@oxy.so/services 1.0.0

package/lib/typescript/commonjs/ui/context/commitSessionFlow.d.ts

@@ -0,0 +1,81 @@
+import type { User } from '@oxy.so/core';
+import type { WebAuthMode } from '../oauth/types';
+export interface CommitDeviceSetAndResolveDeps {
+    /**
+     * Whether this commit is a deliberate sign-in on THIS device (activates the
+     * account and BLOCKS on the device-set reconcile before resolving) vs. a
+     * cold-boot restore (resolves auth from the profile fetch FIRST, then
+     * reconciles the device set in the background).
+     */
+    activate: boolean;
+    /** Cold boot already carries authoritative device state from the mint. */
+    hasDeviceState?: boolean;
+    /** The committing account id (only used by `registerAndActivate`). */
+    userId?: string;
+    /** Minimal user carried by the commit input; used if the profile fetch fails. */
+    fallbackUser: User | null;
+    /** Deliberate sign-in: register + activate the account in the device set. */
+    registerAndActivate: (userId?: string) => Promise<void>;
+    /** Cold boot: ensure membership only; the server's `activeAccountId` wins. */
+    addCurrentAccount: () => Promise<void>;
+    /** Start the device-scoped socket. */
+    startSocket: () => Promise<void>;
+    /** Project the server-authoritative device state onto local sessions. */
+    syncFromClient: () => Promise<void>;
+    /** Hydrate the full profile (the commit input carries only minimal data). */
+    getCurrentUser: () => Promise<User | null>;
+    loginSuccess: (user: User) => void;
+    onAuthStateChange?: (user: User | null) => void;
+    markAuthResolved: () => void;
+}
+/**
+ * Device-set registration + full-user hydration + auth-resolution gate flip.
+ *
+ * On a deliberate sign-in (`activate: true`) the device-set reconcile is awaited
+ * BEFORE hydrating and resolving — unchanged legacy ordering. On a cold boot
+ * (`activate: false`) auth resolves from the profile fetch FIRST so the app can
+ * paint an authenticated shell without waiting on device-set registration, the
+ * socket connect, and the authoritative sessions projection — those reconcile in
+ * a DETACHED background task a moment later.
+ */
+export declare function commitDeviceSetAndResolve(deps: CommitDeviceSetAndResolveDeps): Promise<void>;
+export interface MaybeSyncHubAfterCommitDeps {
+    /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
+    activate: boolean;
+    /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
+    hubSyncRequested: boolean;
+    /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
+    hubSyncEnabled: boolean;
+    /**
+     * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
+     * A first-class input: `'popup'` forbids the redirect outright.
+     */
+    webAuthMode: WebAuthMode;
+    /**
+     * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
+     * navigation was actually started.
+     */
+    syncHub: () => Promise<boolean>;
+}
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+export declare function maybeSyncHubAfterCommit(deps: MaybeSyncHubAfterCommitDeps): Promise<boolean>;
+//# sourceMappingURL=commitSessionFlow.d.ts.map

package/lib/typescript/commonjs/ui/context/commitSessionFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitSessionFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/commitSessionFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,sCAAsC;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,yEAAyE;IACzE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,gBAAgB,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CAoFf;AAED,MAAM,WAAW,2BAA2B;IAC1C,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/lib/typescript/commonjs/ui/context/hooks/useAuthOperations.d.ts

