@oxy.so/services 11.0.0 → 11.2.0-oxy-one.0

package/lib/typescript/module/ui/oauth/nativeAuthTransport.d.ts

@@ -0,0 +1,28 @@
+import type { OxyServices } from '@oxy.so/core';
+import type { OAuthSessionCommitInput } from './types.js';
+export interface StartNativeOAuthSignInOptions {
+    /** Exact registered URI, including any fixed query. Never inferred. */
+    redirectUri: string;
+}
+export type NativeOAuthSignInResult = {
+    status: 'signed-in';
+} | {
+    status: 'cancelled';
+} | {
+    status: 'unsupported';
+    reason: 'unsupported-platform' | 'missing-client-id' | 'identity-bound' | 'not-third-party';
+} | {
+    status: 'failed';
+    reason: 'invalid-redirect-uri' | 'client-resolution-failed' | 'native-callback-invalid' | 'state-mismatch' | 'exchange-failed' | 'already-in-progress';
+};
+export interface NativeOAuthSignInContext {
+    platform: 'native' | 'unsupported';
+    oxyServices: OxyServices;
+    clientId: string | null;
+    authorizeBaseUrl?: string;
+    identityBound: boolean;
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+}
+/** SDK owns the in-memory handshake, observed native callback and session commit. */
+export declare function startNativeOAuthSignIn(context: NativeOAuthSignInContext, options: StartNativeOAuthSignInOptions): Promise<NativeOAuthSignInResult>;
+//# sourceMappingURL=nativeAuthTransport.d.ts.map

package/lib/typescript/module/ui/oauth/nativeAuthTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeAuthTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/nativeAuthTransport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKhD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAS,CAAC;AAEvD,MAAM,WAAW,6BAA6B;IAC5C,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,sBAAsB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,iBAAiB,CAAA;CAAE,GACtH;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,sBAAsB,GAAG,0BAA0B,GAAG,yBAAyB,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC;AACjL,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,QAAQ,GAAG,aAAa,CAAC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAYD,qFAAqF;AACrF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,uBAAuB,CAAC,CA2BlC"}

package/lib/typescript/module/ui/session/createSessionClient.d.ts

@@ -34,7 +34,7 @@ import type { OxyServices } from '@oxy.so/core';
  * account, the client tracks device state truthfully but never re-binds its
  * bearer to the device's mutable active account.
  */
-export declare function createSessionClient(oxyServices: OxyServices, onUnauthenticated?: (origin: SessionStateOrigin) => void, getPinnedAccountId?: () => string | null): {
+export declare function createSessionClient(oxyServices: OxyServices, onUnauthenticated?: (origin: SessionStateOrigin) => void, getPinnedAccountId?: () => string | null, isDeviceSessionAllowed?: () => boolean, onFullExplicitSignOut?: () => Promise<void>): {
     client: SessionClient;
     host: ReturnType<typeof createSessionClientHost>;
 };

package/lib/typescript/module/ui/session/createSessionClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSessionClient.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/createSessionClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,EACxD,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GACvC;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CAClD,CASA"}
+{"version":3,"file":"createSessionClient.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/createSessionClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,EACxD,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,EACxC,sBAAsB,GAAE,MAAM,OAAoB,EAClD,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAC1C;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CAClD,CAmBA"}

