@oxy.so/services 1.0.0

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyRedirectLanes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/legacyRedirectLanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAE5E"}

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+import type { OAuthHandshake } from './types';
+/** Inputs for {@link prepareAuthorizeRequest}. */
+export interface PrepareAuthorizeRequestParams {
+    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
+    clientId: string;
+    /** EXACT registered redirect URI. The token exchange must replay this value. */
+    redirectUri: string;
+    /** Authorize endpoint override; defaults to the production Oxy IdP. */
+    authorizeBaseUrl?: string;
+    /** Requested scope; defaults to the SDK's standard sign-in scope. */
+    scope?: string;
+    /**
+     * Ask the IdP to deliver the result to `window.opener` via `postMessage`
+     * instead of redirecting. Set ONLY by the popup transport. It is a request,
+     * not a guarantee — an IdP with no opener still redirects.
+     */
+    responseMode?: 'web_message';
+}
+/** A ready-to-use authorize request plus the secrets that finish it. */
+export interface PreparedAuthorizeRequest {
+    /** Fully-built `auth.oxy.so/authorize` URL. */
+    authorizeUrl: string;
+    /**
+     * Exact origin of {@link authorizeUrl}. The popup transport accepts
+     * `postMessage` from this origin and no other.
+     */
+    authorizeOrigin: string;
+    /** The `state` + PKCE verifier this request is bound to. */
+    handshake: OAuthHandshake;
+}
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+export declare function prepareAuthorizeRequest(params: PrepareAuthorizeRequestParams): Promise<PreparedAuthorizeRequest>;
+//# sourceMappingURL=oauthHandshake.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthHandshake.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthHandshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAkBnC"}

package/lib/typescript/commonjs/ui/oauth/oauthPopup.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Popup lifecycle for the web OAuth transport.
+ *
+ * Owns the window itself — opening it, navigating it, watching it, and tearing
+ * every listener and timer down — and nothing else: message validation lives in
+ * `oauthPopupMessages.ts`, and the code exchange in `completeOAuthCode.ts`.
+ *
+ * Three browser realities shape this module:
+ *
+ * - **Gesture attribution.** `window.open` only succeeds while the user's click
+ *   is still being handled. Anything awaited first (resolving the application,
+ *   generating PKCE) loses it and the popup is silently blocked. So the window
+ *   is opened EMPTY up front and navigated once the authorize URL exists —
+ *   the same shape as `passkeyHubPopup.ts`.
+ * - **No close event.** A cross-origin popup fires nothing when the user
+ *   dismisses it; polling `closed` is the only mechanism (as in core's
+ *   `AccountDialogController.watchPopup`).
+ * - **No cross-origin reads.** The popup's URL, title, and document are all
+ *   opaque. The authorization result arrives ONLY as a `postMessage`.
+ */
+import type { OAuthPopupHandle, OAuthPopupOutcome } from './types';
+/**
+ * Window name for the sign-in popup. Naming the target means a second press
+ * REUSES the same window instead of stacking a new one behind the first.
+ */
+export declare const OXY_OAUTH_POPUP_WINDOW_NAME = "oxy-oauth";
+/**
+ * How long a popup sign-in may stay unanswered (ms).
+ *
+ * Generous on purpose: the IdP surface can involve scanning a QR and approving
+ * on a phone, so this tracks the authorize handle's own ~5-minute lifetime
+ * rather than a UI-scale timeout. It is a backstop against a wedged popup, not
+ * a pace-setter — a user who gives up closes the window and gets the faster
+ * `closed` outcome.
+ */
+export declare const DEFAULT_OAUTH_POPUP_TIMEOUT_MS = 300000;
+/**
+ * Open a new, EMPTY sign-in popup.
+ *
+ * MUST be called SYNCHRONOUSLY from a user-gesture handler, before any `await`.
+ * Returns `null` when the browser blocked it, when `window.open` threw, and on
+ * hosts with no DOM (native / SSR) — never throws, because "no popup" is an
+ * ordinary outcome the caller answers by falling back to a redirect.
+ */
+export declare function openOAuthPopup(): OAuthPopupHandle | null;
+/**
+ * Point an already-open popup at the authorize URL. Returns `false` when the
+ * assignment threw (a window closed between opening and navigating), so the
+ * caller can fall back to a redirect instead of waiting on a dead window.
