@oxyhq/services 26.0.1 → 26.0.3

package/lib/commonjs/ui/utils/crossOriginRestore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","_isWebBrowser","_oauthReturn","_oauthNavigation","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","isLoopbackOrigin","isIdpHubOrigin","isOfficialWebOrigin","maybeStartSilentOAuthRestore","opts","isWebBrowser","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","generatePkcePair","state","generateOAuthState","persistOAuthHandshake","redirectUri","normalizeOAuthRedirectUri","authorizeUrl","buildOAuthAuthorizeUrl","authorizeBaseUrl","clientId","scope","prompt","redirectToAuthorize","error","logger","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","replaceUrlAfterOAuthReturn","pathname","hash","clearOAuthHandshake"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;;;;;;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AAcA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,YAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AAEA,SAASI,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACC,4CAAsC,CAAC,IACnDH,KAAK,CAACE,OAAO,CAACE,oCAA8B,CAChD,CAAC;AACH;;AAEA;AACO,SAASC,+BAA+BA,CAAA,EAAS;EACtD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACM,OAAO,CAACH,4CAAsC,EAAE,GAAG,CAAC;EAC1DH,KAAK,CAACM,OAAO,CAACF,oCAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACO,SAASG,6BAA6BA,CAAA,EAAS;EACpD,MAAMP,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMQ,GAAG,IAAI,CAACL,4CAAsC,EAAEC,oCAA8B,CAAC,EAAE;IAC1FJ,KAAK,CAACS,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAI,IAAAC,sBAAgB,EAACD,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAI,IAAAE,oBAAc,EAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAO,IAAAC,yBAAmB,EAACH,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACO,eAAeI,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMC,QAAQ,GAAIrB,UAAU,CAA6BqB,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACR,6BAA6B,CAACQ,QAAQ,CAACP,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIZ,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMoB,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAM,IAAAC,sBAAgB,EAAC,CAAC;IAChE,MAAMC,KAAK,GAAG,MAAM,IAAAC,wBAAkB,EAAC,CAAC;IACxC,IAAI,CAAC,IAAAC,2BAAqB,EAACF,KAAK,EAAEH,YAAY,CAAC,EAAE;MAC/C,OAAO,KAAK;IACd;IAEA,MAAMM,WAAW,GAAG,IAAAC,+BAAyB,EAC3Cd,IAAI,CAACa,WAAW,IAAIX,QAAQ,CAACP,MAC/B,CAAC;IAED,MAAMoB,YAAY,GAAG,IAAAC,4BAAsB,EAAC;MAC1CC,gBAAgB,EAAEjB,IAAI,CAACiB,gBAAgB;MACvCC,QAAQ,EAAElB,IAAI,CAACkB,QAAQ;MACvBL,WAAW;MACXH,KAAK;MACLF,aAAa;MACbW,KAAK,EAAEnB,IAAI,CAACmB,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEF/B,+BAA+B,CAAC,CAAC;IACjC,IAAAgC,oCAAmB,EAACN,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOO,KAAK,EAAE;IACdC,YAAM,CAACC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEH,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASI,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAAC,IAAAzB,0BAAY,EAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMC,QAAQ,GAAIrB,UAAU,CAAgDqB,QAAQ;EACpF,MAAMyB,OAAO,GAAI9C,UAAU,CAA2B8C,OAAO;EAC7D,IAAI,CAACzB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMiB,KAAK,GAAGnB,MAAM,CAACyB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIN,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAjC,+BAA+B,CAAC,CAAC;EAEjC,IAAIsC,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAC7B,QAAQ,CAAC8B,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA,IAAAC,uCAA0B,EAAC,GAAGL,GAAG,CAACM,QAAQ,GAAGN,GAAG,CAACzB,MAAM,GAAGyB,GAAG,CAACO,IAAI,EAAE,CAAC;EACvE;EACA,IAAAC,yBAAmB,EAAC,CAAC;EACrB,OAAOhB,KAAK;AACd","ignoreList":[]}

package/lib/module/ui/oauth/legacyRedirectLanes.js

@@ -1,44 +0,0 @@
-"use strict";
-
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export function allowsAutomaticIdpRedirect(webAuthMode) {
-  return webAuthMode === 'redirect';
-}
-//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/module/ui/oauth/legacyRedirectLanes.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}

