAAGD,eAAe,IAAIpE,eAAe;;MAE1D;MACA;MACA;MACA;MACA,MAAMsE,eAAe,GAAGhE,aAAa,CAClCiE,QAAQ,CAAC,CAAC,EACTC,QAAQ,CAACnB,IAAI,CAAEoB,OAAO,IAAKA,OAAO,CAACpC,SAAS,KAAKgC,eAAe,CAAC,EAAEK,SAAS;MAChF,IAAI,CAACJ,eAAe,EAAE;QACpB,MAAM,IAAIK,KAAK,CAAC,wCAAwCN,eAAe,GAAG,CAAC;MAC7E;MAEA,MAAM/D,aAAa,CAACsE,OAAO,CAAC;QAAEF,SAAS,EAAEJ;MAAgB,CAAC,CAAC;;MAE3D;MACA;MACA;MACA;MACA,MAAMO,iBAAiB,GAAGvE,aAAa,CAACiE,QAAQ,CAAC,CAAC,EAAEC,QAAQ,IAAI,EAAE;MAClE,MAAMjE,cAAc,CAAC,CAAC;MAEtB,IAAI8D,eAAe,KAAKrE,eAAe,IAAI6E,iBAAiB,CAACC,MAAM,KAAK,CAAC,EAAE;QACzE;QACA;QACA;QACAtF,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;MAC3B;IACF,CAAC,CAAC,OAAO8C,KAAK,EAAE;MACd,MAAM6B,SAAS,GAAG5F,qBAAqB,CAAC+D,KAAK,CAAC;MAE9C,IAAI6B,SAAS,IAAIX,eAAe,KAAKpE,eAAe,EAAE;QACpD;QACAR,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;QACzB;MACF;MAEAlB,eAAe,CAACgE,KAAK,EAAE;QACrBa,cAAc,EAAE,eAAe;QAC/BC,IAAI,EAAE1E,iBAAiB;QACvBmB,OAAO;QACPwD,YAAY,EAAGC,GAAW,IAAKrD,YAAY,CAAC;UAAEqC,KAAK,EAAEgB;QAAI,CAAC,CAAC;QAC3DxE,MAAM;QACNsF,MAAM,EAAED,SAAS,GAAG,GAAG,GAAGE;MAC5B,CAAC,CAAC;IACJ;EACF,CAAC,EACD,CACEjF,eAAe,EACfI,iBAAiB,EACjBX,KAAK,EACLC,MAAM,EACNe,OAAO,EACPH,aAAa,EACbO,YAAY,EACZN,cAAc,CAElB,CAAC;;EAED;AACF;AACA;EACE,MAAM2E,SAAS,GAAGnG,WAAW,CAAC,YAA2B;IACvD,IAAI,CAACiB,eAAe,EAAE;MACpB,MAAMkD,KAAK,GAAG,IAAIyB,KAAK,CAAC,yBAAyB,CAAC;MAClD9D,YAAY,CAAC;QAAEqC,KAAK,EAAEA,KAAK,CAACY;MAAQ,CAAC,CAAC;MACtCrD,OAAO,GAAG;QAAEqD,OAAO,EAAEZ,KAAK,CAACY,OAAO;QAAEE,IAAI,EAAEzE,qBAAqB;QAAEyF,MAAM,EAAE;MAAI,CAAC,CAAC;MAC/E,MAAM9B,KAAK;IACb;IAEA,IAAI;MACF;MACA;MACA;MACA;MACA,MAAM5C,aAAa,CAACsE,OAAO,CAAC;QAAEO,GAAG,EAAE;MAAK,CAAC,CAAC;MAC1C;MACA;MACA;MACA3F,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;MACrC,MAAMU,iBAAiB,CAAC,CAAC;IAC3B,CAAC,CAAC,OAAO8C,KAAK,EAAE;MACdhE,eAAe,CAACgE,KAAK,EAAE;QACrBa,cAAc,EAAE,mBAAmB;QACnCC,IAAI,EAAEzE,qBAAqB;QAC3BkB,OAAO;QACPwD,YAAY,EAAGC,GAAW,IAAKrD,YAAY,CAAC;UAAEqC,KAAK,EAAEgB;QAAI,CAAC,CAAC;QAC3DxE;MACF,CAAC,CAAC;MACF,MAAMwD,KAAK,YAAYyB,KAAK,GAAGzB,KAAK,GAAG,IAAIyB,KAAK,CAAC,mBAAmB,CAAC;IACvE;EACF,CAAC,EAAE,CAAC3E,eAAe,EAAEI,iBAAiB,EAAEX,KAAK,EAAEC,MAAM,EAAEe,OAAO,EAAEH,aAAa,EAAEO,YAAY,CAAC,CAAC;EAE7F,OAAO;IACL+C,MAAM;IACNO,MAAM;IACNe;EACF,CAAC;AACH,CAAC","ignoreList":[]}
+{"version":3,"names":["useCallback","DeviceManager","fetchSessionsWithFallback","handleAuthError","isInvalidSessionError","SignatureService","LOGIN_ERROR_CODE","LOGOUT_ERROR_CODE","LOGOUT_ALL_ERROR_CODE","clearPersistedAuthSafe","store","logger","clear","catch","clearError","useAuthOperations","oxyServices","activeSessionId","setActiveSessionId","updateSessions","saveActiveSessionId","clearSessionState","switchSession","sessionClient","syncFromClient","onAuthStateChange","onError","loginSuccess","loginFailure","logoutStore","setAuthState","identityBinding","refreshPinnedAccountId","performSignIn","publicKey","deviceFingerprintObj","getDeviceFingerprint","deviceFingerprint","JSON","stringify","deviceInfo","getDeviceInfo","deviceName","getDefaultDeviceName","challengeResponse","requestChallenge","challenge","signature","timestamp","signChallenge","fullUser","sessionResponse","verifyChallenge","deviceSecret","deviceId","save","sessionId","userId","user","id","accessToken","expiresAt","persistError","pinStore","toLowerCase","accountId","pinError","registerAndActivate","registrationError","getCurrentUser","allDeviceSessions","fallbackDeviceId","fallbackUserId","error","__DEV__","existingSession","find","session","toString","logoutSession","logoutError","filter","merge","signIn","isLoading","message","defaultMessage","code","setAuthError","msg","logout","targetSessionId","sessionToLogout","targetAccountId","getState","accounts","account","Error","signOut","remainingAccounts","length","isInvalid","status","undefined","logoutAll","all"],"sourceRoot":"../../../../../src","sources":["ui/context/hooks/useAuthOperations.ts"],"mappings":";;AAAA,SAASA,WAAW,QAAQ,OAAO;AAInC,SAASC,aAAa,QAAQ,aAAa;AAC3C,SAASC,yBAAyB,QAAQ,+BAA4B;AACtE,SAASC,eAAe,EAAEC,qBAAqB,QAAQ,8BAA2B;AAGlF,SAASC,gBAAgB,QAAQ,aAAa;AAwD9C,MAAMC,gBAAgB,GAAG,aAAa;AACtC,MAAMC,iBAAiB,GAAG,cAAc;AACxC,MAAMC,qBAAqB,GAAG,kBAAkB;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,sBAAsBA,CACpCC,KAAqB,EACrBC,MAAmD,EAC7C;EACND,KAAK,CAACE,KAAK,CAAC,CAAC,CAACC,KAAK,CAAEC,UAAU,IAAK;IAClCH,MAAM,GAAG,kDAAkD,EAAEG,UAAU,CAAC;EAC1E,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAMC,iBAAiB,GAAGA,CAAC;EAChCC,WAAW;EACXN,KAAK;EACLO,eAAe;EACfC,kBAAkB;EAClBC,cAAc;EACdC,mBAAmB;EACnBC,iBAAiB;EACjBC,aAAa;EACbC,aAAa;EACbC,cAAc;EACdC,iBAAiB;EACjBC,OAAO;EACPC,YAAY;EACZC,YAAY;EACZC,WAAW;EACXC,YAAY;EACZnB,MAAM;EACNoB,eAAe;EACfC;AACwB,CAAC,KAA8B;EACvD;AACF;AACA;EACE,MAAMC,aAAa,GAAGjC,WAAW,CAC/B,MAAOkC,SAAiB,IAAoB;IAC1C,MAAMC,oBAAoB,GAAGlC,aAAa,CAACmC,oBAAoB,CAAC,CAAC;IACjE,MAAMC,iBAAiB,GAAGC,IAAI,CAACC,SAAS,CAACJ,oBAAoB,CAAC;IAC9D,MAAMK,UAAU,GAAG,MAAMvC,aAAa,CAACwC,aAAa,CAAC,CAAC;IACtD,MAAMC,UAAU,GAAGF,UAAU,CAACE,UAAU,IAAIzC,aAAa,CAAC0C,oBAAoB,CAAC,CAAC;IAEhF,MAAMC,iBAAiB,GAAG,MAAM5B,WAAW,CAAC6B,gBAAgB,CAACX,SAAS,CAAC;IACvE,MAAMY,SAAS,GAAGF,iBAAiB,CAACE,SAAS;;IAE7C;IACA;IACA;;IAEA;IACA,MAAM;MAAEA,SAAS,EAAEC,SAAS;MAAEC;IAAU,CAAC,GAAG,MAAM3C,gBAAgB,CAAC4C,aAAa,CAACH,SAAS,CAAC;IAE3F,IAAII,QAAc;IAClB,IAAIC,eAAqC;;IAEzC;IACA;IACA;IACAA,eAAe,GAAG,MAAMnC,WAAW,CAACoC,eAAe,CACjDlB,SAAS,EACTY,SAAS,EACTC,SAAS,EACTC,SAAS,EACTN,UAAU,EACVL,iBACF,CAAC;;IAED;IACA;IACA;IACA;IACA;IACA;IACA,MAAMgB,YAAY,GAAGF,eAAe,CAACE,YAAY;IACjD,IAAIF,eAAe,CAACG,QAAQ,IAAID,YAAY,EAAE;MAC5C,IAAI;QACF,MAAM3C,KAAK,CAAC6C,IAAI,CAAC;UACfC,SAAS,EAAEL,eAAe,CAACK,SAAS;UACpCC,MAAM,EAAEN,eAAe,CAACO,IAAI,CAACC,EAAE;UAC/BL,QAAQ,EAAEH,eAAe,CAACG,QAAQ;UAClCD,YAAY;UACZ,IAAIF,eAAe,CAACS,WAAW,GAAG;YAAEA,WAAW,EAAET,eAAe,CAACS;UAAY,CAAC,GAAG,CAAC,CAAC,CAAC;UACpF,IAAIT,eAAe,CAACU,SAAS,GAAG;YAAEA,SAAS,EAAEV,eAAe,CAACU;UAAU,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOC,YAAY,EAAE;QACrBnD,MAAM,GAAG,4CAA4C,EAAEmD,YAAY,CAAC;MACtE;IACF;IAEA,IAAI/B,eAAe,EAAE;MACnB,IAAI;QACF,MAAMA,eAAe,CAACgC,QAAQ,CAACR,IAAI,CAAC;UAClCrB,SAAS,EAAEA,SAAS,CAAC8B,WAAW,CAAC,CAAC;UAClCC,SAAS,EAAEd,eAAe,CAACO,IAAI,CAACC;QAClC,CAAC,CAAC;QACF,MAAM3B,sBAAsB,GAAG,CAAC;MAClC,CAAC,CAAC,OAAOkC,QAAQ,EAAE;QACjBvD,MAAM,GAAG,8CAA8C,EAAEuD,QAAQ,CAAC;MACpE;IACF;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,IAAI;MACF,MAAM3C,aAAa,CAAC4C,mBAAmB,CAAChB,eAAe,CAACO,IAAI,CAACC,EAAE,CAAC;MAChE,MAAMnC,cAAc,CAAC,CAAC;IACxB,CAAC,CAAC,OAAO4C,iBAAiB,EAAE;MAC1BzD,MAAM,GAAG,oDAAoD,EAAEyD,iBAAiB,CAAC;IACnF;;IAEA;IACA;IACA;IACA;IACAlB,QAAQ,GAAG,MAAMlC,WAAW,CAACqD,cAAc,CAAC,CAAC;;IAE7C;IACA,IAAIC,iBAAkC,GAAG,EAAE;IAC3C,IAAI;MACFA,iBAAiB,GAAG,MAAMpE,yBAAyB,CAACc,WAAW,EAAEmC,eAAe,CAACK,SAAS,EAAE;QAC1Fe,gBAAgB,EAAEpB,eAAe,CAACG,QAAQ;QAC1CkB,cAAc,EAAEtB,QAAQ,CAACS,EAAE;QAC3BhD;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,OAAO8D,KAAK,EAAE;MACd,IAAIC,OAAO,IAAI/D,MAAM,EAAE;QACrBA,MAAM,CAAC,6CAA6C,EAAE8D,KAAK,CAAC;MAC9D;IACF;;IAEA;IACA,MAAME,eAAe,GAAGL,iBAAiB,CAACM,IAAI,CAC3CC,OAAO,IACNA,OAAO,CAACpB,MAAM,EAAEqB,QAAQ,CAAC,CAAC,KAAK5B,QAAQ,CAACS,EAAE,EAAEmB,QAAQ,CAAC,CAAC,IACtDD,OAAO,CAACrB,SAAS,KAAKL,eAAe,CAACK,SAC1C,CAAC;IAED,IAAImB,eAAe,EAAE;MACnB;MACA,IAAI;QACF,MAAM3D,WAAW,CAAC+D,aAAa,CAAC5B,eAAe,CAACK,SAAS,EAAEL,eAAe,CAACK,SAAS,CAAC;MACvF,CAAC,CAAC,OAAOwB,WAAW,EAAE;QACpB;QACA,IAAIN,OAAO,IAAI/D,MAAM,EAAE;UACrBA,MAAM,CAAC,4DAA4D,EAAEqE,WAAW,CAAC;QACnF;MACF;MACA,MAAM1D,aAAa,CAACqD,eAAe,CAACnB,SAAS,CAAC;MAC9CrC,cAAc,CACZmD,iBAAiB,CAACW,MAAM,CAAEJ,OAAO,IAAKA,OAAO,CAACrB,SAAS,KAAKL,eAAe,CAACK,SAAS,CAAC,EACtF;QAAE0B,KAAK,EAAE;MAAM,CACjB,CAAC;MACDzD,iBAAiB,GAAGyB,QAAQ,CAAC;MAC7B,OAAOA,QAAQ;IACjB;IAEAhC,kBAAkB,CAACiC,eAAe,CAACK,SAAS,CAAC;IAC7C,MAAMpC,mBAAmB,CAAC+B,eAAe,CAACK,SAAS,CAAC;IACpDrC,cAAc,CAACmD,iBAAiB,EAAE;MAAEY,KAAK,EAAE;IAAK,CAAC,CAAC;IAElDvD,YAAY,CAACuB,QAAQ,CAAC;IACtBzB,iBAAiB,GAAGyB,QAAQ,CAAC;IAE7B,OAAOA,QAAQ;EACjB,CAAC,EACD,CACEvC,MAAM,EACNgB,YAAY,EACZF,iBAAiB,EACjBT,WAAW,EACXI,mBAAmB,EACnBG,aAAa,EACbL,kBAAkB,EAClBR,KAAK,EACLY,aAAa,EACbE,cAAc,EACdL,cAAc,EACdY,eAAe,EACfC,sBAAsB,CAE1B,CAAC;;EAED;AACF;AACA;EACE,MAAMmD,MAAM,GAAGnF,WAAW,CACxB,OAAOkC,SAAiB,EAAEQ,UAAmB,KAAoB;IAC/DZ,YAAY,CAAC;MAAEsD,SAAS,EAAE,IAAI;MAAEX,KAAK,EAAE;IAAK,CAAC,CAAC;IAE9C,IAAI;MACF,OAAO,MAAMxC,aAAa,CAACC,SAAS,CAAC;IACvC,CAAC,CAAC,OAAOuC,KAAK,EAAE;MACd,MAAMY,OAAO,GAAGlF,eAAe,CAACsE,KAAK,EAAE;QACrCa,cAAc,EAAE,gBAAgB;QAChCC,IAAI,EAAEjF,gBAAgB;QACtBoB,OAAO;QACP8D,YAAY,EAAGC,GAAW,IAAK3D,YAAY,CAAC;UAAE2C,KAAK,EAAEgB;QAAI,CAAC,CAAC;QAC3D9E;MACF,CAAC,CAAC;MACFiB,YAAY,CAACyD,OAAO,CAAC;MACrB,MAAMZ,KAAK;IACb,CAAC,SAAS;MACR3C,YAAY,CAAC;QAAEsD,SAAS,EAAE;MAAM,CAAC,CAAC;IACpC;EACF,CAAC,EACD,CAACtD,YAAY,EAAEG,aAAa,EAAEL,YAAY,EAAEF,OAAO,EAAEf,MAAM,CAC7D,CAAC;;EAED;AACF;AACA;EACE,MAAM+E,MAAM,GAAG1F,WAAW,CACxB,MAAO2F,eAAwB,IAAoB;IACjD,IAAI,CAAC1E,eAAe,EAAE;IAEtB,IAAI;MACF,MAAM2E,eAAe,GAAGD,eAAe,IAAI1E,eAAe;;MAE1D;MACA;MACA;MACA;MACA,MAAM4E,eAAe,GAAGtE,aAAa,CAClCuE,QAAQ,CAAC,CAAC,EACTC,QAAQ,CAACnB,IAAI,CAAEoB,OAAO,IAAKA,OAAO,CAACxC,SAAS,KAAKoC,eAAe,CAAC,EAAE3B,SAAS;MAChF,IAAI,CAAC4B,eAAe,EAAE;QACpB,MAAM,IAAII,KAAK,CAAC,wCAAwCL,eAAe,GAAG,CAAC;MAC7E;MAEA,MAAMrE,aAAa,CAAC2E,OAAO,CAAC;QAAEjC,SAAS,EAAE4B;MAAgB,CAAC,CAAC;;MAE3D;MACA;MACA;MACA;MACA,MAAMM,iBAAiB,GAAG5E,aAAa,CAACuE,QAAQ,CAAC,CAAC,EAAEC,QAAQ,IAAI,EAAE;MAClE,MAAMvE,cAAc,CAAC,CAAC;MAEtB,IAAIoE,eAAe,KAAK3E,eAAe,IAAIkF,iBAAiB,CAACC,MAAM,KAAK,CAAC,EAAE;QACzE;QACA;QACA;QACA3F,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;MAC3B;IACF,CAAC,CAAC,OAAOoD,KAAK,EAAE;MACd,MAAM4B,SAAS,GAAGjG,qBAAqB,CAACqE,KAAK,CAAC;MAE9C,IAAI4B,SAAS,IAAIV,eAAe,KAAK1E,eAAe,EAAE;QACpD;QACAR,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;QACrC,MAAMU,iBAAiB,CAAC,CAAC;QACzB;MACF;MAEAlB,eAAe,CAACsE,KAAK,EAAE;QACrBa,cAAc,EAAE,eAAe;QAC/BC,IAAI,EAAEhF,iBAAiB;QACvBmB,OAAO;QACP8D,YAAY,EAAGC,GAAW,IAAK3D,YAAY,CAAC;UAAE2C,KAAK,EAAEgB;QAAI,CAAC,CAAC;QAC3D9E,MAAM;QACN2F,MAAM,EAAED,SAAS,GAAG,GAAG,GAAGE;MAC5B,CAAC,CAAC;IACJ;EACF,CAAC,EACD,CACEtF,eAAe,EACfI,iBAAiB,EACjBX,KAAK,EACLC,MAAM,EACNe,OAAO,EACPH,aAAa,EACbO,YAAY,EACZN,cAAc,CAElB,CAAC;;EAED;AACF;AACA;EACE,MAAMgF,SAAS,GAAGxG,WAAW,CAAC,YAA2B;IACvD,IAAI,CAACiB,eAAe,EAAE;MACpB,MAAMwD,KAAK,GAAG,IAAIwB,KAAK,CAAC,yBAAyB,CAAC;MAClDnE,YAAY,CAAC;QAAE2C,KAAK,EAAEA,KAAK,CAACY;MAAQ,CAAC,CAAC;MACtC3D,OAAO,GAAG;QAAE2D,OAAO,EAAEZ,KAAK,CAACY,OAAO;QAAEE,IAAI,EAAE/E,qBAAqB;QAAE8F,MAAM,EAAE;MAAI,CAAC,CAAC;MAC/E,MAAM7B,KAAK;IACb;IAEA,IAAI;MACF;MACA;MACA;MACA;MACA,MAAMlD,aAAa,CAAC2E,OAAO,CAAC;QAAEO,GAAG,EAAE;MAAK,CAAC,CAAC;MAC1C;MACA;MACA;MACAhG,sBAAsB,CAACC,KAAK,EAAEC,MAAM,CAAC;MACrC,MAAMU,iBAAiB,CAAC,CAAC;IAC3B,CAAC,CAAC,OAAOoD,KAAK,EAAE;MACdtE,eAAe,CAACsE,KAAK,EAAE;QACrBa,cAAc,EAAE,mBAAmB;QACnCC,IAAI,EAAE/E,qBAAqB;QAC3BkB,OAAO;QACP8D,YAAY,EAAGC,GAAW,IAAK3D,YAAY,CAAC;UAAE2C,KAAK,EAAEgB;QAAI,CAAC,CAAC;QAC3D9E;MACF,CAAC,CAAC;MACF,MAAM8D,KAAK,YAAYwB,KAAK,GAAGxB,KAAK,GAAG,IAAIwB,KAAK,CAAC,mBAAmB,CAAC;IACvE;EACF,CAAC,EAAE,CAAChF,eAAe,EAAEI,iBAAiB,EAAEX,KAAK,EAAEC,MAAM,EAAEe,OAAO,EAAEH,aAAa,EAAEO,YAAY,CAAC,CAAC;EAE7F,OAAO;IACLqD,MAAM;IACNO,MAAM;IACNc;EACF,CAAC;AACH,CAAC","ignoreList":[]}

