@oxy.so/services 1.0.0

package/lib/module/ui/server.js

@@ -0,0 +1,55 @@
+"use strict";
+
+/**
+ * Server-safe UI exports (noops)
+ *
+ * Import from this module for SSR environments where React components
+ * shouldn't be rendered on the server.
+ *
+ * @example
+ * import { OxyProvider, useOxy } from '@oxy.so/services/ui/server';
+ */
+
+// Noop utilities
+const noopComponent = () => null;
+const noopHook = () => ({});
+const noopStorageResult = {
+  storage: null,
+  isReady: false
+};
+
+// Components (all render null)
+export const OxyProvider = noopComponent;
+export const OxySignInButton = noopComponent;
+export const LogoIcon = noopComponent;
+export const LogoText = noopComponent;
+export const FollowButton = noopComponent;
+export const OxyPayButton = noopComponent;
+
+// Context
+export const useOxy = noopHook;
+
+// Hooks (all return empty objects)
+export const useAuth = noopHook;
+export const useFollow = noopHook;
+export const useStorage = () => noopStorageResult;
+
+// Screens (render null)
+export const ProfileScreen = noopComponent;
+
+// Stores (return empty objects)
+export const useAuthStore = noopHook;
+
+// Toast (noop)
+export const toast = Object.assign(() => {}, {
+  success: () => {},
+  error: () => {},
+  info: () => {},
+  warning: () => {},
+  loading: () => {},
+  dismiss: () => {}
+});
+
+// Error handler utilities (pure functions work everywhere)
+export { handleAuthError, isInvalidSessionError, isTimeoutOrNetworkError, extractErrorMessage } from "./utils/errorHandlers.js";
+//# sourceMappingURL=server.js.map

package/lib/module/ui/server.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["noopComponent","noopHook","noopStorageResult","storage","isReady","OxyProvider","OxySignInButton","LogoIcon","LogoText","FollowButton","OxyPayButton","useOxy","useAuth","useFollow","useStorage","ProfileScreen","useAuthStore","toast","Object","assign","success","error","info","warning","loading","dismiss","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage"],"sourceRoot":"../../../src","sources":["ui/server.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA,MAAMA,aAAa,GAAGA,CAAA,KAAM,IAAI;AAChC,MAAMC,QAAQ,GAAGA,CAAA,MAAO,CAAC,CAAC,CAAC;AAC3B,MAAMC,iBAAiB,GAAG;EAAEC,OAAO,EAAE,IAAI;EAAEC,OAAO,EAAE;AAAM,CAAC;;AAE3D;AACA,OAAO,MAAMC,WAAW,GAAGL,aAAa;AACxC,OAAO,MAAMM,eAAe,GAAGN,aAAa;AAC5C,OAAO,MAAMO,QAAQ,GAAGP,aAAa;AACrC,OAAO,MAAMQ,QAAQ,GAAGR,aAAa;AACrC,OAAO,MAAMS,YAAY,GAAGT,aAAa;AACzC,OAAO,MAAMU,YAAY,GAAGV,aAAa;;AAEzC;AACA,OAAO,MAAMW,MAAM,GAAGV,QAAQ;;AAE9B;AACA,OAAO,MAAMW,OAAO,GAAGX,QAAQ;AAC/B,OAAO,MAAMY,SAAS,GAAGZ,QAAQ;AACjC,OAAO,MAAMa,UAAU,GAAGA,CAAA,KAAMZ,iBAAiB;;AAEjD;AACA,OAAO,MAAMa,aAAa,GAAGf,aAAa;;AAE1C;AACA,OAAO,MAAMgB,YAAY,GAAGf,QAAQ;;AAEpC;AACA,OAAO,MAAMgB,KAAK,GAAGC,MAAM,CAACC,MAAM,CAC9B,MAAM,CAAC,CAAC,EACR;EACIC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,KAAK,EAAEA,CAAA,KAAM,CAAC,CAAC;EACfC,IAAI,EAAEA,CAAA,KAAM,CAAC,CAAC;EACdC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC;AACpB,CACJ,CAAC;;AAED;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,0BAAuB","ignoreList":[]}

