@oxyhq/services 30.0.0 → 30.0.1

package/lib/typescript/commonjs/ui/navigation/surfaceRegistry.d.ts

@@ -0,0 +1,194 @@
+import type { ReactNode } from 'react';
+import type { AccountDialogView, FileMetadata } from '@oxyhq/core';
+import type { RouteName } from './routes';
+import type { AvatarCropResult } from '../screens/AvatarCropScreen';
+import type { AvatarRemovalResult } from '../screens/ChangeAvatarScreen';
+/**
+ * The SDK's typed surface registry — the contract layer the SDK stacks on top of
+ * Bloom's content-agnostic surface stack (`@oxyhq/bloom/surfaces`). One entry per
+ * route describing its `props` (what the presenter must pass) and its `result`
+ * (what awaiting `present()` resolves with). Hand-maintained, contract-first:
+ * adding a route here is the single edit that types it end to end.
+ *
+ * For P1 most routes keep permissive `Record<string, unknown>` props + a `void`
+ * result — the historical grab-bag `showBottomSheet`/`navigate` props are
+ * unchanged. Later phases tighten individual routes without changing this shape.
+ */
+/** One registry entry: the props a route is presented with + its dismissal result. */
+type SurfaceRoute<Props = Record<string, unknown>, Result = void> = {
+    props: Props;
+    result: Result;
+};
+export interface SurfaceRegistry {
+    ManageAccount: SurfaceRoute;
+    AccountVerification: SurfaceRoute;
+    PaymentGateway: SurfaceRoute;
+    Profile: SurfaceRoute;
+    LanguageSelector: SurfaceRoute;
+    PrivacySettings: SurfaceRoute;
+    SearchSettings: SurfaceRoute;
+    /**
+     * File picker / manager. In single-select picker mode the surface is
+     * dismissed with the picked {@link FileMetadata} (the avatar-picker promise
+     * flow); legacy callers that pass an `onSelect`/`onConfirmSelection` callback
+     * keep their callback behaviour and this result goes unread.
+     */
+    FileManagement: SurfaceRoute<Record<string, unknown>, FileMetadata>;
+    HelpSupport: SurfaceRoute;
+    FAQ: SurfaceRoute;
+    Feedback: SurfaceRoute;
+    LegalDocuments: SurfaceRoute;
+    AppInfo: SurfaceRoute;
+    PremiumSubscription: SurfaceRoute;
+    WelcomeNewUser: SurfaceRoute;
+    UserLinks: SurfaceRoute;
+    HistoryView: SurfaceRoute;
+    SavesCollections: SurfaceRoute;
+    EditProfile: SurfaceRoute;
+    EditProfileField: SurfaceRoute;
+    LearnMoreUsernames: SurfaceRoute;
+    TrustCenter: SurfaceRoute;
+    TrustLeaderboard: SurfaceRoute;
+    TrustRewards: SurfaceRoute;
+    TrustRules: SurfaceRoute;
+    AboutTrust: SurfaceRoute;
+    TrustFAQ: SurfaceRoute;
+    FollowersList: SurfaceRoute;
+    FollowingList: SurfaceRoute;
+    CreateAccount: SurfaceRoute;
+    AccountMembers: SurfaceRoute;
+    AccountSettings: SurfaceRoute;
+    /**
+     * Profile-picture source list — the ONE entry into changing an avatar. Every
+     * source that yields an image navigates WITHIN this surface to `AvatarCrop`
+     * (so the panel morphs), and the crop's own dismissal resolves this surface.
+     * Hence the union: a confirmed crop, or the user removing their photo.
+     */
+    ChangeAvatar: SurfaceRoute<Record<string, unknown>, AvatarCropResult | AvatarRemovalResult>;
+    /**
+     * Square-crop editor. Dismissed with the cropped {@link AvatarCropResult}.
+     * Reached only by navigating within a `ChangeAvatar` surface.
+     */
+    AvatarCrop: SurfaceRoute<Record<string, unknown>, AvatarCropResult>;
+    Notifications: SurfaceRoute;
+    ConnectedApps: SurfaceRoute;
+    Preferences: SurfaceRoute;
+    /** Unified account switcher + sign-in surface (folded `OxyAccountDialogScreen` body). */
+    AccountDialog: SurfaceRoute<{
+        initialView?: AccountDialogView;
+    }>;
+}
+/** Typed props a route is presented with. */
+export type SurfaceProps<K extends RouteName> = SurfaceRegistry[K]['props'];
+/** What awaiting a route's `present()` resolves with when it is dismissed. */
+export type SurfaceResult<K extends RouteName> = SurfaceRegistry[K]['result'];
+/**
+ * How a surface renders — the SDK's presentation taxonomy. Each value maps to a
+ * concrete Bloom `Dialog` placement/chrome in `surfaces.ts`:
+ *
+ *   - `'sheet'`      → responsive `{ base: 'bottom', md: 'center' }` (the default,
+ *                      and — since every screen morphs — the presentation of EVERY
+ *                      route today: a bottom sheet on narrow, a centered card wide).