+ */
+export declare function navigateOAuthPopup(popup: OAuthPopupHandle, url: string): boolean;
+/** Close the popup if it is still open. Idempotent, null-safe, never throws. */
+export declare function closeOAuthPopup(popup: OAuthPopupHandle | null): void;
+/** Inputs for {@link awaitOAuthPopupResult}. */
+export interface AwaitOAuthPopupOptions {
+    /** The exact window reference returned by {@link openOAuthPopup}. */
+    popup: OAuthPopupHandle;
+    /** Exact origin the IdP will post from (`new URL(authorizeUrl).origin`). */
+    expectedOrigin: string;
+    /** The CSRF `state` sent on the authorize request. */
+    expectedState: string;
+    /**
+     * EXACT registered redirect URI for this attempt. When the IdP cannot
+     * `postMessage` (no usable opener) it falls back to redirecting the popup;
+     * if that lands on the same origin, the result is read from the popup URL.
+     */
+    redirectUri: string;
+    /** @default DEFAULT_OAUTH_POPUP_TIMEOUT_MS */
+    timeoutMs?: number;
+}
+/**
+ * Wait for the popup to deliver an authorization result.
+ *
+ * Settles EXACTLY once, with a typed outcome for every path — code, IdP error,
+ * state mismatch, user-closed, timeout — and removes its listener, its close
+ * poll, and both timers before resolving, whatever the outcome. Messages that
+ * arrive after settling reach nothing, so a duplicate delivery is inert.
+ *
+ * Never rejects: closing the window and running out of time are expected
+ * outcomes, not exceptions.
+ */
+export declare function awaitOAuthPopupResult(options: AwaitOAuthPopupOptions): Promise<OAuthPopupOutcome>;
+//# sourceMappingURL=oauthPopup.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthPopup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPopup.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAKvD;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAkCtD;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,gBAAgB,GAAG,IAAI,CASxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAOpE;AA2CD,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,EAAE,gBAAgB,CAAC;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B"}

package/lib/typescript/commonjs/ui/oauth/oauthPopupMessages.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Runtime validation for the popup OAuth `postMessage` channel.
+ *
+ * Everything arriving on `window`'s `message` event is untrusted: any frame on
+ * the page, any other popup, and any browser extension can post to us. This
+ * module is the ONLY place that decides whether an incoming event is a genuine
+ * authorization response, and it answers with a value — never a thrown error.
+ *
+ * A message is accepted only when ALL of these hold:
+ *   1. `event.origin` is EXACTLY the authorize endpoint's origin,
+ *   2. `event.source` is the exact `Window` reference we opened,
+ *   3. `event.data` matches one of the two frozen message shapes,
+ *   4. the `state` it carries matches the one this RP sent.
+ *
+ * Failing (1)–(3) is indistinguishable from unrelated page traffic, so the
+ * message is IGNORED and the flow keeps waiting. Failing (4) means our own
+ * popup answered a different request than the one in flight, which is terminal:
+ * it is reported as a mismatch rather than left to hang until the timeout.
+ */
+import type { OAuthPopupHandle, OxyOAuthMessage } from './types';
+/** `postMessage` discriminator for a successful authorization. */
+export declare const OXY_OAUTH_CODE_MESSAGE_TYPE = "oxy:oauth:code";
+/** `postMessage` discriminator for a typed OAuth failure. */
+export declare const OXY_OAUTH_ERROR_MESSAGE_TYPE = "oxy:oauth:error";
+/** Verdict for one incoming `message` event. */
+export type OAuthPopupMessageVerdict = 
+/** Not ours (wrong origin/source) or not a valid message — keep waiting. */
+{
+    kind: 'ignore';
+} | {
+    kind: 'code';
+    code: string;
+    state: string;
+} | {
+    kind: 'oauth-error';
+    error: string;
+    errorDescription?: string;
+}
+/** Well-formed, from our popup, but bound to a different authorize request. */
+ | {
+    kind: 'state-mismatch';
+};
+/** What {@link readOAuthPopupMessage} validates an event against. */
+export interface OAuthPopupMessageContext {
+    /** Exact origin of the authorize endpoint (`new URL(authorizeUrl).origin`). */
+    expectedOrigin: string;
+    /** The CSRF `state` this RP sent on the authorize request. */
+    expectedState: string;
+    /** The exact popup reference `window.open()` returned. */
+    popup: OAuthPopupHandle;
+}
+/**
+ * Parse untrusted `event.data` into one of the two frozen message shapes, or
+ * `null` when it is anything else (including `null`, primitives, arrays, and
+ * objects with missing/wrong-typed fields).