package/lib/module/ui/utils/crossOriginRestore.js

@@ -1,131 +0,0 @@
-"use strict";
-
-import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, clearOAuthHandshake, persistOAuthHandshake, normalizeOAuthRedirectUri, logger } from '@oxyhq/core';
-import { isWebBrowser } from "./isWebBrowser.js";
-import { replaceUrlAfterOAuthReturn } from "./oauthReturn.js";
-import { redirectToAuthorize } from "../components/oauthNavigation.js";
-function sessionStore() {
-  return globalThis.sessionStorage;
-}
-
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export function isCrossOriginRestoreBlocked() {
-  const store = sessionStore();
-  if (!store) return false;
-  return Boolean(store.getItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY) || store.getItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY));
-}
-
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export function markCrossOriginRestoreAttempted() {
-  const store = sessionStore();
-  if (!store) return;
-  store.setItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, '1');
-  store.setItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY, '1');
-}
-
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export function clearCrossOriginRestoreGuards() {
-  const store = sessionStore();
-  if (!store) return;
-  for (const key of [OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY]) {
-    store.removeItem(key);
-  }
-}
-
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export function isSilentRestoreEligibleOrigin(origin) {
-  if (isLoopbackOrigin(origin)) return false;
-  if (isIdpHubOrigin()) return false;
-  return isOfficialWebOrigin(origin);
-}
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export async function maybeStartSilentOAuthRestore(opts) {
-  if (!isWebBrowser()) return false;
-  const location = globalThis.location;
-  if (!location) return false;
-
-  // Defense-in-depth: never bounce a loopback / non-official / IdP-hub origin to
-  // a hosted authorize endpoint (the caller gates on this too).
-  if (!isSilentRestoreEligibleOrigin(location.origin)) {
-    return false;
-  }
-  if (isCrossOriginRestoreBlocked()) {
-    return false;
-  }
-  const params = new URLSearchParams(location.search);
-  if (params.has('code') || params.has('error')) {
-    return false;
-  }
-  try {
-    const {
-      codeVerifier,
-      codeChallenge
-    } = await generatePkcePair();
-    const state = await generateOAuthState();
-    if (!persistOAuthHandshake(state, codeVerifier)) {
-      return false;
-    }
-    const redirectUri = normalizeOAuthRedirectUri(opts.redirectUri ?? location.origin);
-    const authorizeUrl = buildOAuthAuthorizeUrl({
-      authorizeBaseUrl: opts.authorizeBaseUrl,
-      clientId: opts.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-      scope: opts.scope,
-      prompt: 'none'
-    });
-    markCrossOriginRestoreAttempted();
-    redirectToAuthorize(authorizeUrl);
-    return true;
-  } catch (error) {
-    logger.warn('Silent OAuth restore skipped', {
-      component: 'crossOriginRestore'
-    }, error);
-    return false;
-  }
-}
-
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export function consumeSilentOAuthError() {
-  if (!isWebBrowser()) return null;
-  const location = globalThis.location;
-  const history = globalThis.history;
-  if (!location) return null;
-  const params = new URLSearchParams(location.search);
-  const error = params.get('error');
-  if (error !== 'login_required' && error !== 'consent_required') {
-    return null;
-  }
-  markCrossOriginRestoreAttempted();
-  if (history?.replaceState) {
-    const url = new URL(location.href);
-    url.searchParams.delete('error');
-    url.searchParams.delete('error_description');
-    url.searchParams.delete('state');
-    // Silent restore failed, but the visitor still asked for a specific page.
-    // Put them back on it rather than leaving them on the bare origin the IdP
-    // redirected to.
-    replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
-  }
-  clearOAuthHandshake();
-  return error;
-}
-//# sourceMappingURL=crossOriginRestore.js.map

