@oxyhq/services 22.13.1 → 23.0.0

package/lib/module/ui/utils/crossOriginRestore.js

@@ -1,131 +0,0 @@
-"use strict";
-
-import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, clearOAuthHandshake, persistOAuthHandshake, canonicalizeOAuthRedirectUri, logger } from '@oxyhq/core';
-import { isWebBrowser } from "./isWebBrowser.js";
-import { replaceUrlAfterOAuthReturn } from "./oauthReturn.js";
-import { redirectToAuthorize } from "../components/oauthNavigation.js";
-function sessionStore() {
-  return globalThis.sessionStorage;
-}
-
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export function isCrossOriginRestoreBlocked() {
-  const store = sessionStore();
-  if (!store) return false;
-  return Boolean(store.getItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY) || store.getItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY));
-}
-
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export function markCrossOriginRestoreAttempted() {
-  const store = sessionStore();
-  if (!store) return;
-  store.setItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, '1');
-  store.setItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY, '1');
-}
-
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export function clearCrossOriginRestoreGuards() {
-  const store = sessionStore();
-  if (!store) return;
-  for (const key of [OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY]) {
-    store.removeItem(key);
-  }
-}
-
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export function isSilentRestoreEligibleOrigin(origin) {
-  if (isLoopbackOrigin(origin)) return false;
-  if (isIdpHubOrigin()) return false;
-  return isOfficialWebOrigin(origin);
-}
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export async function maybeStartSilentOAuthRestore(opts) {
-  if (!isWebBrowser()) return false;
-  const location = globalThis.location;
-  if (!location) return false;
-
-  // Defense-in-depth: never bounce a loopback / non-official / IdP-hub origin to
-  // a hosted authorize endpoint (the caller gates on this too).
-  if (!isSilentRestoreEligibleOrigin(location.origin)) {
-    return false;
-  }
-  if (isCrossOriginRestoreBlocked()) {
-    return false;
-  }
-  const params = new URLSearchParams(location.search);
-  if (params.has('code') || params.has('error')) {
-    return false;
-  }
-  try {
-    const {
-      codeVerifier,
-      codeChallenge
-    } = await generatePkcePair();
-    const state = await generateOAuthState();
-    const redirectUri = canonicalizeOAuthRedirectUri(opts.redirectUri ?? location.origin);
-    if (!persistOAuthHandshake(state, codeVerifier, redirectUri)) {
-      return false;
-    }
-    const authorizeUrl = buildOAuthAuthorizeUrl({
-      authorizeBaseUrl: opts.authorizeBaseUrl,
-      clientId: opts.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-      scope: opts.scope,
-      prompt: 'none'
-    });
-    markCrossOriginRestoreAttempted();
-    redirectToAuthorize(authorizeUrl);
-    return true;
-  } catch (error) {
-    logger.warn('Silent OAuth restore skipped', {
-      component: 'crossOriginRestore'
-    }, error);
-    return false;
-  }
-}
-
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export function consumeSilentOAuthError() {
-  if (!isWebBrowser()) return null;
-  const location = globalThis.location;
-  const history = globalThis.history;
-  if (!location) return null;
-  const params = new URLSearchParams(location.search);
-  const error = params.get('error');
-  if (error !== 'login_required' && error !== 'consent_required') {
-    return null;
-  }
-  markCrossOriginRestoreAttempted();
-  if (history?.replaceState) {
-    const url = new URL(location.href);
-    url.searchParams.delete('error');
-    url.searchParams.delete('error_description');
-    url.searchParams.delete('state');
-    // Silent restore failed, but the visitor still asked for a specific page.
-    // Put them back on it rather than leaving them on the bare origin the IdP
-    // redirected to.
-    replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
-  }
-  clearOAuthHandshake();
-  return error;
-}
-//# sourceMappingURL=crossOriginRestore.js.map