+ *
+ * Unknown extra properties are tolerated but never read: only the fields below
+ * are ever surfaced, so a hostile sender cannot smuggle values past this point.
+ */
+export declare function parseOAuthPopupMessage(data: unknown): OxyOAuthMessage | null;
+/**
+ * Classify one `message` event against the in-flight authorize request.
+ *
+ * Never throws. See the module header for the acceptance rules.
+ */
+export declare function readOAuthPopupMessage(event: MessageEvent, context: OAuthPopupMessageContext): OAuthPopupMessageVerdict;
+//# sourceMappingURL=oauthPopupMessages.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthPopupMessages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPopupMessages.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopupMessages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAEjE,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,mBAAmB,CAAC;AAE5D,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,gDAAgD;AAChD,MAAM,MAAM,wBAAwB;AAClC,4EAA4E;AAC1E;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,+EAA+E;GAC7E;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE/B,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAkBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAsB5E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,wBAAwB,GAChC,wBAAwB,CAwC1B"}

package/lib/typescript/commonjs/ui/oauth/types.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Typed contracts shared by the browser "Sign in with Oxy" OAuth transports.
+ *
+ * Two transports deliver the same authorization code to the same completion
+ * path (see `completeOAuthCode.ts`):
+ *
+ * - `redirect` — the historical full-page hand-off to `auth.oxy.so/authorize`.
+ *   The RP tab navigates away and comes back to its registered `redirect_uri`
+ *   with `?code=…&state=…`; cold boot finishes the exchange.
+ * - `popup` — a small `auth.oxy.so` window opened from the user's click. The RP
+ *   stays mounted with its route and unsaved state intact; the IdP delivers the
+ *   result to `window.opener` via `postMessage` and closes itself.
+ *
+ * Only the authorization code, the CSRF `state`, and a typed OAuth error ever
+ * cross the `postMessage` channel. Access tokens, device secrets, and the PKCE
+ * `code_verifier` NEVER do — the opener keeps the verifier and performs the code
+ * exchange itself.
+ */
+/** How a web relying party hands the user to the IdP for third-party sign-in. */
+export type WebAuthMode = 'popup' | 'redirect';
+/**
+ * Minimal structural handle over a popup `Window` — exactly what the popup
+ * transport needs: navigate it once the authorize URL is built, detect the user
+ * closing it (`closed`, polled — there is no cross-origin close event), and
+ * close it programmatically on completion. Satisfied directly by the value
+ * `window.open()` returns.
+ *
+ * Deliberately NOT `Window`: the transport must never read cross-origin
+ * properties off the popup, and a narrow handle makes that impossible to do by
+ * accident (and trivial to fake in tests).
+ */
+export interface OAuthPopupHandle {
+    readonly closed: boolean;
+    close(): void;
+    location: {
+        href: string;
+    };
+}
+/**
+ * The RP-side OAuth handshake for one authorize request: the CSRF `state` sent
+ * to the IdP and the PKCE `code_verifier` replayed on the token exchange.
+ *
+ * In `redirect` mode it is persisted to `sessionStorage` across the full-page
+ * navigation; in `popup` mode it never leaves memory.