@@ -0,0 +1,70 @@
+import type { ApiError, AuthStateStore, IdentityBinding, SessionClient, User } from '@oxy.so/core';
+import type { OxyRuntime } from '../../runtime';
+import type { StorageInterface } from '../../utils/storageHelpers';
+import type { OxyServices } from '@oxy.so/core';
+export interface UseAuthOperationsOptions {
+    oxyServices: OxyServices;
+    storage: StorageInterface | null;
+    /**
+     * The device-first persisted auth-state store. On EXPLICIT full sign-out the
+     * session blob is cleared (`store.clear()`) so a reload's cold boot finds no
+     * device credential to restore; on sign-in the returned zero-cookie device
+     * credential (`deviceId` + `deviceSecret`) is persisted so the next boot
+     * warm-restores without a redirect.
+     */
+    store: AuthStateStore;
+    /**
+     * The one owner of the session facts. Reads (`activeSessionId`) and writes
+     * (the account, the session mirror, the loading/error gates) both go through
+     * it, so this hook holds no copy of anything to fall out of step.
+     */
+    runtime: OxyRuntime;
+    saveActiveSessionId: (sessionId: string) => Promise<void>;
+    clearSessionState: () => Promise<void>;
+    /** Used only by `performSignIn`'s same-user duplicate-session dedup (legacy session-validate path; unrelated to the SessionClient device-account set). */
+    switchSession: (sessionId: string) => Promise<User>;
+    /**
+     * The Phase 3-A/3-B `SessionClient` (server-authoritative device account
+     * set). Device-scoped sign-out routes through `sessionClient.signOut(...)`.
+     * `logoutAll` additionally uses the global bearer endpoint so sessions on
+     * other devices and their refresh-token families are revoked.
+     */
+    sessionClient: SessionClient;
+    /** Reprojects `sessionClient.getState()` onto sessions/activeSessionId/user (Task 1's callback). Awaited after a partial `signOut` so the exposed state reflects the server truth before the call resolves. */
+    syncFromClient: () => Promise<void>;
+    onAuthStateChange?: (user: User | null) => void;
+    onError?: (error: ApiError) => void;
+    logger?: (message: string, error?: unknown) => void;
+    /**
+     * Identity-bound session (`sessionMode: 'identity'`). When set, a successful
+     * key sign-in writes the durable `{publicKey, accountId}` pin so pinned
+     * re-mints and projections bind immediately instead of waiting for a second
+     * `establishIdentitySession` round-trip.
+     */
+    identityBinding?: IdentityBinding;
+    /** Refreshes the provider's memoised pinned account id after the pin lands. */
+    refreshPinnedAccountId?: () => Promise<string | null>;
+}
+export interface UseAuthOperationsResult {
+    /** Sign in with existing public key */
+    signIn: (publicKey: string, deviceName?: string) => Promise<User>;
+    /** Logout from current session */
+    logout: (targetSessionId?: string) => Promise<void>;
+    /** Logout from all sessions */
+    logoutAll: () => Promise<void>;
+}
+/**
+ * Clear the persisted device credential on an explicit full sign-out.
+ * Best-effort and non-blocking: sign-out must never fail because a storage
+ * write threw. Exported so `OxyContext`'s zero-account branch (a REMOTE full
+ * sign-out pushed over the socket) runs the EXACT same cleanup as the local
+ * `logout` / `logoutAll` paths — a remote sign-out is indistinguishable from a
+ * local one to the next cold boot.
+ */
+export declare function clearPersistedAuthSafe(store: AuthStateStore, logger?: (message: string, error?: unknown) => void): void;
+/**
+ * Authentication operations using public key cryptography.
+ * Accepts public key as parameter - identity management is handled by the app layer.
+ */
+export declare const useAuthOperations: ({ oxyServices, store, runtime, saveActiveSessionId, clearSessionState, switchSession, sessionClient, syncFromClient, onAuthStateChange, onError, logger, identityBinding, refreshPinnedAccountId, }: UseAuthOperationsOptions) => UseAuthOperationsResult;
+//# sourceMappingURL=useAuthOperations.d.ts.map

package/lib/typescript/commonjs/ui/context/hooks/useAuthOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthOperations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/context/hooks/useAuthOperations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEnG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;;;;OAMG;IACH,KAAK,EAAE,cAAc,CAAC;IACtB;;;;OAIG;IACH,OAAO,EAAE,UAAU,CAAC;IACpB,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0JAA0J;IAC1J,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,+MAA+M;IAC/M,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kCAAkC;IAClC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,+BAA+B;IAC/B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAMD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAClD,IAAI,CAIN;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,qMAc/B,wBAAwB,KAAG,uBAiU7B,CAAC"}

