feat: enable subscription connections in web and dev

electron/web-subscription-browser.cjs

@@ -0,0 +1,19 @@
+"use strict";
+
+/** Desktop-dev has no tabs. Resolve only an opaque action on its own Next
+ * server, then open the owner-validated provider page outside the renderer.
+ * The caller must authenticate its trusted app main frame first. */
+async function openWebSubscriptionBrowser(action, origin, { fetch: request = globalThis.fetch, openExternal }) {
+	if (typeof action !== "string" || !/^\/api\/subscriptions\/browser\?id=[0-9a-f-]{36}$/.test(action)) throw new Error("Invalid sign-in action.");
+	const response = await request(new URL(action, origin), {
+		method: "POST", redirect: "manual", credentials: "omit",
+		headers: { origin, "x-learnharness-subscriptions": "1" },
+		signal: AbortSignal.timeout(15000),
+	});
+	const target = response.headers.get("location");
+	if (response.status !== 303 || !target) throw new Error("Sign-in action expired.");
+	const parsed = new URL(target);
+	if (parsed.protocol !== "https:" || parsed.username || parsed.password) throw new Error("Invalid provider page.");
+	await openExternal(target);
+}
+module.exports = { openWebSubscriptionBrowser };