+ */
+export interface OAuthHandshake {
+    /** Opaque CSRF token echoed back by the IdP and validated before any exchange. */
+    state: string;
+    /** The PKCE secret. Never crosses `postMessage`, a URL, or storage in popup mode. */
+    codeVerifier: string;
+}
+/** Successful authorization delivered by the IdP over `postMessage`. */
+export interface OxyOAuthCodeMessage {
+    type: 'oxy:oauth:code';
+    code: string;
+    state: string;
+}
+/** Typed OAuth failure delivered by the IdP over `postMessage`. */
+export interface OxyOAuthErrorMessage {
+    type: 'oxy:oauth:error';
+    error: string;
+    errorDescription?: string;
+    state?: string;
+}
+/** The ONLY two message shapes that may cross the popup channel. */
+export type OxyOAuthMessage = OxyOAuthCodeMessage | OxyOAuthErrorMessage;
+/** Session material handed to the provider's commit funnel after an exchange. */
+export interface OAuthSessionCommitInput {
+    sessionId: string;
+    accessToken?: string;
+    deviceId?: string;
+    deviceSecret?: string;
+    userId: string;
+    expiresAt?: string;
+    user?: {
+        id: string;
+        username?: string;
+        avatar?: string;
+    };
+}
+/**
+ * Terminal outcome of one popup sign-in attempt. Every expected path — the user
+ * closing the window, a timeout, an IdP error — is a value, never a thrown
+ * exception.
+ */
+export type OAuthPopupOutcome = 
+/** The IdP delivered an authorization code whose `state` matched. */
+{
+    kind: 'code';
+    code: string;
+    state: string;
+}
+/** The IdP delivered a typed OAuth error (`access_denied`, `login_required`, …). */
+ | {
+    kind: 'oauth-error';
+    error: string;
+    errorDescription?: string;
+}
+/** A well-formed message from our popup carried the wrong `state`. */
+ | {
+    kind: 'state-mismatch';
+}
+/** The user dismissed the popup without completing sign-in. */
+ | {
+    kind: 'closed';
+}
+/** No result arrived within the allotted window. */
+ | {
+    kind: 'timed-out';
+}
+/** No DOM message host (SSR / native) — the popup transport does not apply. */
+ | {
+    kind: 'unsupported';
+};
+/** Why the shared completion path could not produce a session. */
+export type OAuthCompletionFailure = 'state-mismatch' | 'exchange-failed';
+/** Result of the ONE completion path both transports run. */
+export type OAuthCompletionResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: OAuthCompletionFailure;
+};
+/** Why the transport fell back to a full-page redirect. */
+export type WebOAuthRedirectReason = 
+/** `webAuthMode: 'redirect'` — the configured transport. */
+'redirect-mode'
+/** The browser refused `window.open` (blocker, or no gesture attribution). */
+ | 'popup-blocked'
+/** The popup opened but could not be navigated to the authorize URL. */
+ | 'popup-navigation-failed';
+/** Why a web sign-in attempt failed outright. */
+export type WebOAuthFailureReason = 
+/** The handshake could not be persisted for the redirect return (no/blocked storage). */
+'handshake-storage'
+/** The `state` returned by the IdP did not match the one we sent. */
+ | 'state-mismatch'
+/** `POST /auth/oauth/token` or the session commit failed. */
+ | 'exchange-failed'
+/** The IdP reported a typed OAuth error. */
+ | 'idp-error';
+/** Why a web sign-in attempt was not applicable at all. */
+export type WebOAuthUnsupportedReason = 
+/** Not a browser (native / SSR) — native uses `openAuthorizeUrlNative`. */
+'no-browser'
+/** `sessionMode: 'identity'` has no third-party OAuth lane by construction. */
+ | 'identity-bound'
+/** No `clientId` is configured on the provider. */
+ | 'missing-client-id';
+/** Terminal, typed outcome of a web third-party sign-in attempt. */
+export type WebOAuthSignInResult = 
+/** A session was committed; the RP is authenticated without a reload. */
+{
+    status: 'signed-in';
+}
+/** The tab is navigating to the IdP; nothing else will resolve in this document. */
+ | {
+    status: 'redirecting';
+    via: WebOAuthRedirectReason;
+}
+/** The user dismissed the popup. */
+ | {
+    status: 'cancelled';
+}
+/** No result arrived within the allotted window. */
+ | {
+    status: 'timed-out';
+} | {
+    status: 'failed';
+    reason: WebOAuthFailureReason;
+    description?: string;
+} | {
+    status: 'unsupported';
+    reason: WebOAuthUnsupportedReason;
+};