package/lib/typescript/commonjs/ui/context/oxyContextHelpers.d.ts

@@ -0,0 +1,5 @@
+/** Local display hint when a session lacks explicit `expiresAt` (7 days). */
+export declare const DEFAULT_SESSION_VALIDITY_MS: number;
+export declare function getHttpStatus(error: unknown): number | undefined;
+export declare function isUnauthorizedStatus(error: unknown): boolean;
+//# sourceMappingURL=oxyContextHelpers.d.ts.map

package/lib/typescript/commonjs/ui/context/oxyContextHelpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxyContextHelpers.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/oxyContextHelpers.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,QAA0B,CAAC;AAEnE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAoBhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5D"}

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts

@@ -0,0 +1,232 @@
+import type { ReactNode } from 'react';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode } from '@oxy.so/core';
+import type { UseFollowHook } from '../hooks/useFollow.types';
+import type { useLanguageManagement } from '../hooks/useLanguageManagement';
+import type { RouteName } from '../navigation/routes';
+import type { StartWebOAuthSignInOptions } from '../oauth/browserAuthTransport';
+import type { OAuthConsentResult, RequestOAuthConsentOptions } from '../oauth/explicitOAuthConsent';
+import type { WebAuthMode, WebOAuthSignInResult } from '../oauth/types';
+import type { StorageInterface } from '../utils/storageHelpers';
+export interface OxyContextState {
+    user: User | null;
+    sessions: ClientSession[];
+    activeSessionId: string | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    isTokenReady: boolean;
+    hasAccessToken: boolean;
+    canUsePrivateApi: boolean;
+    isPrivateApiPending: boolean;
+    /**
+     * Whether the initial auth determination has concluded.
+     *
+     * `false` from mount until the FIRST device-first cold boot resolves —
+     * during that window `isAuthenticated: false` is UNDETERMINED, not a
+     * definitive "logged out". Flips to `true` exactly once the boot concludes
+     * (a session was committed OR none exists) and never reverts. Consumers should
+     * defer their first auth-dependent fetch until this is `true` so a cold-boot
+     * web reload with an existing session does not fetch anonymous data.
+     */
+    isAuthResolved: boolean;
+    isStorageReady: boolean;
+    /**
+     * Who owns this provider's session (see `OxyProviderProps.sessionMode`).
+     *
+     * `'account'` — the device's active account; any app on the device can switch
+     * it and this client follows. `'identity'` — the owner of the local primary
+     * identity key, permanently: a sibling app's account switch never changes this
+     * client's user or bearer, and every account-graph mutation
+     * (`switchToAccount` / `switchSession`) rejects with `IdentityBoundSessionError`
+     * while `accounts` stays empty and the account dialog never opens.
+     */
+    sessionMode: SessionMode;
+    /** How web third-party sign-in reaches the IdP (see `OxyProviderProps.webAuthMode`). */
+    webAuthMode: WebAuthMode;
+    error: string | null;
+    /** Active UI locale (`language-REGION`): the account's primary locale when signed in, else the guest/device locale. */
+    currentLanguage: string;
+    /** Ordered account locales (primary first) when signed in, or the single guest override when signed out. */
+    currentLanguages: string[];
+    currentLanguageMetadata: ReturnType<typeof useLanguageManagement>['metadata'];
+    currentLanguageName: string;
+    currentNativeLanguageName: string;
+    hasIdentity: () => Promise<boolean>;
+    getPublicKey: () => Promise<string | null>;
+    signIn: (publicKey: string, deviceName?: string) => Promise<User>;
+    /**
+     * Sign in with a passkey (WebAuthn). With no `username` this is the