package/lib/typescript/module/ui/session/deviceCredentialTracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deviceCredentialTracker.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/deviceCredentialTracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gCAAiC,SAAQ,cAAc;IACtE;;;OAGG;IACH,oBAAoB,IAAI,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC;CACjE;AAQD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,gCAAgC,CAkB7F"}
+{"version":3,"file":"deviceCredentialTracker.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/deviceCredentialTracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAA2C,MAAM,sBAAsB,CAAC;AAEpG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gCAAiC,SAAQ,cAAc;IACtE;;;OAGG;IACH,oBAAoB,IAAI,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC;CACjE;AAQD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,gCAAgC,CAwB7F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "11.0.0",
+  "version": "11.2.0-oxy-one.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -155,7 +155,7 @@
   },
   "dependencies": {
     "@expo/config-plugins": "57.0.9",
-    "@oxy.so/contracts": "^4.4.0",
+    "@oxy.so/contracts": "4.11.0-oxy-one.0",
     "color": "^4.2.3"
   },
   "devDependencies": {
@@ -163,7 +163,7 @@
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@expo/vector-icons": "^15.0.3",
-    "@oxy.so/core": "4.0.0",
+    "@oxy.so/core": "4.5.0-oxy-one.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^12.0.1",
     "@react-native/babel-preset": "^0.86.2",
@@ -178,7 +178,7 @@
     "@types/jest": "^30.0.0",
     "@types/node": "^20.19.43",
     "@types/react": "*",
-    "@oxy.so/bloom": "^6.2.0",
+    "@oxy.so/bloom": "6.2.1",
     "copyfiles": "^2.4.1",
     "expo-clipboard": "~57.0.2",
     "expo-constants": "~57.0.5",
@@ -212,42 +212,42 @@
     "typescript": "^5.9.2",
     "zustand": "^5.0.14"
   },
-  "//@oxy.so/bloom": "RE-RAISE THIS FLOOR ON EVERY BREAKING BLOOM RELEASE, in the same commit as the root package.json catalog entry and the code that requires it. The breaking position is the MAJOR, so `^3.0.1` means `>=3.0.1 <4.0.0`: 3.x minors are admitted on semver's additive promise, and Bloom 4.0.0 is refused until someone raises this deliberately. The CAP is the part that is load-bearing. An earlier revision of this key recorded the opposite trade -- an uncapped `>=` floor, accepted so that intentionally-breaking Bloom 0.x minors would not be blocked -- and that trade is closed by evidence rather than by preference: an unbounded range is exactly what let `bun install` pair this package with Bloom 1.0.0 and emit no warning at all, and 1.0.0 broke it four ways (a deleted provider, a renamed confirm option, a renamed Chip fill, and two REMOVED SUBPATHS that fail at bundle time, before any typecheck runs). A floor is a claim about what was measured; a cap is the claim that nothing beyond it was. RAISED TO 3.0.1 from `^2.1.0`. Bloom 3.0.0 breaks exactly two things -- `PageHeader` defaults to `presentation=\"floating\"` and stops hiding the title under `transparent`, and `Field disabled` now reaches the control that reads the field context -- and THIS PACKAGE IMPORTS NEITHER: it renders no `PageHeader` and no `Field`, and 3.0 removes no subpath (unlike 2.0.0, which is why that floor cost code changes and this one does not). Its six `transparent` occurrences are CSS colour values, not the PageHeader prop. The cap had to move rather than widen to a union, because leaving `^2.1.0` in place is what made `bun install` resolve a SECOND, nested Bloom 2.12.4 under this package for any app on Bloom 3 -- two copies of a library whose 3.0 contracts (`control-surface`, `TopEdgeProvider`, `ScrollOffsetProvider`) are React contexts, so a provider from one copy cannot be read by a consumer from the other. Mention's `oxyRuntimeCompatibility` test is what caught it; nothing in a typecheck can. RAISED AGAIN TO 3.2.0 from `^3.0.1`, for the same class of