package/lib/module/ui/utils/crossOriginRestore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["buildOAuthAuthorizeUrl","generateOAuthState","generatePkcePair","isIdpHubOrigin","isLoopbackOrigin","isOfficialWebOrigin","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","clearOAuthHandshake","persistOAuthHandshake","canonicalizeOAuthRedirectUri","logger","isWebBrowser","replaceUrlAfterOAuthReturn","redirectToAuthorize","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","maybeStartSilentOAuthRestore","opts","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","state","redirectUri","authorizeUrl","authorizeBaseUrl","clientId","scope","prompt","error","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","pathname","hash"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;AACA,SACEA,sBAAsB,EACtBC,kBAAkB,EAClBC,gBAAgB,EAChBC,cAAc,EACdC,gBAAgB,EAChBC,mBAAmB,EACnBC,sCAAsC,EACtCC,8BAA8B,EAC9BC,mBAAmB,EACnBC,qBAAqB,EACrBC,4BAA4B,EAC5BC,MAAM,QACD,aAAa;AACpB,SAASC,YAAY,QAAQ,mBAAgB;AAC7C,SAASC,0BAA0B,QAAQ,kBAAe;AAC1D,SAASC,mBAAmB,QAAQ,kCAA+B;AAEnE,SAASC,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACA,OAAO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACf,sCAAsC,CAAC,IACnDa,KAAK,CAACE,OAAO,CAACd,8BAA8B,CAChD,CAAC;AACH;;AAEA;AACA,OAAO,SAASe,+BAA+BA,CAAA,EAAS;EACtD,MAAMH,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACI,OAAO,CAACjB,sCAAsC,EAAE,GAAG,CAAC;EAC1Da,KAAK,CAACI,OAAO,CAAChB,8BAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACA,OAAO,SAASiB,6BAA6BA,CAAA,EAAS;EACpD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMM,GAAG,IAAI,CAACnB,sCAAsC,EAAEC,8BAA8B,CAAC,EAAE;IAC1FY,KAAK,CAACO,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAIxB,gBAAgB,CAACwB,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAIzB,cAAc,CAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAOE,mBAAmB,CAACuB,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACA,OAAO,eAAeC,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAClB,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMmB,QAAQ,GAAIf,UAAU,CAA6Be,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACJ,6BAA6B,CAACI,QAAQ,CAACH,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIV,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMc,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAMnC,gBAAgB,CAAC,CAAC;IAChE,MAAMoC,KAAK,GAAG,MAAMrC,kBAAkB,CAAC,CAAC;IACxC,MAAMsC,WAAW,GAAG7B,4BAA4B,CAC9CoB,IAAI,CAACS,WAAW,IAAIR,QAAQ,CAACH,MAC/B,CAAC;IACD,IAAI,CAACnB,qBAAqB,CAAC6B,KAAK,EAAEF,YAAY,EAAEG,WAAW,CAAC,EAAE;MAC5D,OAAO,KAAK;IACd;IAEA,MAAMC,YAAY,GAAGxC,sBAAsB,CAAC;MAC1CyC,gBAAgB,EAAEX,IAAI,CAACW,gBAAgB;MACvCC,QAAQ,EAAEZ,IAAI,CAACY,QAAQ;MACvBH,WAAW;MACXD,KAAK;MACLD,aAAa;MACbM,KAAK,EAAEb,IAAI,CAACa,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEFtB,+BAA+B,CAAC,CAAC;IACjCR,mBAAmB,CAAC0B,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOK,KAAK,EAAE;IACdlC,MAAM,CAACmC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEF,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASG,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAACpC,YAAY,CAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMmB,QAAQ,GAAIf,UAAU,CAAgDe,QAAQ;EACpF,MAAMkB,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMW,KAAK,GAAGb,MAAM,CAACkB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIL,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAvB,+BAA+B,CAAC,CAAC;EAEjC,IAAI2B,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACtB,QAAQ,CAACuB,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA3C,0BAA0B,CAAC,GAAGuC,GAAG,CAACK,QAAQ,GAAGL,GAAG,CAAClB,MAAM,GAAGkB,GAAG,CAACM,IAAI,EAAE,CAAC;EACvE;EACAlD,mBAAmB,CAAC,CAAC;EACrB,OAAOqC,KAAK;AACd","ignoreList":[]}

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts

@@ -1,40 +0,0 @@
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-import type { WebAuthMode } from './types';
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export declare function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean;
-//# sourceMappingURL=legacyRedirectLanes.d.ts.map