package/lib/module/ui/session/authStore.js

@@ -0,0 +1,70 @@
+"use strict";
+
+/**
+ * Platform `AuthStateStore` for `@oxy.so/services`.
+ *
+ * The device model persists the durable device credential (`deviceId` +
+ * `deviceSecret`) per origin (web) / per device (native), and the SDK re-mints
+ * the access token from that credential on cold boot. `@oxy.so/core` owns the
+ * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
+ * `createMemoryAuthStateStore`); this module only selects the seam:
+ *
+ *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
+ *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
+ *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
+ *    the shared `createNativeSecureKeyValueStorage()` adapter
+ *    (`expo-secure-store`, AsyncStorage fallback), WRAPPED so every credential
+ *    it persists is also mirrored into the device-wide shared slot.
+ *
+ * The native wrapper is how several official apps end up on ONE `DeviceSession`
+ * (and therefore one active context): whichever app proves a credential publishes
+ * it, and a later-installed sibling adopts it during cold boot instead of asking
+ * for the Commons identity key. The mirror is additive — it can neither change
+ * nor fail the app's own durable write.
+ */
+import { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, createSharedMirroringAuthStateStore } from '@oxy.so/core';
+import { isReactNative } from "../utils/storageHelpers.js";
+import { createNativeSecureKeyValueStorage } from "./nativeSecureStorage.js";
+import { createPlatformSharedDeviceCredentialStore } from "./sharedDeviceCredentialStore.js";
+/**
+ * Build the platform {@link AuthStateStore} for this runtime.
+ *
+ * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
+ * token) per-app in SecureStore; the SDK re-mints the access token from the
+ * device credential on the next cold boot.
+ *
+ * ## The ephemeral check is FIRST, and the order is load-bearing
+ *
+ * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
+ * never reach the native path — and therefore can never reach the shared-slot
+ * mirroring wrapper. Checked after that branch instead, an origin that has
+ * declined to persist a credential would publish one into the device-wide slot
+ * every sibling app adopts on cold boot: it would keep nothing itself while
+ * deciding which session five other apps boot into.
+ *
+ * That is unreachable today because the only ephemeral caller is a web origin, so
+ * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
+ * of guarantee that stops holding when someone adds the second caller, so it is
+ * structural here rather than incidental, and
+ * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
+ */
+export function createPlatformAuthStateStore(options = {}) {
+  // FIRST, above every platform branch — see the docblock for why the ordering
+  // is the guarantee and not a coincidence.
+  if (options.storage === 'ephemeral') {
+    return createMemoryAuthStateStore();
+  }
+  if (!isReactNative()) {
+    return createWebAuthStateStore();
+  }
+  const local = createNativeAuthStateStore(createNativeSecureKeyValueStorage());
+  if (options.sessionMode === 'identity') {
+    return local;
+  }
+  const shared = createPlatformSharedDeviceCredentialStore();
+  return shared ? createSharedMirroringAuthStateStore({
+    local,
+    shared
+  }) : local;
+}
+//# sourceMappingURL=authStore.js.map

package/lib/module/ui/session/authStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createWebAuthStateStore","createNativeAuthStateStore","createMemoryAuthStateStore","createSharedMirroringAuthStateStore","isReactNative","createNativeSecureKeyValueStorage","createPlatformSharedDeviceCredentialStore","createPlatformAuthStateStore","options","storage","local","sessionMode","shared"],"sourceRoot":"../../../../src","sources":["ui/session/authStore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEA,uBAAuB,EACvBC,0BAA0B,EAC1BC,0BAA0B,EAC1BC,mCAAmC,QAG9B,cAAc;AACrB,SAASC,aAAa,QAAQ,4BAAyB;AACvD,SAASC,iCAAiC,QAAQ,0BAAuB;AACzE,SAASC,yCAAyC,QAAQ,kCAA+B;AAgCzF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,4BAA4BA,CAC1CC,OAAsC,GAAG,CAAC,CAAC,EAC3B;EAChB;EACA;EACA,IAAIA,OAAO,CAACC,OAAO,KAAK,WAAW,EAAE;IACnC,OAAOP,0BAA0B,CAAC,CAAC;EACrC;EAEA,IAAI,CAACE,aAAa,CAAC,CAAC,EAAE;IACpB,OAAOJ,uBAAuB,CAAC,CAAC;EAClC;EAEA,MAAMU,KAAK,GAAGT,0BAA0B,CAACI,iCAAiC,CAAC,CAAC,CAAC;EAC7E,IAAIG,OAAO,CAACG,WAAW,KAAK,UAAU,EAAE;IACtC,OAAOD,KAAK;EACd;EACA,MAAME,MAAM,GAAGN,yCAAyC,CAAC,CAAC;EAC1D,OAAOM,MAAM,GAAGT,mCAAmC,CAAC;IAAEO,KAAK;IAAEE;EAAO,CAAC,CAAC,GAAGF,KAAK;AAChF","ignoreList":[]}

