@oxyhq/services 26.0.1 → 26.0.3

package/src/ui/boot/__tests__/coldBootWebAuthMode.test.ts

@@ -1,281 +0,0 @@
-/**
- * `runProviderColdBoot` — the `webAuthMode` transport gate (#691 phase 7).
- *
- * `webAuthMode: 'popup'` must never let the boot navigate the RP's top-level
- * window: no silent `prompt=none` restore, no authorize redirect, a signed-out
- * domain simply resolves signed out. `'redirect'` — still the default and the
- * compatibility path — must behave exactly as before.
- *
- * Unlike `__tests__/boot/runProviderColdBoot.test.ts` (deadline + connectivity
- * wiring, with `crossOriginRestore` stubbed out), this suite keeps the restore
- * lane REAL so the redirect-mode assertions reach the actual navigation
- * primitive — the thing popup mode has to suppress.
- */
-
-import type { AuthStateStore, PersistedAuthState, SessionClient } from '@oxyhq/core';
-
-// Only `runSessionColdBoot` and the origin-CLASSIFICATION predicates are faked.
-// jsdom's `location` is non-configurable, so origin eligibility has to be driven
-// through the predicates (their real behaviour is covered by core's own tests);
-// everything else in core (PKCE, authorize-URL builder, handshake store) stays
-// real so the redirect-mode lane is exercised end to end.
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return {
-    __esModule: true,
-    ...actual,
-    runSessionColdBoot: jest.fn(),
-    isLoopbackOrigin: jest.fn(() => false),
-    isOfficialWebOrigin: jest.fn(() => true),
-    isIdpHubOrigin: jest.fn(() => false),
-  };
-});
-
-// The ONLY top-level-window navigation primitive either lane can reach.
-jest.mock('../../components/oauthNavigation', () => ({
-  redirectToAuthorize: jest.fn(),
-}));
-
-// Spied but REAL: redirect mode must still perform the actual restore.
-jest.mock('../../utils/crossOriginRestore', () => {
-  const actual = jest.requireActual('../../utils/crossOriginRestore');
-  return {
-    __esModule: true,
-    ...actual,
-    maybeStartSilentOAuthRestore: jest.fn(actual.maybeStartSilentOAuthRestore),
-    consumeSilentOAuthError: jest.fn(actual.consumeSilentOAuthError),
-  };
-});
-
-jest.mock('../../utils/oauthReturn', () => {
-  const actual = jest.requireActual('../../utils/oauthReturn');
-  return {
-    __esModule: true,
-    ...actual,
-    tryCompleteOAuthReturn: jest.fn(async () => false),
-    consumeHubSyncFailure: jest.fn(actual.consumeHubSyncFailure),
-  };
-});
-
-import { runSessionColdBoot } from '@oxyhq/core';
-import { redirectToAuthorize } from '../../components/oauthNavigation';
-import {
-  clearCrossOriginRestoreGuards,
-  consumeSilentOAuthError,
-  maybeStartSilentOAuthRestore,
-} from '../../utils/crossOriginRestore';
-import { consumeHubSyncFailure, tryCompleteOAuthReturn } from '../../utils/oauthReturn';
-import { runProviderColdBoot, type RunProviderColdBootOptions } from '../runProviderColdBoot';
-
-const mockRunSessionColdBoot = runSessionColdBoot as jest.Mock;
-const mockRedirectToAuthorize = redirectToAuthorize as jest.Mock;
-const mockSilentRestore = maybeStartSilentOAuthRestore as jest.Mock;
-const mockConsumeSilentOAuthError = consumeSilentOAuthError as jest.Mock;
-const mockConsumeHubSyncFailure = consumeHubSyncFailure as jest.Mock;
-const mockTryCompleteOAuthReturn = tryCompleteOAuthReturn as jest.Mock;
-
-const CLIENT_ID = 'oxy_dk_test';
-
-/** An auth store holding no device credential — the signed-out domain case. */
-function makeEmptyAuthStore(): AuthStateStore {
-  return {
-    load: jest.fn(async (): Promise<PersistedAuthState | null> => null),