+     * usernameless / discoverable-credential flow: the browser prompts for any
+     * resident Oxy passkey. Pass `username` for the username-first flow — the
+     * server scopes `allowCredentials` to that user's passkeys so a
+     * NON-discoverable hardware key (e.g. a U2F/security key) can be used.
+     * WEB-ONLY — throws on native or an unsupported browser (native passkeys are
+     * Commons' job). On `useOxy()`, NOT re-exposed on `useAuth()`.
+     */
+    signInWithPasskey: (opts?: {
+        username?: string;
+        deviceName?: string;
+        deviceFingerprint?: string;
+    }) => Promise<void>;
+    /**
+     * Create a brand-new account whose first authentication method is a passkey.
+     * WEB-ONLY — throws on native or an unsupported browser.
+     */
+    registerWithPasskey: (params: {
+        username: string;
+        deviceName?: string;
+    }) => Promise<void>;
+    /**
+     * Add a passkey to the already-signed-in account (bearer present). Does NOT
+     * commit a new session; refreshes the linked auth-methods list on success.
+     * WEB-ONLY — throws on native or an unsupported browser.
+     */
+    addPasskey: (params?: {
+        deviceName?: string;
+    }) => Promise<void>;
+    /**
+     * Remove a passkey from the current account by its credential id
+     * (`AuthMethodEntry.credentialId`). Refreshes the linked auth-methods list on
+     * success. Works on any platform (it is a plain unlink, not a WebAuthn
+     * ceremony) but is only reachable from surfaces that list passkeys.
+     */
+    removePasskey: (credentialId: string) => Promise<void>;
+    revokeSuspiciousSignIn: () => Promise<void>;
+    handleWebSession: (session: SessionLoginResponse) => Promise<void>;
+    /**
+     * Run a WEB third-party OAuth sign-in (authorization code + PKCE) end to end
+     * using this provider's `webAuthMode`, and commit the resulting session.
+     *
+     * This is the shared operation `OxySignInButton` delegates to; RPs that ship
+     * their own button call it directly and never implement popup listeners, a
+     * token exchange, or `state` validation themselves. Returns a typed result —
+     * closing the popup and running out of time are values, not exceptions.
+     *
+     * In popup mode the window MUST be opened during the user's click: either
+     * call this synchronously from the press handler (it opens one itself), or
+     * call `openOAuthPopup()` there and pass the handle as `popup`.
+     *
+     * No-op outside a browser and in `sessionMode: 'identity'`, both of which
+     * resolve to `{ status: 'unsupported' }`.
+     */
+    startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
+    /**
+     * Ask the already-authenticated user for explicit OAuth consent to exact
+     * application scopes. Must be called from a user gesture. Works on web and
+     * native and commits only a callback bound to the same user, state, PKCE pair
+     * and byte-exact redirect URI.
+     */
+    requestOAuthConsent: (options: RequestOAuthConsentOptions) => Promise<OAuthConsentResult>;
+    logout: (targetSessionId?: string) => Promise<void>;
+    logoutAll: () => Promise<void>;
+    switchSession: (sessionId: string) => Promise<User>;
+    removeSession: (sessionId: string) => Promise<void>;
+    refreshSessions: () => Promise<void>;
+    setLanguage: (languageId: string) => Promise<void>;
+    getDeviceSessions: () => Promise<Array<{
+        sessionId: string;
+        deviceId: string;
+        deviceName?: string;
+        lastActive?: string;
+        expiresAt?: string;
+    }>>;
+    logoutAllDeviceSessions: () => Promise<void>;
+    updateDeviceName: (deviceName: string) => Promise<void>;
+    clearSessionState: () => Promise<void>;
+    clearAllAccountData: () => Promise<void>;
+    storageKeyPrefix: string;
+    clientId: string | null;
+    oxyServices: OxyServices;