package/lib/module/ui/session/backgroundSession.js

@@ -0,0 +1,252 @@
+"use strict";
+
+/**
+ * The JS half of the native background session credential.
+ *
+ * A home-screen widget or a sync job refreshes while the app process is dead:
+ * there is no JS runtime, so it cannot go through this SDK's normal session lane
+ * at all. Native code needs its own way to obtain a bearer, and this module is
+ * what gives it one — while the app runs, it provisions a purpose-built
+ * credential and hands it to the native store that `so.oxy.session.OxyBackgroundSession`
+ * reads.
+ *
+ * ## Why a separate credential rather than the device secret
+ *
+ * `POST /session/device/token` ROTATES the device secret on every mint, and the
+ * presented secret dies 60 seconds later. Native code minting with it would be a
+ * second writer to the value this SDK's whole session depends on — and since
+ * `createNativeAuthStateStore` serves JS from an in-process mirror that never
+ * re-reads storage, JS would be blind to that rotation. A worker killed between
+ * the server's rotation and its local write would sign the user out of the app.
+ * A credential that nobody rotates removes that failure mode instead of managing
+ * it.
+ *
+ * ## What this does NOT do
+ *
+ * It never reads or writes `oxy.auth.v1` / expo-secure-store. The two credentials
+ * live in different stores with one writer each, so there is nothing to keep in
+ * lockstep and no state that can disagree.
+ *
+ * ## Android only, and web is refused rather than merely unsupported
+ *
+ * Web is gated off by an explicit platform check, not by the native module being
+ * absent — provisioning in a browser origin would be a security downgrade, so it
+ * must not depend on an incidental fact. See {@link loadNativeModule}. iOS has no
+ * implementation yet and resolves to no module, so every function here degrades to
+ * a no-op: an app can enable this and lose nothing on other platforms.
+ */
+import { requireOptionalNativeModule } from 'expo-modules-core';
+import { Platform } from 'react-native';
+import { logger } from '@oxy.so/core';
+
+/**
+ * The native module's surface. Deliberately write-mostly: there is no `get`,
+ * because JS has no use for the secret it just wrote and keeping native as the
+ * secret's only reader is one less place it can leak from.
+ */
+
+/**
+ * Re-provision once the remaining lifetime drops below this.
+ *
+ * The server issues a 30-day credential; renewing with a week to spare means an
+ * app opened even occasionally always holds a live one, while an app left unopened
+ * for a month lets it lapse — which is the intended outcome, not a failure.
+ */
+const RENEW_WHEN_REMAINING_MS = 7 * 24 * 60 * 60 * 1000;
+let nativeModule;
+
+/**
+ * Resolve the native module once — and refuse outright on web.
+ *
+ * ## Web is excluded on purpose, and not merely because the module is absent
+ *
+ * The credential is deliberately NON-ROTATING and long-lived, which is safe only
+ * because native background code is its sole consumer and nobody rotates it. A
+ * browser origin already holds the ROTATING `deviceSecret`, and it has no
+ * background worker to serve — so provisioning there would add a strictly weaker
+ * long-lived secret alongside a stronger short-lived one. That is a downgrade, not
+ * a harmless no-op, and the harm lands at the PROVISION CALL (which mints a live
+ * server-side credential) regardless of whether anything manages to store it.
+ *
+ * That property must not rest on `requireOptionalNativeModule` happening to return
+ * `null` on web. It does today — the module is registered for android only — but
+ * that is an incidental fact a future web shim or a web-build native-module mock
+ * would quietly reverse. So the platform is checked FIRST, before we even ask the
+ * registry, and every entry point in this module inherits the gate.
+ *
+ * (A pre-deploy server makes this visible too: oxy-api's `sessionDevice` router
+ * applies `requireSameSiteOrigin` path-agnostically, so an unmatched path answers
+ * `404` to a native caller but `403 BAD_ORIGIN` to a browser one. Core's degrade is
+ * deliberately narrow — `404 → null` only — because a real origin misconfiguration
+ * on a CURRENT server also returns 403, and swallowing that would hide a genuine
+ * bug. Platform gating belongs here, where the platform is actually known.)
+ *
+ * `requireOptionalNativeModule` (a static import Metro always resolves) rather
+ * than a dynamic `import(moduleName)`: the latter compiles to `require(variable)`
+ * in the CJS build, which Metro cannot resolve inside a consuming app — it
+ * silently returned `null` there, which is exactly how the cross-app SSO bridge
+ * broke once. Same reasoning as `loadSharedIdentityBridge` in `@oxy.so/protocol`.
+ */
+function loadNativeModule() {
+  if (nativeModule === undefined) {
+    if (Platform.OS === 'web') {
+      nativeModule = null;
+      return nativeModule;
+    }
+    const native = requireOptionalNativeModule('OxyBackgroundSession');
+    nativeModule = native && typeof native.put === 'function' && typeof native.clear === 'function' && typeof native.peek === 'function' ? {
+      put: native.put.bind(native),
+      clear: native.clear.bind(native),
+      peek: native.peek.bind(native)
+    } : null;
+  }
+  return nativeModule;
+}
+
+/** Whether this platform/app can hold a background credential at all. */
+export function isBackgroundSessionSupported() {
+  return loadNativeModule() !== null;
+}
+
+/**
+ * Drop the stored credential. No-op where unsupported, and never throws.
+ *