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/commonjs/ui/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB;AAC3B,qEAAqE;AACnE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC/C,oFAAoF;GAClF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,sEAAsE;GACpE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE;AAC5B,+DAA+D;GAC7D;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE;AACpB,oDAAoD;GAClD;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE;AACvB,+EAA+E;GAC7E;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B,kEAAkE;AAClE,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAE1E,6DAA6D;AAC7D,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAElD,2DAA2D;AAC3D,MAAM,MAAM,sBAAsB;AAChC,4DAA4D;AAC1D,eAAe;AACjB,8EAA8E;GAC5E,eAAe;AACjB,wEAAwE;GACtE,yBAAyB,CAAC;AAE9B,iDAAiD;AACjD,MAAM,MAAM,qBAAqB;AAC/B,yFAAyF;AACvF,mBAAmB;AACrB,qEAAqE;GACnE,gBAAgB;AAClB,6DAA6D;GAC3D,iBAAiB;AACnB,4CAA4C;GAC1C,WAAW,CAAC;AAEhB,2DAA2D;AAC3D,MAAM,MAAM,yBAAyB;AACnC,2EAA2E;AACzE,YAAY;AACd,+EAA+E;GAC7E,gBAAgB;AAClB,mDAAmD;GACjD,mBAAmB,CAAC;AAExB,oEAAoE;AACpE,MAAM,MAAM,oBAAoB;AAC9B,yEAAyE;AACvE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE;AACzB,oFAAoF;GAClF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,sBAAsB,CAAA;CAAE;AACxD,oCAAoC;GAClC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE;AACzB,oDAAoD;GAClD;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC"}

package/lib/typescript/commonjs/ui/runtime/createOxyRuntime.d.ts

@@ -0,0 +1,144 @@
+import type { DeviceDirectory, DeviceSessionState } from '@oxy.so/contracts';
+import type { ClientSession, User } from '@oxy.so/core';
+import type { IdentitySessionBinding } from '../session/identityBinding';
+import type { OxyRuntimeSnapshot } from './types';
+/**
+ * A change of SUBJECT — the account the session acts as.
+ *
+ * `previous === null` is an initial sign-in (nothing account-scoped is cached
+ * yet); `next === null` is a sign-out; both non-null and different is a switch,
+ * the only case that must invalidate a warm cache.
+ */
+export interface SubjectTransition {
+    previous: string | null;
+    next: string | null;
+}
+/**
+ * The three seams the runtime reads, declared STRUCTURALLY rather than as the
+ * concrete `OxyServices` / `SessionClient` / `SessionClientHost` types.
+ *
+ * The real classes satisfy them, so nothing changes at the call site — but a
+ * test can hand the runtime three plain objects instead of casting a stub
+ * through `unknown`, which is how a stub silently drifts from the interface it
+ * pretends to implement.
+ */
+export interface RuntimeClient {
+    getAccessToken(): string | null;
+    getUsersByIds(ids: string[]): Promise<User[]>;
+}
+export interface RuntimeSessionClient {
+    getState(): DeviceSessionState | null;
+    getDirectory(): DeviceDirectory | null;
+    subscribe(listener: (state: DeviceSessionState | null) => void): () => void;
+    refreshDirectory(): Promise<void>;
+    activateContext(contextId: string): Promise<void>;
+    signOutContext(contextId: string): Promise<void>;
+    signOutPrincipal(principalId: string): Promise<void>;
+}
+export interface RuntimeSessionHost {
+    setCurrentAccountId(accountId: string | null): void;
+}
+export interface OxyRuntimeConfig {
+    oxyServices: RuntimeClient;
+    sessionClient: RuntimeSessionClient;
+    sessionClientHost: RuntimeSessionHost;
+    /** `null` for every account-mode runtime; the pin binding in identity mode. */
+    identity: IdentitySessionBinding | null;
+    /**
+     * Reset account-scoped caches. Called BETWEEN the bearer commit and the
+     * snapshot publish, which is the whole point of routing every fact change
+     * through one transition (ADR 0002's ordering invariant): a consumer woken by
+     * a switch must never read a cache entry belonging to the previous subject.
+     */
+    onSubjectChange?: (transition: SubjectTransition) => void;
+    /**
+     * The device reports zero accounts. Local UI teardown only — the durable
+     * device credential is the caller's decision, gated on a `request`-origin
+     * verdict.
+     */
+    onDeviceEmpty: () => Promise<void>;
+    /** Persist the projected session-id list (display/bookkeeping storage). */
+    onSessionsProjected?: (sessionIds: string[]) => void;
+    /**
+     * Identity mode only: the pinned account is unknown or has left this device's
+     * session set, so the session must be re-derived from the local identity key.