+    /** Server-authoritative device session client. `null` before an `OxyProvider` is mounted. */
+    sessionClient: SessionClient | null;
+    useFollow?: UseFollowHook;
+    showBottomSheet?: (screenOrConfig: RouteName | {
+        screen: RouteName;
+        props?: Record<string, unknown>;
+    }) => void;
+    openAvatarPicker: () => void;
+    accountDialogController: AccountDialogController | null;
+    isAccountDialogOpen: boolean;
+    openAccountDialog: (view?: AccountDialogView) => void;
+    closeAccountDialog: () => void;
+    accounts: AccountNode[];
+    switchToAccount: (accountId: string) => Promise<void>;
+    refreshAccounts: () => Promise<void>;
+    createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
+}
+export interface OxyRuntimeProviderProps {
+    children: ReactNode;
+    oxyServices?: OxyServices;
+    baseURL?: string;
+    authWebUrl?: string;
+    authRedirectUri?: string;
+    /**
+     * Authorize endpoint override for web "Sign in with Oxy". Defaults to the
+     * production Oxy IdP when unset; a local/staging deployment points it at its
+     * own IdP so sign-in never reaches production `auth.oxy.so`.
+     */
+    authorizeBaseUrl?: string;
+    storageKeyPrefix?: string;
+    clientId?: string;
+    /**
+     * Who owns this provider's session. See `OxyProviderProps.sessionMode` for the
+     * full contract.
+     * @default 'account'
+     */
+    sessionMode?: SessionMode;
+    /**
+     * Transport for WEB third-party sign-in. See `OxyProviderProps.webAuthMode`.
+     * @default 'popup'
+     */
+    webAuthMode?: WebAuthMode;
+    /**
+     * Let NATIVE background code (a home-screen widget's WorkManager worker, a sync
+     * job) authenticate while the app process is dead and there is no JS runtime.
+     *
+     * With this on, the SDK provisions a purpose-built background credential
+     * whenever the app runs and stores it where `so.oxy.session.OxyBackgroundSession`
+     * can read it; Kotlin then exchanges it for a short access token on demand. The
+     * app writes no session code — this prop is the whole integration.
+     *
+     * OFF by default, because a credential that nobody needs is exposure that
+     * nobody needs. Turn it on only in an app that actually has background code to
+     * authenticate. Android-only today; inert on web and iOS.
+     *
+     * The credential cannot create a session (only the running app can provision
+     * one), cannot rotate or otherwise disturb the app's own device credential, and
+     * is re-authorized server-side on every use so it can never outlive a sign-out.
+     * It does NOT reduce authority: the token it mints is a full user access token,
+     * exactly like the device credential's.
+     *
+     * @default false
+     */
+    backgroundSession?: boolean;
+    /**
+     * Whether this origin/app persists the durable device credential at all. See
+     * `OxyProviderProps.deviceCredentialStorage` for the full rule and the one
+     * caller of `'ephemeral'`.
+     *
+     * @default 'persistent'
+     */
+    deviceCredentialStorage?: 'persistent' | 'ephemeral';
+    onAuthStateChange?: (user: User | null) => void;
+    onError?: (error: ApiError) => void;
+    /** Storage instance owned by the public provider; internal composition seam. */
+    platformStorage?: StorageInterface | null;
+}
+/** Internal commit input — session plus zero-cookie device credential. */
+export interface CommitInput {
+    sessionId: string;
+    accessToken?: string;
+    deviceId?: string;
+    deviceSecret?: string;
+    expiresAt?: string;
+    userId?: string;
+    user?: {
+        id: string;
+        username?: string;
+        avatar?: string;
+    };
+    /** State returned with a device-token mint, avoiding an immediate REST reread. */
+    deviceState?: import('@oxy.so/contracts').DeviceSessionState;
+}
+//# sourceMappingURL=oxyContextTypes.d.ts.map