+ * Called on sign-out and BEFORE an account switch's network work, so the window
+ * in which background code could still serve the previous account is as short as
+ * one local write.
+ */
+export async function clearBackgroundSession() {
+  const native = loadNativeModule();
+  if (!native) {
+    return;
+  }
+  try {
+    await native.clear();
+  } catch (error) {
+    logger.warn('[backgroundSession] could not clear the native background credential', {
+      component: 'backgroundSession',
+      error
+    });
+  }
+}
+/**
+ * Fail LOUDLY when the installed `@oxy.so/core` predates
+ * `provisionBackgroundCredential`.
+ *
+ * This is the one failure here that is a build/dependency mistake rather than a
+ * runtime condition, and it is the one that must never be quiet. Everything else
+ * in `syncBackgroundSession` is caught and logged at warn, which is right for a
+ * flaky network — but applying that to a version skew would leave background
+ * refreshes permanently non-functional behind a warning nobody reads. So this
+ * throws, and logs at ERROR first so it is still visible in a release build whose
+ * rejection handler is silent.
+ *
+ * Reachable only through a runtime skew: the declared `@oxy.so/core` range covers
+ * the method, so a correctly-resolved install cannot get here, and TypeScript
+ * rules it out at compile time.
+ */
+function assertProvisioningAvailable(oxyServices) {
+  if (typeof oxyServices.provisionBackgroundCredential === 'function') {
+    return;
+  }
+  const message = '[backgroundSession] the installed @oxy.so/core has no provisionBackgroundCredential, ' + 'so no background credential can be provisioned and native background refreshes will ' + 'never authenticate. Install a @oxy.so/core that satisfies this package\'s declared range.';
+  logger.error(message, undefined, {
+    component: 'backgroundSession'
+  });
+  throw new Error(message);
+}
+
+/**
+ * Bring the native credential in line with the session JS currently holds.
+ *
+ * Ordering is the load-bearing part: a credential belonging to a DIFFERENT
+ * account is cleared before any network call, so a crash mid-provision leaves
+ * background code signed out rather than serving the previous account's data
+ * under the new account's name. The server enforces the same rule independently
+ * (a mint is re-authorized against the live device session, and against its ACTIVE
+ * account), so this is the fast local half of a belt-and-braces pair, not the only
+ * guard.
+ *
+ * Throws for exactly one thing — a `@oxy.so/core` too old to provision (see
+ * {@link assertProvisioningAvailable}). Every other failure is caught and logged:
+ * a background credential is an enhancement, and failing to provision one must
+ * not disturb the session that is working.
+ */
+export async function syncBackgroundSession(input) {
+  const native = loadNativeModule();
+  if (!native) {
+    return;
+  }
+  const {
+    oxyServices,
+    userId,
+    canUsePrivateApi,
+    isCurrent
+  } = input;
+
+  // Before the try, so the catch below cannot turn a dependency skew into a
+  // warning. Signed-out is exempt: clearing needs no core method, and a sign-out
+  // must never be blocked by one.
+  if (userId) {
+    assertProvisioningAvailable(oxyServices);
+  }
+  try {
+    if (!userId) {
+      // Signed out. Local-only, so it works with no bearer and no network.
+      await native.clear();
+      return;
+    }
+    const stored = await native.peek();
+    if (stored && stored.accountId !== userId) {
+      // Identity changed under a live credential — clear FIRST, provision after.
+      await native.clear();
+    }
+    const isForCurrentAccount = stored?.accountId === userId;
+    const hasLifeLeft = isForCurrentAccount && stored.expiresAt - Date.now() > RENEW_WHEN_REMAINING_MS;
+    if (hasLifeLeft) {
+      return;
+    }
+
+    // Everything below needs a bearer. Without one yet (cold boot still
+    // resolving) there is nothing to do but wait for the next run — the token
+    // landing re-triggers this.
+    if (!canUsePrivateApi || !isCurrent()) {
+      return;
+    }
+    const provisioned = await oxyServices.provisionBackgroundCredential();
+    if (!provisioned) {
+      // `null` means the endpoint is not deployed yet. Expected during the
+      // rollout window (api leads the SDK) and deliberately quiet.
+      return;
+    }
+    if (!isCurrent()) {
+      return;
+    }
+    if (provisioned.accountId !== userId) {
+      // The active account moved while the request was in flight, so this
+      // credential is already for the wrong account. Drop it; the next run
+      // provisions for the account that is actually signed in.
+      await native.clear();
+      return;
+    }
+    const expiresAt = Date.parse(provisioned.expiresAt);
+    if (!Number.isFinite(expiresAt)) {
+      logger.warn('[backgroundSession] server returned an unparseable credential expiry', {
+        component: 'backgroundSession'
+      });
+      return;
+    }
+    const persisted = await native.put(oxyServices.getBaseURL(), provisioned.deviceId, provisioned.secret, provisioned.accountId, expiresAt);
+    if (!persisted) {
+      logger.warn('[backgroundSession] the native store did not retain the background credential; background refreshes stay signed out until the next attempt', {
+        component: 'backgroundSession'
+      });
+    }
+  } catch (error) {
+    logger.warn('[backgroundSession] could not sync the native background credential', {
+      component: 'backgroundSession',
+      error
+    });
+  }
+}
+//# sourceMappingURL=backgroundSession.js.map