+ *   - `'center'`     → a plain centered modal at every width. Currently unused.
+ *   - `'drawer'`     → responsive `{ base: 'bottom', md: 'left' }` side drawer.
+ *                      Currently unused.
+ *   - `'fullScreen'` → a flush black-canvas surface (`contentPadding: 0`,
+ *                      programmatic-only dismiss). Currently unused: the flagship
+ *                      photo picker now MORPHS in place as a `sheet` (it paints its
+ *                      own black canvas + bar inside the themed panel), so nothing
+ *                      needs a stacked full-bleed surface. Retained for a future
+ *                      route that genuinely must be full-bleed.
+ */
+export type SurfacePresentation = 'sheet' | 'center' | 'drawer' | 'fullScreen';
+/**
+ * Per-route surface configuration. Merges the historical `SheetRouteConfig`
+ * knobs with the new {@link SurfacePresentation}.
+ *
+ * NOTE: `scrollable` is LIVE — it is threaded through `bloomOptionsFor` onto the
+ * Bloom `Dialog` surface (`scrollable` prop), so a route that owns its own scroll
+ * container opts OUT of the Dialog's internal ScrollView. `manualActivation` /
+ * `dynamicBackdrop` / `handleComponent` remain informational — reserved for a
+ * future Bloom bottom-placement passthrough; the shared `DialogBottomSheet`
+ * currently owns pan coordination itself.
+ */
+export interface SurfaceRouteConfig {
+    /** Which surface hosts the route. */
+    presentation: SurfacePresentation;
+    /**
+     * When `false`, the route owns its own scroll container (a FlatList /
+     * SectionList / VirtualizedList, or its own ScrollView) and the host must not
+     * wrap it in a ScrollView. Threaded onto Bloom's `Dialog` via `bloomOptionsFor`.
+     */
+    scrollable: boolean;
+    /**
+     * Whether the surface MORPHS when this route is navigated to WITHIN it — the
+     * panel animates from the outgoing frame's size to this one's instead of
+     * hard-cutting (the in-place NAV-WITHIN size animation). `true` for every
+     * ordinary route screen; a wizard step swap counts as a frame here too.
+     *
+     * Distinct from {@link stacks}: `morph` tunes the size animation of an IN-PLACE
+     * frame swap; `stacks` decides whether the frame lands in place at all or opens
+     * a new surface. A stacked surface can still morph between ITS OWN frames.
+     */
+    morph: boolean;
+    /**
+     * An EXPLICIT target size the panel MORPHS to for this route, instead of the
+     * measured natural height / the surface width. This is how an own-scroller frame
+     * (its content owns its own scroll, so the panel can't measure it) still GROWS
+     * its container to a large declared size — the panel animates UP to it on entry
+     * and back DOWN on exit while the frame's inner list scrolls within. `heightRatio`
+     * is a fraction of the viewport height (clamped there); `maxWidth` (px) widens the
+     * centered card beyond the ordinary sheet. Omit for the normal measured behaviour.
+     */
+    frameSize?: {
+        heightRatio?: number;
+        maxWidth?: number;
+    };
+    /**
+     * Whether navigating TO this route from INSIDE an existing surface opens a NEW
+     * stacked surface (its own backdrop + entry animation — the DEPTH axis) instead
+     * of morphing in place within the current one (the NAV-WITHIN axis).
+     *
+     * `false` (the DEFAULT) — morph in place: the route is pushed as a frame in the
+     * host surface's nav stack and the panel reshapes from the previous frame to it
+     * (size-animated per {@link morph}). Every ordinary screen. This is what makes
+     * morph the default: a drill-in navigates WITHIN unless the target opts out.
+     *
+     * `true` — the route's chrome is fundamentally incompatible with morphing into
+     * a host, so it must own its own surface: the full-bleed `fullScreen` image
+     * picker (black canvas, flush content, programmatic-only dismiss). Presented on
+     * top; dismissing it unwinds back to the surface that opened it.
