@oxy.so/services 11.5.0 → 11.8.0

package/lib/typescript/module/ui/screens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAqB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,2BAAwB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,4BAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC3D,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAqB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,2BAAwB,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,4BAAyB,CAAC;AAE3E,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAqB,CAAC"}

package/lib/typescript/module/ui/utils/identityCrypto.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The self-custody identity (`@oxy.so/core/crypto`: secp256k1, bip39, the AEAD
+ * cipher — ~32 KB gzipped on web), loaded where a key or signature is used.
+ *
+ * Importing it statically put it in every app's startup JavaScript, although a
+ * reader without an identity key never touches it before first paint. Core's
+ * `crypto` entry installs its polyfill before anything else, so loading it
+ * late keeps the order every key operation relies on.
+ */
+export declare const loadIdentityCrypto: () => Promise<{
+    default: typeof import("@oxy.so/core/crypto");
+    KeyManager: typeof import("@oxy.so/core/crypto").KeyManager;
+    IdentityAlreadyExistsError: typeof import("@oxy.so/core/crypto").IdentityAlreadyExistsError;
+    IdentityPersistError: typeof import("@oxy.so/core/crypto").IdentityPersistError;
+    IdentityUnavailableError: typeof import("@oxy.so/core/crypto").IdentityUnavailableError;
+    readIdentityMarker: typeof import("@oxy.so/core/crypto").readIdentityMarker;
+    updateIdentityMarker: typeof import("@oxy.so/core/crypto").updateIdentityMarker;
+    SignatureService: typeof import("@oxy.so/core/crypto").SignatureService;
+    RecoveryPhraseService: typeof import("@oxy.so/core/crypto").RecoveryPhraseService;
+    BACKUP_KDF_ENCRYPTION_INFO: "oxy-backup-encryption-key";
+    hkdfSha256: typeof import("@oxy.so/core/crypto").hkdfSha256;
+    encryptAead: typeof import("@oxy.so/core/crypto").encryptAead;
+    decryptAead: typeof import("@oxy.so/core/crypto").decryptAead;
+    AEAD_KEY_LENGTH: 32;
+    AEAD_NONCE_LENGTH: 24;
+    deriveSharedSecret: typeof import("@oxy.so/core/crypto").deriveSharedSecret;
+    SCOPED_SEED_KDF_SALT: "oxy-identity-scoped-seed-v1";
+    SOCIAL_RECEIVE_CHAIN_CODE_KEY: "oxypay/faircoin/social/v1";
+    MAX_SOCIAL_RECEIVE_INDEX: 2147483647;
+    deriveScopedSeedFromKey: typeof import("@oxy.so/core/crypto").deriveScopedSeedFromKey;
+    deriveSocialReceiveKey: typeof import("@oxy.so/core/crypto").deriveSocialReceiveKey;
+    signSocialReceiveDigest: typeof import("@oxy.so/core/crypto").signSocialReceiveDigest;
+    authChallengeDigest: typeof import("@oxy.so/core/crypto").authChallengeDigest;
+    digestIdentityPayload: typeof import("@oxy.so/core/crypto").digestIdentityPayload;
+    signIdentityProof: typeof import("@oxy.so/core/crypto").signIdentityProof;
+    deriveIdentityLinkCode: typeof import("@oxy.so/core/crypto").deriveIdentityLinkCode;
+    solveRegistrationPow: typeof import("@oxy.so/core/crypto").solveRegistrationPow;
+    createContentHasher: typeof import("@oxy.so/core/crypto").createContentHasher;
+    canonicalize: typeof import("@oxy.so/protocol").canonicalize;
+    loadCommonsIdentityBridge: typeof import("@oxy.so/protocol").loadCommonsIdentityBridge;
+    signMessage: typeof import("@oxy.so/protocol").signMessage;
+    verifySignature: typeof import("@oxy.so/protocol").verifySignature;
+}>;
+//# sourceMappingURL=identityCrypto.d.ts.map