-    save: jest.fn(async () => undefined),
-    clear: jest.fn(async () => undefined),
-  } as unknown as AuthStateStore;
-}
-
-interface Harness {
-  options: RunProviderColdBootOptions;
-  commitSession: jest.Mock;
-  markAuthResolved: jest.Mock;
-  setTokenReady: jest.Mock;
-  sessionClientStart: jest.Mock;
-}
-
-function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harness {
-  const commitSession = jest.fn(async () => undefined);
-  const markAuthResolved = jest.fn();
-  const setTokenReady = jest.fn();
-  const sessionClientStart = jest.fn(async () => undefined);
-
-  const options: RunProviderColdBootOptions = {
-    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
-    authStore: makeEmptyAuthStore(),
-    clientId: CLIENT_ID,
-    sessionClient: { start: sessionClientStart } as unknown as SessionClient,
-    syncDeviceCredentialToHost: jest.fn(async () => undefined),
-    commitSession,
-    markAuthResolved,
-    setTokenReady,
-    ...overrides,
-  };
-
-  return { options, commitSession, markAuthResolved, setTokenReady, sessionClientStart };
-}
-
-/** `runSessionColdBoot` finding no session at all — the signed-out domain. */
-function stubSignedOutBoot(): void {
-  mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
-    await opts.onSignedOut?.('no_session');
-    return { kind: 'unauthenticated' } as const;
-  });
-}
-
-describe('runProviderColdBoot — webAuthMode transport gate (#691 phase 7)', () => {
-  beforeEach(() => {
-    mockRunSessionColdBoot.mockReset();
-    mockRedirectToAuthorize.mockClear();
-    mockSilentRestore.mockClear();
-    mockConsumeSilentOAuthError.mockClear();
-    mockConsumeHubSyncFailure.mockClear();
-    mockTryCompleteOAuthReturn.mockClear();
-    mockTryCompleteOAuthReturn.mockImplementation(async () => false);
-    globalThis.sessionStorage?.clear();
-    clearCrossOriginRestoreGuards();
-  });
-
-  describe("webAuthMode: 'popup'", () => {
-    it('never starts the silent restore and never navigates the top-level window', async () => {
-      stubSignedOutBoot();
-      const { options } = makeHarness({ webAuthMode: 'popup' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockSilentRestore).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-
-    it('resolves a domain with no local credential SIGNED OUT instead of bouncing', async () => {
-      stubSignedOutBoot();
-      const { options, markAuthResolved, commitSession, sessionClientStart } = makeHarness({
-        webAuthMode: 'popup',
-      });
-
-      await runProviderColdBoot(options);
-
-      // Auth resolution concluded (routing can settle), nothing was committed,
-      // and with no persisted credential the device socket is not started.
-      expect(markAuthResolved).toHaveBeenCalled();
-      expect(commitSession).not.toHaveBeenCalled();
-      expect(sessionClientStart).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-
-    it('still completes an authorization code already on the URL (blocked-popup fallback)', async () => {
-      // A popup-mode app lands here whenever the browser blocked the popup and
-      // `startWebOAuthSignIn` fell back to a full-page redirect.
-      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
-      const { options, markAuthResolved, setTokenReady } = makeHarness({ webAuthMode: 'popup' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
-      expect(setTokenReady).toHaveBeenLastCalledWith(true);
-      expect(markAuthResolved).toHaveBeenCalled();
-      // The device mint is short-circuited by the completed return leg.
