v3.3.3

3.3.3 fixes the drive sign-in that reported a DECLINE as a blocked popup (#390, fixed by #394).

Declining an OAuth consent screen — or closing the sign-in window, or hitting a Workspace admin-approval wall — used to surface as Couldn't load files: Popup was blocked by the browser, which sent the user into their browser's popup settings over a choice they had just made themselves. Three things compounded:

• The auth view retried itself. DriveAuthFallback auto-triggers sign-in on mount while the tile click's user activation is still live, and its || error guard is what stops a second attempt — but OneDrive, Dropbox and Box rendered it WITHOUT passing error (it stayed inside the ...uploaderProps rest), so the guard could never fire. A decline cleared isLoading, the view re-mounted with a fresh attemptedRef, and it opened a second popup with no activation left. That window.open returned null, and popup-oauth-plugin reported the block.
• The decline was never surfaced on its own. The popup poll accepted only href.startsWith(redirectUri) && href.includes('code='), so an ?error=access_denied redirect fell through until the window closed, and a closed window resolved silently with no error and no state.
• A blocked popup threw before the state ever moved, so the view sat on its spinner and the auth fallback carrying the error never rendered at all.

What changed:

• Every drive component in every framework (React, Vue, Svelte, Angular, vanilla) forwards error into its auth fallback, so the no-auto-retry-after-an-error guard is reachable across the remount.
• The redirect poll reads error / error_description off both the query and the fragment, and reports a refused or admin-walled consent as a cancellation. A closed window is a cancellation too, rather than a silent resolve. authenticateViaPopup() still RESOLVES in both cases — the promise contract is unchanged.
• Cancellations carry AUTH_DENIED and a real popup block carries the new AUTH_POPUP_BLOCKED, so the two can finally be told apart. The drive controller turns those into a messageKey, and the renderer shows the matching catalogue string — the nine-locale errors.popupBlocked that shipped unused, or a new errors.authCancelled. Every other failure keeps its own message.
• A popup attempt that ends without a session clears isLoading, cannot become an unhandled rejection, and ALWAYS leaves an error behind.
• UpupAuthError takes an optional third code argument defaulting to AUTH_PROVIDER_ERROR, so existing call sites are unchanged. ErrorMessages.authCancelled is OPTIONAL, so a hand-written locale bundle still type-checks — which is why this is a patch and not a breaking minor.

Also in this release: #411 holds the drive-sandbox escaper copy to the @useupup/core implementation with a twin test, so the two cannot drift.

📦 Packages

Eight of the nine packages are published to npm under the @useupup scope. @useupup/server did NOT publish at this version — it fails npm OIDC trusted publishing with ENEEDAUTH, as it did on 3.3.1 and 3.3.2, and is still on 3.3.0. Nothing is wrong with the server package's code; the trusted-publisher configuration on npmjs.com has to be repaired before it can ship. Tracked in #406.

Package	Version
@useupup/angular	3.3.3
@useupup/core	3.3.3
@useupup/next	3.3.3
@useupup/preact	3.3.3
@useupup/react	3.3.3
@useupup/server	3.3.0 — not published at 3.3.3 (#406)
@useupup/svelte	3.3.3
@useupup/vanilla	3.3.3
@useupup/vue	3.3.3

📥 Install

# pick your framework
npm i @useupup/react     # or @useupup/vue · @useupup/svelte · @useupup/angular · @useupup/vanilla · @useupup/preact

# server mode — presign + proxy uploads to any S3-compatible storage
npm i @useupup/server    # plus @useupup/next for Next.js route handlers — server is still 3.3.0, see #406

📝 What's changed

• fix(core,react,vue,svelte,angular,vanilla): report a declined drive consent as a cancellation, not a blocked popup by @BSalaeddin in #394
• test(scripts): hold the drive-sandbox escaper copy to the core implementation by @BSalaeddin in #411
• chore: promote dev to master (3.3.3 — drive decline reporting) by @BSalaeddin in #412
• Version Packages by @github-actions in #413

Full Changelog: v3.3.2...v3.3.3