package/lib/module/ui/context/useOxyAccountGraph.js

@@ -5,10 +5,12 @@ import { logger as loggerUtil } from '@oxyhq/core';
 import { isUnauthorizedStatus } from "./oxyContextHelpers.js";
 import { resetSessionScopedStores } from "../stores/resetSessionScopedStores.js";
 import { ASSET_DOWNLOAD_URLS_QUERY_KEY } from "../hooks/useResolvedFileUrls.js";
+import { IdentityBoundSessionError } from "../session/index.js";
 export function useOxyAccountGraph({
   isAuthenticated,
   tokenReady,
   initialized,
+  identityBound,
   oxyServices,
   sessionClient,
   syncFromClient,
@@ -19,7 +21,7 @@ export function useOxyAccountGraph({
 }) {
   const [accounts, setAccounts] = useState([]);
   const refreshAccounts = useCallback(async () => {
-    if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
+    if (identityBound || !isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
       setAccounts([]);
       return;
     }
@@ -38,13 +40,13 @@ export function useOxyAccountGraph({
         }, err);
       }
     }
-  }, [isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
+  }, [identityBound, isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
   useEffect(() => {
-    if (isAuthenticated && initialized && tokenReady) {
+    if (!identityBound && isAuthenticated && initialized && tokenReady) {
       refreshAccounts();
       void accountDialogControllerRef.current?.refresh();
     }
-  }, [isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
+  }, [identityBound, isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
   const runPostAccountSwitchSideEffects = useCallback(async () => {
     resetSessionScopedStores();
     // Scoped media tokens are per-viewer — drop any cached URLs immediately so
@@ -57,6 +59,12 @@ export function useOxyAccountGraph({
     queryClient.invalidateQueries();
   }, [refreshAccounts, queryClient]);
   const switchToAccount = useCallback(async accountId => {
+    if (identityBound) {
+      // Loud rejection, never a silent no-op: a resolved promise here would
+      // read to the caller as a completed switch that simply left the user
+      // unchanged, which is exactly the confusion this mode must avoid.
+      throw new IdentityBoundSessionError('switchToAccount');
+    }
     const deviceState = sessionClient.getState();
     if (deviceState?.accounts.some(account => account.accountId === accountId)) {
       await sessionClient.switchAccount(accountId);
@@ -84,7 +92,7 @@ export function useOxyAccountGraph({
       hubSync: false
     });
     await runPostAccountSwitchSideEffects();
-  }, [oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
+  }, [identityBound, oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
   const createAccount = useCallback(async data => {
     const account = await oxyServices.createAccount(data);
     await refreshAccounts();