package/lib/module/ui/session/backgroundSession.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["requireOptionalNativeModule","Platform","logger","RENEW_WHEN_REMAINING_MS","nativeModule","loadNativeModule","undefined","OS","native","put","clear","peek","bind","isBackgroundSessionSupported","clearBackgroundSession","error","warn","component","assertProvisioningAvailable","oxyServices","provisionBackgroundCredential","message","Error","syncBackgroundSession","input","userId","canUsePrivateApi","isCurrent","stored","accountId","isForCurrentAccount","hasLifeLeft","expiresAt","Date","now","provisioned","parse","Number","isFinite","persisted","getBaseURL","deviceId","secret"],"sourceRoot":"../../../../src","sources":["ui/session/backgroundSession.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,2BAA2B,QAAQ,mBAAmB;AAC/D,SAASC,QAAQ,QAAQ,cAAc;AAEvC,SAASC,MAAM,QAAQ,cAAc;;AAErC;AACA;AACA;AACA;AACA;;AA+BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;AAEvD,IAAIC,YAAiE;;AAErE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAA4C;EACnE,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,IAAIL,QAAQ,CAACM,EAAE,KAAK,KAAK,EAAE;MACzBH,YAAY,GAAG,IAAI;MACnB,OAAOA,YAAY;IACrB;IACA,MAAMI,MAAM,GAAGR,2BAA2B,CACxC,sBACF,CAAC;IACDI,YAAY,GACVI,MAAM,IACN,OAAOA,MAAM,CAACC,GAAG,KAAK,UAAU,IAChC,OAAOD,MAAM,CAACE,KAAK,KAAK,UAAU,IAClC,OAAOF,MAAM,CAACG,IAAI,KAAK,UAAU,GAC7B;MACEF,GAAG,EAAED,MAAM,CAACC,GAAG,CAACG,IAAI,CAACJ,MAAM,CAAC;MAC5BE,KAAK,EAAEF,MAAM,CAACE,KAAK,CAACE,IAAI,CAACJ,MAAM,CAAC;MAChCG,IAAI,EAAEH,MAAM,CAACG,IAAI,CAACC,IAAI,CAACJ,MAAM;IAC/B,CAAC,GACD,IAAI;EACZ;EACA,OAAOJ,YAAY;AACrB;;AAEA;AACA,OAAO,SAASS,4BAA4BA,CAAA,EAAY;EACtD,OAAOR,gBAAgB,CAAC,CAAC,KAAK,IAAI;AACpC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeS,sBAAsBA,CAAA,EAAkB;EAC5D,MAAMN,MAAM,GAAGH,gBAAgB,CAAC,CAAC;EACjC,IAAI,CAACG,MAAM,EAAE;IACX;EACF;EACA,IAAI;IACF,MAAMA,MAAM,CAACE,KAAK,CAAC,CAAC;EACtB,CAAC,CAAC,OAAOK,KAAK,EAAE;IACdb,MAAM,CAACc,IAAI,CAAC,sEAAsE,EAAE;MAClFC,SAAS,EAAE,mBAAmB;MAC9BF;IACF,CAAC,CAAC;EACJ;AACF;AAgBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASG,2BAA2BA,CAACC,WAAwB,EAAQ;EACnE,IAAI,OAAOA,WAAW,CAACC,6BAA6B,KAAK,UAAU,EAAE;IACnE;EACF;EACA,MAAMC,OAAO,GACX,uFAAuF,GACvF,sFAAsF,GACtF,2FAA2F;EAC7FnB,MAAM,CAACa,KAAK,CAACM,OAAO,EAAEf,SAAS,EAAE;IAAEW,SAAS,EAAE;EAAoB,CAAC,CAAC;EACpE,MAAM,IAAIK,KAAK,CAACD,OAAO,CAAC;AAC1B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeE,qBAAqBA,CAACC,KAAiC,EAAiB;EAC5F,MAAMhB,MAAM,GAAGH,gBAAgB,CAAC,CAAC;EACjC,IAAI,CAACG,MAAM,EAAE;IACX;EACF;EACA,MAAM;IAAEW,WAAW;IAAEM,MAAM;IAAEC,gBAAgB;IAAEC;EAAU,CAAC,GAAGH,KAAK;;EAElE;EACA;EACA;EACA,IAAIC,MAAM,EAAE;IACVP,2BAA2B,CAACC,WAAW,CAAC;EAC1C;EAEA,IAAI;IACF,IAAI,CAACM,MAAM,EAAE;MACX;MACA,MAAMjB,MAAM,CAACE,KAAK,CAAC,CAAC;MACpB;IACF;IAEA,MAAMkB,MAAM,GAAG,MAAMpB,MAAM,CAACG,IAAI,CAAC,CAAC;IAClC,IAAIiB,MAAM,IAAIA,MAAM,CAACC,SAAS,KAAKJ,MAAM,EAAE;MACzC;MACA,MAAMjB,MAAM,CAACE,KAAK,CAAC,CAAC;IACtB;IAEA,MAAMoB,mBAAmB,GAAGF,MAAM,EAAEC,SAAS,KAAKJ,MAAM;IACxD,MAAMM,WAAW,GACfD,mBAAmB,IAAIF,MAAM,CAACI,SAAS,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG/B,uBAAuB;IAChF,IAAI4B,WAAW,EAAE;MACf;IACF;;IAEA;IACA;IACA;IACA,IAAI,CAACL,gBAAgB,IAAI,CAACC,SAAS,CAAC,CAAC,EAAE;MACrC;IACF;IAEA,MAAMQ,WAAW,GAAG,MAAMhB,WAAW,CAACC,6BAA6B,CAAC,CAAC;IACrE,IAAI,CAACe,WAAW,EAAE;MAChB;MACA;MACA;IACF;IACA,IAAI,CAACR,SAAS,CAAC,CAAC,EAAE;MAChB;IACF;IACA,IAAIQ,WAAW,CAACN,SAAS,KAAKJ,MAAM,EAAE;MACpC;MACA;MACA;MACA,MAAMjB,MAAM,CAACE,KAAK,CAAC,CAAC;MACpB;IACF;IAEA,MAAMsB,SAAS,GAAGC,IAAI,CAACG,KAAK,CAACD,WAAW,CAACH,SAAS,CAAC;IACnD,IAAI,CAACK,MAAM,CAACC,QAAQ,CAACN,SAAS,CAAC,EAAE;MAC/B9B,MAAM,CAACc,IAAI,CAAC,sEAAsE,EAAE;QAClFC,SAAS,EAAE;MACb,CAAC,CAAC;MACF;IACF;IAEA,MAAMsB,SAAS,GAAG,MAAM/B,MAAM,CAACC,GAAG,CAChCU,WAAW,CAACqB,UAAU,CAAC,CAAC,EACxBL,WAAW,CAACM,QAAQ,EACpBN,WAAW,CAACO,MAAM,EAClBP,WAAW,CAACN,SAAS,EACrBG,SACF,CAAC;IACD,IAAI,CAACO,SAAS,EAAE;MACdrC,MAAM,CAACc,IAAI,CACT,4IAA4I,EAC5I;QAAEC,SAAS,EAAE;MAAoB,CACnC,CAAC;IACH;EACF,CAAC,CAAC,OAAOF,KAAK,EAAE;IACdb,MAAM,CAACc,IAAI,CAAC,qEAAqE,EAAE;MACjFC,SAAS,EAAE,mBAAmB;MAC9BF;IACF,CAAC,CAAC;EACJ;AACF","ignoreList":[]}