package/lib/typescript/module/ui/utils/identityCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityCrypto.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/identityCrypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "11.5.0",
+  "version": "11.8.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -111,7 +111,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/oxyhq/sdk",
+    "url": "git+https://github.com/OxyHQ/oxy.git",
     "directory": "packages/services"
   },
   "author": "OxyHQ",
@@ -136,33 +136,18 @@
     "copy-dts": "copyfiles -u 1 \"src/**/*.d.ts\" lib/typescript",
     "delete-debug-view": "rm -rf ./lib/commonjs/components/bottomSheetDebugView ./lib/module/components/bottomSheetDebugView ./lib/typescript/components/bottomSheetDebugView || true",
     "delete-dts.js": "find ./lib/commonjs -name '*.d.js*' -delete && find ./lib/module -name '*.d.js*' -delete",
-    "release": "rm -rf lib && bun run build && release-it",
     "prepublishOnly": "node ../../scripts/assert-bun-publish.mjs && bun run typescript && bun run test && bun run build"
   },
-  "release-it": {
-    "git": {
-      "tagName": "@oxy.so/services@${version}",
-      "tagAnnotation": "Release @oxy.so/services@${version}",
-      "commitMessage": "chore(services): release @oxy.so/services@${version}"
-    },
-    "github": {
-      "release": true,
-      "releaseName": "@oxy.so/services@${version}"
-    },
-    "npm": {
-      "publish": true
-    }
-  },
   "dependencies": {
     "@expo/config-plugins": "57.0.9",
-    "@oxy.so/contracts": "4.16.0",
+    "@oxy.so/contracts": "4.21.0",
     "color": "^5.0.3"
   },
   "devDependencies": {
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@expo/vector-icons": "^15.0.3",
-    "@oxy.so/core": "4.10.0",
+    "@oxy.so/core": "4.17.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^12.0.1",
     "@react-native/babel-preset": "^0.86.2",
@@ -177,7 +162,7 @@
     "@types/jest": "^30.0.0",
     "@types/node": "^20.19.43",
     "@types/react": "*",
-    "@oxy.so/bloom": "^10.4.0",
+    "@oxy.so/bloom": "^10.9.0",
     "copyfiles": "^2.4.1",
     "expo-clipboard": "~57.0.2",
     "expo-constants": "~57.0.5",
@@ -205,7 +190,6 @@
     "react-native-reanimated": "4.5.0",
     "react-native-safe-area-context": "~5.8.0",
     "react-native-svg": "15.15.5",
-    "release-it": "^19.0.6",
     "socket.io-client": "^4.8.1",
     "ts-jest": "^29.4.12",
     "typescript": "^5.9.2",
@@ -215,7 +199,7 @@
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxy.so/bloom": ">=6.2.1 <6.3.0 || >=7.1.2 <7.2.0 || >=7.7.0 <7.8.0 || >=7.13.1 <7.34.0 || >=8.0.0 <8.2.0 || >=9.0.0 <9.1.0 || >=10.0.0",
-    "@oxy.so/core": "4.10.0",
+    "@oxy.so/core": "4.17.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": ">=11.4.1 <13.0.0",
     "@tanstack/query-async-storage-persister": "^5.101",

package/src/assets/fonts/icons/manifest.json

@@ -6,7 +6,7 @@
       "fontFamily": "OxyServicesIonicons",
       "file": "src/assets/fonts/icons/OxyServicesIonicons.ttf",
       "bytes": 43004,
-      "sha256": "367d1eb46c64097ace34b793d7fbff9257c0da191d8cab73329cfe8999e95611",
+      "sha256": "f6617b302f84bfad9625e5b7cfebe3bc1c2b29d5dfea4f727c5fdd7393069a73",
       "names": [
         "add",
         "add-circle-outline",
@@ -151,8 +151,8 @@
     "materialCommunityIcons": {
       "fontFamily": "OxyServicesMaterialCommunityIcons",
       "file": "src/assets/fonts/icons/OxyServicesMaterialCommunityIcons.ttf",
-      "bytes": 28852,
-      "sha256": "844252d83e5510b012333218db9e16cc997164360d1ab4f24148c3ca384ab740",
+      "bytes": 29224,
+      "sha256": "b490224be59f3195d1907810f33dee438cfde45fc24d5d7f80a93b9d8af93eb7",
       "names": [
         "account",
         "account-circle",
@@ -213,6 +213,7 @@
         "code-tags",
         "cog",
         "cog-outline",
+        "contacts",
         "contain",
         "content-copy",
         "controller",
@@ -220,6 +221,7 @@
         "credit-card",
         "cube-outline",
         "database-outline",
+        "decimal",
         "delete",
         "delete-outline",
         "devices",
@@ -349,5 +351,5 @@
     }
   },
   "glyphMapsFile": "src/ui/icons/subsetGlyphMaps.ts",
-  "glyphMapsSha256": "25d2d86d08ea7238dfe49210cf98754ffcc60fefbe5b8ad812e13c2d3239948f"
+  "glyphMapsSha256": "96b7c9a8bfa5332ba2c27bf26a42ffd308d141861b4bc4b78744bc566afdf519"
 }