package/lib/module/ui/context/useOxyAccountGraph.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useEffect","useState","logger","loggerUtil","isUnauthorizedStatus","resetSessionScopedStores","ASSET_DOWNLOAD_URLS_QUERY_KEY","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","oxyServices","sessionClient","syncFromClient","commitSession","queryClient","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","refreshAccounts","getAccessToken","list","listAccounts","err","current","__DEV__","debug","component","refresh","runPostAccountSwitchSideEffects","removeQueries","queryKey","invalidateQueries","switchToAccount","accountId","deviceState","getState","some","account","switchAccount","result","user","sessionId","Error","accessToken","deviceSecret","deviceId","expiresAt","userId","id","activate","hubSync","createAccount","data"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,QAAQ,QAAwB,OAAO;AAGxE,SAASC,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAElD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,wBAAwB,QAAQ,uCAAoC;AAC7E,SAASC,6BAA6B,QAAQ,iCAA8B;AAgB5E,OAAO,SAASC,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,WAAW;EACXC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAGlB,QAAQ,CAAgB,EAAE,CAAC;EAE3D,MAAMmB,eAAe,GAAGrB,WAAW,CAAC,YAA2B;IAC7D,IAAI,CAACS,eAAe,IAAI,CAACC,UAAU,IAAI,CAACE,WAAW,CAACU,cAAc,CAAC,CAAC,EAAE;MACpEF,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMG,IAAI,GAAG,MAAMX,WAAW,CAACY,YAAY,CAAC,CAAC;MAC7CJ,WAAW,CAACG,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ,IAAIpB,oBAAoB,CAACoB,GAAG,CAAC,EAAE;QAC7BL,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACQ,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXvB,UAAU,CAACwB,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEJ,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAAChB,eAAe,EAAEG,WAAW,EAAEF,UAAU,EAAEQ,oBAAoB,CAAC,CAAC;EAEpEjB,SAAS,CAAC,MAAM;IACd,IAAIQ,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAChDW,eAAe,CAAC,CAAC;MACjB,KAAKJ,0BAA0B,CAACS,OAAO,EAAEI,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACrB,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEW,eAAe,EAAEJ,0BAA0B,CAAC,CAAC;EAE3F,MAAMc,+BAA+B,GAAG/B,WAAW,CAAC,YAA2B;IAC7EM,wBAAwB,CAAC,CAAC;IAC1B;IACA;IACA;IACAU,WAAW,CAACgB,aAAa,CAAC;MAAEC,QAAQ,EAAE,CAAC1B,6BAA6B;IAAE,CAAC,CAAC;IACxE,MAAMc,eAAe,CAAC,CAAC;IACvBL,WAAW,CAACkB,iBAAiB,CAAC,CAAC;EACjC,CAAC,EAAE,CAACb,eAAe,EAAEL,WAAW,CAAC,CAAC;EAElC,MAAMmB,eAAe,GAAGnC,WAAW,CACjC,MAAOoC,SAAiB,IAAoB;IAC1C,MAAMC,WAAW,GAAGxB,aAAa,CAACyB,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAElB,QAAQ,CAACoB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACJ,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAMvB,aAAa,CAAC4B,aAAa,CAACL,SAAS,CAAC;MAC5C,MAAMtB,cAAc,CAAC,CAAC;MACtB,MAAMiB,+BAA+B,CAAC,CAAC;MACvC;IACF;IAEA,MAAMW,MAAM,GAAG,MAAM9B,WAAW,CAACuB,eAAe,CAACC,SAAS,CAAC;IAC3D,IAAI,CAACM,MAAM,EAAEC,IAAI,IAAI,CAACD,MAAM,EAAEE,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAM9B,aAAa,CACjB;MACE6B,SAAS,EAAEF,MAAM,CAACE,SAAS;MAC3BE,WAAW,EAAEJ,MAAM,CAACI,WAAW;MAC/BC,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACC,IAAI,CAACQ,EAAE;MACtBR,IAAI,EAAED,MAAM,CAACC;IACf,CAAC;IACD;IACA;IACA;MAAES,QAAQ,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAM,CACnC,CAAC;IACD,MAAMtB,+BAA+B,CAAC,CAAC;EACzC,CAAC,EACD,CAACnB,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,EAAEgB,+BAA+B,CAC7F,CAAC;EAED,MAAMuB,aAAa,GAAGtD,WAAW,CAC/B,MAAOuD,IAAwB,IAA2B;IACxD,MAAMf,OAAO,GAAG,MAAM5B,WAAW,CAAC0C,aAAa,CAACC,IAAI,CAAC;IACrD,MAAMlC,eAAe,CAAC,CAAC;IACvB,OAAOmB,OAAO;EAChB,CAAC,EACD,CAAC5B,WAAW,EAAES,eAAe,CAC/B,CAAC;EAED,OAAO;IACLF,QAAQ;IACRE,eAAe;IACfc,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["useCallback","useEffect","useState","logger","loggerUtil","isUnauthorizedStatus","resetSessionScopedStores","ASSET_DOWNLOAD_URLS_QUERY_KEY","IdentityBoundSessionError","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","identityBound","oxyServices","sessionClient","syncFromClient","commitSession","queryClient","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","refreshAccounts","getAccessToken","list","listAccounts","err","current","__DEV__","debug","component","refresh","runPostAccountSwitchSideEffects","removeQueries","queryKey","invalidateQueries","switchToAccount","accountId","deviceState","getState","some","account","switchAccount","result","user","sessionId","Error","accessToken","deviceSecret","deviceId","expiresAt","userId","id","activate","hubSync","createAccount","data"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,SAAS,EAAEC,QAAQ,QAAwB,OAAO;AAGxE,SAASC,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAElD,SAASC,oBAAoB,QAAQ,wBAAqB;AAC1D,SAASC,wBAAwB,QAAQ,uCAAoC;AAC7E,SAASC,6BAA6B,QAAQ,iCAA8B;AAC5E,SAASC,yBAAyB,QAAQ,qBAAY;AAsBtD,OAAO,SAASC,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,aAAa;EACbC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,WAAW;EACXC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAGpB,QAAQ,CAAgB,EAAE,CAAC;EAE3D,MAAMqB,eAAe,GAAGvB,WAAW,CAAC,YAA2B;IAC7D,IAAIa,aAAa,IAAI,CAACH,eAAe,IAAI,CAACC,UAAU,IAAI,CAACG,WAAW,CAACU,cAAc,CAAC,CAAC,EAAE;MACrFF,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMG,IAAI,GAAG,MAAMX,WAAW,CAACY,YAAY,CAAC,CAAC;MAC7CJ,WAAW,CAACG,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ,IAAItB,oBAAoB,CAACsB,GAAG,CAAC,EAAE;QAC7BL,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACQ,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXzB,UAAU,CAAC0B,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEJ,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAACd,aAAa,EAAEH,eAAe,EAAEI,WAAW,EAAEH,UAAU,EAAES,oBAAoB,CAAC,CAAC;EAEnFnB,SAAS,CAAC,MAAM;IACd,IAAI,CAACY,aAAa,IAAIH,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAClEY,eAAe,CAAC,CAAC;MACjB,KAAKJ,0BAA0B,CAACS,OAAO,EAAEI,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACnB,aAAa,EAAEH,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEY,eAAe,EAAEJ,0BAA0B,CAAC,CAAC;EAE1G,MAAMc,+BAA+B,GAAGjC,WAAW,CAAC,YAA2B;IAC7EM,wBAAwB,CAAC,CAAC;IAC1B;IACA;IACA;IACAY,WAAW,CAACgB,aAAa,CAAC;MAAEC,QAAQ,EAAE,CAAC5B,6BAA6B;IAAE,CAAC,CAAC;IACxE,MAAMgB,eAAe,CAAC,CAAC;IACvBL,WAAW,CAACkB,iBAAiB,CAAC,CAAC;EACjC,CAAC,EAAE,CAACb,eAAe,EAAEL,WAAW,CAAC,CAAC;EAElC,MAAMmB,eAAe,GAAGrC,WAAW,CACjC,MAAOsC,SAAiB,IAAoB;IAC1C,IAAIzB,aAAa,EAAE;MACjB;MACA;MACA;MACA,MAAM,IAAIL,yBAAyB,CAAC,iBAAiB,CAAC;IACxD;IACA,MAAM+B,WAAW,GAAGxB,aAAa,CAACyB,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAElB,QAAQ,CAACoB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACJ,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAMvB,aAAa,CAAC4B,aAAa,CAACL,SAAS,CAAC;MAC5C,MAAMtB,cAAc,CAAC,CAAC;MACtB,MAAMiB,+BAA+B,CAAC,CAAC;MACvC;IACF;IAEA,MAAMW,MAAM,GAAG,MAAM9B,WAAW,CAACuB,eAAe,CAACC,SAAS,CAAC;IAC3D,IAAI,CAACM,MAAM,EAAEC,IAAI,IAAI,CAACD,MAAM,EAAEE,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAM9B,aAAa,CACjB;MACE6B,SAAS,EAAEF,MAAM,CAACE,SAAS;MAC3BE,WAAW,EAAEJ,MAAM,CAACI,WAAW;MAC/BC,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACC,IAAI,CAACQ,EAAE;MACtBR,IAAI,EAAED,MAAM,CAACC;IACf,CAAC;IACD;IACA;IACA;MAAES,QAAQ,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAM,CACnC,CAAC;IACD,MAAMtB,+BAA+B,CAAC,CAAC;EACzC,CAAC,EACD,CAACpB,aAAa,EAAEC,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,EAAEgB,+BAA+B,CAC5G,CAAC;EAED,MAAMuB,aAAa,GAAGxD,WAAW,CAC/B,MAAOyD,IAAwB,IAA2B;IACxD,MAAMf,OAAO,GAAG,MAAM5B,WAAW,CAAC0C,aAAa,CAACC,IAAI,CAAC;IACrD,MAAMlC,eAAe,CAAC,CAAC;IACvB,OAAOmB,OAAO;EAChB,CAAC,EACD,CAAC5B,WAAW,EAAES,eAAe,CAC/B,CAAC;EAED,OAAO;IACLF,QAAQ;IACRE,eAAe;IACfc,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/hooks/useSwitchableAccounts.js