package/lib/module/ui/session/createSessionClient.js

@@ -0,0 +1,53 @@
+"use strict";
+
+import { SessionClient, createSessionClientHost } from '@oxy.so/core';
+import { createTokenTransport } from "./tokenTransport.js";
+
+/**
+ * Wire a `SessionClient` for `@oxy.so/services`.
+ *
+ * The platform-agnostic parts (host adapter, client, projection helpers) live
+ * ONCE in `@oxy.so/core`; this thin factory only injects the pieces specific to
+ * the RN/Expo SDK:
+ *
+ *  - `socket.io-client`'s `io`, STATICALLY imported (socket.io-client is a real
+ *    dependency of `@oxy.so/services`) so realtime session sync never relies on
+ *    core's lazy dynamic import of a bare specifier — bundler-fragile in
+ *    Metro/Expo-web against the published core dist.
+ *  - the device-first {@link createTokenTransport}, which mints a fallback token
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
+ *
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
+ *
+ * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
+ * when signed out (after the one-shot join redirect).
+ *
+ * `getPinnedAccountId` reports the account an IDENTITY-BOUND provider
+ * (`sessionMode: 'identity'`) is pinned to, and `null` for every account-mode
+ * provider — which is exactly the value `SessionClient` and the transport read
+ * when the option is absent, so account mode is unchanged. While it reports an
+ * account, the client tracks device state truthfully but never re-binds its
+ * bearer to the device's mutable active account.
+ */
+export function createSessionClient(oxyServices, onUnauthenticated, getPinnedAccountId) {
+  const host = createSessionClientHost(oxyServices);
+  const transport = createTokenTransport(oxyServices, getPinnedAccountId);
+  const client = new SessionClient(host, {
+    transport,
+    onUnauthenticated,
+    getPinnedAccountId
+  });
+  return {
+    client,
+    host
+  };
+}
+//# sourceMappingURL=createSessionClient.js.map