reason the 2.x note records, only in the other direction: 3.2.0 ADDS the per-glyph icon subpaths (`@oxy.so/bloom/icons/RiAtLine`) that this package's screens now import instead of the `@oxy.so/bloom/icons` barrel, and a missing subpath fails at bundle time, in the consumer's Metro, long after this package has typechecked and shipped. `^3.0.1` would have admitted Bloom 3.0.1 and 3.1.0, neither of which has those subpaths, so the floor is the only thing standing between a consumer and a red build. Nothing else about 3.1.0 or 3.2.0 is required here; the cap stays at the major. RAISED TO ^4.2.0: FollowButton now delegates its visuals to Bloom media-header FollowButton with loading, textStyle and large size; the new shared UI contracts require one Bloom4 context across Services and its consumer. RAISED TO ^4.31.0: the sign-in and account screens type one-time codes into `InputOtp` with `type=\"alphanumeric\"` (the long sign-in code and backup codes), which 4.31.0 adds; older 4.x drops the letters. RAISED TO ^4.35.0: every password field passes `revealable` to `TextFieldInput` (the eye button, 4.35.0); older 4.x drops the prop silently and the password cannot be shown. The provider also mounts `@oxy.so/bloom/locale` (4.32.0+). RAISED TO ^5.1.0 (services 9.0.0, a major because consumers must move to Bloom 5 with it): Bloom 5.0.0 types `Card`'s `style` without radius, border width or `overflow` (geometry goes through `radius`/`border`/`clipContent`) and stops clipping a Card's children by default, so `BenefitList`'s `overflow: 'visible'` became both a type error and unnecessary; it is removed. The cap MOVES rather than widening to a `^4 || ^5` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 5.1.0 because that is the version measured here (every package builds and tests against it); 5.0.0 was not measured. RAISED TO ^6.0.0 (services 10.0.0, a major because consumers must move to Bloom 6 with it, and because this package's own `FollowButton`/`FollowTargetButton` `size` moves with Bloom's vocabulary): Bloom 6.0.0 removes the duplicate spellings its 5.x types still admitted, and this package used four of them. The control `size` narrows to `xs|sm|md|lg`, so every `small`/`medium`/`large` handed to a Bloom control became `sm`/`md`/`lg`, and the Follow buttons' public `size` became `sm|md|lg` because it is passed straight through to Bloom's media-header `FollowButton`. `Switch` is controlled by `checked`/`onCheckedChange`, not `value`/`onValueChange`. `Button` has no `variant`: each call site names `appearance` and `tone` (the pair the 5.x recipe resolved the variant to, so nothing repaints), `LinkButton`'s colour is `linkTone`, and `PeableButton` renders `InverseButton`. `Card` takes `appearance=\"outline\"` for `variant=\"outlined\"`. The deprecated spellings Bloom 6 still accepts (`isInvalid`, Chip `color`/`variant`) are not breaks and are left alone. The cap MOVES rather than widening to a `^5 || ^6` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 6.0.0 because that is the version measured when this raise was made; the workspace catalog has since moved to ^6.2.0, which adds only the `cover-header` subpath this package does not import, so the floor stays.",
+  "//@oxy.so/bloom": "RE-RAISE THIS FLOOR ON EVERY BREAKING BLOOM RELEASE, in the same commit as the root package.json catalog entry and the code that requires it. The breaking position is the MAJOR, so `^3.0.1` means `>=3.0.1 <4.0.0`: 3.x minors are admitted on semver's additive promise, and Bloom 4.0.0 is refused until someone raises this deliberately. The CAP is the part that is load-bearing. An earlier revision of this key recorded the opposite trade -- an uncapped `>=` floor, accepted so that intentionally-breaking Bloom 0.x minors would not be blocked -- and that trade is closed by evidence rather than by preference: an unbounded range is exactly what let `bun install` pair this package with Bloom 1.0.0 and emit no warning