@@ -18,7 +18,12 @@ const EMPTY_SNAPSHOT = {
     authorizeCode: null,
     qrPayload: null,
     expiresAt: null,
-    error: null
+    error: null,
+    route: null,
+    routeFailed: false,
+    pushSentAt: null,
+    openedAt: null,
+    progress: 'idle'
   },
   commonsAvailability: 'unknown'
 };

package/lib/module/ui/hooks/useSwitchableAccounts.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useMemo","useSyncExternalStore","useOxy","EMPTY_SNAPSHOT","view","accounts","activeAccountId","loading","error","switchingAccountId","signIn","phase","authorizeCode","qrPayload","expiresAt","commonsAvailability","useSwitchableAccounts","accountDialogController","controller","subscribe","listener","undefined","getSnapshot","snapshot","currentSessionId","active","find","account","accountId","sessionId","isLoading"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSwitchableAccounts.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,OAAO,EAAEC,oBAAoB,QAAQ,OAAO;AAElE,SAASC,MAAM,QAAQ,0BAAuB;AAW9C;AACA;AACA;AACA;AACA,MAAMC,cAAqC,GAAG;EAC1CC,IAAI,EAAE,UAAU;EAChBC,QAAQ,EAAE,EAAE;EACZC,eAAe,EAAE,IAAI;EACrBC,OAAO,EAAE,KAAK;EACdC,KAAK,EAAE,IAAI;EACXC,kBAAkB,EAAE,IAAI;EACxBC,MAAM,EAAE;IAAEC,KAAK,EAAE,MAAM;IAAEC,aAAa,EAAE,IAAI;IAAEC,SAAS,EAAE,IAAI;IAAEC,SAAS,EAAE,IAAI;IAAEN,KAAK,EAAE;EAAK,CAAC;EAC7FO,mBAAmB,EAAE;AACzB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,qBAAqBA,CAAA,EAAgC;EACjE,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAGhB,MAAM,CAAC,CAAC;EAExD,MAAMiB,SAAS,GAAGpB,WAAW,CACxBqB,QAAoB,IAAMF,UAAU,GAAGA,UAAU,CAACC,SAAS,CAACC,QAAQ,CAAC,GAAG,MAAMC,SAAU,EACzF,CAACH,UAAU,CACf,CAAC;EACD,MAAMI,WAAW,GAAGvB,WAAW,CAC3B,MAAOmB,UAAU,GAAGA,UAAU,CAACI,WAAW,CAAC,CAAC,GAAGnB,cAAe,EAC9D,CAACe,UAAU,CACf,CAAC;EACD,MAAMK,QAAQ,GAAGtB,oBAAoB,CAACkB,SAAS,EAAEG,WAAW,EAAEA,WAAW,CAAC;EAE1E,MAAME,gBAAgB,GAAGxB,OAAO,CAAgB,MAAM;IAClD,MAAMyB,MAAM,GAAGF,QAAQ,CAAClB,QAAQ,CAACqB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,SAAS,KAAKL,QAAQ,CAACjB,eAAe,CAAC;IAClG,OAAOmB,MAAM,EAAEI,SAAS,IAAI,IAAI;EACpC,CAAC,EAAE,CAACN,QAAQ,CAAC,CAAC;EAEd,OAAO;IACHlB,QAAQ,EAAEkB,QAAQ,CAAClB,QAAQ;IAC3ByB,SAAS,EAAEP,QAAQ,CAAChB,OAAO;IAC3BiB;EACJ,CAAC;AACL","ignoreList":[]}
+{"version":3,"names":["useCallback","useMemo","useSyncExternalStore","useOxy","EMPTY_SNAPSHOT","view","accounts","activeAccountId","loading","error","switchingAccountId","signIn","phase","authorizeCode","qrPayload","expiresAt","route","routeFailed","pushSentAt","openedAt","progress","commonsAvailability","useSwitchableAccounts","accountDialogController","controller","subscribe","listener","undefined","getSnapshot","snapshot","currentSessionId","active","find","account","accountId","sessionId","isLoading"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSwitchableAccounts.ts"],"mappings":";;AAAA,SAASA,WAAW,EAAEC,OAAO,EAAEC,oBAAoB,QAAQ,OAAO;AAElE,SAASC,MAAM,QAAQ,0BAAuB;AAW9C;AACA;AACA;AACA;AACA,MAAMC,cAAqC,GAAG;EAC1CC,IAAI,EAAE,UAAU;EAChBC,QAAQ,EAAE,EAAE;EACZC,eAAe,EAAE,IAAI;EACrBC,OAAO,EAAE,KAAK;EACdC,KAAK,EAAE,IAAI;EACXC,kBAAkB,EAAE,IAAI;EACxBC,MAAM,EAAE;IACJC,KAAK,EAAE,MAAM;IACbC,aAAa,EAAE,IAAI;IACnBC,SAAS,EAAE,IAAI;IACfC,SAAS,EAAE,IAAI;IACfN,KAAK,EAAE,IAAI;IACXO,KAAK,EAAE,IAAI;IACXC,WAAW,EAAE,KAAK;IAClBC,UAAU,EAAE,IAAI;IAChBC,QAAQ,EAAE,IAAI;IACdC,QAAQ,EAAE;EACd,CAAC;EACDC,mBAAmB,EAAE;AACzB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,qBAAqBA,CAAA,EAAgC;EACjE,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAGrB,MAAM,CAAC,CAAC;EAExD,MAAMsB,SAAS,GAAGzB,WAAW,CACxB0B,QAAoB,IAAMF,UAAU,GAAGA,UAAU,CAACC,SAAS,CAACC,QAAQ,CAAC,GAAG,MAAMC,SAAU,EACzF,CAACH,UAAU,CACf,CAAC;EACD,MAAMI,WAAW,GAAG5B,WAAW,CAC3B,MAAOwB,UAAU,GAAGA,UAAU,CAACI,WAAW,CAAC,CAAC,GAAGxB,cAAe,EAC9D,CAACoB,UAAU,CACf,CAAC;EACD,MAAMK,QAAQ,GAAG3B,oBAAoB,CAACuB,SAAS,EAAEG,WAAW,EAAEA,WAAW,CAAC;EAE1E,MAAME,gBAAgB,GAAG7B,OAAO,CAAgB,MAAM;IAClD,MAAM8B,MAAM,GAAGF,QAAQ,CAACvB,QAAQ,CAAC0B,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,SAAS,KAAKL,QAAQ,CAACtB,eAAe,CAAC;IAClG,OAAOwB,MAAM,EAAEI,SAAS,IAAI,IAAI;EACpC,CAAC,EAAE,CAACN,QAAQ,CAAC,CAAC;EAEd,OAAO;IACHvB,QAAQ,EAAEuB,QAAQ,CAACvB,QAAQ;IAC3B8B,SAAS,EAAEP,QAAQ,CAACrB,OAAO;IAC3BsB;EACJ,CAAC;AACL","ignoreList":[]}