+     *
+     * NOTE: the DEPTH `present` / `presentDetached` APIs ALWAYS open a new surface
+     * regardless of this flag — `stacks` only governs the in-surface drill-in
+     * (`navigate` / `showBottomSheet`) decision in `navigateWithinOrPresent`.
+     */
+    stacks: boolean;
+    /**
+     * Whether the surface renders the Dialog's OWN navigation header (sticky
+     * gradient nav bar + large collapsing title over the surface's scroll content).
+     * `true` for EVERY route — the whole SDK UI is unified on the shared header:
+     * screens render NO header of their own and declare their title/subtitle (+ any
+     * action slot / `onBack`) via `useSurfaceHeader`. No route opts out anymore.
+     */
+    header: boolean;
+    /** Body-pan activation strategy — reserved (owned by Bloom's Dialog surface). */
+    manualActivation: boolean;
+    /** Drag-proportional backdrop dim — reserved (owned by Bloom's Dialog surface). */
+    dynamicBackdrop: boolean;
+    /** Optional custom drag-handle slot — reserved (owned by Bloom's Dialog surface). */
+    handleComponent?: () => ReactNode;
+}
+/**
+ * Resolve the surface configuration for a route + props. Every route defaults to
+ * the responsive sheet, renders the SHARED Dialog nav header, and MORPHS in place
+ * when navigated to from within a surface (no route stacks — genuine overlays are
+ * Bloom-raw `surfaces.present`/`confirm` calls, outside this registry). The
+ * image-only FileManagement picker is a normal sheet that owns its own scroll and
+ * grows to a large morph target; every other own-scroller is `scrollable: false`.
+ */
+export declare const getSurfaceConfig: (route: RouteName, props: Record<string, unknown>) => SurfaceRouteConfig;
+/** Convenience: just the presentation taxonomy for a route + props. */
+export declare const getSurfacePresentation: (route: RouteName, props: Record<string, unknown>) => SurfacePresentation;
+export {};
+//# sourceMappingURL=surfaceRegistry.d.ts.map

package/lib/typescript/commonjs/ui/navigation/surfaceRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surfaceRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/ui/navigation/surfaceRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEzE;;;;;;;;;;GAUG;AAEH,sFAAsF;AACtF,KAAK,YAAY,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,IAAI;IAClE,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,YAAY,CAAC;IAC5B,mBAAmB,EAAE,YAAY,CAAC;IAClC,cAAc,EAAE,YAAY,CAAC;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,gBAAgB,EAAE,YAAY,CAAC;IAC/B,eAAe,EAAE,YAAY,CAAC;IAC9B,cAAc,EAAE,YAAY,CAAC;IAC7B;;;;;OAKG;IACH,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACpE,WAAW,EAAE,YAAY,CAAC;IAC1B,GAAG,EAAE,YAAY,CAAC;IAClB,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,YAAY,CAAC;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,mBAAmB,EAAE,YAAY,CAAC;IAClC,cAAc,EAAE,YAAY,CAAC;IAC7B,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,YAAY,CAAC;IAC1B,gBAAgB,EAAE,YAAY,CAAC;IAC/B,WAAW,EAAE,YAAY,CAAC;IAC1B,gBAAgB,EAAE,YAAY,CAAC;IAC/B,kBAAkB,EAAE,YAAY,CAAC;IACjC,WAAW,EAAE,YAAY,CAAC;IAC1B,gBAAgB,EAAE,YAAY,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,UAAU,EAAE,YAAY,CAAC;IACzB,UAAU,EAAE,YAAY,CAAC;IACzB,QAAQ,EAAE,YAAY,CAAC;IACvB,aAAa,EAAE,YAAY,CAAC;IAC5B,aAAa,EAAE,YAAY,CAAC;IAC5B,aAAa,EAAE,YAAY,CAAC;IAC5B,cAAc,EAAE,YAAY,CAAC;IAC7B,eAAe,EAAE,YAAY,CAAC;IAC9B;;;;;OAKG;IACH,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,CAAC,CAAC;IAC5F;;;OAGG;IACH,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACpE,aAAa,EAAE,YAAY,CAAC;IAC5B,aAAa,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,YAAY,CAAC;IAC1B,yFAAyF;IACzF,aAAa,EAAE,YAAY,CAAC;QAAE,WAAW,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;CAClE;AAeD,6CAA6C;AAC7C,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5E,8EAA8E;AAC9E,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mFAAmF;IACnF,eAAe,EAAE,OAAO,CAAC;IACzB,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,SAAS,CAAC;CACnC;AAqDD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,OAAO,SAAS,EAChB,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,kBAqBF,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,GACjC,OAAO,SAAS,EAChB,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,mBAAkE,CAAC"}

package/lib/typescript/commonjs/ui/navigation/surfaces.d.ts

@@ -0,0 +1,110 @@
+import { type PresentOptions } from '@oxyhq/bloom/surfaces';
+import type { RouteName } from './routes';
+import { type SurfaceProps, type SurfaceResult } from './surfaceRegistry';
+import { type SurfaceNavStack } from './surfaceNavStack';
+/**
+ * A live handle to a presented SDK surface. Exposes DEPTH controls (`dismiss`,
+ * `result`) and NAV-WITHIN controls (`navigate`/`replace`/`goBack`/`setStep`) that
+ * drive this surface's own nav stack. Held by the `showBottomSheet` adapter (base
+ * surface) and by `OxyContext` (the AccountDialog surface).