at all, and 1.0.0 broke it four ways (a deleted provider, a renamed confirm option, a renamed Chip fill, and two REMOVED SUBPATHS that fail at bundle time, before any typecheck runs). A floor is a claim about what was measured; a cap is the claim that nothing beyond it was. RAISED TO 3.0.1 from `^2.1.0`. Bloom 3.0.0 breaks exactly two things -- `PageHeader` defaults to `presentation=\"floating\"` and stops hiding the title under `transparent`, and `Field disabled` now reaches the control that reads the field context -- and THIS PACKAGE IMPORTS NEITHER: it renders no `PageHeader` and no `Field`, and 3.0 removes no subpath (unlike 2.0.0, which is why that floor cost code changes and this one does not). Its six `transparent` occurrences are CSS colour values, not the PageHeader prop. The cap had to move rather than widen to a union, because leaving `^2.1.0` in place is what made `bun install` resolve a SECOND, nested Bloom 2.12.4 under this package for any app on Bloom 3 -- two copies of a library whose 3.0 contracts (`control-surface`, `TopEdgeProvider`, `ScrollOffsetProvider`) are React contexts, so a provider from one copy cannot be read by a consumer from the other. Mention's `oxyRuntimeCompatibility` test is what caught it; nothing in a typecheck can. RAISED AGAIN TO 3.2.0 from `^3.0.1`, for the same class of reason the 2.x note records, only in the other direction: 3.2.0 ADDS the per-glyph icon subpaths (`@oxy.so/bloom/icons/RiAtLine`) that this package's screens now import instead of the `@oxy.so/bloom/icons` barrel, and a missing subpath fails at bundle time, in the consumer's Metro, long after this package has typechecked and shipped. `^3.0.1` would have admitted Bloom 3.0.1 and 3.1.0, neither of which has those subpaths, so the floor is the only thing standing between a consumer and a red build. Nothing else about 3.1.0 or 3.2.0 is required here; the cap stays at the major. RAISED TO ^4.2.0: FollowButton now delegates its visuals to Bloom media-header FollowButton with loading, textStyle and large size; the new shared UI contracts require one Bloom4 context across Services and its consumer. RAISED TO ^4.31.0: the sign-in and account screens type one-time codes into `InputOtp` with `type=\"alphanumeric\"` (the long sign-in code and backup codes), which 4.31.0 adds; older 4.x drops the letters. RAISED TO ^4.35.0: every password field passes `revealable` to `TextFieldInput` (the eye button, 4.35.0); older 4.x drops the prop silently and the password cannot be shown. The provider also mounts `@oxy.so/bloom/locale` (4.32.0+). RAISED TO ^5.1.0 (services 9.0.0, a major because consumers must move to Bloom 5 with it): Bloom 5.0.0 types `Card`'s `style` without radius, border width or `overflow` (geometry goes through `radius`/`border`/`clipContent`) and stops clipping a Card's children by default, so `BenefitList`'s `overflow: 'visible'` became both a type error and unnecessary; it is removed. The cap MOVES rather than widening to a `^4 || ^5` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 5.1.0 because that is the version measured here (every package builds and tests against it); 5.0.0 was not measured. RAISED TO ^6.0.0 (services 10.0.0, a major because consumers must move to Bloom 6 with it, and because this package's own `FollowButton`/`FollowTargetButton` `size` moves with Bloom's vocabulary): Bloom 6.0.0 removes the duplicate spellings its 5.x types still admitted, and this package used four of them. The control `size` narrows to `xs|sm|md|lg`, so every `small`/`medium`/`large` handed to a Bloom control became `sm`/`md`/`lg`, and the Follow buttons' public `size` became `sm|md|lg` because it is passed straight through to Bloom's media-header `FollowButton`. `Switch` is controlled by `checked`/`onCheckedChange`, not `value`/`onValueChange`. `Button` has no `variant`: each call site names `appearance` and `tone` (the pair the 5.x recipe resolved the variant to, so nothing