package/lib/module/ui/index.js

@@ -26,7 +26,6 @@ export { LogoText } from "./components/logo/LogoText.js";
 export { RequireOxyAuth } from "./components/RequireOxyAuth.js";
 export { default as FollowButton } from "./components/FollowButton.js";
 export { default as OxyPayButton } from "./components/OxyPayButton.js";
-export { FontLoader, setupFonts } from './components/FontLoader';
 export { default as ProfileButton } from "./components/ProfileButton.js";
 
 // Context + hooks

package/lib/module/ui/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["default","OxyProvider","OxySignInButton","OxyAuthPrompt","LogoIcon","LogoText","RequireOxyAuth","FollowButton","OxyPayButton","FontLoader","setupFonts","ProfileButton","useOxy","useAuth","useFollow","useSeedFollowStatuses","useStorage","ProfileScreen","ManageAccountScreen","CreateAccountScreen","AccountMembersScreen","AccountSettingsScreen","useAuthStore","useAccountStore","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage"],"sourceRoot":"../../../src","sources":["ui/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA;AACA,SAASA,OAAO,IAAIC,WAAW,QAAQ,6BAA0B;AACjE,SAASD,OAAO,IAAIE,eAAe,QAAQ,iCAA8B;AACzE,SAASF,OAAO,IAAIG,aAAa,QAAQ,+BAA4B;AAErE,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,cAAc,QAAQ,gCAA6B;AAE5D,SAASN,OAAO,IAAIO,YAAY,QAAQ,8BAA2B;AACnE,SAASP,OAAO,IAAIQ,YAAY,QAAQ,8BAA2B;AACnE,SAASC,UAAU,EAAEC,UAAU,QAAQ,yBAAyB;AAChE,SAASV,OAAO,IAAIW,aAAa,QAAQ,+BAA4B;;AAErE;AACA,SAASC,MAAM,QAAQ,yBAAsB;AAC7C,SAASC,OAAO,QAAQ,oBAAiB;AACzC,SAASC,SAAS,EAAEC,qBAAqB,QAAQ,sBAAmB;AACpE,SAASC,UAAU,QAAQ,uBAAoB;AAG/C;AACA,SAAShB,OAAO,IAAIiB,aAAa,QAAQ,4BAAyB;AAClE,SAASjB,OAAO,IAAIkB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAASlB,OAAO,IAAImB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAASnB,OAAO,IAAIoB,oBAAoB,QAAQ,mCAAgC;AAChF,SAASpB,OAAO,IAAIqB,qBAAqB,QAAQ,oCAAiC;;AAElF;AACA,SAASC,YAAY,QAAQ,uBAAoB;AACjD,SAASC,eAAe,QAAQ,0BAAuB;;AAEvD;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,0BAAuB","ignoreList":[]}
+{"version":3,"names":["default","OxyProvider","OxySignInButton","OxyAuthPrompt","LogoIcon","LogoText","RequireOxyAuth","FollowButton","OxyPayButton","ProfileButton","useOxy","useAuth","useFollow","useSeedFollowStatuses","useStorage","ProfileScreen","ManageAccountScreen","CreateAccountScreen","AccountMembersScreen","AccountSettingsScreen","useAuthStore","useAccountStore","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage"],"sourceRoot":"../../../src","sources":["ui/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA;AACA,SAASA,OAAO,IAAIC,WAAW,QAAQ,6BAA0B;AACjE,SAASD,OAAO,IAAIE,eAAe,QAAQ,iCAA8B;AACzE,SAASF,OAAO,IAAIG,aAAa,QAAQ,+BAA4B;AAErE,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,QAAQ,QAAQ,+BAA4B;AACrD,SAASC,cAAc,QAAQ,gCAA6B;AAE5D,SAASN,OAAO,IAAIO,YAAY,QAAQ,8BAA2B;AACnE,SAASP,OAAO,IAAIQ,YAAY,QAAQ,8BAA2B;AACnE,SAASR,OAAO,IAAIS,aAAa,QAAQ,+BAA4B;;AAErE;AACA,SAASC,MAAM,QAAQ,yBAAsB;AAC7C,SAASC,OAAO,QAAQ,oBAAiB;AACzC,SAASC,SAAS,EAAEC,qBAAqB,QAAQ,sBAAmB;AACpE,SAASC,UAAU,QAAQ,uBAAoB;AAG/C;AACA,SAASd,OAAO,IAAIe,aAAa,QAAQ,4BAAyB;AAClE,SAASf,OAAO,IAAIgB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAAShB,OAAO,IAAIiB,mBAAmB,QAAQ,kCAA+B;AAC9E,SAASjB,OAAO,IAAIkB,oBAAoB,QAAQ,mCAAgC;AAChF,SAASlB,OAAO,IAAImB,qBAAqB,QAAQ,oCAAiC;;AAElF;AACA,SAASC,YAAY,QAAQ,uBAAoB;AACjD,SAASC,eAAe,QAAQ,0BAAuB;;AAEvD;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,0BAAuB","ignoreList":[]}