-      expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-
-    it('commits the OAuth return WITHOUT hub sync', async () => {
-      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
-      const { options } = makeHarness({ webAuthMode: 'popup' });
-
-      await runProviderColdBoot(options);
-
-      const commit = mockTryCompleteOAuthReturn.mock.calls[0][0] as {
-        commitSession: (input: unknown) => Promise<void>;
-      };
-      await commit.commitSession({ sessionId: 's1', userId: 'u1' });
-      expect(options.commitSession).toHaveBeenCalledWith(
-        { sessionId: 's1', userId: 'u1' },
-        { activate: true, hubSync: false },
-      );
-    });
-  });
-
-  describe("webAuthMode: 'redirect' (unchanged compatibility path)", () => {
-    it('starts the silent restore and navigates to the IdP with prompt=none', async () => {
-      stubSignedOutBoot();
-      const { options } = makeHarness({ webAuthMode: 'redirect' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
-      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
-      const url = new URL(mockRedirectToAuthorize.mock.calls[0][0] as string);
-      expect(url.origin + url.pathname).toBe('https://auth.oxy.so/authorize');
-      expect(url.searchParams.get('client_id')).toBe(CLIENT_ID);
-      expect(url.searchParams.get('prompt')).toBe('none');
-    });
-
-    it('is the DEFAULT when no webAuthMode is supplied', async () => {
-      stubSignedOutBoot();
-      const { options } = makeHarness();
-
-      await runProviderColdBoot(options);
-
-      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
-      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
-    });
-
-    it('does NOT restore when the mint already resolved a session', async () => {
-      mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
-        const session = { sessionId: 's1', userId: 'u1', accessToken: 'at', via: 'device-secret-mint' };
-        await opts.onSession?.(session);
-        return { kind: 'session', via: session.via, session } as const;
-      });
-      const { options, commitSession } = makeHarness({ webAuthMode: 'redirect' });
-
-      await runProviderColdBoot(options);
-
-      expect(commitSession).toHaveBeenCalledWith(
-        { sessionId: 's1', accessToken: 'at', userId: 'u1' },
-        { activate: false },
-      );
-      expect(mockSilentRestore).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('URL-cleanup consumers run in BOTH modes', () => {
-    it.each(['popup', 'redirect'] as const)(
-      'consumes the silent-OAuth error and hub-sync failure params (%s)',
-      async (webAuthMode) => {
-        stubSignedOutBoot();
-        const { options } = makeHarness({ webAuthMode });
-
-        await runProviderColdBoot(options);
-
-        expect(mockConsumeSilentOAuthError).toHaveBeenCalledTimes(1);
-        expect(mockConsumeHubSyncFailure).toHaveBeenCalledTimes(1);
-      },
-    );
-
-    it.each(['popup', 'redirect'] as const)(
-      'consumes an authorization code left on the URL (%s)',
-      async (webAuthMode) => {
-        stubSignedOutBoot();
-        const { options } = makeHarness({ webAuthMode });
-
-        await runProviderColdBoot(options);
-
-        expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
-      },
-    );
-  });
-
-  describe('identity mode still skips both web OAuth lanes in either transport', () => {
-    it.each(['popup', 'redirect'] as const)('skips the return leg and the restore (%s)', async (webAuthMode) => {
-      stubSignedOutBoot();
-      const { options } = makeHarness({ webAuthMode, sessionMode: 'identity' });
-
-      await runProviderColdBoot(options);
-
-      expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
-      expect(mockSilentRestore).not.toHaveBeenCalled();
-      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
-    });
-  });
-});

package/src/ui/oauth/legacyRedirectLanes.ts

@@ -1,43 +0,0 @@
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-
-import type { WebAuthMode } from './types';
-
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-export function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean {
-  return webAuthMode === 'redirect';
-}

package/src/ui/utils/__tests__/crossOriginRestore.test.ts

@@ -1,143 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-
-// Spy on the platform redirect so no real navigation happens and we can assert
-// the authorize URL the silent-restore flow hands to the browser.
-jest.mock('../../components/oauthNavigation', () => ({
-  redirectToAuthorize: jest.fn(),
-}));
-
-// jsdom's `location` is non-configurable, so the origin the code reads cannot be
-// reassigned per-test. Instead, drive the ORIGIN-CLASSIFICATION predicates
-// (whose real behaviour is covered by core's officialOrigins.test.ts) and keep
-// every other core helper real (PKCE, authorize-URL builder, handshake store).