package/lib/module/ui/utils/crossOriginRestore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["buildOAuthAuthorizeUrl","generateOAuthState","generatePkcePair","isIdpHubOrigin","isLoopbackOrigin","isOfficialWebOrigin","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","clearOAuthHandshake","persistOAuthHandshake","normalizeOAuthRedirectUri","logger","isWebBrowser","replaceUrlAfterOAuthReturn","redirectToAuthorize","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","maybeStartSilentOAuthRestore","opts","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","state","redirectUri","authorizeUrl","authorizeBaseUrl","clientId","scope","prompt","error","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","pathname","hash"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;AACA,SACEA,sBAAsB,EACtBC,kBAAkB,EAClBC,gBAAgB,EAChBC,cAAc,EACdC,gBAAgB,EAChBC,mBAAmB,EACnBC,sCAAsC,EACtCC,8BAA8B,EAC9BC,mBAAmB,EACnBC,qBAAqB,EACrBC,yBAAyB,EACzBC,MAAM,QACD,aAAa;AACpB,SAASC,YAAY,QAAQ,mBAAgB;AAC7C,SAASC,0BAA0B,QAAQ,kBAAe;AAC1D,SAASC,mBAAmB,QAAQ,kCAA+B;AAEnE,SAASC,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACA,OAAO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACf,sCAAsC,CAAC,IACnDa,KAAK,CAACE,OAAO,CAACd,8BAA8B,CAChD,CAAC;AACH;;AAEA;AACA,OAAO,SAASe,+BAA+BA,CAAA,EAAS;EACtD,MAAMH,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACI,OAAO,CAACjB,sCAAsC,EAAE,GAAG,CAAC;EAC1Da,KAAK,CAACI,OAAO,CAAChB,8BAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACA,OAAO,SAASiB,6BAA6BA,CAAA,EAAS;EACpD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMM,GAAG,IAAI,CAACnB,sCAAsC,EAAEC,8BAA8B,CAAC,EAAE;IAC1FY,KAAK,CAACO,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAIxB,gBAAgB,CAACwB,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAIzB,cAAc,CAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAOE,mBAAmB,CAACuB,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACA,OAAO,eAAeC,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAClB,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMmB,QAAQ,GAAIf,UAAU,CAA6Be,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACJ,6BAA6B,CAACI,QAAQ,CAACH,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIV,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMc,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAMnC,gBAAgB,CAAC,CAAC;IAChE,MAAMoC,KAAK,GAAG,MAAMrC,kBAAkB,CAAC,CAAC;IACxC,IAAI,CAACQ,qBAAqB,CAAC6B,KAAK,EAAEF,YAAY,CAAC,EAAE;MAC/C,OAAO,KAAK;IACd;IAEA,MAAMG,WAAW,GAAG7B,yBAAyB,CAC3CoB,IAAI,CAACS,WAAW,IAAIR,QAAQ,CAACH,MAC/B,CAAC;IAED,MAAMY,YAAY,GAAGxC,sBAAsB,CAAC;MAC1CyC,gBAAgB,EAAEX,IAAI,CAACW,gBAAgB;MACvCC,QAAQ,EAAEZ,IAAI,CAACY,QAAQ;MACvBH,WAAW;MACXD,KAAK;MACLD,aAAa;MACbM,KAAK,EAAEb,IAAI,CAACa,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEFtB,+BAA+B,CAAC,CAAC;IACjCR,mBAAmB,CAAC0B,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOK,KAAK,EAAE;IACdlC,MAAM,CAACmC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEF,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASG,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAACpC,YAAY,CAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMmB,QAAQ,GAAIf,UAAU,CAAgDe,QAAQ;EACpF,MAAMkB,OAAO,GAAIjC,UAAU,CAA2BiC,OAAO;EAC7D,IAAI,CAAClB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMW,KAAK,GAAGb,MAAM,CAACkB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIL,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAvB,+BAA+B,CAAC,CAAC;EAEjC,IAAI2B,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACtB,QAAQ,CAACuB,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA3C,0BAA0B,CAAC,GAAGuC,GAAG,CAACK,QAAQ,GAAGL,GAAG,CAAClB,MAAM,GAAGkB,GAAG,CAACM,IAAI,EAAE,CAAC;EACvE;EACAlD,mBAAmB,CAAC,CAAC;EACrB,OAAOqC,KAAK;AACd","ignoreList":[]}

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts

@@ -1,40 +0,0 @@
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-import type { WebAuthMode } from './types';
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export declare function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean;
-//# sourceMappingURL=legacyRedirectLanes.d.ts.map

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacyRedirectLanes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/legacyRedirectLanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAE5E"}

package/lib/typescript/commonjs/ui/utils/crossOriginRestore.d.ts

@@ -1,43 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export declare function isCrossOriginRestoreBlocked(): boolean;
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export declare function markCrossOriginRestoreAttempted(): void;
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export declare function clearCrossOriginRestoreGuards(): void;
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export declare function isSilentRestoreEligibleOrigin(origin: string): boolean;
-export interface SilentOAuthRestoreOptions {
-    oxyServices: OxyServices;
-    clientId: string;
-    redirectUri?: string;
-    scope?: string;
-    /**
-     * Authorize endpoint override (env-configurable per deployment). Defaults to
-     * the production Oxy IdP when unset, so a local/staging app points silent
-     * restore at its OWN IdP instead of production `auth.oxy.so`.
-     */
-    authorizeBaseUrl?: string;
-}
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export declare function maybeStartSilentOAuthRestore(opts: SilentOAuthRestoreOptions): Promise<boolean>;
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export declare function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null;
-//# sourceMappingURL=crossOriginRestore.d.ts.map

package/lib/typescript/commonjs/ui/utils/crossOriginRestore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAiDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CA0BtF"}

package/lib/typescript/module/ui/oauth/legacyRedirectLanes.d.ts

@@ -1,40 +0,0 @@
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-import type { WebAuthMode } from './types.js';
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export declare function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean;
-//# sourceMappingURL=legacyRedirectLanes.d.ts.map

package/lib/typescript/module/ui/oauth/legacyRedirectLanes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacyRedirectLanes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/legacyRedirectLanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAS,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAE5E"}

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts

@@ -1,43 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export declare function isCrossOriginRestoreBlocked(): boolean;
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export declare function markCrossOriginRestoreAttempted(): void;
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export declare function clearCrossOriginRestoreGuards(): void;
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export declare function isSilentRestoreEligibleOrigin(origin: string): boolean;
-export interface SilentOAuthRestoreOptions {
-    oxyServices: OxyServices;
-    clientId: string;
-    redirectUri?: string;
-    scope?: string;
-    /**
-     * Authorize endpoint override (env-configurable per deployment). Defaults to
-     * the production Oxy IdP when unset, so a local/staging app points silent
-     * restore at its OWN IdP instead of production `auth.oxy.so`.
-     */
-    authorizeBaseUrl?: string;
-}
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export declare function maybeStartSilentOAuthRestore(opts: SilentOAuthRestoreOptions): Promise<boolean>;
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export declare function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null;
-//# sourceMappingURL=crossOriginRestore.d.ts.map

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAiDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CA0BtF"}