package/lib/module/ui/session/createSessionClient.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SessionClient","createSessionClientHost","createTokenTransport","createSessionClient","oxyServices","onUnauthenticated","getPinnedAccountId","host","transport","client"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;AAAA,SACEA,aAAa,EACbC,uBAAuB,QAGlB,cAAc;AACrB,SAASC,oBAAoB,QAAQ,qBAAkB;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EACxDC,kBAAwC,EAIxC;EACA,MAAMC,IAAI,GAAGN,uBAAuB,CAACG,WAAW,CAAC;EACjD,MAAMI,SAAS,GAAGN,oBAAoB,CAACE,WAAW,EAAEE,kBAAkB,CAAC;EACvE,MAAMG,MAAM,GAAG,IAAIT,aAAa,CAACO,IAAI,EAAE;IACrCC,SAAS;IACTH,iBAAiB;IACjBC;EACF,CAAC,CAAC;EACF,OAAO;IAAEG,MAAM;IAAEF;EAAK,CAAC;AACzB","ignoreList":[]}

package/lib/module/ui/session/identityBinding.js

@@ -0,0 +1,89 @@
+"use strict";
+
+/**
+ * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
+ *
+ * `@oxy.so/core` owns everything platform-agnostic about an identity-bound
+ * session: the pin store shapes, `resolveIdentityPin`,
+ * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
+ * deliberately leaves out is WHICH pin store a given runtime should use, so this
+ * module supplies it — web `localStorage` vs the same native SecureStore adapter
+ * the device credential already persists through — and adds the one piece of
+ * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
+ * account id.
+ *
+ * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
+ * on the socket/apply path, while resolving the pin is asynchronous (a storage
+ * read plus a keychain read, through `resolveIdentityPin`). The provider
+ * resolves it before the cold boot and after every (re-)established identity
+ * session; every read after that is free.
+ */
+import { createNativeIdentityPinStore, createWebIdentityPinStore, resolveIdentityPin } from '@oxy.so/core';
+import { isReactNative } from "../utils/storageHelpers.js";
+import { createNativeSecureKeyValueStorage } from "./nativeSecureStorage.js";
+
+/**
+ * The provider-scoped identity binding: the core {@link IdentityBinding} handed
+ * to the cold boot and the re-mint handler, plus the resolved pin the projection
+ * and `SessionClient` bind to.
+ */
+
+/**
+ * Thrown by every account-graph mutation while the provider runs in
+ * `sessionMode: 'identity'`.
+ *
+ * An identity-bound app's user is the owner of the local identity key — fixed,
+ * for the lifetime of that key. Switching it is not a temporarily-unavailable
+ * operation that could be retried, it is not part of this mode's contract at
+ * all, so the surfaces reject loudly rather than resolving to a no-op that would
+ * read to the caller as a successful switch.
+ */
+export class IdentityBoundSessionError extends Error {
+  name = 'IdentityBoundSessionError';
+  code = 'identity_bound_session';
+  constructor(operation) {
+    super(`"${operation}" is unavailable while the session is identity-bound (sessionMode: "identity"): this app authenticates as the owner of the local identity key and cannot switch accounts.`);
+    this.operation = operation;
+  }
+}
+
+/**
+ * Build the identity binding for this runtime. Called ONCE per provider mount,
+ * and ONLY when `sessionMode: 'identity'` — account-mode providers never
+ * construct a pin store.
+ */
+export function createIdentitySessionBinding() {
+  const pinStore = isReactNative() ? createNativeIdentityPinStore(createNativeSecureKeyValueStorage()) : createWebIdentityPinStore();
+  const binding = {
+    pinStore
+  };
+
+  // Only a RESOLVED (non-null) pin is memoised. A `null` outcome is either "not
+  // pinned yet" or an indeterminate key read (locked keychain), and caching
+  // either one would leave this client permanently unpinned for the rest of the
+  // process — the exact state in which it would start following the device's
+  // mutable active account.
+  let pinnedAccountId = null;
+  let inFlight = null;
+  const resolve = () => {
+    if (!inFlight) {
+      inFlight = resolveIdentityPin(binding).then(pin => {
+        pinnedAccountId = pin?.accountId ?? null;
+        return pinnedAccountId;
+      }).finally(() => {
+        inFlight = null;
+      });
+    }
+    return inFlight;
+  };
+  return {
+    binding,
+    getPinnedAccountId: () => pinnedAccountId,
+    ensurePinnedAccountId: () => pinnedAccountId !== null ? Promise.resolve(pinnedAccountId) : resolve(),
+    refreshPinnedAccountId: () => {
+      pinnedAccountId = null;
+      return resolve();
+    }
+  };
+}
+//# sourceMappingURL=identityBinding.js.map

