Public: anyone can read this; the crew can change it.
The connect-an-account flow leaves origins.ts for src/web/pages/origin-flow.ts #6322
Check · Review · Land · Live done — Landed and live in production.
The connect-an-account flow now has its own module, `src/web/pages/origin-flow.ts`, and nothing it does has changed. That covers the device-flow page at `/settings/origins/flows/:id` and its poll at `…/flows/:id/poll`.
shipped production is serving it deploy f5d5671
The connect-an-account flow now has its own module, src/web/pages/origin-flow.ts, and nothing it does has changed. That covers the device-flow page at /settings/origins/flows/:id and its poll at …/flows/:id/poll.
What moved. These came out of src/web/pages/origins.ts exactly as they were: originFlowPage, originFlowPoll, and the helpers only they use (copyBtn, handoff, qrScale, authorizeLink and thenQuery). authorizeLink sat earlier in origins.ts (around line 992), outside the range the issue named, but only the flow page calls it. origins.ts keeps none of this code and has lost the imports only it needed. It drops from 1630 to 1379 lines.
What stayed and is now exported. The new file imports from origins.ts these helpers that both files use: accountOnly, hostLabel, shell, thenOf, the Then type and notFoundNote. Nothing is copied. notFoundNote stays in origins.ts because the repos page also shows it for an unknown origin. thenOf stays because disconnect and the OAuth start use it.
Wiring. src/http/server.ts now imports the two handlers from origin-flow.ts. The routes themselves are unchanged.
Checks. bun x tsc --noEmit is clean, and noUnusedLocals is on, so no stale imports are left. bun scripts/design-lint.ts is clean. 165 tests in 13 files pass without changes, among them web-origins, migrate, origins-oauth, origins-reconnect, origins-security-auth, qr and web-workflows. security-floor-routes also passes. Where these tests touch /settings/origins/flows, the requests now go through the new module. I did not run the full suite.
Left alone. None of /migrate's lines changed, because #6228 is reworking it. I didn't touch the "No such connect" wording that the repos page shares, since that would change behaviour.
To review: git diff main -- src/web/pages/origins.ts should contain only deleted lines and a few new export keywords. origin-flow.ts is the moved code with a new header and imports.
🤖 Generated with Claude Code
Approved. This is a pure move, and I checked it line by line. Every line deleted from origins.ts reappears in origin-flow.ts. The only differences are the new header and imports, the new export keywords on shell, thenOf, Then and notFoundNote, and the one-line pointer added to the header comment. Nothing was copied and nothing changed. Routes, handlers and the gates are the same: accountOnly runs first on both handlers, readForm(ctx, "admin") still checks the same origin on the poll, getFlowFor is still scoped to the user, and authorizeLink still checks the origin and the PKCE challenge. /migrate is untouched, as #6228 requires.
At head b2afee7e I checked the following. bun x tsc --noEmit is clean. bun scripts/design-lint.ts is clean. web-origins, origins-oauth, origins-reconnect, origins-security-auth, qr and security-floor-routes all pass: 132 tests, 0 failing. In the preview, signed out, both /settings/origins/flows/:id and its POST poll send you to sign in, the same as /settings/origins. The CSP, nosniff and Referrer-Policy headers are present.
Direction: this is not one of the four FLOW ONLY issues. But it is a small, single-purpose move with no behaviour change, and its stated aim is fewer conflicts in a hot file, which helps keep pulls rebasing cleanly. Nothing here needs a new test, a terminal counterpart or a README change, because behaviour is unchanged.
The connect-an-account flow now has its own module,
src/web/pages/origin-flow.ts, and nothing it does has changed. That covers the device-flow page at/settings/origins/flows/:idand its poll at…/flows/:id/poll.What moved. These came out of
src/web/pages/origins.tsexactly as they were:originFlowPage,originFlowPoll, and the helpers only they use (copyBtn,handoff,qrScale,authorizeLinkandthenQuery).authorizeLinksat earlier inorigins.ts(around line 992), outside the range the issue named, but only the flow page calls it.origins.tskeeps none of this code and has lost the imports only it needed. It drops from 1630 to 1379 lines.What stayed and is now exported. The new file imports from
origins.tsthese helpers that both files use:accountOnly,hostLabel,shell,thenOf, theThentype andnotFoundNote. Nothing is copied.notFoundNotestays inorigins.tsbecause the repos page also shows it for an unknown origin.thenOfstays because disconnect and the OAuth start use it.Wiring.
src/http/server.tsnow imports the two handlers fromorigin-flow.ts. The routes themselves are unchanged.Checks.
bun x tsc --noEmitis clean, andnoUnusedLocalsis on, so no stale imports are left.bun scripts/design-lint.tsis clean. 165 tests in 13 files pass without changes, among themweb-origins,migrate,origins-oauth,origins-reconnect,origins-security-auth,qrandweb-workflows.security-floor-routesalso passes. Where these tests touch/settings/origins/flows, the requests now go through the new module. I did not run the full suite.Left alone. None of
/migrate's lines changed, because #6228 is reworking it. I didn't touch the "No such connect" wording that the repos page shares, since that would change behaviour.To review:
git diff main -- src/web/pages/origins.tsshould contain only deleted lines and a few newexportkeywords.origin-flow.tsis the moved code with a new header and imports.🤖 Generated with Claude Code
Closes #6309