repaints), `LinkButton`'s colour is `linkTone`, and `PeableButton` renders `InverseButton`. `Card` takes `appearance=\"outline\"` for `variant=\"outlined\"`. The deprecated spellings Bloom 6 still accepts (`isInvalid`, Chip `color`/`variant`) are not breaks and are left alone. The cap MOVES rather than widening to a `^5 || ^6` union, for the reason the 3.0.1 note records: a union lets an app resolve a second, nested Bloom copy and split the React contexts. The floor is 6.0.0 because that is the version measured when this raise was made; the workspace catalog has since moved to ^6.2.0, which adds only the `cover-header` subpath this package does not import, so the floor stays. MAINTENANCE 6.2.1: floor >=6.2.1 and cap <6.3.0 deliberately admit only the reviewed patch line with native Back/X completion and SVG paint/resize fixes. Known 6.4.0 lacks these fixes; the exact root catalog pin prevents a caret from selecting it. A broader minor range requires forward-port and consumer acceptance. VERIFIED 7.1.2: the additional >=7.1.2 <7.2.0 line contains the reviewed native fixes. Services build/types and the website real browser provider/theme tests pass with one byte-verified Bloom copy at both the root and Services importer. The root catalog remains pinned to 6.2.1; consumers explicitly choose one supported line. Versions 6.3.x, 6.4.x and 7.1.0/7.1.1 remain excluded.",
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
-    "@oxy.so/bloom": "^6.0.0",
-    "@oxy.so/core": "^4.0.0",
+    "@oxy.so/bloom": ">=6.2.1 <6.3.0 || >=7.1.2 <7.2.0",
+    "@oxy.so/core": "4.5.0-oxy-one.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
-    "@react-native-community/netinfo": ">=11.4.1",
+    "@react-native-community/netinfo": ">=11.4.1 <13.0.0",
     "@tanstack/query-async-storage-persister": "^5.101",
     "@tanstack/query-sync-storage-persister": "^5.101",
     "@tanstack/react-query": "^5.101",
     "@tanstack/react-query-persist-client": "^5.101",
-    "@types/react": "*",
-    "@types/react-native": "*",
-    "expo": ">=56.0.0",
+    "@types/react": "<20.0.0",
+    "@types/react-native": "<1.0.0",
+    "expo": ">=56.0.0 <58.0.0",
     "expo-clipboard": ">=56.0.0 <59.0.0",
-    "expo-constants": ">=56.0.0",
-    "expo-document-picker": ">=56.0.0",
-    "expo-file-system": ">=56.0.0",
-    "expo-haptics": ">=56.0.0",
-    "expo-image": ">=2.0.0",
-    "expo-image-manipulator": ">=56.0.0",
-    "expo-image-picker": ">=56.0.0",
-    "expo-linear-gradient": ">=56.0.0",
-    "expo-modules-core": "*",
-    "expo-notifications": ">=56.0.0",
-    "expo-web-browser": ">=56.0.0",
-    "nativewind": ">=5.0.0",
+    "expo-constants": ">=56.0.0 <58.0.0",
+    "expo-document-picker": ">=56.0.0 <58.0.0",
+    "expo-file-system": ">=56.0.0 <58.0.0",
+    "expo-haptics": ">=56.0.0 <58.0.0",
+    "expo-image": ">=2.0.0 <58.0.0",
+    "expo-image-manipulator": ">=56.0.0 <58.0.0",
+    "expo-image-picker": ">=56.0.0 <58.0.0",
+    "expo-linear-gradient": ">=56.0.0 <58.0.0",
+    "expo-modules-core": "<58.0.0",
+    "expo-notifications": ">=56.0.0 <58.0.0",
+    "expo-web-browser": ">=56.0.0 <58.0.0",
+    "nativewind": ">=5.0.0-preview.3 <6.0.0",
     "react-native-css": "^3.0.6",
-    "react": ">=18.0.0",
-    "react-native": ">=0.85.0",
-    "react-native-gesture-handler": ">=2.31.1",
-    "react-native-keyboard-controller": ">=1.21.0",
+    "react": ">=18.0.0 <20.0.0",
+    "react-native": ">=0.85.0 <0.87.0",
+    "react-native-gesture-handler": ">=2.31.1 <3.0.0",
+    "react-native-keyboard-controller": ">=1.21.0 <2.0.0",
     "react-native-qrcode-svg": "^6.3.0",
-    "react-native-reanimated": ">=4.3.0",
-    "react-native-safe-area-context": ">=5.7.0",
-    "react-native-svg": ">=15.15.0",
+    "react-native-reanimated": ">=4.3.0 <5.0.0",
+    "react-native-safe-area-context": ">=5.7.0 <6.0.0",
+    "react-native-svg": ">=15.15.0 <16.0.0",
     "zustand": "^5.0.0"
   },
   "peerDependenciesMeta": {