package/lib/module/ui/session/identityBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createNativeIdentityPinStore","createWebIdentityPinStore","resolveIdentityPin","isReactNative","createNativeSecureKeyValueStorage","IdentityBoundSessionError","Error","name","code","constructor","operation","createIdentitySessionBinding","pinStore","binding","pinnedAccountId","inFlight","resolve","then","pin","accountId","finally","getPinnedAccountId","ensurePinnedAccountId","Promise","refreshPinnedAccountId"],"sourceRoot":"../../../../src","sources":["ui/session/identityBinding.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEA,4BAA4B,EAC5BC,yBAAyB,EACzBC,kBAAkB,QAEb,cAAc;AACrB,SAASC,aAAa,QAAQ,4BAAyB;AACvD,SAASC,iCAAiC,QAAQ,0BAAuB;;AAEzE;AACA;AACA;AACA;AACA;;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAyB,SAASC,KAAK,CAAC;EACjCC,IAAI,GAAG,2BAA2B;EAC3CC,IAAI,GAAG,wBAAwB;EACxCC,WAAWA,CAAUC,SAAiB,EAAE;IACtC,KAAK,CACH,IAAIA,SAAS,2KACf,CAAC;IAAC,KAHiBA,SAAiB,GAAjBA,SAAiB;EAItC;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,4BAA4BA,CAAA,EAA2B;EACrE,MAAMC,QAAQ,GAAGT,aAAa,CAAC,CAAC,GAC5BH,4BAA4B,CAACI,iCAAiC,CAAC,CAAC,CAAC,GACjEH,yBAAyB,CAAC,CAAC;EAC/B,MAAMY,OAAwB,GAAG;IAAED;EAAS,CAAC;;EAE7C;EACA;EACA;EACA;EACA;EACA,IAAIE,eAA8B,GAAG,IAAI;EACzC,IAAIC,QAAuC,GAAG,IAAI;EAElD,MAAMC,OAAO,GAAGA,CAAA,KAA8B;IAC5C,IAAI,CAACD,QAAQ,EAAE;MACbA,QAAQ,GAAGb,kBAAkB,CAACW,OAAO,CAAC,CACnCI,IAAI,CAAEC,GAAG,IAAK;QACbJ,eAAe,GAAGI,GAAG,EAAEC,SAAS,IAAI,IAAI;QACxC,OAAOL,eAAe;MACxB,CAAC,CAAC,CACDM,OAAO,CAAC,MAAM;QACbL,QAAQ,GAAG,IAAI;MACjB,CAAC,CAAC;IACN;IACA,OAAOA,QAAQ;EACjB,CAAC;EAED,OAAO;IACLF,OAAO;IACPQ,kBAAkB,EAAEA,CAAA,KAAMP,eAAe;IACzCQ,qBAAqB,EAAEA,CAAA,KACrBR,eAAe,KAAK,IAAI,GAAGS,OAAO,CAACP,OAAO,CAACF,eAAe,CAAC,GAAGE,OAAO,CAAC,CAAC;IACzEQ,sBAAsB,EAAEA,CAAA,KAAM;MAC5BV,eAAe,GAAG,IAAI;MACtB,OAAOE,OAAO,CAAC,CAAC;IAClB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/index.js

@@ -0,0 +1,21 @@
+"use strict";
+
+/**
+ * Session-sync integration layer — intra-package use only.
+ *
+ * `@oxy.so/core` owns the platform-agnostic `SessionClient`, its host adapter,
+ * and the pure `DeviceSessionState → services` projection helpers; those are
+ * re-exported straight from core here so `OxyContext` has one import site.
+ * `@oxy.so/services` supplies only the platform pieces: the thin
+ * `createSessionClient` factory (injects socket.io-client `io` + the
+ * device-first token transport), the `AuthStateStore` factory, and — for
+ * `sessionMode: 'identity'` — the identity binding (platform pin store + the
+ * memoised pinned account id).
+ */
+export { createSessionClient } from "./createSessionClient.js";
+export { createTokenTransport } from "./tokenTransport.js";
+export { createPlatformAuthStateStore } from "./authStore.js";
+export { useBackgroundSessionSync } from "./useBackgroundSessionSync.js";
+export { createIdentitySessionBinding, IdentityBoundSessionError } from "./identityBinding.js";
+export { createSessionClientHost, accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions } from '@oxy.so/core';
+//# sourceMappingURL=index.js.map

package/lib/module/ui/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createSessionClient","createTokenTransport","createPlatformAuthStateStore","useBackgroundSessionSync","createIdentitySessionBinding","IdentityBoundSessionError","createSessionClientHost","accountIdsOf","activeSessionIdOf","activeUserOf","deviceStateToClientSessions"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAQ,0BAAuB;AAC3D,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,4BAA4B,QAAQ,gBAAa;AAC1D,SAASC,wBAAwB,QAAQ,+BAA4B;AACrE,SAASC,4BAA4B,EAAEC,yBAAyB,QAAQ,sBAAmB;AAE3F,SACEC,uBAAuB,EACvBC,YAAY,EACZC,iBAAiB,EACjBC,YAAY,EACZC,2BAA2B,QACtB,cAAc","ignoreList":[]}