@oxy.so/services 12.13.0 → 13.0.0

package/lib/typescript/commonjs/ui/hooks/queries/useSupervision.d.ts

@@ -20,29 +20,29 @@ export declare const supervisionQueryKeys: {
 export declare function useSupervision(): {
     data: {
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     } | undefined;
     error: Error;
@@ -69,58 +69,58 @@ export declare function useSupervision(): {
     isEnabled: boolean;
     refetch: (options?: import("@tanstack/react-query").RefetchOptions) => Promise<import("@tanstack/react-query").QueryObserverResult<{
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     }, Error>>;
     fetchStatus: import("@tanstack/react-query").FetchStatus;
 } | {
     data: {
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     } | undefined;
     error: null;
@@ -147,58 +147,58 @@ export declare function useSupervision(): {
     isEnabled: boolean;
     refetch: (options?: import("@tanstack/react-query").RefetchOptions) => Promise<import("@tanstack/react-query").QueryObserverResult<{
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     }, Error>>;
     fetchStatus: import("@tanstack/react-query").FetchStatus;
 } | {
     data: {
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     } | undefined;
     error: Error;
@@ -225,58 +225,58 @@ export declare function useSupervision(): {
     isEnabled: boolean;
     refetch: (options?: import("@tanstack/react-query").RefetchOptions) => Promise<import("@tanstack/react-query").QueryObserverResult<{
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     }, Error>>;
     fetchStatus: import("@tanstack/react-query").FetchStatus;
 } | {
     data: {
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     } | undefined;
     error: null;
@@ -303,58 +303,58 @@ export declare function useSupervision(): {
     isEnabled: boolean;
     refetch: (options?: import("@tanstack/react-query").RefetchOptions) => Promise<import("@tanstack/react-query").QueryObserverResult<{
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     }, Error>>;
     fetchStatus: import("@tanstack/react-query").FetchStatus;
 } | {
     data: {
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     } | undefined;
     error: null;
@@ -381,58 +381,58 @@ export declare function useSupervision(): {
     isEnabled: boolean;
     refetch: (options?: import("@tanstack/react-query").RefetchOptions) => Promise<import("@tanstack/react-query").QueryObserverResult<{
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     }, Error>>;
     fetchStatus: import("@tanstack/react-query").FetchStatus;
 } | {
     data: {
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     } | undefined;
     isError: false;
@@ -459,29 +459,29 @@ export declare function useSupervision(): {
     isEnabled: boolean;
     refetch: (options?: import("@tanstack/react-query").RefetchOptions) => Promise<import("@tanstack/react-query").QueryObserverResult<{
         self: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         } | null;
         children: {
-            status: "active" | "orphaned" | "ended";
-            createdAt: string;
-            policyVersion: "2";
             childAccountId: string;
             guardianAccountId: string | null;
+            status: "active" | "orphaned" | "ended";
+            policyVersion: "2";
             consentVersion: "1";
+            createdAt: string;
         }[];
         invitations: {
-            status: "pending" | "accepted" | "cancelled";
-            createdAt: string;
             id: string;
-            expiresAt: string;
             childAccountId: string;
             guardianAccountId: string;
+            status: "pending" | "accepted" | "cancelled";
+            expiresAt: string;
             consentVersion: "1";
+            createdAt: string;
         }[];
     }, Error>>;
     fetchStatus: import("@tanstack/react-query").FetchStatus;

package/lib/typescript/commonjs/ui/oauth/explicitOAuthConsent.d.ts

@@ -1,11 +1,9 @@
 /**
  * Explicit OAuth consent for an already-authenticated Oxy user.
  *
- * This is deliberately separate from sign-in routing. First-party applications
- * normally use the account dialog, but a consent-required scope (for example
- * `acting-as:offline`) still has to go through the OAuth authorize surface. The
- * caller must invoke this operation from a real user gesture; it never runs on
- * mount, retries silently, or grants anything locally.
+ * External applications may request additional scopes through OAuth. Own Oxy
+ * applications use the account dialog and never create OAuth consent grants.
+ * The caller invokes this operation from a user gesture.
  */
 import type { OxyServices } from "@oxy.so/core";
 import type { OAuthSessionCommitInput, WebAuthMode, WebOAuthFailureReason, WebOAuthRedirectReason } from "./types";
@@ -18,7 +16,7 @@ export interface RequestOAuthConsentOptions {
     timeoutMs?: number;
 }
 export type OAuthConsentFailureReason = WebOAuthFailureReason | "invalid-redirect-uri" | "invalid-scopes" | "scope-not-configured" | "client-resolution-failed" | "native-callback-invalid" | "state-mismatch" | "exchange-failed" | "subject-mismatch";
-export type OAuthConsentUnsupportedReason = "missing-client-id" | "identity-bound" | "not-authenticated" | "unsupported-platform";
+export type OAuthConsentUnsupportedReason = "missing-client-id" | "first-party-application" | "identity-bound" | "not-authenticated" | "unsupported-platform";
 export type OAuthConsentResult = {
     status: "consented";
 } | {