package/src/index.ts

@@ -436,3 +436,7 @@ export {
   closeAccountDialog,
   subscribeToAccountDialog,
 } from './ui/navigation/accountDialogManager';
+
+export type { StartNativeOAuthSignInOptions, NativeOAuthSignInResult } from './ui/oauth/nativeAuthTransport';
+
+export { usePersonalPlans, usePersonalPlanSubscriptions } from './ui/hooks/queries/usePersonalPlans';

package/src/ui/boot/__tests__/coldBootNoIdpRedirect.test.ts

@@ -78,7 +78,7 @@ function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harne
   const sessionClientStart = jest.fn(async () => undefined);
 
   const options: RunProviderColdBootOptions = {
-    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
+    oxyServices: { apps: { getPublic: jest.fn(async () => ({ id: 'registered-app', name: 'Registered App', type: 'first_party', isOfficial: false, isInternal: false, scopes: [] })) } } as unknown as RunProviderColdBootOptions['oxyServices'],
     authStore: makeEmptyAuthStore(),
     clientId: CLIENT_ID,
     sessionClient: { start: sessionClientStart } as unknown as SessionClient,
@@ -198,7 +198,7 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
       await commit.commitSession({ sessionId: 's1', userId: 'u1' });
       expect(options.commitSession).toHaveBeenCalledWith(
         { sessionId: 's1', userId: 'u1' },
-        { activate: true },
+        { activate: true, oauth: true },
       );
     });
   });
@@ -213,3 +213,57 @@ describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b
     expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
   });
 });
+
+describe('registered cold-boot classification', () => {
+  beforeEach(() => { mockRunSessionColdBoot.mockReset(); mockTryCompleteOAuthReturn.mockReset(); mockTryCompleteOAuthReturn.mockResolvedValue(false); });
+  it('external classification bypasses prior secrets, shared device and identity pin work', async () => {
+    const { options } = makeHarness();
+    (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({ id: 'external', name: 'External', type: 'third_party', isOfficial: false, isInternal: false, scopes: [] });
+    const beforeDeviceBoot = jest.fn();
+    await runProviderColdBoot({ ...options, beforeDeviceBoot });
+    expect(options.oxyServices.apps.getPublic).toHaveBeenCalledWith(CLIENT_ID, { cache: false });
+    expect(options.authStore.load).not.toHaveBeenCalled();
+    expect(options.authStore.clear).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(beforeDeviceBoot).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+  });
+  it.each(['missing', 'inactive', 'offline', 'invalid'])('fails closed for %s before secrets and callback work', async (mode) => {
+    const { options } = makeHarness();
+    if (mode === 'missing') options.clientId = undefined;
+    else if (mode === 'invalid') (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({ type: 'unknown' });
+    else (options.oxyServices.apps.getPublic as jest.Mock).mockRejectedValue(new Error(mode));
+    await runProviderColdBoot(options);
+    expect(options.markAuthResolved).toHaveBeenCalled();
+    expect(options.authStore.load).not.toHaveBeenCalled();
+    expect(options.authStore.clear).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+    expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+  });
+  it('a cold external OAuth callback never probes a previous device secret', async () => {
+    const { options } = makeHarness();
+    (options.oxyServices.apps.getPublic as jest.Mock).mockResolvedValue({ id: 'external', name: 'External', type: 'third_party', isOfficial: false, isInternal: false, scopes: [] });
+    mockTryCompleteOAuthReturn.mockImplementation(async ({ commitSession }) => {
+      await commitSession({ sessionId: 'isolated', userId: 'external-user', accessToken: 'isolated-bearer' }); return true;
+    });
+    await runProviderColdBoot(options);
+    expect(options.commitSession).toHaveBeenCalledWith({ sessionId: 'isolated', userId: 'external-user', accessToken: 'isolated-bearer' }, { activate: true, oauth: true });
+    expect(options.authStore.load).not.toHaveBeenCalled();
+    expect(options.syncDeviceCredentialToHost).not.toHaveBeenCalled();
+    expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+  });
+});
+
+it('an unresponsive registry resolves signed-out without a late privileged continuation', async () => {
+ jest.useFakeTimers();
+ try {
+  const {options}=makeHarness(); let release!: (app:unknown)=>void;
+  (options.oxyServices.apps.getPublic as jest.Mock).mockImplementation(()=>new Promise(resolve=>{release=resolve;}));
+  mockRunSessionColdBoot.mockReset(); mockTryCompleteOAuthReturn.mockReset();
+  const boot=runProviderColdBoot(options); await jest.advanceTimersByTimeAsync(5000); await boot;
+  expect(options.markAuthResolved).toHaveBeenCalled(); expect(options.authStore.load).not.toHaveBeenCalled();
+  release({id:'app',name:'Late',type:'first_party',isOfficial:true,isInternal:false,scopes:[]}); await Promise.resolve();
+  expect(mockRunSessionColdBoot).not.toHaveBeenCalled(); expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+ } finally {jest.useRealTimers();}
+});