package/src/ui/components/organizations/OrganizationClaimReview.tsx

@@ -2,10 +2,8 @@ import { useState } from 'react';
 import { ActivityIndicator, View } from 'react-native';
 import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { isHttpRequestError } from '@oxy.so/core';
-import {
-  organizationClaimReviewSchema,
-  type OrganizationClaimReview as OrganizationClaimReviewInput,
-} from '@oxy.so/contracts';
+import type { OrganizationClaimReview as OrganizationClaimReviewInput } from '@oxy.so/contracts';
+import { organizationClaimReviewCheck, parseContract } from '@oxy.so/contracts/client';
 import { Button } from '@oxy.so/bloom/button';
 import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
 import { TextField, TextFieldInput } from '@oxy.so/bloom/text-field';
@@ -123,7 +121,7 @@ function ReviewDetail({ claimId, onClose }: { claimId: string; onClose: () => vo
         throw new Error('Independent staff review is required');
       return oxyServices.organizations.reviewClaim(
         claimId,
-        organizationClaimReviewSchema.parse({ decision, evidenceReference: evidence }),
+        parseContract(organizationClaimReviewCheck, { decision, evidenceReference: evidence }),
       );
     },
     onError: (error) => {

package/src/ui/components/organizations/OrganizationDirectorySearch.tsx

@@ -1,12 +1,13 @@
 import { useEffect, useState } from 'react';
 import { ActivityIndicator, View } from 'react-native';
 import { useInfiniteQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import type { Organization, OrganizationType } from '@oxy.so/contracts';
 import {
-  createOrganizationSchema,
-  organizationClaimInputSchema,
-  type Organization,
-  type OrganizationType,
-} from '@oxy.so/contracts';
+  createOrganizationCheck,
+  organizationClaimInputCheck,
+  parseContract,
+  checkContract,
+} from '@oxy.so/contracts/client';
 import { Avatar } from '@oxy.so/bloom/avatar';
 import { Button } from '@oxy.so/bloom/button';
 import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
@@ -56,7 +57,7 @@ export function OrganizationDirectorySearch({
         throw new Error('An active organization and personal session are required');
       return oxyServices.organizations.claim(
         selected.accountId,
-        organizationClaimInputSchema.parse({ evidenceReference: evidence }),
+        parseContract(organizationClaimInputCheck, { evidenceReference: evidence }),
       );
     },
     onSuccess: () => queryClient.invalidateQueries({ queryKey: ['oxy', 'organizations'] }),
@@ -65,7 +66,7 @@ export function OrganizationDirectorySearch({
     mutationFn: () => {
       if (!personalReady) throw new Error('A personal session is required');
       return oxyServices.organizations.create(
-        createOrganizationSchema.parse({ name: search.trim(), organizationType: type }),
+        parseContract(createOrganizationCheck, { name: search.trim(), organizationType: type }),
       );
     },
     onSuccess: (organization) => {
@@ -210,8 +211,10 @@ export function OrganizationDirectorySearch({
             loading={create.isPending}
             onPress={() => {
               if (
-                !createOrganizationSchema.safeParse({ name: search.trim(), organizationType: type })
-                  .success
+                checkContract(createOrganizationCheck, {
+                  name: search.trim(),
+                  organizationType: type,
+                }) === null
               ) {
                 setValidationError(true);
                 return;