+     * Projecting anything here would mean projecting somebody else's account.
+     */
+    onIdentityUnbound?: (binding: IdentitySessionBinding, revision: number) => void;
+    logger: (message: string, error?: unknown) => void;
+}
+/**
+ * The headless session runtime (ADR 0004).
+ *
+ * It owns the session facts and the ORDER in which they become visible. React
+ * is an adapter: the provider hands components this object and they subscribe
+ * with selectors, so an unrelated change (a locale, a dialog opening) cannot
+ * rebuild an auth consumer's view.
+ */
+export interface OxyRuntime {
+    getSnapshot(): OxyRuntimeSnapshot;
+    subscribe(listener: () => void): () => void;
+    /** Begin projecting `SessionClient` transitions. Returns the disposer. */
+    start(): () => void;
+    /**
+     * Project the client's current device state onto the snapshot. Idempotent and
+     * revision-guarded: a projection whose profile fetch was overtaken by a
+     * fresher state discards itself rather than publishing a stale subject.
+     */
+    reconcileFromClient(): Promise<void>;
+    /** Read the device directory and publish it (opts this runtime into ADR 0002). */
+    refreshDirectory(): Promise<void>;
+    /**
+     * Make one `principal acting as account` context active (ADR 0002).
+     *
+     * `contextId`, never an account id: on a device holding two people the same
+     * organization is reachable through both, and an account id cannot name which
+     * route to take.
+     */
+    activateContext(contextId: string): Promise<void>;
+    /**
+     * Remove ONE `principal → account` pair. The same account reached through a
+     * second person is a different session with a different audit actor, and it
+     * stays.
+     *
+     * Context ids are NOT stable across a removal: the server offers the pair
+     * again under a NEW id on the next directory read, so nothing may cache one
+     * across this call.
+     */
+    signOutContext(contextId: string): Promise<void>;
+    /** Remove ONE PERSON and every context they reach, and nobody else's. */
+    signOutPrincipal(principalId: string): Promise<void>;
+    /**
+     * Run several fact changes as ONE transition.
+     *
+     * A session commit sets the optimistic session mirror, the active session id
+     * and the account. Left as three transitions those are three publishes, and
+     * — worse — the account is compared against a different baseline each time,
+     * so an account-scoped cache reset could run against a half-applied session.
+     * Batched, subscribers are woken once, after all of it, with the reset having
+     * run exactly once in between.
+     */
+    batch(mutate: () => void): void;
+    setAccount(user: User): void;
+    setLoading(loading: boolean): void;
+    setError(error: string | null): void;
+    setStorageReady(ready: boolean): void;
+    setTokenReady(ready: boolean): void;
+    setHasAccessToken(has: boolean): void;
+    setSwitching(switching: boolean): void;
+    markAuthResolved(): void;
+    /**
+     * Merge an optimistic local session mirror so the UI moves before the server
+     * round-trip. The authoritative projection overwrites it a moment later; both
+     * write the SAME field, so there is still exactly one owner.
+     */
+    mergeSessions(incoming: ClientSession[], options?: {
+        merge?: boolean;
+        preserveSessionIds?: string[];
+    }): void;
+    setActiveSessionId(sessionId: string | null): void;
+    /** Local teardown: drop the session projection without touching the server. */
+    clearSession(): void;
+}
+export declare function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime;
+//# sourceMappingURL=createOxyRuntime.d.ts.map

package/lib/typescript/commonjs/ui/runtime/createOxyRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOxyRuntime.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/createOxyRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,cAAc,CAAC;AAYvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAoC,MAAM,SAAS,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,IAAI,kBAAkB,GAAG,IAAI,CAAC;IACtC,YAAY,IAAI,eAAe,GAAG,IAAI,CAAC;IACvC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5E,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,aAAa,CAAC;IAC3B,aAAa,EAAE,oBAAoB,CAAC;IACpC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAExC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAE1D;;;;OAIG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAErD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAEhF,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,IAAI,kBAAkB,CAAC;IAClC,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAE5C,0EAA0E;IAC1E,KAAK,IAAI,MAAM,IAAI,CAAC;IAEpB;;;;OAIG;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,kFAAkF;IAClF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;OAMG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,yEAAyE;IACzE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAEhC,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,gBAAgB,IAAI,IAAI,CAAC;IAEzB;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7G,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAEnD,+EAA+E;IAC/E,YAAY,IAAI,IAAI,CAAC;CACtB;AA2DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAyYrE"}

package/lib/typescript/commonjs/ui/runtime/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The headless session runtime (ADR 0004).
