@oxy.so/services 11.5.0 → 11.6.0

package/src/ui/components/signIn/OxySignUpPanel.tsx

@@ -15,11 +15,8 @@ import type React from 'react';
 import { useEffect, useState } from 'react';
 import { Linking, Platform } from 'react-native';
 import { toast } from '@oxy.so/bloom/toast';
-import {
-  SIGN_IN_ERROR_CODES,
-  emailAddressSchema,
-  type EmailVerificationConfirmResponse,
-} from '@oxy.so/contracts';
+import type { EmailVerificationConfirmResponse } from '@oxy.so/contracts';
+import { SIGN_IN_ERROR_CODES, emailAddressCheck, checkContract } from '@oxy.so/contracts/client';
 import { useOxy } from '../../context/OxyContext';
 import { useAccountDialogSnapshot } from '../../hooks/accountDialogSnapshot';
 import { useI18n } from '../../hooks/useI18n';
@@ -126,13 +123,13 @@ export const OxySignUpPanel: React.FC<OxySignUpPanelProps> = ({
   };
 
   const submitEmail = () => {
-    const parsed = emailAddressSchema.safeParse(email);
-    if (!parsed.success) {
+    const address = checkContract(emailAddressCheck, email);
+    if (address === null) {
       setError(t('signup.email.invalid'));
       return;
     }
-    setEmail(parsed.data);
-    run(() => sendCode(parsed.data));
+    setEmail(address);
+    run(() => sendCode(address));
   };
 
   // The code step reports this promise's failure in place.

package/src/ui/components/signIn/ReauthStep.tsx

@@ -8,12 +8,8 @@
 
 import type React from 'react';
 import { useState } from 'react';
-import {
-  EMAIL_CODE_LENGTH,
-  TOTP_DIGITS,
-  type ReauthAction,
-  type ReauthProof,
-} from '@oxy.so/contracts';
+import type { ReauthAction, ReauthProof } from '@oxy.so/contracts';
+import { EMAIL_CODE_LENGTH, TOTP_DIGITS } from '@oxy.so/contracts/client';
 import { useOxy } from '../../context/OxyContext';
 import { useI18n } from '../../hooks/useI18n';
 import { SubtleLink } from '../authChooser/primitives';

package/src/ui/components/signIn/accountFlowParts.tsx

@@ -18,6 +18,7 @@ import { useTheme } from '@oxy.so/bloom/theme';
 import { TextField, TextFieldHint, TextFieldInput, TextFieldLabel } from '@oxy.so/bloom/text-field';
 import { Text } from '@oxy.so/bloom/typography';
 import { WizardProgress } from '@oxy.so/bloom/wizard';
+import type { EmailVerificationConfirmResponse } from '@oxy.so/contracts';
 import {
   EMAIL_CODE_LENGTH,
   EMAIL_SIGNIN_LONG_CODE_ALPHABET,
@@ -25,8 +26,7 @@ import {
   EMAIL_VERIFICATION_ERROR_CODES,
   SIGN_IN_ERROR_CODES,
   normalizeEmailSignInCode,
-  type EmailVerificationConfirmResponse,
-} from '@oxy.so/contracts';
+} from '@oxy.so/contracts/client';
 import { useOxy } from '../../context/OxyContext';
 import { useI18n } from '../../hooks/useI18n';
 import type { Translate } from '../authChooser/types';

package/src/ui/context/OxyContext.tsx

@@ -29,7 +29,6 @@ import type {
   AccountDialogController,
   AccountDialogView,
 } from '@oxy.so/core/session';
-import { KeyManager } from '@oxy.so/core/crypto';
 import {
   refreshDeviceSecretArm,
   establishIdentitySession,
@@ -60,6 +59,7 @@ import {
   type RequestOAuthConsentOptions,
 } from '../oauth/explicitOAuthConsent';
 import { isWebBrowser } from '../utils/isWebBrowser';
+import { loadIdentityCrypto } from '../utils/identityCrypto';
 import { resolveDeliveryPlatform } from '../utils/deliveryPlatform';
 import { runProviderColdBoot } from '../boot/runProviderColdBoot';
 import { resolveApplicationSessionLane } from '../oauth/applicationSessionLane';
@@ -696,6 +696,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         try {
           // The same keys the refresh handler's second arm signs with: the
           // identity-bound client's own key, or the cross-app shared identity.
+          const { KeyManager } = await loadIdentityCrypto();
           return identity ? await KeyManager.hasIdentity() : await KeyManager.hasSharedIdentity();
         } catch {
           return false;
@@ -1495,9 +1496,12 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   // — a locked keychain must never be misreported as "no identity". `hasIdentity`
   // still resolves `false` and `getPublicKey` still resolves `null` for a genuine
   // absence.
-  const hasIdentity = useCallback(async (): Promise<boolean> => KeyManager.hasIdentity(), []);
+  const hasIdentity = useCallback(
+    async (): Promise<boolean> => (await loadIdentityCrypto()).KeyManager.hasIdentity(),
+    [],
+  );
   const getPublicKey = useCallback(
-    async (): Promise<string | null> => KeyManager.getPublicKey(),
+    async (): Promise<string | null> => (await loadIdentityCrypto()).KeyManager.getPublicKey(),
     [],
   );
 

package/src/ui/context/hooks/useAuthOperations.ts

@@ -8,9 +8,9 @@ import type { LogoutResult } from '../oxyContextTypes';
 import { DeviceManager } from '@oxy.so/core/session';
 import { fetchSessionsWithFallback } from '../../utils/sessionHelpers';
 import { handleAuthError, isInvalidSessionError } from '../../utils/errorHandlers';
+import { loadIdentityCrypto } from '../../utils/identityCrypto';
 import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxy.so/core';
-import { SignatureService } from '@oxy.so/core/crypto';
 
 export interface UseAuthOperationsOptions {
   oxyServices: OxyServices;
@@ -126,6 +126,7 @@ export const useAuthOperations = ({
       // in local storage as 'oxy_biometric_enabled' and can be checked there.
 