package/lib/module/ui/oauth/browserAuthTransport.js

@@ -0,0 +1,167 @@
+"use strict";
+
+/**
+ * The single web entry point for third-party "Sign in with Oxy".
+ *
+ * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
+ * result — so callers (`OxySignInButton`, and any RP with its own button) never
+ * touch `window.open`, `postMessage`, or the token exchange themselves.
+ *
+ * Popup mode keeps the relying party mounted: its route, scroll position, and
+ * unsaved state survive because the tab never navigates. Redirect mode is the
+ * compatibility fallback, and is also where popup mode lands when the browser
+ * blocks the window — a blocked popup must still sign the user in, not dead-end.
+ *
+ * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
+ * remains the native lane and is untouched by this module.
+ */
+
+import { logger, persistOAuthHandshake } from '@oxyhq/core';
+import { redirectToAuthorize } from "../components/oauthNavigation.js";
+import { isWebBrowser } from "../utils/isWebBrowser.js";
+import { completeOAuthCode } from "./completeOAuthCode.js";
+import { prepareAuthorizeRequest } from "./oauthHandshake.js";
+import { awaitOAuthPopupResult, closeOAuthPopup, navigateOAuthPopup, openOAuthPopup } from "./oauthPopup.js";
+
+/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
+
+/** Per-press inputs for {@link startWebOAuthSignIn}. */
+
+export async function startWebOAuthSignIn(context, options) {
+  if (!isWebBrowser()) {
+    closeOAuthPopup(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'no-browser'
+    };
+  }
+  if (context.identityBound) {
+    closeOAuthPopup(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'identity-bound'
+    };
+  }
+  if (!context.clientId) {
+    closeOAuthPopup(options.popup ?? null);
+    return {
+      status: 'unsupported',
+      reason: 'missing-client-id'
+    };
+  }
+
+  // Claim the window BEFORE the first `await` below, so a caller that invoked us
+  // straight from the click still has gesture attribution. An explicit `null`
+  // means the caller already tried and was blocked.
+  const popup = context.mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
+  if (context.mode === 'redirect') {
+    closeOAuthPopup(popup);
+    return startRedirectSignIn(context, options, 'redirect-mode');
+  }
+  if (!popup) {
+    logger.warn('OAuth sign-in popup was blocked; falling back to a full-page redirect', {
+      component: 'browserAuthTransport'
+    });
+    return startRedirectSignIn(context, options, 'popup-blocked');
+  }
+  try {
+    const prepared = await prepareAuthorizeRequest({
+      clientId: context.clientId,
+      redirectUri: options.redirectUri,
+      authorizeBaseUrl: context.authorizeBaseUrl,
+      scope: options.scope,
+      responseMode: 'web_message'
+    });
+    if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
+      return startRedirectSignIn(context, options, 'popup-navigation-failed');
+    }
+    const outcome = await awaitOAuthPopupResult({
+      popup,
+      expectedOrigin: prepared.authorizeOrigin,
+      expectedState: prepared.handshake.state,
+      redirectUri: options.redirectUri,
+      ...(options.timeoutMs !== undefined ? {
+        timeoutMs: options.timeoutMs
+      } : {})
+    });
+    switch (outcome.kind) {
+      case 'code':
+        {
+          const completion = await completeOAuthCode({
+            oxyServices: context.oxyServices,
+            clientId: context.clientId,
+            code: outcome.code,
+            returnedState: outcome.state,
+            handshake: prepared.handshake,
+            redirectUri: options.redirectUri,
+            commitSession: context.commitSession
+          });
+          return completion.ok ? {
+            status: 'signed-in'
+          } : {
+            status: 'failed',
+            reason: completion.reason
+          };
+        }
+      case 'oauth-error':
+        return {
+          status: 'failed',
+          reason: 'idp-error',
+          description: outcome.errorDescription ?? outcome.error
+        };
+      case 'state-mismatch':
+        return {
+          status: 'failed',
+          reason: 'state-mismatch'
+        };
+      case 'closed':
+        return {
+          status: 'cancelled'
+        };
+      case 'timed-out':
+        return {
+          status: 'timed-out'
+        };
+      case 'unsupported':
+        return {
+          status: 'unsupported',
+          reason: 'no-browser'
+        };
+    }
+  } finally {
+    // Covers throws after open (prepare/exchange/commit) and every settled outcome.
+    closeOAuthPopup(popup);
+  }
+}
+
+/**
+ * Full-page hand-off to the IdP. The document is destroyed by the navigation, so
+ * the handshake MUST reach `sessionStorage` first — without it the return trip
+ * cannot validate `state`, and starting the redirect anyway would strand the
+ * user at a callback that can only refuse them.
+ */
+async function startRedirectSignIn(context, options, via) {
+  // Narrowed by the caller; repeated here so this helper is safe on its own.
+  if (!context.clientId) return {
+    status: 'unsupported',
+    reason: 'missing-client-id'
+  };
+  const prepared = await prepareAuthorizeRequest({
+    clientId: context.clientId,
+    redirectUri: options.redirectUri,
+    authorizeBaseUrl: context.authorizeBaseUrl,
+    scope: options.scope
+  });
+  if (!persistOAuthHandshake(prepared.handshake.state, prepared.handshake.codeVerifier, options.redirectUri)) {
+    return {
+      status: 'failed',
+      reason: 'handshake-storage'
+    };
+  }
+  redirectToAuthorize(prepared.authorizeUrl);
+  return {
+    status: 'redirecting',
+    via
+  };
+}
+//# sourceMappingURL=browserAuthTransport.js.map