+ */
+export interface SurfaceInstance<K extends RouteName = RouteName> {
+    readonly route: RouteName;
+    navigate: (route: RouteName, props?: Record<string, unknown>) => void;
+    replace: (route: RouteName, props?: Record<string, unknown>) => void;
+    goBack: () => boolean;
+    canGoBack: () => boolean;
+    setStep: (step: number) => void;
+    /** Open a result-bearing sub-flow WITHIN this surface (morph). See {@link openWithinOrPresent}. */
+    beginFlow: (route: RouteName, props?: Record<string, unknown>) => Promise<unknown>;
+    dismiss: (result?: SurfaceResult<K>) => void;
+    readonly result: Promise<SurfaceResult<K> | undefined>;
+}
+/**
+ * The type-erased handle the `showBottomSheet` adapter needs from a tracked
+ * surface: what it hosts, and how to drive/dismiss it. Kept result-type-free so
+ * the (generic) `SurfaceInstance<K>` never has to be widened into a shared array.
+ * Exported so `OxyContext` can hold the surface it MORPHS the account dialog into
+ * (see {@link topRouteSurface}).
+ */
+export interface TrackedSurface {
+    readonly route: RouteName;
+    navigate: (route: RouteName, props?: Record<string, unknown>) => void;
+    goBack: () => boolean;
+    /** Open a result-bearing sub-flow WITHIN this surface (morph). See {@link openWithinOrPresent}. */
+    beginFlow: (route: RouteName, props?: Record<string, unknown>) => Promise<unknown>;
+    dismiss: () => void;
+}
+/**
+ * Present a NEW route surface on top of the stack (the DEPTH axis). Resolves with
+ * the value the surface is dismissed with. Registered in the route-surface stack.
+ */
+export declare function present<K extends RouteName>(route: K, props?: SurfaceProps<K>, opts?: PresentOptions): SurfaceInstance<K>;
+/**
+ * Present a surface that is NOT part of the `showBottomSheet` base-navigation
+ * lineage (the AccountDialog modal). Otherwise identical to {@link present}.
+ */
+export declare function presentDetached<K extends RouteName>(route: K, props?: SurfaceProps<K>, opts?: PresentOptions): SurfaceInstance<K>;
+/**
+ * Untyped present for the adapter, the nav helpers, and the `SurfaceScreen`
+ * binding (where the route is a runtime value and its props are already erased).
+ */
+export declare function presentRoute(route: RouteName, props?: Record<string, unknown>): SurfaceInstance;
+/** The top-most active route surface, or `undefined` when none are open. */
+export declare function topRouteSurface(): TrackedSurface | undefined;
+/**
+ * The frontmost surface a result-bearing flow should morph INTO: the detached
+ * AccountDialog if open (it sits on top of everything), else the top tracked
+ * route surface. Used by {@link openWithinOrPresent} so the account-menu hero
+ * avatar morphs the dialog into `ChangeAvatar` instead of stacking a new surface.
+ */
+export declare function topMorphableSurface(): TrackedSurface | undefined;
+/**
+ * Dismiss every active route surface (the whole `showBottomSheet` session). The
+ * AccountDialog is untracked, so it is untouched. Iterates a snapshot because
+ * `dismiss` mutates `activeRouteSurfaces` asynchronously as surfaces settle.
+ */
+export declare function closeAllRouteSurfaces(): void;
+/**
+ * Drill in from a screen. From inside a surface the DEFAULT is to navigate WITHIN
+ * it — the panel MORPHS from the current frame's size to the next's. EVERY screen
+ * morphs; a NEW surface is stacked on top ONLY when the target route declares
+ * `stacks` (reserved for genuine overlays — none today, since action sheets /
+ * confirms / prompts are Bloom-raw `surfaces.present` calls outside this
+ * registry). A stacked surface gets its own backdrop + entry animation; dismissing
+ * it unwinds back to the surface that opened it.