package/src/ui/boot/runProviderColdBoot.ts

@@ -1,3 +1,4 @@
+import { resolveApplicationSessionLane } from '../oauth/applicationSessionLane';
 import { logger as loggerUtil, type OxyServices } from '@oxy.so/core';
 import { runSessionColdBoot, type AuthStateStore, type IdentityBinding, type SessionMode } from '@oxy.so/core/session';
 import type { SessionClient } from '@oxy.so/core/session';
@@ -80,8 +81,14 @@ export interface RunProviderColdBootOptions {
   /** The identity binding required by `sessionMode: 'identity'`. */
   identity?: IdentityBinding;
   sessionClient: SessionClient;
+  /** Provider-owned fresh classifier, also used by explicit action recovery. */
+  resolveSessionLane?: () => Promise<'device' | 'oauth'>;
+  /** Identity pin work may run only after a fresh device classification. */
+  onClassified?: (lane: 'device' | 'oauth') => void | Promise<void>;
+  beforeDeviceBoot?: () => Promise<void>;
+  afterDeviceBoot?: () => Promise<void>;
   syncDeviceCredentialToHost: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean; oauth?: boolean }) => Promise<void>;
   markAuthResolved: () => void;
   setTokenReady: (ready: boolean) => void;
 }
@@ -124,6 +131,11 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
   setTokenReady(false);
 
   try {
+    // Classification precedes every local-secret, shared-credential and identity
+    // probe. Unavailable registry metadata fails closed, including offline boot.
+    const lane = await (opts.resolveSessionLane?.() ?? resolveApplicationSessionLane(oxyServices, clientId));
+    await opts.onClassified?.(lane);
+    if (identityBound && lane !== 'device') return;
     // The redirect transport's RETURN leg. An app reaches it whenever the browser
     // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
     // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
@@ -136,7 +148,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
           oxyServices,
           clientId,
           authRedirectUri,
-          commitSession: (input) => commitSession(input, { activate: true }),
+          commitSession: (input) => commitSession(input, { activate: true, oauth: true }),
         });
     if (oauthCompleted) {
       setTokenReady(true);
@@ -144,6 +156,13 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       return;
     }
 