package/lib/module/ui/oauth/browserAuthTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["logger","persistOAuthHandshake","redirectToAuthorize","isWebBrowser","completeOAuthCode","prepareAuthorizeRequest","awaitOAuthPopupResult","closeOAuthPopup","navigateOAuthPopup","openOAuthPopup","startWebOAuthSignIn","context","options","popup","status","reason","identityBound","clientId","mode","undefined","startRedirectSignIn","warn","component","prepared","redirectUri","authorizeBaseUrl","scope","responseMode","authorizeUrl","outcome","expectedOrigin","authorizeOrigin","expectedState","handshake","state","timeoutMs","kind","completion","oxyServices","code","returnedState","commitSession","ok","description","errorDescription","error","via","codeVerifier"],"sourceRoot":"../../../../src","sources":["ui/oauth/browserAuthTransport.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,MAAM,EAAEC,qBAAqB,QAAQ,aAAa;AAE3D,SAASC,mBAAmB,QAAQ,kCAA+B;AACnE,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,iBAAiB,QAAQ,wBAAqB;AACvD,SAASC,uBAAuB,QAAQ,qBAAkB;AAC1D,SAASC,qBAAqB,EAAEC,eAAe,EAAEC,kBAAkB,EAAEC,cAAc,QAAQ,iBAAc;;AASzG;;AAeA;;AAwBA,OAAO,eAAeC,mBAAmBA,CACvCC,OAAiC,EACjCC,OAAmC,EACJ;EAC/B,IAAI,CAACT,YAAY,CAAC,CAAC,EAAE;IACnBI,eAAe,CAACK,OAAO,CAACC,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAa,CAAC;EACxD;EACA,IAAIJ,OAAO,CAACK,aAAa,EAAE;IACzBT,eAAe,CAACK,OAAO,CAACC,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAC5D;EACA,IAAI,CAACJ,OAAO,CAACM,QAAQ,EAAE;IACrBV,eAAe,CAACK,OAAO,CAACC,KAAK,IAAI,IAAI,CAAC;IACtC,OAAO;MAAEC,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC/D;;EAEA;EACA;EACA;EACA,MAAMF,KAAK,GACTF,OAAO,CAACO,IAAI,KAAK,OAAO,IAAIN,OAAO,CAACC,KAAK,KAAKM,SAAS,GAAGV,cAAc,CAAC,CAAC,GAAGG,OAAO,CAACC,KAAK,IAAI,IAAI;EAEpG,IAAIF,OAAO,CAACO,IAAI,KAAK,UAAU,EAAE;IAC/BX,eAAe,CAACM,KAAK,CAAC;IACtB,OAAOO,mBAAmB,CAACT,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EACA,IAAI,CAACC,KAAK,EAAE;IACVb,MAAM,CAACqB,IAAI,CAAC,uEAAuE,EAAE;MACnFC,SAAS,EAAE;IACb,CAAC,CAAC;IACF,OAAOF,mBAAmB,CAACT,OAAO,EAAEC,OAAO,EAAE,eAAe,CAAC;EAC/D;EAEA,IAAI;IACF,MAAMW,QAAQ,GAAG,MAAMlB,uBAAuB,CAAC;MAC7CY,QAAQ,EAAEN,OAAO,CAACM,QAAQ;MAC1BO,WAAW,EAAEZ,OAAO,CAACY,WAAW;MAChCC,gBAAgB,EAAEd,OAAO,CAACc,gBAAgB;MAC1CC,KAAK,EAAEd,OAAO,CAACc,KAAK;MACpBC,YAAY,EAAE;IAChB,CAAC,CAAC;IAEF,IAAI,CAACnB,kBAAkB,CAACK,KAAK,EAAEU,QAAQ,CAACK,YAAY,CAAC,EAAE;MACrD,OAAOR,mBAAmB,CAACT,OAAO,EAAEC,OAAO,EAAE,yBAAyB,CAAC;IACzE;IAEA,MAAMiB,OAAO,GAAG,MAAMvB,qBAAqB,CAAC;MAC1CO,KAAK;MACLiB,cAAc,EAAEP,QAAQ,CAACQ,eAAe;MACxCC,aAAa,EAAET,QAAQ,CAACU,SAAS,CAACC,KAAK;MACvCV,WAAW,EAAEZ,OAAO,CAACY,WAAW;MAChC,IAAIZ,OAAO,CAACuB,SAAS,KAAKhB,SAAS,GAAG;QAAEgB,SAAS,EAAEvB,OAAO,CAACuB;MAAU,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,QAAQN,OAAO,CAACO,IAAI;MAClB,KAAK,MAAM;QAAE;UACX,MAAMC,UAAU,GAAG,MAAMjC,iBAAiB,CAAC;YACzCkC,WAAW,EAAE3B,OAAO,CAAC2B,WAAW;YAChCrB,QAAQ,EAAEN,OAAO,CAACM,QAAQ;YAC1BsB,IAAI,EAAEV,OAAO,CAACU,IAAI;YAClBC,aAAa,EAAEX,OAAO,CAACK,KAAK;YAC5BD,SAAS,EAAEV,QAAQ,CAACU,SAAS;YAC7BT,WAAW,EAAEZ,OAAO,CAACY,WAAW;YAChCiB,aAAa,EAAE9B,OAAO,CAAC8B;UACzB,CAAC,CAAC;UACF,OAAOJ,UAAU,CAACK,EAAE,GAChB;YAAE5B,MAAM,EAAE;UAAY,CAAC,GACvB;YAAEA,MAAM,EAAE,QAAQ;YAAEC,MAAM,EAAEsB,UAAU,CAACtB;UAAO,CAAC;QACrD;MACA,KAAK,aAAa;QAChB,OAAO;UACLD,MAAM,EAAE,QAAQ;UAChBC,MAAM,EAAE,WAAW;UACnB4B,WAAW,EAAEd,OAAO,CAACe,gBAAgB,IAAIf,OAAO,CAACgB;QACnD,CAAC;MACH,KAAK,gBAAgB;QACnB,OAAO;UAAE/B,MAAM,EAAE,QAAQ;UAAEC,MAAM,EAAE;QAAiB,CAAC;MACvD,KAAK,QAAQ;QACX,OAAO;UAAED,MAAM,EAAE;QAAY,CAAC;MAChC,KAAK,WAAW;QACd,OAAO;UAAEA,MAAM,EAAE;QAAY,CAAC;MAChC,KAAK,aAAa;QAChB,OAAO;UAAEA,MAAM,EAAE,aAAa;UAAEC,MAAM,EAAE;QAAa,CAAC;IAC1D;EACF,CAAC,SAAS;IACR;IACAR,eAAe,CAACM,KAAK,CAAC;EACxB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeO,mBAAmBA,CAChCT,OAAiC,EACjCC,OAAmC,EACnCkC,GAA2B,EACI;EAC/B;EACA,IAAI,CAACnC,OAAO,CAACM,QAAQ,EAAE,OAAO;IAAEH,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAoB,CAAC;EAEpF,MAAMQ,QAAQ,GAAG,MAAMlB,uBAAuB,CAAC;IAC7CY,QAAQ,EAAEN,OAAO,CAACM,QAAQ;IAC1BO,WAAW,EAAEZ,OAAO,CAACY,WAAW;IAChCC,gBAAgB,EAAEd,OAAO,CAACc,gBAAgB;IAC1CC,KAAK,EAAEd,OAAO,CAACc;EACjB,CAAC,CAAC;EAEF,IAAI,CAACzB,qBAAqB,CACxBsB,QAAQ,CAACU,SAAS,CAACC,KAAK,EACxBX,QAAQ,CAACU,SAAS,CAACc,YAAY,EAC/BnC,OAAO,CAACY,WACV,CAAC,EAAE;IACD,OAAO;MAAEV,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAoB,CAAC;EAC1D;EAEAb,mBAAmB,CAACqB,QAAQ,CAACK,YAAY,CAAC;EAC1C,OAAO;IAAEd,MAAM,EAAE,aAAa;IAAEgC;EAAI,CAAC;AACvC","ignoreList":[]}

package/lib/module/ui/oauth/completeOAuthCode.js

@@ -0,0 +1,75 @@
+"use strict";
+
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+
+import { logger } from '@oxyhq/core';
+
+/** Inputs for {@link completeOAuthCode}. */
+
+export async function completeOAuthCode(input) {
+  let cleaned = false;
+  const runCleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    input.cleanup?.();
+  };
+  if (!input.handshake || !input.returnedState || input.handshake.state !== input.returnedState) {
+    logger.warn('OAuth completion rejected: missing or mismatched state', {
+      component: 'completeOAuthCode'
+    });
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'state-mismatch'
+    };
+  }
+  try {
+    const result = await input.oxyServices.exchangeOAuthCode({
+      code: input.code,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      codeVerifier: input.handshake.codeVerifier
+    });
+    runCleanup();
+    await input.commitSession({
+      sessionId: result.sessionId,
+      accessToken: result.accessToken,
+      deviceId: result.deviceId,
+      deviceSecret: result.deviceSecret,
+      userId: result.user.id,
+      expiresAt: result.expiresAt,
+      user: result.user
+    });
+    return {
+      ok: true
+    };
+  } catch (error) {
+    logger.warn('OAuth code exchange failed', {
+      component: 'completeOAuthCode'
+    }, error);
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'exchange-failed'
+    };
+  }
+}
+//# sourceMappingURL=completeOAuthCode.js.map

package/lib/module/ui/oauth/completeOAuthCode.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["logger","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","warn","component","ok","reason","result","oxyServices","exchangeOAuthCode","code","clientId","redirectUri","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,MAAM,QAAQ,aAAa;;AAGpC;;AA2BA,OAAO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FP,MAAM,CAACS,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFN,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEO,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMX,KAAK,CAACY,WAAW,CAACC,iBAAiB,CAAC;MACvDC,IAAI,EAAEd,KAAK,CAACc,IAAI;MAChBC,QAAQ,EAAEf,KAAK,CAACe,QAAQ;MACxBC,WAAW,EAAEhB,KAAK,CAACgB,WAAW;MAC9BC,YAAY,EAAEjB,KAAK,CAACI,SAAS,CAACa;IAChC,CAAC,CAAC;IACFf,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACkB,aAAa,CAAC;MACxBC,SAAS,EAAER,MAAM,CAACQ,SAAS;MAC3BC,WAAW,EAAET,MAAM,CAACS,WAAW;MAC/BC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;MACzBC,YAAY,EAAEX,MAAM,CAACW,YAAY;MACjCC,MAAM,EAAEZ,MAAM,CAACa,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEf,MAAM,CAACe,SAAS;MAC3BF,IAAI,EAAEb,MAAM,CAACa;IACf,CAAC,CAAC;IACF,OAAO;MAAEf,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOkB,KAAK,EAAE;IACd7B,MAAM,CAACS,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEmB,KAAK,CAAC;IACpFzB,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEO,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}

package/lib/module/ui/oauth/legacyRedirectLanes.js

@@ -0,0 +1,44 @@
+"use strict";
+
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+export function allowsAutomaticIdpRedirect(webAuthMode) {
+  return webAuthMode === 'redirect';
+}
+//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/module/ui/oauth/legacyRedirectLanes.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}