package/src/ui/components/organizations/OrganizationSettings.tsx

@@ -1,11 +1,8 @@
 import { useState } from 'react';
 import { ActivityIndicator, View } from 'react-native';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import {
-  updateOrganizationSchema,
-  type Organization,
-  type OrganizationType,
-} from '@oxy.so/contracts';
+import type { Organization, OrganizationType, UpdateOrganization } from '@oxy.so/contracts';
+import { updateOrganizationCheck, checkContract } from '@oxy.so/contracts/client';
 import { Button } from '@oxy.so/bloom/button';
 import { toast } from '@oxy.so/bloom/toast';
 import { SettingsListGroup } from '@oxy.so/bloom/settings-list';
@@ -62,7 +59,7 @@ function OrganizationForm({ organization }: { organization: Organization }) {
   const [type, setType] = useState<OrganizationType>(organization.organizationType);
   const [invalid, setInvalid] = useState(false);
   const save = useMutation({
-    mutationFn: (input: ReturnType<typeof updateOrganizationSchema.parse>) => {
+    mutationFn: (input: UpdateOrganization) => {
       if (!canUsePrivateApi) throw new Error('An authenticated session is required');
       return oxyServices.organizations.update(organization.accountId, input);
     },
@@ -113,14 +110,14 @@ function OrganizationForm({ organization }: { organization: Organization }) {
           disabled={save.isPending || !canUsePrivateApi}
           loading={save.isPending}
           onPress={() => {
-            const input = updateOrganizationSchema.safeParse({
+            const input = checkContract(updateOrganizationCheck, {
               legalName: legalName.trim() || null,
               websiteUrl: website.trim() || null,
               countryCode: country.trim().toUpperCase() || null,
               organizationType: type,
             });
-            setInvalid(!input.success);
-            if (input.success) save.mutate(input.data);
+            setInvalid(input === null);
+            if (input) save.mutate(input);
           }}
         >
           {t('organizationDirectory.save')}

package/src/ui/components/organizations/OrganizationTypePicker.tsx

@@ -1,4 +1,5 @@
-import { ORGANIZATION_TYPES, type OrganizationType } from '@oxy.so/contracts';
+import type { OrganizationType } from '@oxy.so/contracts';
+import { ORGANIZATION_TYPES } from '@oxy.so/contracts/client';
 import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
 import { Text } from '@oxy.so/bloom/typography';
 import { useI18n } from '../../hooks/useI18n';

package/src/ui/components/signIn/OxyAuthenticatorPanel.tsx

@@ -19,7 +19,8 @@ import { CodeBlock } from '@oxy.so/bloom/code';
 import { useTheme } from '@oxy.so/bloom/theme';
 import { toast } from '@oxy.so/bloom/toast';
 import { Text } from '@oxy.so/bloom/typography';
-import { TOTP_DIGITS, type TotpEnrollResponse } from '@oxy.so/contracts';
+import type { TotpEnrollResponse } from '@oxy.so/contracts';
+import { TOTP_DIGITS } from '@oxy.so/contracts/client';
 import { useQueryClient } from '@tanstack/react-query';
 import { useOxy } from '../../context/OxyContext';
 import { useSignInMethods } from '../../hooks/queries/useAuthMethods';

package/src/ui/components/signIn/OxyLinkCommonsPanel.tsx

@@ -19,9 +19,9 @@ import { Button } from '@oxy.so/bloom/button';
 import { Loading } from '@oxy.so/bloom/loading';
 import { useTheme } from '@oxy.so/bloom/theme';
 import { Text } from '@oxy.so/bloom/typography';
-import { deriveIdentityLinkCode } from '@oxy.so/core/crypto';
 import type { IdentityLinkCreateResponse } from '@oxy.so/contracts';
 import { useOxy } from '../../context/OxyContext';
+import { loadIdentityCrypto } from '../../utils/identityCrypto';
 import { useSignInMethods } from '../../hooks/queries/useAuthMethods';
 import { useI18n } from '../../hooks/useI18n';
 import { OxyAuthScreen, OxyAuthScreenHeader } from './OxyAuthScreen';
@@ -99,6 +99,8 @@ export const OxyLinkCommonsPanel: React.FC<OxyLinkCommonsPanelProps> = ({ onLink
         const state = await oxyServices.identity.links.get(link.linkId);
         if (stopped) return;
         if (state.status === 'signed' && state.publicKey) {
+          const { deriveIdentityLinkCode } = await loadIdentityCrypto();
+          if (stopped) return;
           setStep({
             name: 'matching',
             link,

package/src/ui/components/signIn/OxyPasswordPanel.tsx

@@ -11,7 +11,7 @@ import { StyleSheet } from 'react-native';
 import { Field } from '@oxy.so/bloom/field';
 import { Switch } from '@oxy.so/bloom/switch';
 import { toast } from '@oxy.so/bloom/toast';
-import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH } from '@oxy.so/contracts';
+import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH } from '@oxy.so/contracts/client';
 import { useQueryClient } from '@tanstack/react-query';
 import { useOxy } from '../../context/OxyContext';
 import { useSignInMethods } from '../../hooks/queries/useAuthMethods';