+ */
+export declare function navigateWithinOrPresent(navStack: SurfaceNavStack, route: RouteName, props?: Record<string, unknown>): void;
+/** Replace variant of {@link navigateWithinOrPresent} (swaps the top frame). */
+export declare function replaceWithinOrPresent(navStack: SurfaceNavStack, route: RouteName, props?: Record<string, unknown>): void;
+/**
+ * Open a result-bearing route the SAME way a drill-in navigates (the morph-by-
+ * default rule), but returning the route's dismissal RESULT to the caller.
+ *
+ * When a surface is already open and the target morphs into it (the default —
+ * anything not marked `stacks`), it runs as a SUB-FLOW inside that surface: the
+ * panel morphs from the current screen into the target, and the promise resolves
+ * with the target's `dismiss(result)` (or `undefined` when cancelled), popping
+ * back to the caller's frame WITHOUT closing the host. Otherwise (no surface, or a
+ * route that stacks) it presents a fresh surface and resolves with its dismissal —
+ * identical to the historical `present(route).result`.
+ *
+ * The entry seam for the avatar picker AND its nested "My Oxy files" media
+ * selector: each awaits its result whether it morphed into the caller's surface
+ * or opened cold, with no morph-vs-present branch of its own.
+ */
+export declare function openWithinOrPresent<K extends RouteName>(route: K, props?: SurfaceProps<K>): Promise<SurfaceResult<K> | undefined>;
+/**
+ * The SDK's imperative surface API (a module singleton). `present` is the typed
+ * route presenter; `dismissAll` unwinds the whole session. Not yet exported from
+ * the package root — the public `surfaces`/`useSurfaces` API lands in a later
+ * phase; for P1 the internal adapters (`showBottomSheet`, `openAccountDialog`)
+ * are the only public entry points.
+ */
+export declare const surfaces: {
+    readonly present: <K extends RouteName>(route: K, props?: SurfaceProps<K>, opts?: PresentOptions) => Promise<SurfaceResult<K> | undefined>;
+    readonly dismissAll: typeof closeAllRouteSurfaces;
+};
+/** Hook form of {@link surfaces} (stable singleton). */
+export declare function useSurfaces(): typeof surfaces;
+//# sourceMappingURL=surfaces.d.ts.map

package/lib/typescript/commonjs/ui/navigation/surfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surfaces.d.ts","sourceRoot":"","sources":["../../../../../src/ui/navigation/surfaces.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,aAAa,EAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AA8EhF;;;;;GAKG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACrE,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,mGAAmG;IACnG,SAAS,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,mGAAmG;IACnG,SAAS,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AA2FD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,SAAS,EACzC,KAAK,EAAE,CAAC,EACR,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,IAAI,CAAC,EAAE,cAAc,GACpB,eAAe,CAAC,CAAC,CAAC,CAEpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,EACjD,KAAK,EAAE,CAAC,EACR,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,IAAI,CAAC,EAAE,cAAc,GACpB,eAAe,CAAC,CAAC,CAAC,CAEpB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAE/F;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,IAAI,cAAc,GAAG,SAAS,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,GAAG,SAAS,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,SAAS,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAON;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,SAAS,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAON;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,SAAS,EACrD,KAAK,EAAE,CAAC,EACR,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAUvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ;uBACT,CAAC,SAAS,SAAS,SAAS,CAAC,UAAU,YAAY,CAAC,CAAC,CAAC,SAAS,cAAc;;CAG/E,CAAC;AAEX,wDAAwD;AACxD,wBAAgB,WAAW,IAAI,OAAO,QAAQ,CAE7C"}

package/lib/typescript/commonjs/ui/oauth/browserAuthTransport.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The single web entry point for third-party "Sign in with Oxy".
+ *
+ * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
+ * result — so callers (`OxySignInButton`, and any RP with its own button) never
+ * touch `window.open`, `postMessage`, or the token exchange themselves.
+ *
+ * Popup mode keeps the relying party mounted: its route, scroll position, and
+ * unsaved state survive because the tab never navigates. Redirect mode is the
+ * compatibility fallback, and is also where popup mode lands when the browser
+ * blocks the window — a blocked popup must still sign the user in, not dead-end.
+ *
+ * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
+ * remains the native lane and is untouched by this module.