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxyContextTypes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/oxyContextTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9M,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,wFAAwF;IACxF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uHAAuH;IACvH,eAAe,EAAE,MAAM,CAAC;IACxB,4GAA4G;IAC5G,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAElC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;OAGG;IACH,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;OAIG;IACH,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE5F;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE1F,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,6FAA6F;IAC7F,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAE7B,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAE/B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;IACrD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,gFAAgF;IAChF,eAAe,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,CAAC;CAC9D"}

package/lib/typescript/commonjs/ui/context/passkeyFlow.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Pure passkey (WebAuthn) sign-in / registration orchestration.
+ *
+ * Extracted from `OxyContext` so the fixed `options → ceremony → verify → commit`
+ * ordering is unit-testable with injected deps — the exact pattern
+ * `commitSessionFlow.ts` (`commitDeviceSetAndResolve`) uses. The context methods
+ * (`signInWithPasskey` / `registerWithPasskey` / `addPasskey`) are thin wrappers
+ * that supply the real deps: the core `webauthn*` methods, the platform ceremony
+ * client (`webauthn/passkeyClient`), and the internal `commitSession` funnel.
+ *
+ * All three GATE on `isSupported()` first (the platform client returns `false`
+ * off the web) so an unsupported surface fails loudly before touching a ceremony.
+ */
+import type { LoginResult } from '@oxy.so/contracts';
+import type { CommitInput } from './oxyContextTypes';
+/**
+ * The result of `OxyServices.webauthnRegisterVerify` — either the LINK branch
+ * (`{ success, message }`, bearer present, no session) or the SIGNUP branch (a
+ * full {@link LoginResult}, which carries a `sessionId` on its session arm).
+ */
+export type PasskeyRegisterVerifyResult = {
+    success: true;
+    message: string;
+} | LoginResult;
+/** Thrown when a passkey flow is attempted on a surface that cannot run WebAuthn. */
+export declare const PASSKEY_UNSUPPORTED_MESSAGE = "Passkeys are not available in this environment. Use another sign-in method.";
+/** Injected dependencies for {@link runPasskeyLogin}. */
+export interface RunPasskeyLoginDeps {
+    isSupported: () => boolean;
+    getLoginOptions: (username?: string) => Promise<unknown>;
+    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+    loginVerify: (response: unknown, envelope: {
+        deviceName?: string;
+        deviceFingerprint?: string;
+        deviceId?: string;
+    }) => Promise<LoginResult>;
+    commit: (input: CommitInput) => Promise<void>;
+    /**
+     * When present, scopes login options to that user's registered passkeys
+     * (username-first) — the path a NON-discoverable hardware key (e.g. a U2F
+     * security key) needs, since it can't be found by a usernameless ceremony.
+     * Omit for the discoverable / resident-credential path.
+     */
+    username?: string;
+    deviceId?: string;
+    deviceName?: string;
+    deviceFingerprint?: string;
+}
+/**
+ * Passkey SIGN-IN. With no `username` this is the usernameless
+ * (discoverable-credential) flow; with a `username` it is username-first —
+ * the server scopes `allowCredentials` to that user's passkeys so a
+ * non-discoverable hardware key (U2F/security key) can be selected. Either way:
+ * request login options, run the authentication ceremony, verify, then commit
+ * the session. A passkey assertion is itself the strong factor — sign-in always
+ * resolves to a completed session.
+ */
+export declare function runPasskeyLogin(deps: RunPasskeyLoginDeps): Promise<void>;
+/** Injected dependencies for {@link runPasskeyRegister}. */
+export interface RunPasskeyRegisterDeps {
+    isSupported: () => boolean;
+    getRegisterOptions: (username: string) => Promise<unknown>;
+    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+    registerVerify: (response: unknown, envelope: {
+        username: string;
+        deviceName?: string;
+    }) => Promise<PasskeyRegisterVerifyResult>;
+    commit: (input: CommitInput) => Promise<void>;
+    username: string;
+    deviceName?: string;
+}
+/**
+ * Passkey SIGNUP: create a brand-new account whose first auth method is a
+ * passkey. The verify signup branch mints a session (a {@link LoginSessionResult}
+ * carrying `sessionId`), which is committed exactly like a password signup.
+ */
+export declare function runPasskeyRegister(deps: RunPasskeyRegisterDeps): Promise<void>;
+/** Injected dependencies for {@link runPasskeyAdd}. */
+export interface RunPasskeyAddDeps {
+    isSupported: () => boolean;
+    getRegisterOptions: () => Promise<unknown>;
+    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+    registerVerify: (response: unknown, envelope: {
+        deviceName?: string;
+    }) => Promise<PasskeyRegisterVerifyResult>;
+    onLinked: () => void;
+    deviceName?: string;
+}
+/**
+ * ADD a passkey to the already-signed-in account (bearer present). The verify
+ * link branch returns `{ success, message }` with NO session — so this never
+ * commits a session; it just fires `onLinked` (which invalidates the
+ * auth-methods query). A session arm here would be a server contract violation.
+ */
+export declare function runPasskeyAdd(deps: RunPasskeyAddDeps): Promise<void>;
+//# sourceMappingURL=passkeyFlow.d.ts.map