package/src/ui/components/signIn/OxySignInPanel.tsx

@@ -36,6 +36,11 @@ import { useTheme } from '@oxy.so/bloom/theme';
 import { toast } from '@oxy.so/bloom/toast';
 import { Text } from '@oxy.so/bloom/typography';
 import type { SwitcherContextRow } from '@oxy.so/core/session';
+import type {
+  EmailSignInAccountOption,
+  EmailSignInStepResult,
+  LoginResult,
+} from '@oxy.so/contracts';
 import {
   EMAIL_CODE_LENGTH,
   EMAIL_SIGNIN_LONG_CODE_LENGTH,
@@ -43,10 +48,7 @@ import {
   TOTP_DIGITS,
   isEmailSignInChooseAccount,
   isSecondFactorRequired,
-  type EmailSignInAccountOption,
-  type EmailSignInStepResult,
-  type LoginResult,
-} from '@oxy.so/contracts';
+} from '@oxy.so/contracts/client';
 import { useQueryClient } from '@tanstack/react-query';
 import { useOxy } from '../../context/OxyContext';
 import { useAccountDialogSnapshot } from '../../hooks/accountDialogSnapshot';

package/src/ui/components/signIn/OxySignUpPanel.tsx

@@ -15,11 +15,8 @@ import type React from 'react';
 import { useEffect, useState } from 'react';
 import { Linking, Platform } from 'react-native';
 import { toast } from '@oxy.so/bloom/toast';
-import {
-  SIGN_IN_ERROR_CODES,
-  emailAddressSchema,
-  type EmailVerificationConfirmResponse,
-} from '@oxy.so/contracts';
+import type { EmailVerificationConfirmResponse } from '@oxy.so/contracts';
+import { SIGN_IN_ERROR_CODES, emailAddressCheck, checkContract } from '@oxy.so/contracts/client';
 import { useOxy } from '../../context/OxyContext';
 import { useAccountDialogSnapshot } from '../../hooks/accountDialogSnapshot';
 import { useI18n } from '../../hooks/useI18n';
@@ -126,13 +123,13 @@ export const OxySignUpPanel: React.FC<OxySignUpPanelProps> = ({
   };
 
   const submitEmail = () => {
-    const parsed = emailAddressSchema.safeParse(email);
-    if (!parsed.success) {
+    const address = checkContract(emailAddressCheck, email);
+    if (address === null) {
       setError(t('signup.email.invalid'));
       return;
     }
-    setEmail(parsed.data);
-    run(() => sendCode(parsed.data));
+    setEmail(address);
+    run(() => sendCode(address));
   };
 
   // The code step reports this promise's failure in place.

package/src/ui/components/signIn/ReauthStep.tsx

@@ -8,12 +8,8 @@
 
 import type React from 'react';
 import { useState } from 'react';
-import {
-  EMAIL_CODE_LENGTH,
-  TOTP_DIGITS,
-  type ReauthAction,
-  type ReauthProof,
-} from '@oxy.so/contracts';
+import type { ReauthAction, ReauthProof } from '@oxy.so/contracts';
+import { EMAIL_CODE_LENGTH, TOTP_DIGITS } from '@oxy.so/contracts/client';
 import { useOxy } from '../../context/OxyContext';
 import { useI18n } from '../../hooks/useI18n';
 import { SubtleLink } from '../authChooser/primitives';

package/src/ui/components/signIn/accountFlowParts.tsx

@@ -18,6 +18,7 @@ import { useTheme } from '@oxy.so/bloom/theme';
 import { TextField, TextFieldHint, TextFieldInput, TextFieldLabel } from '@oxy.so/bloom/text-field';
 import { Text } from '@oxy.so/bloom/typography';
 import { WizardProgress } from '@oxy.so/bloom/wizard';
+import type { EmailVerificationConfirmResponse } from '@oxy.so/contracts';
 import {
   EMAIL_CODE_LENGTH,
   EMAIL_SIGNIN_LONG_CODE_ALPHABET,
@@ -25,8 +26,7 @@ import {
   EMAIL_VERIFICATION_ERROR_CODES,
   SIGN_IN_ERROR_CODES,
   normalizeEmailSignInCode,
-  type EmailVerificationConfirmResponse,
-} from '@oxy.so/contracts';
+} from '@oxy.so/contracts/client';
 import { useOxy } from '../../context/OxyContext';
 import { useI18n } from '../../hooks/useI18n';
 import type { Translate } from '../authChooser/types';