+ */
+import type { OxyServices } from '@oxyhq/core';
+import type { OAuthPopupHandle, OAuthSessionCommitInput, WebAuthMode, WebOAuthSignInResult } from './types';
+/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
+export interface WebOAuthTransportContext {
+    /** The provider's `webAuthMode`. */
+    mode: WebAuthMode;
+    oxyServices: OxyServices;
+    /** The app's registered client id; `null` disables third-party sign-in. */
+    clientId: string | null;
+    /** Authorize endpoint override (local/staging deployments). */
+    authorizeBaseUrl?: string;
+    /** `sessionMode: 'identity'` — no third-party OAuth lane exists by design. */
+    identityBound: boolean;
+    /** The provider's session commit funnel. */
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+}
+/** Per-press inputs for {@link startWebOAuthSignIn}. */
+export interface StartWebOAuthSignInOptions {
+    /** EXACT registered redirect URI for this application. */
+    redirectUri: string;
+    /**
+     * The popup to drive, when the caller already opened one.
+     *
+     * - omitted — this call opens the window itself, which is only valid when it
+     *   was invoked SYNCHRONOUSLY from the user's click (gesture attribution);
+     * - `null` — the caller tried and the browser blocked it: fall back to a
+     *   full-page redirect;
+     * - a handle — use exactly this window.
+     *
+     * Callers that must `await` before signing in (resolving the application, for
+     * instance) have to open the window in their press handler and pass it here;
+     * a window opened after an `await` is silently blocked by every browser.
+     */
+    popup?: OAuthPopupHandle | null;
+    /** Requested scope; defaults to the SDK's standard sign-in scope. */
+    scope?: string;
+    /** Popup timeout override (ms). */
+    timeoutMs?: number;
+}
+export declare function startWebOAuthSignIn(context: WebOAuthTransportContext, options: StartWebOAuthSignInOptions): Promise<WebOAuthSignInResult>;
+//# sourceMappingURL=browserAuthTransport.d.ts.map

package/lib/typescript/commonjs/ui/oauth/browserAuthTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browserAuthTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/browserAuthTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EAEX,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAEjB,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wDAAwD;AACxD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAsF/B"}

package/lib/typescript/commonjs/ui/oauth/completeOAuthCode.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+import type { OxyServices } from '@oxyhq/core';
+import type { OAuthCompletionResult, OAuthHandshake, OAuthSessionCommitInput } from './types';
+/** Inputs for {@link completeOAuthCode}. */
+export interface CompleteOAuthCodeInput {
+    oxyServices: OxyServices;
+    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
+    clientId: string;
+    /** The single-use authorization code the IdP issued. */
+    code: string;
+    /** The `state` the IdP returned, or `null` when it sent none. */
+    returnedState: string | null;
+    /**
+     * The handshake this RP started the authorize request with, or `null` when it
+     * is gone (never stored, expired, or a different tab's). A missing handshake
+     * is treated exactly like a mismatched `state`: no exchange is attempted.
+     */
+    handshake: OAuthHandshake | null;
+    /** EXACT redirect URI sent on the authorize request — OAuth requires a match. */
+    redirectUri: string;
+    /** The provider's session commit funnel. */
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+    /**
+     * Transport-specific teardown, invoked once after the exchange settles and
+     * before the commit. The redirect lane strips `?code=` and clears the
+     * persisted handshake; the popup lane has nothing persisted and omits it.
+     */
+    cleanup?: () => void;
+}
+export declare function completeOAuthCode(input: CompleteOAuthCodeInput): Promise<OAuthCompletionResult>;
+//# sourceMappingURL=completeOAuthCode.d.ts.map

package/lib/typescript/commonjs/ui/oauth/completeOAuthCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completeOAuthCode.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/completeOAuthCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAE9F,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+import type { OAuthHandshake } from './types';
+/** Inputs for {@link prepareAuthorizeRequest}. */
+export interface PrepareAuthorizeRequestParams {
+    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
+    clientId: string;
+    /** EXACT registered redirect URI. The token exchange must replay this value. */
+    redirectUri: string;
+    /** Authorize endpoint override; defaults to the production Oxy IdP. */
+    authorizeBaseUrl?: string;
+    /** Requested scope; defaults to the SDK's standard sign-in scope. */
+    scope?: string;
+    /**
+     * Ask the IdP to deliver the result to `window.opener` via `postMessage`
+     * instead of redirecting. Set ONLY by the popup transport. It is a request,
+     * not a guarantee — an IdP with no opener still redirects.