package/lib/typescript/commonjs/ui/oauth/explicitOAuthConsent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"explicitOAuthConsent.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/explicitOAuthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAMnE,OAAO,KAAK,EAEX,uBAAuB,EACvB,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,0BAA0B;IAC1C,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,yBAAyB,GAClC,qBAAqB,GACrB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,0BAA0B,GAC1B,yBAAyB,GACzB,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,CAAC;AAEtB,MAAM,MAAM,6BAA6B,GACtC,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAC3B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,sBAAsB,CAAA;CAAE,GACtD;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACA,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,yBAAyB,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAA;CAAE,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,wFAAwF;IACxF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAuDD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAqI7B"}
+{"version":3,"file":"explicitOAuthConsent.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/explicitOAuthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAMnE,OAAO,KAAK,EAEX,uBAAuB,EACvB,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,0BAA0B;IAC1C,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,yBAAyB,GAClC,qBAAqB,GACrB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,0BAA0B,GAC1B,yBAAyB,GACzB,gBAAgB,GAChB,iBAAiB,GACjB,kBAAkB,CAAC;AAEtB,MAAM,MAAM,6BAA6B,GACtC,mBAAmB,GACnB,yBAAyB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAC3B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,sBAAsB,CAAA;CAAE,GACtD;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IACA,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,yBAAyB,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAA;CAAE,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,wFAAwF;IACxF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAuDD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,kBAAkB,CAAC,CA2I7B"}

package/lib/typescript/commonjs/ui/session/cachedBoot.d.ts

@@ -0,0 +1,48 @@
+/**
+ * What a returning session needs for its first paint, kept on this device.
+ *
+ * A cold boot used to wait on two round trips before it showed anything: the
+ * registry's classification of this app and the profile of the signed-in
+ * account. With a session saved on the device, the app now paints at once from
+ * what the last run left here, and the boot verifies both in the background
+ * (`runProviderColdBoot`). This module is that cache:
+ *
+ * - the registry's last verdict on this app (`device` or `oauth`), tied to the
+ *   `clientId` it was given for;
+ * - the last account profile the runtime held, tied to that account's id.
+ *
+ * Both live in the provider's ordinary storage (AsyncStorage on native,
+ * `localStorage` on web), next to the per-account query cache, which already
+ * holds the same profile under the SDK's `users` queries. Neither is a
+ * credential: the device secret and the access token stay in the auth store.
+ *
+ * A cached session is offered only when it matches the auth store: the profile
+ * must belong to the account the persisted session is for, so a switch or a
+ * sign-out on a previous run can never paint somebody else.
+ */
+import type { User } from '@oxy.so/core';
+import { type AuthStateStore } from '@oxy.so/core/session';
+import type { StorageInterface } from '../utils/storageHelpers';
+export type SessionLane = 'device' | 'oauth';
+/** A persisted session the app can show before the network answers. */
+export interface CachedSession {
+    sessionId: string;
+    userId: string;
+    deviceId: string;
+    /** The account profile the last run held for {@link userId}. */
+    user: User;
+    /** The persisted access token, when it is still valid past the refresh lead. */
+    warmToken: string | null;
+}
+export interface CachedBootStore {
+    saveLane(clientId: string, lane: SessionLane): Promise<void>;
+    saveAccount(user: User): Promise<void>;
+    clearAccount(): Promise<void>;
+    /**
+     * The cached session for this `clientId`, or `null` when anything a first
+     * paint needs is missing or does not match the auth store.
+     */
+    readSession(clientId: string, authStore: AuthStateStore): Promise<CachedSession | null>;
+}
+export declare function createCachedBootStore(storage: StorageInterface, prefix: string, now?: () => number): CachedBootStore;
+//# sourceMappingURL=cachedBoot.d.ts.map

package/lib/typescript/commonjs/ui/session/cachedBoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cachedBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/cachedBoot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE7C,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,IAAI,EAAE,IAAI,CAAC;IACX,gFAAgF;IAChF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CACzF;AAuBD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,MAAiB,GAC3B,eAAe,CA+DjB"}