package/src/ui/components/supervision/PersonPicker.tsx

@@ -0,0 +1,67 @@
+import { useState } from 'react';
+import { View } from 'react-native';
+import { useQuery } from '@tanstack/react-query';
+import { Button } from '@oxy.so/bloom/button';
+import { Text } from '@oxy.so/bloom/typography';
+import type { SafetyPerson } from '@oxy.so/contracts';
+import { useOxy } from '../../context/OxyContext';
+import { useI18n } from '../../hooks/useI18n';
+import { AccountFlowField, AccountFlowNote } from '../signIn/accountFlowParts';
+export function PersonPicker({
+  onSelect,
+  exclude = [],
+}: {
+  onSelect: (person: SafetyPerson) => void;
+  exclude?: string[];
+}) {
+  const { oxyServices, user } = useOxy(),
+    { t } = useI18n();
+  const [text, setText] = useState(''),
+    [query, setQuery] = useState('');
+  const results = useQuery({
+    queryKey: ['oxy', 'safety', 'people', user?.id, query],
+    queryFn: () => oxyServices.safety.people({ query }),
+    enabled: query.length >= 2,
+    staleTime: 0,
+    gcTime: 0,
+    retry: false,
+  });
+  return (
+    <View style={{ gap: 12 }}>
+      <AccountFlowNote>{t('supervision.exactHandleHint')}</AccountFlowNote>
+      <AccountFlowField
+        label={t('supervision.searchLabel')}
+        value={text}
+        onChange={setText}
+        onSubmit={() => setQuery(text.trim().replace(/^@/, ''))}
+        error={null}
+        testID="supervision-person-query"
+      />
+      <Button
+        onPress={() => setQuery(text.trim().replace(/^@/, ''))}
+        disabled={text.trim().length < 2}
+        loading={results.isFetching}
+      >
+        {t('supervision.search')}
+      </Button>
+      {results.isError ? (
+        <AccountFlowNote>{t('supervision.loadError')}</AccountFlowNote>
+      ) : (
+        results.data?.items
+          .filter((person) => !exclude.includes(person.accountId))
+          .map((person) => (
+            <Button
+              key={person.accountId}
+              appearance="plain"
+              onPress={() => onSelect(person)}
+              testID={`supervision-person-${person.accountId}`}
+            >
+              {person.displayName ?? person.username ?? t('supervision.account')}{' '}
+              {person.username ? `@${person.username}` : ''}
+            </Button>
+          ))
+      )}
+      {results.data?.items.length === 0 ? <Text>{t('supervision.noPeople')}</Text> : null}
+    </View>
+  );
+}

package/src/ui/components/supervision/presentation.ts

@@ -0,0 +1,17 @@
+/** Format integer authorization evidence without rounding it through a floating-point division. */
+export function formatApprovalAmount(minor: number, currency: string, locale: string): string {
+  const digits =
+    new Intl.NumberFormat(locale, { style: 'currency', currency }).resolvedOptions()
+      .maximumFractionDigits ?? 2;
+  const value = BigInt(minor),
+    absolute = value < 0n ? -value : value,
+    scale = 10n ** BigInt(digits);
+  const whole = new Intl.NumberFormat(locale, { maximumFractionDigits: 0 }).format(
+    absolute / scale,
+  );
+  const decimal =
+    new Intl.NumberFormat(locale).formatToParts(1.1).find((part) => part.type === 'decimal')
+      ?.value ?? '.';
+  const fraction = digits ? `${decimal}${(absolute % scale).toString().padStart(digits, '0')}` : '';
+  return `${value < 0n ? '-' : ''}${whole}${fraction} ${currency}`;
+}