+     */
+    responseMode?: 'web_message';
+}
+/** A ready-to-use authorize request plus the secrets that finish it. */
+export interface PreparedAuthorizeRequest {
+    /** Fully-built `auth.oxy.so/authorize` URL. */
+    authorizeUrl: string;
+    /**
+     * Exact origin of {@link authorizeUrl}. The popup transport accepts
+     * `postMessage` from this origin and no other.
+     */
+    authorizeOrigin: string;
+    /** The `state` + PKCE verifier this request is bound to. */
+    handshake: OAuthHandshake;
+}
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+export declare function prepareAuthorizeRequest(params: PrepareAuthorizeRequestParams): Promise<PreparedAuthorizeRequest>;
+//# sourceMappingURL=oauthHandshake.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthHandshake.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthHandshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAkBnC"}

package/lib/typescript/commonjs/ui/oauth/oauthPopup.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Popup lifecycle for the web OAuth transport.
+ *
+ * Owns the window itself — opening it, navigating it, watching it, and tearing
+ * every listener and timer down — and nothing else: message validation lives in
+ * `oauthPopupMessages.ts`, and the code exchange in `completeOAuthCode.ts`.
+ *
+ * Three browser realities shape this module:
+ *
+ * - **Gesture attribution.** `window.open` only succeeds while the user's click
+ *   is still being handled. Anything awaited first (resolving the application,
+ *   generating PKCE) loses it and the popup is silently blocked. So the window
+ *   is opened EMPTY up front and navigated once the authorize URL exists —
+ *   the same shape as `passkeyHubPopup.ts`.
+ * - **No close event.** A cross-origin popup fires nothing when the user
+ *   dismisses it; polling `closed` is the only mechanism (as in core's
+ *   `AccountDialogController.watchPopup`).
+ * - **No cross-origin reads.** The popup's URL, title, and document are all
+ *   opaque. The authorization result arrives ONLY as a `postMessage`.
+ */
+import type { OAuthPopupHandle, OAuthPopupOutcome } from './types';
+/**
+ * Window name for the sign-in popup. Naming the target means a second press
+ * REUSES the same window instead of stacking a new one behind the first.
+ */
+export declare const OXY_OAUTH_POPUP_WINDOW_NAME = "oxy-oauth";
+/**
+ * How long a popup sign-in may stay unanswered (ms).
+ *
+ * Generous on purpose: the IdP surface can involve scanning a QR and approving
+ * on a phone, so this tracks the authorize handle's own ~5-minute lifetime
+ * rather than a UI-scale timeout. It is a backstop against a wedged popup, not
+ * a pace-setter — a user who gives up closes the window and gets the faster
+ * `closed` outcome.
+ */
+export declare const DEFAULT_OAUTH_POPUP_TIMEOUT_MS = 300000;
+/**
+ * Open a new, EMPTY sign-in popup.
+ *
+ * MUST be called SYNCHRONOUSLY from a user-gesture handler, before any `await`.
+ * Returns `null` when the browser blocked it, when `window.open` threw, and on
+ * hosts with no DOM (native / SSR) — never throws, because "no popup" is an
+ * ordinary outcome the caller answers by falling back to a redirect.
+ */
+export declare function openOAuthPopup(): OAuthPopupHandle | null;
+/**
+ * Point an already-open popup at the authorize URL. Returns `false` when the
+ * assignment threw (a window closed between opening and navigating), so the
+ * caller can fall back to a redirect instead of waiting on a dead window.
+ */
+export declare function navigateOAuthPopup(popup: OAuthPopupHandle, url: string): boolean;
+/** Close the popup if it is still open. Idempotent, null-safe, never throws. */
+export declare function closeOAuthPopup(popup: OAuthPopupHandle | null): void;
+/** Inputs for {@link awaitOAuthPopupResult}. */
+export interface AwaitOAuthPopupOptions {
+    /** The exact window reference returned by {@link openOAuthPopup}. */
+    popup: OAuthPopupHandle;
+    /** Exact origin the IdP will post from (`new URL(authorizeUrl).origin`). */
+    expectedOrigin: string;
+    /** The CSRF `state` sent on the authorize request. */
+    expectedState: string;
+    /**
+     * EXACT registered redirect URI for this attempt. When the IdP cannot
+     * `postMessage` (no usable opener) it falls back to redirecting the popup;
+     * if that lands on the same origin, the result is read from the popup URL.
+     */
+    redirectUri: string;
+    /** @default DEFAULT_OAUTH_POPUP_TIMEOUT_MS */
+    timeoutMs?: number;
+}
+/**
+ * Wait for the popup to deliver an authorization result.