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacyRedirectLanes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/legacyRedirectLanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAE5E"}

package/lib/typescript/commonjs/ui/utils/crossOriginRestore.d.ts

@@ -1,43 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export declare function isCrossOriginRestoreBlocked(): boolean;
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export declare function markCrossOriginRestoreAttempted(): void;
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export declare function clearCrossOriginRestoreGuards(): void;
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export declare function isSilentRestoreEligibleOrigin(origin: string): boolean;
-export interface SilentOAuthRestoreOptions {
-    oxyServices: OxyServices;
-    clientId: string;
-    redirectUri?: string;
-    scope?: string;
-    /**
-     * Authorize endpoint override (env-configurable per deployment). Defaults to
-     * the production Oxy IdP when unset, so a local/staging app points silent
-     * restore at its OWN IdP instead of production `auth.oxy.so`.
-     */
-    authorizeBaseUrl?: string;
-}
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export declare function maybeStartSilentOAuthRestore(opts: SilentOAuthRestoreOptions): Promise<boolean>;
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export declare function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null;
-//# sourceMappingURL=crossOriginRestore.d.ts.map

package/lib/typescript/commonjs/ui/utils/crossOriginRestore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CA0BtF"}

package/lib/typescript/module/ui/oauth/legacyRedirectLanes.d.ts

@@ -1,40 +0,0 @@
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-import type { WebAuthMode } from './types.js';
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export declare function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean;
-//# sourceMappingURL=legacyRedirectLanes.d.ts.map

package/lib/typescript/module/ui/oauth/legacyRedirectLanes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacyRedirectLanes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/legacyRedirectLanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAS,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAE5E"}

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts

@@ -1,43 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export declare function isCrossOriginRestoreBlocked(): boolean;
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export declare function markCrossOriginRestoreAttempted(): void;
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export declare function clearCrossOriginRestoreGuards(): void;
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export declare function isSilentRestoreEligibleOrigin(origin: string): boolean;
-export interface SilentOAuthRestoreOptions {
-    oxyServices: OxyServices;
-    clientId: string;
-    redirectUri?: string;
-    scope?: string;
-    /**
-     * Authorize endpoint override (env-configurable per deployment). Defaults to
-     * the production Oxy IdP when unset, so a local/staging app points silent
-     * restore at its OWN IdP instead of production `auth.oxy.so`.
-     */
-    authorizeBaseUrl?: string;
-}
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export declare function maybeStartSilentOAuthRestore(opts: SilentOAuthRestoreOptions): Promise<boolean>;
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export declare function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null;
-//# sourceMappingURL=crossOriginRestore.d.ts.map