package/lib/typescript/commonjs/ui/context/passkeyFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/passkeyFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAAC;AAE3F,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,gFACuC,CAAC;AAehF,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,WAAW,EAAE,CACX,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9E;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,cAAc,EAAE,CACd,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBpF;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,cAAc,EAAE,CACd,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC9B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1E"}

package/lib/typescript/commonjs/ui/context/useOxyAccountGraph.d.ts

@@ -0,0 +1,30 @@
+import { type RefObject } from 'react';
+import type { OxyServices, AccountNode, CreateAccountInput, AccountDialogController, SessionClient } from '@oxy.so/core';
+import type { CommitInput } from './oxyContextTypes';
+interface UseOxyAccountGraphParams {
+    isAuthenticated: boolean;
+    tokenReady: boolean;
+    initialized: boolean;
+    /**
+     * `sessionMode: 'identity'`. The account graph is a switcher surface, and an
+     * identity-bound client authenticates as the owner of the local identity key —
+     * permanently. The graph is therefore never fetched and every switch rejects.
+     */
+    identityBound: boolean;
+    oxyServices: OxyServices;
+    sessionClient: SessionClient;
+    syncFromClient: () => Promise<void>;
+    commitSession: (input: CommitInput, options: {
+        activate: boolean;
+    }) => Promise<void>;
+    accountDialogControllerRef: RefObject<AccountDialogController | null>;
+    clearSessionStateRef: RefObject<() => Promise<void>>;
+}
+export declare function useOxyAccountGraph({ isAuthenticated, tokenReady, initialized, identityBound, oxyServices, sessionClient, syncFromClient, commitSession, accountDialogControllerRef, clearSessionStateRef, }: UseOxyAccountGraphParams): {
+    accounts: AccountNode[];
+    refreshAccounts: () => Promise<void>;
+    switchToAccount: (accountId: string) => Promise<void>;
+    createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
+};
+export {};
+//# sourceMappingURL=useOxyAccountGraph.d.ts.map

package/lib/typescript/commonjs/ui/context/useOxyAccountGraph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOxyAccountGraph.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/useOxyAccountGraph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIzH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,UAAU,wBAAwB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,0BAA0B,EAAE,SAAS,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACtE,oBAAoB,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtD;AAED,wBAAgB,kBAAkB,CAAC,EACjC,eAAe,EACf,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,0BAA0B,EAC1B,oBAAoB,GACrB,EAAE,wBAAwB;;2BAGqB,OAAO,CAAC,IAAI,CAAC;iCA4BvC,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;0BAyC3B,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;EAczD"}

package/lib/typescript/commonjs/ui/hooks/accountDialogSnapshot.d.ts

@@ -0,0 +1,15 @@
+import type { AccountDialogSnapshot } from '@oxy.so/core';
+/**
+ * The snapshot `useSyncExternalStore` reads before a controller exists.
+ *
+ * `useSyncExternalStore` calls `getSnapshot` several times per commit and
+ * compares by identity, so the no-controller answer has to be one constant
+ * reference — a fresh object literal loops.
+ *
+ * It is ONE constant because there were three, byte-identical, in the hook and
+ * both dialog surfaces. Adding a field to `AccountDialogSnapshot` broke all
+ * three at once and would have gone on doing so; a shared constant makes the
+ * compiler point at one place.
+ */
+export declare const EMPTY_ACCOUNT_DIALOG_SNAPSHOT: AccountDialogSnapshot;
+//# sourceMappingURL=accountDialogSnapshot.d.ts.map

package/lib/typescript/commonjs/ui/hooks/accountDialogSnapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountDialogSnapshot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/accountDialogSnapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAsB3C,CAAC"}