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return {
-    __esModule: true,
-    ...actual,
-    isLoopbackOrigin: jest.fn(),
-    isOfficialWebOrigin: jest.fn(),
-    isIdpHubOrigin: jest.fn(),
-  };
-});
-
-import {
-  isLoopbackOrigin,
-  isOfficialWebOrigin,
-  isIdpHubOrigin,
-} from '@oxyhq/core';
-import { redirectToAuthorize } from '../../components/oauthNavigation';
-import {
-  isSilentRestoreEligibleOrigin,
-  maybeStartSilentOAuthRestore,
-  clearCrossOriginRestoreGuards,
-} from '../crossOriginRestore';
-
-const mockRedirect = redirectToAuthorize as jest.Mock;
-const mockIsLoopback = isLoopbackOrigin as jest.Mock;
-const mockIsOfficial = isOfficialWebOrigin as jest.Mock;
-const mockIsIdpHub = isIdpHubOrigin as jest.Mock;
-
-const OXY_SERVICES_STUB = {} as OxyServices;
-
-/** Default to an eligible official origin; individual tests narrow this. */
-function makeOriginEligible(): void {
-  mockIsLoopback.mockReturnValue(false);
-  mockIsIdpHub.mockReturnValue(false);
-  mockIsOfficial.mockReturnValue(true);
-}
-
-describe('crossOriginRestore', () => {
-  beforeEach(() => {
-    mockRedirect.mockClear();
-    mockIsLoopback.mockReset();
-    mockIsOfficial.mockReset();
-    mockIsIdpHub.mockReset();
-    globalThis.sessionStorage?.clear();
-    clearCrossOriginRestoreGuards();
-  });
-
-  describe('isSilentRestoreEligibleOrigin', () => {
-    it('rejects loopback / local-dev origins', () => {
-      mockIsLoopback.mockReturnValue(true);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(true);
-      expect(isSilentRestoreEligibleOrigin('http://localhost:3000')).toBe(false);
-    });
-
-    it('rejects the central IdP hub origin (no self-hop)', () => {
-      mockIsLoopback.mockReturnValue(false);
-      mockIsIdpHub.mockReturnValue(true);
-      mockIsOfficial.mockReturnValue(true);
-      expect(isSilentRestoreEligibleOrigin('https://auth.oxy.so')).toBe(false);
-    });
-
-    it('rejects non-official origins', () => {
-      mockIsLoopback.mockReturnValue(false);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(false);
-      expect(isSilentRestoreEligibleOrigin('https://evil.example')).toBe(false);
-    });
-
-    it('accepts official, non-loopback, non-IdP origins', () => {
-      makeOriginEligible();
-      expect(isSilentRestoreEligibleOrigin('https://accounts.oxy.so')).toBe(true);
-    });
-  });
-
-  describe('maybeStartSilentOAuthRestore', () => {
-    it('is SKIPPED on a loopback origin (no redirect)', async () => {
-      mockIsLoopback.mockReturnValue(true);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(true);
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-      });
-      expect(redirected).toBe(false);
-      expect(mockRedirect).not.toHaveBeenCalled();
-    });
-
-    it('is SKIPPED on a non-official origin (no redirect)', async () => {
-      mockIsLoopback.mockReturnValue(false);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(false);
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-      });
-      expect(redirected).toBe(false);
-      expect(mockRedirect).not.toHaveBeenCalled();
-    });
-
-    it('redirects to the PROD IdP by default on an eligible origin', async () => {
-      makeOriginEligible();
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-      });
-      expect(redirected).toBe(true);
-      expect(mockRedirect).toHaveBeenCalledTimes(1);
-      const url = mockRedirect.mock.calls[0][0] as string;
-      expect(url.startsWith('https://auth.oxy.so/authorize?')).toBe(true);
-      const params = new URL(url).searchParams;
-      expect(params.get('client_id')).toBe('oxy_dk_test');
-      expect(params.get('prompt')).toBe('none');
-    });
-
-    it('honors an authorizeBaseUrl override (self-hosted / staging IdP)', async () => {
-      makeOriginEligible();
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-        authorizeBaseUrl: 'https://auth.staging.oxy.so/authorize',
-      });
-      expect(redirected).toBe(true);
-      const url = mockRedirect.mock.calls[0][0] as string;
-      expect(url.startsWith('https://auth.staging.oxy.so/authorize?')).toBe(true);
-      const params = new URL(url).searchParams;
-      expect(params.get('client_id')).toBe('oxy_dk_test');
-      expect(params.get('prompt')).toBe('none');
-    });
-  });
-});

package/src/ui/utils/crossOriginRestore.ts

@@ -1,169 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-import {
-  buildOAuthAuthorizeUrl,
-  generateOAuthState,
-  generatePkcePair,
-  isIdpHubOrigin,
-  isLoopbackOrigin,
-  isOfficialWebOrigin,
-  OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY,