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CA0BtF"}

package/src/ui/boot/__tests__/coldBootWebAuthMode.test.ts

@@ -1,281 +0,0 @@
-/**
- * `runProviderColdBoot` — the `webAuthMode` transport gate (#691 phase 7).
- *
- * `webAuthMode: 'popup'` must never let the boot navigate the RP's top-level
- * window: no silent `prompt=none` restore, no authorize redirect, a signed-out
- * domain simply resolves signed out. `'redirect'` — still the default and the
- * compatibility path — must behave exactly as before.
- *
- * Unlike `__tests__/boot/runProviderColdBoot.test.ts` (deadline + connectivity
- * wiring, with `crossOriginRestore` stubbed out), this suite keeps the restore
- * lane REAL so the redirect-mode assertions reach the actual navigation
- * primitive — the thing popup mode has to suppress.
- */
-
-import type { AuthStateStore, PersistedAuthState, SessionClient } from '@oxyhq/core';
-
-// Only `runSessionColdBoot` and the origin-CLASSIFICATION predicates are faked.
-// jsdom's `location` is non-configurable, so origin eligibility has to be driven
-// through the predicates (their real behaviour is covered by core's own tests);
-// everything else in core (PKCE, authorize-URL builder, handshake store) stays
-// real so the redirect-mode lane is exercised end to end.
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return {
-    __esModule: true,
-    ...actual,
-    runSessionColdBoot: jest.fn(),
-    isLoopbackOrigin: jest.fn(() => false),
-    isOfficialWebOrigin: jest.fn(() => true),
-    isIdpHubOrigin: jest.fn(() => false),
-  };
-});
-
-// The ONLY top-level-window navigation primitive either lane can reach.
-jest.mock('../../components/oauthNavigation', () => ({
-  redirectToAuthorize: jest.fn(),
-}));
-
-// Spied but REAL: redirect mode must still perform the actual restore.
-jest.mock('../../utils/crossOriginRestore', () => {
-  const actual = jest.requireActual('../../utils/crossOriginRestore');
-  return {
-    __esModule: true,
-    ...actual,
-    maybeStartSilentOAuthRestore: jest.fn(actual.maybeStartSilentOAuthRestore),
-    consumeSilentOAuthError: jest.fn(actual.consumeSilentOAuthError),
-  };
-});
-
-jest.mock('../../utils/oauthReturn', () => {
-  const actual = jest.requireActual('../../utils/oauthReturn');
-  return {
-    __esModule: true,
-    ...actual,
-    tryCompleteOAuthReturn: jest.fn(async () => false),
-    consumeHubSyncFailure: jest.fn(actual.consumeHubSyncFailure),
-  };
-});
-
-import { runSessionColdBoot } from '@oxyhq/core';
-import { redirectToAuthorize } from '../../components/oauthNavigation';
-import {
-  clearCrossOriginRestoreGuards,
-  consumeSilentOAuthError,
-  maybeStartSilentOAuthRestore,
-} from '../../utils/crossOriginRestore';
-import { consumeHubSyncFailure, tryCompleteOAuthReturn } from '../../utils/oauthReturn';
-import { runProviderColdBoot, type RunProviderColdBootOptions } from '../runProviderColdBoot';
-
-const mockRunSessionColdBoot = runSessionColdBoot as jest.Mock;
-const mockRedirectToAuthorize = redirectToAuthorize as jest.Mock;
-const mockSilentRestore = maybeStartSilentOAuthRestore as jest.Mock;
-const mockConsumeSilentOAuthError = consumeSilentOAuthError as jest.Mock;
-const mockConsumeHubSyncFailure = consumeHubSyncFailure as jest.Mock;
-const mockTryCompleteOAuthReturn = tryCompleteOAuthReturn as jest.Mock;
-
-const CLIENT_ID = 'oxy_dk_test';
-
-/** An auth store holding no device credential — the signed-out domain case. */
-function makeEmptyAuthStore(): AuthStateStore {
-  return {
-    load: jest.fn(async (): Promise<PersistedAuthState | null> => null),
-    save: jest.fn(async () => undefined),
-    clear: jest.fn(async () => undefined),
-  } as unknown as AuthStateStore;
-}
-
-interface Harness {
-  options: RunProviderColdBootOptions;
-  commitSession: jest.Mock;
-  markAuthResolved: jest.Mock;
-  setTokenReady: jest.Mock;
-  sessionClientStart: jest.Mock;
-}
-
-function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harness {
-  const commitSession = jest.fn(async () => undefined);
-  const markAuthResolved = jest.fn();
-  const setTokenReady = jest.fn();
-  const sessionClientStart = jest.fn(async () => undefined);
-
-  const options: RunProviderColdBootOptions = {
-    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
-    authStore: makeEmptyAuthStore(),
-    clientId: CLIENT_ID,
-    sessionClient: { start: sessionClientStart } as unknown as SessionClient,
-    syncDeviceCredentialToHost: jest.fn(async () => undefined),
-    commitSession,
-    markAuthResolved,
-    setTokenReady,
-    ...overrides,
-  };
-
-  return { options, commitSession, markAuthResolved, setTokenReady, sessionClientStart };
-}
-
-/** `runSessionColdBoot` finding no session at all — the signed-out domain. */
-function stubSignedOutBoot(): void {
-  mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
-    await opts.onSignedOut?.('no_session');
-    return { kind: 'unauthenticated' } as const;
-  });
-}
-
-describe('runProviderColdBoot — webAuthMode transport gate (#691 phase 7)', () => {
-  beforeEach(() => {
-    mockRunSessionColdBoot.mockReset();
-    mockRedirectToAuthorize.mockClear();
-    mockSilentRestore.mockClear();
-    mockConsumeSilentOAuthError.mockClear();
-    mockConsumeHubSyncFailure.mockClear();
-    mockTryCompleteOAuthReturn.mockClear();
-    mockTryCompleteOAuthReturn.mockImplementation(async () => false);
-    globalThis.sessionStorage?.clear();
-    clearCrossOriginRestoreGuards();
-  });
-
-  describe("webAuthMode: 'popup'", () => {
-    it('never starts the silent restore and never navigates the top-level window', async () => {