+    if (lane === 'oauth') {
+      setTokenReady(true);
+      return;
+    }
+
+    await opts.beforeDeviceBoot?.();
+
     // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
     // the two doomed network steps so routing settles immediately instead of
     // burning the overall deadline on a mint that cannot succeed. Any ambiguity
@@ -224,6 +243,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
         }
       },
     });
+    await opts.afterDeviceBoot?.();
   } catch (error) {
     if (__DEV__) {
       loggerUtil.error(

package/src/ui/components/OxySignInButton.tsx

@@ -1,3 +1,4 @@
+import { classifyApplicationSessionLane } from '../oauth/applicationSessionLane';
 import type React from 'react';
 import { useCallback, useState, useEffect, useRef } from 'react';
 import { type ViewStyle, type TextStyle, type StyleProp, Platform } from 'react-native';
@@ -142,6 +143,8 @@ export interface OxySignInButtonProps {
      * ```
      */
     onOAuthResult?: (result: OxyOAuthResult) => void;
+    /** Opt in to the shared SDK native finalizer. Mutually exclusive with onOAuthResult. */
+    nativeOAuthCompletion?: 'sdk';
 }
 
 const ACTION_KEYS: Record<OxySignInButtonAction, string> = {
@@ -188,9 +191,10 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
     showWhenAuthenticated = false,
     oauthRedirectUri,
     onOAuthResult,
+    nativeOAuthCompletion,
 }) => {
     const { t } = useI18n();
-    const { openAccountDialog, oxyServices, clientId, webAuthMode, startWebOAuthSignIn } = useOxy();
+    const { openAccountDialog, oxyServices, clientId, webAuthMode, startWebOAuthSignIn, startNativeOAuthSignIn } = useOxy();
     const { isAuthenticated, isLoading } = useAuthStore(
         useShallow((state) => ({ isAuthenticated: state.isAuthenticated, isLoading: state.isLoading }))
     );
@@ -228,7 +232,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
         if (cached && cached.clientId === clientId && cached.oxyServices === oxyServices) {
             return cached.promise;
         }
-        const promise = oxyServices.apps.getPublic(clientId).catch((error) => {
+        const promise = oxyServices.apps.getPublic(clientId, { cache: false }).catch((error) => {
             // Only clear if this is still the live entry (a later resolve may have
             // replaced it after a clientId/oxyServices change).
             if (appResolutionRef.current?.promise === promise) {
@@ -308,6 +312,14 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                 return;
             }
 
+            if (nativeOAuthCompletion === 'sdk') {
+                if (onOAuthResult) { notifyNotConfigured(app.name); return; }
+                const result = await startNativeOAuthSignIn({ redirectUri: oauthRedirectUri });
+                if (result.status === 'failed') notifyFailed();
+                if (result.status === 'unsupported') notifyNotConfigured(app.name);
+                return;
+            }
+
             // Native: open the in-app auth session, then hand the handshake to the
             // RP so it can complete the token exchange from its deep-link callback.
             const [pkce, state] = await Promise.all([generatePkcePair(), generateOAuthState()]);
@@ -332,6 +344,8 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
             clientId,
             oauthRedirectUri,
             onOAuthResult,
+            nativeOAuthCompletion,
+            startNativeOAuthSignIn,
             startOfficialSignIn,
             startWebOAuthSignIn,
             shouldPreOpenPopup,
@@ -357,7 +371,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                 const resolving = resolvePublicApplication();
                 if (!resolving) {
                     closeOAuthPopup(popup);
-                    startOfficialSignIn();
+                    notifyNotConfigured('this app');
                     return;
                 }
                 let app: PublicApplication;
@@ -373,7 +387,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                     notifyFailed();
                     return;
                 }
-                if (app.type === 'third_party' && !app.isOfficial) {
+                if (classifyApplicationSessionLane(app) === 'oauth') {
                     await startThirdPartyOAuth(app, popup);
                     return;
                 }
@@ -392,6 +406,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
                 );
                 notifyFailed();
             } finally {
+                appResolutionRef.current = null;
                 routingRef.current = false;
             }
         },
@@ -400,6 +415,7 @@ export const OxySignInButton: React.FC<OxySignInButtonProps> = ({
             startOfficialSignIn,
             startThirdPartyOAuth,
             clientId,
+            notifyNotConfigured,
             notifyFailed,
         ],
     );