       // Sign the challenge
+      const { SignatureService } = await loadIdentityCrypto();
       const { challenge: signature, timestamp } = await SignatureService.signChallenge(challenge);
 
       let fullUser: User;

package/src/ui/oauth/applicationSessionLane.ts

@@ -1,8 +1,8 @@
-import { publicApplicationSchema } from '@oxy.so/contracts';
+import { publicApplicationCheck, parseContract } from '@oxy.so/contracts/client';
 import type { OxyServices } from '@oxy.so/core';
 
 export function classifyApplicationSessionLane(metadata: unknown): 'device' | 'oauth' {
-  const application = publicApplicationSchema.parse(metadata);
+  const application = parseContract(publicApplicationCheck, metadata);
   return application.type === 'third_party' && !application.isOfficial && !application.isInternal
     ? 'oauth'
     : 'device';

package/src/ui/screens/AccountSettingsScreen.tsx

@@ -1,5 +1,9 @@
 import type React from 'react';
-import { ORGANIZATION_NAME_MAX_LENGTH, organizationNameSchema } from '@oxy.so/contracts';
+import {
+  ORGANIZATION_NAME_MAX_LENGTH,
+  organizationNameCheck,
+  checkContract,
+} from '@oxy.so/contracts/client';
 import { OrganizationSettings } from '../components/organizations/OrganizationSettings';
 import { useCallback, useMemo, useState } from 'react';
 import { View, ActivityIndicator } from 'react-native';
@@ -152,7 +156,7 @@ const AccountSettingsScreen: React.FC<BaseScreenProps> = ({
       }
       if (node?.account.kind === 'organization') {
         setDisplayNameError(
-          organizationNameSchema.safeParse(trimmed).success
+          checkContract(organizationNameCheck, trimmed) !== null
             ? ''
             : t('organizationDirectory.invalidName'),
         );

package/src/ui/screens/CreateAccountScreen.tsx

@@ -1,9 +1,10 @@
 import type React from 'react';
+import type { OrganizationType } from '@oxy.so/contracts';
 import {
   ORGANIZATION_NAME_MAX_LENGTH,
-  organizationNameSchema,
-  type OrganizationType,
-} from '@oxy.so/contracts';
+  organizationNameCheck,
+  checkContract,
+} from '@oxy.so/contracts/client';
 import { OrganizationDirectorySearch } from '../components/organizations/OrganizationDirectorySearch';
 import { OrganizationTypePicker } from '../components/organizations/OrganizationTypePicker';
 import { useState, useCallback, useRef, useEffect } from 'react';
@@ -21,12 +22,12 @@ import {
 import {
   applyBotUsernameSuffix,
   stripDisallowedUsernameCharacters,
-  usernameSchemaForAccountKind,
+  usernameCheckForAccountKind,
   BOT_USERNAME_INVALID_MESSAGE,
   USERNAME_INVALID_MESSAGE,
   USERNAME_MAX_LENGTH,
   USERNAME_MIN_LENGTH,
-} from '@oxy.so/contracts';
+} from '@oxy.so/contracts/client';
 import type { BaseScreenProps } from '../types/navigation';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
@@ -196,9 +197,9 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, paren
       // somebody who typed `a.b` to append `bot` sends them to be refused a second
       // time. The issue is read to choose between two LOCALIZED strings rather than
       // shown directly — the schema's message is English, and this screen is not.
-      const parsed = usernameSchemaForAccountKind(forKind).safeParse(value);
-      if (!parsed.success) {
-        const failedTheLabel = parsed.error.issues[0]?.message === BOT_USERNAME_INVALID_MESSAGE;
+      const checked = usernameCheckForAccountKind(forKind)(value, []);
+      if (!checked.ok) {
+        const failedTheLabel = checked.issue.message === BOT_USERNAME_INVALID_MESSAGE;
         setUsernameStatus('invalid');
         setUsernameMessage(
           failedTheLabel
@@ -282,7 +283,7 @@ const CreateAccountScreen: React.FC<BaseScreenProps> = ({ onClose, goBack, paren
       }
       if (kind === 'organization') {
         setDisplayNameError(
-          organizationNameSchema.safeParse(trimmed).success
+          checkContract(organizationNameCheck, trimmed) !== null
             ? ''
             : t('organizationDirectory.invalidName'),
         );

package/src/ui/utils/identityCrypto.ts

@@ -0,0 +1,10 @@
+/**
+ * The self-custody identity (`@oxy.so/core/crypto`: secp256k1, bip39, the AEAD
+ * cipher — ~32 KB gzipped on web), loaded where a key or signature is used.
+ *
+ * Importing it statically put it in every app's startup JavaScript, although a
+ * reader without an identity key never touches it before first paint. Core's
+ * `crypto` entry installs its polyfill before anything else, so loading it
+ * late keeps the order every key operation relies on.
+ */
+export const loadIdentityCrypto = () => import('@oxy.so/core/crypto');