-      stubSignedOutBoot();
-      const { options } = makeHarness({ webAuthMode: 'popup' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockSilentRestore).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-
-    it('resolves a domain with no local credential SIGNED OUT instead of bouncing', async () => {
-      stubSignedOutBoot();
-      const { options, markAuthResolved, commitSession, sessionClientStart } = makeHarness({
-        webAuthMode: 'popup',
-      });
-
-      await runProviderColdBoot(options);
-
-      // Auth resolution concluded (routing can settle), nothing was committed,
-      // and with no persisted credential the device socket is not started.
-      expect(markAuthResolved).toHaveBeenCalled();
-      expect(commitSession).not.toHaveBeenCalled();
-      expect(sessionClientStart).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-
-    it('still completes an authorization code already on the URL (blocked-popup fallback)', async () => {
-      // A popup-mode app lands here whenever the browser blocked the popup and
-      // `startWebOAuthSignIn` fell back to a full-page redirect.
-      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
-      const { options, markAuthResolved, setTokenReady } = makeHarness({ webAuthMode: 'popup' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
-      expect(setTokenReady).toHaveBeenLastCalledWith(true);
-      expect(markAuthResolved).toHaveBeenCalled();
-      // The device mint is short-circuited by the completed return leg.
-      expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-
-    it('commits the OAuth return WITHOUT hub sync', async () => {
-      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
-      const { options } = makeHarness({ webAuthMode: 'popup' });
-
-      await runProviderColdBoot(options);
-
-      const commit = mockTryCompleteOAuthReturn.mock.calls[0][0] as {
-        commitSession: (input: unknown) => Promise<void>;
-      };
-      await commit.commitSession({ sessionId: 's1', userId: 'u1' });
-      expect(options.commitSession).toHaveBeenCalledWith(
-        { sessionId: 's1', userId: 'u1' },
-        { activate: true, hubSync: false },
-      );
-    });
-  });
-
-  describe("webAuthMode: 'redirect' (unchanged compatibility path)", () => {
-    it('starts the silent restore and navigates to the IdP with prompt=none', async () => {
-      stubSignedOutBoot();
-      const { options } = makeHarness({ webAuthMode: 'redirect' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
-      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
-      const url = new URL(mockRedirectToAuthorize.mock.calls[0][0] as string);
-      expect(url.origin + url.pathname).toBe('https://auth.oxy.so/authorize');
-      expect(url.searchParams.get('client_id')).toBe(CLIENT_ID);
-      expect(url.searchParams.get('prompt')).toBe('none');
-    });
-
-    it('is the DEFAULT when no webAuthMode is supplied', async () => {
-      stubSignedOutBoot();
-      const { options } = makeHarness();
-
-      await runProviderColdBoot(options);
-
-      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
-      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
-    });
-
-    it('does NOT restore when the mint already resolved a session', async () => {
-      mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
-        const session = { sessionId: 's1', userId: 'u1', accessToken: 'at', via: 'device-secret-mint' };
-        await opts.onSession?.(session);
-        return { kind: 'session', via: session.via, session } as const;
-      });
-      const { options, commitSession } = makeHarness({ webAuthMode: 'redirect' });
-
-      await runProviderColdBoot(options);
-
-      expect(commitSession).toHaveBeenCalledWith(
-        { sessionId: 's1', accessToken: 'at', userId: 'u1' },
-        { activate: false },
-      );
-      expect(mockSilentRestore).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('URL-cleanup consumers run in BOTH modes', () => {
-    it.each(['popup', 'redirect'] as const)(
-      'consumes the silent-OAuth error and hub-sync failure params (%s)',
-      async (webAuthMode) => {
-        stubSignedOutBoot();
-        const { options } = makeHarness({ webAuthMode });
-
-        await runProviderColdBoot(options);
-
-        expect(mockConsumeSilentOAuthError).toHaveBeenCalledTimes(1);
-        expect(mockConsumeHubSyncFailure).toHaveBeenCalledTimes(1);
-      },
-    );
-
-    it.each(['popup', 'redirect'] as const)(
-      'consumes an authorization code left on the URL (%s)',
-      async (webAuthMode) => {
-        stubSignedOutBoot();
-        const { options } = makeHarness({ webAuthMode });
-
-        await runProviderColdBoot(options);
-
-        expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
-      },
-    );
-  });
-
-  describe('identity mode still skips both web OAuth lanes in either transport', () => {
-    it.each(['popup', 'redirect'] as const)('skips the return leg and the restore (%s)', async (webAuthMode) => {
-      stubSignedOutBoot();
-      const { options } = makeHarness({ webAuthMode, sessionMode: 'identity' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
-      expect(mockSilentRestore).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-  });
-});

package/src/ui/oauth/legacyRedirectLanes.ts

@@ -1,43 +0,0 @@
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-
-import type { WebAuthMode } from './types';
-
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean {
-  return webAuthMode === 'redirect';
-}