+ *
+ * Settles EXACTLY once, with a typed outcome for every path — code, IdP error,
+ * state mismatch, user-closed, timeout — and removes its listener, its close
+ * poll, and both timers before resolving, whatever the outcome. Messages that
+ * arrive after settling reach nothing, so a duplicate delivery is inert.
+ *
+ * Never rejects: closing the window and running out of time are expected
+ * outcomes, not exceptions.
+ */
+export declare function awaitOAuthPopupResult(options: AwaitOAuthPopupOptions): Promise<OAuthPopupOutcome>;
+//# sourceMappingURL=oauthPopup.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthPopup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPopup.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAKvD;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAkCtD;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,gBAAgB,GAAG,IAAI,CASxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAOpE;AA2CD,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,EAAE,gBAAgB,CAAC;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B"}

package/lib/typescript/commonjs/ui/oauth/oauthPopupMessages.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Runtime validation for the popup OAuth `postMessage` channel.
+ *
+ * Everything arriving on `window`'s `message` event is untrusted: any frame on
+ * the page, any other popup, and any browser extension can post to us. This
+ * module is the ONLY place that decides whether an incoming event is a genuine
+ * authorization response, and it answers with a value — never a thrown error.
+ *
+ * A message is accepted only when ALL of these hold:
+ *   1. `event.origin` is EXACTLY the authorize endpoint's origin,
+ *   2. `event.source` is the exact `Window` reference we opened,
+ *   3. `event.data` matches one of the two frozen message shapes,
+ *   4. the `state` it carries matches the one this RP sent.
+ *
+ * Failing (1)–(3) is indistinguishable from unrelated page traffic, so the
+ * message is IGNORED and the flow keeps waiting. Failing (4) means our own
+ * popup answered a different request than the one in flight, which is terminal:
+ * it is reported as a mismatch rather than left to hang until the timeout.
+ */
+import type { OAuthPopupHandle, OxyOAuthMessage } from './types';
+/** `postMessage` discriminator for a successful authorization. */
+export declare const OXY_OAUTH_CODE_MESSAGE_TYPE = "oxy:oauth:code";
+/** `postMessage` discriminator for a typed OAuth failure. */
+export declare const OXY_OAUTH_ERROR_MESSAGE_TYPE = "oxy:oauth:error";
+/** Verdict for one incoming `message` event. */
+export type OAuthPopupMessageVerdict = 
+/** Not ours (wrong origin/source) or not a valid message — keep waiting. */
+{
+    kind: 'ignore';
+} | {
+    kind: 'code';
+    code: string;
+    state: string;
+} | {
+    kind: 'oauth-error';
+    error: string;
+    errorDescription?: string;
+}
+/** Well-formed, from our popup, but bound to a different authorize request. */
+ | {
+    kind: 'state-mismatch';
+};
+/** What {@link readOAuthPopupMessage} validates an event against. */
+export interface OAuthPopupMessageContext {
+    /** Exact origin of the authorize endpoint (`new URL(authorizeUrl).origin`). */
+    expectedOrigin: string;
+    /** The CSRF `state` this RP sent on the authorize request. */
+    expectedState: string;
+    /** The exact popup reference `window.open()` returned. */
+    popup: OAuthPopupHandle;
+}
+/**
+ * Parse untrusted `event.data` into one of the two frozen message shapes, or
+ * `null` when it is anything else (including `null`, primitives, arrays, and
+ * objects with missing/wrong-typed fields).
+ *
+ * Unknown extra properties are tolerated but never read: only the fields below
+ * are ever surfaced, so a hostile sender cannot smuggle values past this point.
+ */
+export declare function parseOAuthPopupMessage(data: unknown): OxyOAuthMessage | null;
+/**
+ * Classify one `message` event against the in-flight authorize request.
+ *
+ * Never throws. See the module header for the acceptance rules.
+ */
+export declare function readOAuthPopupMessage(event: MessageEvent, context: OAuthPopupMessageContext): OAuthPopupMessageVerdict;
+//# sourceMappingURL=oauthPopupMessages.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthPopupMessages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPopupMessages.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopupMessages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAEjE,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,mBAAmB,CAAC;AAE5D,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,gDAAgD;AAChD,MAAM,MAAM,wBAAwB;AAClC,4EAA4E;AAC1E;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,+EAA+E;GAC7E;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE/B,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAkBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAsB5E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,wBAAwB,GAChC,wBAAwB,CA+B1B"}