package/lib/typescript/module/ui/boot/runProviderColdBoot.d.ts

@@ -45,10 +45,34 @@ export interface RunProviderColdBootOptions {
     }) => Promise<void>;
     markAuthResolved: () => void;
     setTokenReady: (ready: boolean) => void;
+    /**
+     * Show the session saved on this device before any network: the account from
+     * its cached profile, auth resolved. Resolves `true` when it did, `false` when
+     * the device holds nothing a first paint can use (then the boot runs as a
+     * first boot). Never consulted in `sessionMode: 'identity'` or with an OAuth
+     * return on the URL.
+     */
+    paintCachedSession?: () => Promise<boolean>;
+    /**
+     * The server ended the painted session: the registry now classifies the app
+     * as OAuth-only, or the mint answered this holder `invalid_device_secret` /
+     * `no_active_session` and no recovery lane restored one. Sign out now.
+     */
+    onCachedSessionRejected?: () => Promise<void>;
+    /**
+     * The painted session could not be checked yet (offline, the registry or the
+     * mint unreachable). It stays on screen; call `retry` later to ask again.
+     */
+    onCachedSessionUnconfirmed?: (retry: () => Promise<void>) => void;
 }
 /**
  * Device-first cold boot for `@oxy.so/services` providers.
  *
+ * A returning session saved on this device (account mode, the app last
+ * classified `device`, its profile cached) paints first, with no network, and
+ * is then checked in the background — see `paintCachedSession`. Otherwise, a
+ * first boot:
+ *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
  * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,

package/lib/typescript/module/ui/boot/runProviderColdBoot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA4B,CAAC;AAwB9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IACvD,0EAA0E;IAC1E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAwKzF"}
+{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA4B,CAAC;AAwB9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC;IACvD,0EAA0E;IAC1E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAC5C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,0BAA0B,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CACnE;AA8LD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0FzF"}

package/lib/typescript/module/ui/components/OxyConsentScreen.d.ts

@@ -39,6 +39,8 @@ export interface OxyConsentResource {
     writeActions: McpOAuthWriteAction[];
 }
 export interface OxyConsentScreenProps {
+    /** Presentation only: own sign-in has no permission grant. External MCP stays consent. */
+    mode?: 'consent' | 'sign-in';
     /** The resolved requesting application. */
     application: OxyConsentApplication;
     /** OAuth scopes requested by the client (mapped to friendly labels). */
@@ -65,6 +67,6 @@ export interface OxyConsentScreenProps {
     /** A blocking error message for the request, when present. */
     error?: string | null;
 }
-export declare function OxyConsentScreen({ application, scopes, user, resource, onAllow, onDeny, busy, allowDisabled, error, }: OxyConsentScreenProps): import("react").JSX.Element;
+export declare function OxyConsentScreen({ application, mode, scopes, user, resource, onAllow, onDeny, busy, allowDisabled, error, }: OxyConsentScreenProps): import("react").JSX.Element;
 export default OxyConsentScreen;
 //# sourceMappingURL=OxyConsentScreen.d.ts.map

package/lib/typescript/module/ui/components/OxyConsentScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyConsentScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyConsentScreen.tsx"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQ7D,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,YAAY,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAmHD,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,MAAM,EACN,IAAY,EACZ,aAAqB,EACrB,KAAY,GACb,EAAE,qBAAqB,+BAmRvB;AAgKD,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"OxyConsentScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyConsentScreen.tsx"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQ7D,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,YAAY,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,2CAA2C;IAC3C,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAmHD,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,IAAgB,EAChB,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,MAAM,EACN,IAAY,EACZ,aAAqB,EACrB,KAAY,GACb,EAAE,qBAAqB,+BAyRvB;AAgKD,eAAe,gBAAgB,CAAC"}

package/lib/typescript/module/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmG/B,OAAO,KAAK,EAAmB,uBAAuB,EAAe,MAAM,sBAAmB,CAAC;AAQ/F,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,sBAAmB,CAAC;AAOhG,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,cAAc,EACd,uBAAuB,GACxB,MAAM,wBAAqB,CAAC;AAI7B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAykDhE,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoG/B,OAAO,KAAK,EAAmB,uBAAuB,EAAe,MAAM,sBAAmB,CAAC;AAQ/F,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,sBAAmB,CAAC;AAOhG,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,cAAc,EACd,uBAAuB,GACxB,MAAM,wBAAqB,CAAC;AAI7B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAutDhE,CAAC"}

package/lib/typescript/module/ui/context/oxyContextTypes.d.ts

@@ -108,7 +108,8 @@ export interface OxyContextState {
     startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
     /**
      * Ask the already-authenticated user for explicit OAuth consent to exact
-     * application scopes. Must be called from a user gesture. Works on web and
+     * external application scopes. Own Oxy apps do not use this operation.
+     * Must be called from a user gesture. Works on web and
      * native and commits only a callback bound to the same user, state, PKCE pair
      * and byte-exact redirect URI.
      */