package/src/ui/context/OxyContext.tsx

@@ -29,7 +29,6 @@ import type {
   AccountDialogController,
   AccountDialogView,
 } from '@oxy.so/core/session';
-import { KeyManager } from '@oxy.so/core/crypto';
 import {
   refreshDeviceSecretArm,
   establishIdentitySession,
@@ -60,6 +59,7 @@ import {
   type RequestOAuthConsentOptions,
 } from '../oauth/explicitOAuthConsent';
 import { isWebBrowser } from '../utils/isWebBrowser';
+import { loadIdentityCrypto } from '../utils/identityCrypto';
 import { resolveDeliveryPlatform } from '../utils/deliveryPlatform';
 import { runProviderColdBoot } from '../boot/runProviderColdBoot';
 import { resolveApplicationSessionLane } from '../oauth/applicationSessionLane';
@@ -696,6 +696,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         try {
           // The same keys the refresh handler's second arm signs with: the
           // identity-bound client's own key, or the cross-app shared identity.
+          const { KeyManager } = await loadIdentityCrypto();
           return identity ? await KeyManager.hasIdentity() : await KeyManager.hasSharedIdentity();
         } catch {
           return false;
@@ -1495,9 +1496,12 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   // — a locked keychain must never be misreported as "no identity". `hasIdentity`
   // still resolves `false` and `getPublicKey` still resolves `null` for a genuine
   // absence.
-  const hasIdentity = useCallback(async (): Promise<boolean> => KeyManager.hasIdentity(), []);
+  const hasIdentity = useCallback(
+    async (): Promise<boolean> => (await loadIdentityCrypto()).KeyManager.hasIdentity(),
+    [],
+  );
   const getPublicKey = useCallback(
-    async (): Promise<string | null> => KeyManager.getPublicKey(),
+    async (): Promise<string | null> => (await loadIdentityCrypto()).KeyManager.getPublicKey(),
     [],
   );
 

package/src/ui/context/hooks/useAuthOperations.ts

@@ -8,9 +8,9 @@ import type { LogoutResult } from '../oxyContextTypes';
 import { DeviceManager } from '@oxy.so/core/session';
 import { fetchSessionsWithFallback } from '../../utils/sessionHelpers';
 import { handleAuthError, isInvalidSessionError } from '../../utils/errorHandlers';
+import { loadIdentityCrypto } from '../../utils/identityCrypto';
 import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxy.so/core';
-import { SignatureService } from '@oxy.so/core/crypto';
 
 export interface UseAuthOperationsOptions {
   oxyServices: OxyServices;
@@ -126,6 +126,7 @@ export const useAuthOperations = ({
       // in local storage as 'oxy_biometric_enabled' and can be checked there.
 
       // Sign the challenge
+      const { SignatureService } = await loadIdentityCrypto();
       const { challenge: signature, timestamp } = await SignatureService.signChallenge(challenge);
 
       let fullUser: User;

package/src/ui/hooks/queries/useSupervision.ts

@@ -0,0 +1,25 @@
+import { useQuery } from '@tanstack/react-query';
+import { useOxy } from '../../context/OxyContext';
+export const supervisionQueryKeys = {
+  all: ['oxy', 'safety', 'supervision'] as const,
+  account: (id: string, sessionId: string) =>
+    ['oxy', 'safety', 'supervision', id, sessionId] as const,
+};
+/** Advisory UI state only. Every read/write still requires the live server policy. */
+export function useSupervision() {
+  const { oxyServices, user, isAuthenticated, activeSessionId } = useOxy();
+  const result = useQuery({
+    queryKey: supervisionQueryKeys.account(user?.id ?? '', activeSessionId ?? ''),
+    queryFn: () => oxyServices.safety.supervisionState(),
+    enabled: isAuthenticated && !!activeSessionId && user?.kind === 'personal',
+    staleTime: 0,
+    gcTime: 0,
+    refetchOnWindowFocus: 'always',
+    refetchOnMount: 'always',
+    retry: false,
+  });
+  return {
+    ...result,
+    data: result.isFetchedAfterMount && !result.isError ? result.data : undefined,
+  };
+}

package/src/ui/icons/subsetGlyphMaps.ts

@@ -199,6 +199,7 @@ export const materialCommunityIconsGlyphMap = {
   "code-tags": 983412,
   "cog": 984211,
   "cog-outline": 985275,
+  "contacts": 984779,
   "contain": 985662,
   "content-copy": 983439,
   "controller": 983732,
@@ -206,6 +207,7 @@ export const materialCommunityIconsGlyphMap = {
   "credit-card": 987119,
   "cube-outline": 983463,
   "database-outline": 988722,
+  "decimal": 987297,
   "delete": 983476,
   "delete-outline": 985575,
   "devices": 987056,

package/src/ui/index.ts

@@ -57,3 +57,5 @@ export {
   extractErrorMessage,
 } from './utils/errorHandlers';
 export type { HandleAuthErrorOptions } from './utils/errorHandlers';
+
+export { useSupervision, supervisionQueryKeys } from './hooks/queries/useSupervision';