-  OXY_SILENT_OAUTH_ATTEMPTED_KEY,
-  clearOAuthHandshake,
-  persistOAuthHandshake,
-  normalizeOAuthRedirectUri,
-  logger,
-} from '@oxyhq/core';
-import { isWebBrowser } from './isWebBrowser';
-import { replaceUrlAfterOAuthReturn } from './oauthReturn';
-import { redirectToAuthorize } from '../components/oauthNavigation';
-
-function sessionStore(): Storage | undefined {
-  return (globalThis as { sessionStorage?: Storage }).sessionStorage;
-}
-
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export function isCrossOriginRestoreBlocked(): boolean {
-  const store = sessionStore();
-  if (!store) return false;
-  return Boolean(
-    store.getItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY) ||
-      store.getItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY),
-  );
-}
-
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export function markCrossOriginRestoreAttempted(): void {
-  const store = sessionStore();
-  if (!store) return;
-  store.setItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, '1');
-  store.setItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY, '1');
-}
-
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export function clearCrossOriginRestoreGuards(): void {
-  const store = sessionStore();
-  if (!store) return;
-  for (const key of [OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY]) {
-    store.removeItem(key);
-  }
-}
-
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export function isSilentRestoreEligibleOrigin(origin: string): boolean {
-  if (isLoopbackOrigin(origin)) return false;
-  if (isIdpHubOrigin()) return false;
-  return isOfficialWebOrigin(origin);
-}
-
-export interface SilentOAuthRestoreOptions {
-  oxyServices: OxyServices;
-  clientId: string;
-  redirectUri?: string;
-  scope?: string;
-  /**
-   * Authorize endpoint override (env-configurable per deployment). Defaults to
-   * the production Oxy IdP when unset, so a local/staging app points silent
-   * restore at its OWN IdP instead of production `auth.oxy.so`.
-   */
-  authorizeBaseUrl?: string;
-}
-
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export async function maybeStartSilentOAuthRestore(
-  opts: SilentOAuthRestoreOptions,
-): Promise<boolean> {
-  if (!isWebBrowser()) return false;
-
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) return false;
-
-  // Defense-in-depth: never bounce a loopback / non-official / IdP-hub origin to
-  // a hosted authorize endpoint (the caller gates on this too).
-  if (!isSilentRestoreEligibleOrigin(location.origin)) {
-    return false;
-  }
-
-  if (isCrossOriginRestoreBlocked()) {
-    return false;
-  }
-
-  const params = new URLSearchParams(location.search);
-  if (params.has('code') || params.has('error')) {
-    return false;
-  }
-
-  try {
-    const { codeVerifier, codeChallenge } = await generatePkcePair();
-    const state = await generateOAuthState();
-    if (!persistOAuthHandshake(state, codeVerifier)) {
-      return false;
-    }
-
-    const redirectUri = normalizeOAuthRedirectUri(
-      opts.redirectUri ?? location.origin,
-    );
-
-    const authorizeUrl = buildOAuthAuthorizeUrl({
-      authorizeBaseUrl: opts.authorizeBaseUrl,
-      clientId: opts.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-      scope: opts.scope,
-      prompt: 'none',
-    });
-
-    markCrossOriginRestoreAttempted();
-    redirectToAuthorize(authorizeUrl);
-    return true;
-  } catch (error) {
-    logger.warn('Silent OAuth restore skipped', { component: 'crossOriginRestore' }, error);
-    return false;
-  }
-}
-
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null {
-  if (!isWebBrowser()) return null;
-  const location = (globalThis as { location?: Location; history?: History }).location;
-  const history = (globalThis as { history?: History }).history;
-  if (!location) return null;
-
-  const params = new URLSearchParams(location.search);
-  const error = params.get('error');
-  if (error !== 'login_required' && error !== 'consent_required') {
-    return null;
-  }
-
-  markCrossOriginRestoreAttempted();
-
-  if (history?.replaceState) {
-    const url = new URL(location.href);
-    url.searchParams.delete('error');
-    url.searchParams.delete('error_description');
-    url.searchParams.delete('state');
-    // Silent restore failed, but the visitor still asked for a specific page.
-    // Put them back on it rather than leaving them on the bare origin the IdP
-    // redirected to.
-    replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
-  }
-  clearOAuthHandshake();
-  return error;
-}