+ *
+ * `createOxyRuntime` owns the session facts and the order in which they become
+ * visible; `useRuntimeSnapshot` / `useRuntimeSelector` are the React adapter
+ * over it. Nothing here imports React except the adapter, and nothing in the
+ * runtime reads React state — which is what lets the provider hold ONE stable
+ * reference and stop rebuilding a 58-field context value on every keystroke.
+ */
+export { createOxyRuntime } from './createOxyRuntime';
+export type { OxyRuntime, OxyRuntimeConfig, RuntimeClient, RuntimeSessionClient, RuntimeSessionHost, SubjectTransition, } from './createOxyRuntime';
+export { useRuntimeSnapshot, useRuntimeSelector } from './useRuntimeSnapshot';
+export { OxyRuntimeHandleProvider, OxyRuntimeMissingError, useActiveAccount, useDeviceDirectory, useOxyRuntime, useOxySnapshot, } from './runtimeContext';
+export type { ActiveAccount } from './runtimeContext';
+export type { OxyRuntimeError, OxyRuntimeSnapshot, OxyRuntimeStatus, OxyTokenStatus, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/ui/runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,SAAS,CAAC"}

package/lib/typescript/commonjs/ui/runtime/runtimeContext.d.ts

@@ -0,0 +1,43 @@
+import type { DeviceDirectory } from '@oxy.so/contracts';
+import type { DeviceContext, User } from '@oxy.so/core';
+import type { OxyRuntime } from './createOxyRuntime';
+import type { OxyRuntimeStatus } from './types';
+export declare const OxyRuntimeHandleProvider: import("react").Provider<OxyRuntime | null>;
+export declare class OxyRuntimeMissingError extends Error {
+    readonly code = "oxy_runtime_missing";
+    constructor();
+}
+/** The runtime this provider owns. THROWS when no `<OxyProvider>` is mounted. */
+export declare function useOxyRuntime(): OxyRuntime;
+export interface ActiveAccount {
+    /**
+     * The human whose authentication backs the session — the audit actor. Equal
+     * to {@link ActiveAccount.account} unless a delegated context is active.
+     */
+    principal: User | null;
+    /** The account the session acts AS — what a profile header renders. */
+    account: User | null;
+    /** The resolved `principal acting as account` pair, when a directory is held. */
+    context: DeviceContext | null;
+    /** Whether the actor and the subject are different accounts. */
+    isDelegated: boolean;
+    status: OxyRuntimeStatus;
+}
+/**
+ * Who this app is running as, with the actor and the subject kept apart.
+ *
+ * Unlike `useOxy()`, this re-renders only when one of those five facts moves —
+ * a locale change, a dialog opening or a session-list refresh does not reach it.
+ */
+export declare function useActiveAccount(): ActiveAccount;
+/**
+ * The device directory — every principal on this device and the contexts each
+ * may act as (ADR 0002).
+ *
+ * `null` until something calls `runtime.refreshDirectory()`. A client that
+ * never asks for one never pays for the round trip.
+ */
+export declare function useDeviceDirectory(): DeviceDirectory | null;
+/** The whole runtime snapshot. Prefer a narrower hook where one exists. */
+export declare function useOxySnapshot(): ReturnType<OxyRuntime['getSnapshot']>;
+//# sourceMappingURL=runtimeContext.d.ts.map

package/lib/typescript/commonjs/ui/runtime/runtimeContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/runtimeContext.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAgBhD,eAAO,MAAM,wBAAwB,6CAAmC,CAAC;AAKzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,yBAAyB;;CAMvC;AAED,iFAAiF;AACjF,wBAAgB,aAAa,IAAI,UAAU,CAM1C;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,gEAAgE;IAChE,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AA2BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,GAAG,IAAI,CAE3D;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAEtE"}