@oxy.so/services 4.0.7 → 6.0.0

package/lib/typescript/commonjs/ui/components/signIn/OxyAccountPicker.d.ts

@@ -0,0 +1,34 @@
+/**
+ * "Choose an account" — every `principal acting as account` pair on this
+ * device, then "Use another account".
+ *
+ * The front screen of sign-in on a returning device, in the account dialog and
+ * on every auth.oxy.so page that asks WHO (sign-in, OAuth authorize, device
+ * approval, MCP linking). Presentational: the host decides what choosing a row
+ * means — a switch, a "Continue as" sign-in, or activating the pair before an
+ * OAuth consent — and passes the pair back, never an account id, which cannot
+ * say whose route was chosen.
+ */
+import type React from 'react';
+import { type SwitcherContextRow, type SwitcherPrincipalRow } from '@oxy.so/core';
+export interface OxyAccountPickerProps {
+    /** The device's people, each with the accounts they may act as (`useDeviceSwitcher`). */
+    principals: SwitcherPrincipalRow[];
+    /** The app being continued to, when there is one. */
+    appName?: string | null;
+    onSelectContext: (context: SwitcherContextRow) => void;
+    /** "Use another account" — the host reveals its sign-in. */
+    onUseAnother: () => void;
+    /** The pair being activated, whose row shows it is busy. */
+    pendingContextId?: string | null;
+    /** Disables every row while a choice is in flight. */
+    isLoading?: boolean;
+    /**
+     * This origin holds no session. A row then reads "Continue as @handle" and
+     * never as the current account: the device can list an identity as active
+     * while nobody is signed in HERE.
+     */
+    signedOut?: boolean;
+}
+export declare const OxyAccountPicker: React.FC<OxyAccountPickerProps>;
+//# sourceMappingURL=OxyAccountPicker.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/OxyAccountPicker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OxyAccountPicker.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyAccountPicker.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,OAAO,EAAyB,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAMzG,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACvD,4DAA4D;IAC5D,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAsE5D,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/OxyAuthScreen.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The shell every Oxy sign-in screen shares — the in-app account dialog and
+ * every page of the auth.oxy.so IdP render these, so the two cannot drift:
+ *
+ *   header   the Oxy mark (56), then the title (48/800, tight) and a 18px
+ *            description, 8 apart
+ *   screen   blocks 24 apart, at most 448 wide
+ *   split    from `md`, Bloom `AuthCard`'s split base — max 880, radius 24,
+ *            1px border, two equal columns, the right one on the secondary
+ *            surface; below `md` the right column is dropped, not stacked
+ *   loading  an indeterminate spinner holding the screen's height
+ *   terms    one centred caption linking the Terms of Service and Privacy Policy
+ *
+ * Layout is NativeWind `className` (breakpoints included). Type stays on
+ * Bloom `Text`'s own ramp through `style` — a `className` there drops its
+ * default family — and colours come from the Bloom theme.
+ */
+import type React from 'react';
+export interface OxyAuthScreenHeaderProps {
+    title: string;
+    description?: React.ReactNode;
+}
+/** The Oxy mark over the screen's title and description. */
+export declare const OxyAuthScreenHeader: React.FC<OxyAuthScreenHeaderProps>;
+/** A sign-in screen's column: its blocks 24 apart. `className` extends it (the split's form column). */
+export declare const OxyAuthScreen: React.FC<{
+    children: React.ReactNode;
+    className?: string;
+}>;
+/** The split card: `children` on the left and, from `md`, `aside` on the right. */
+export declare const OxyAuthSplit: React.FC<{
+    children: React.ReactNode;
+    aside: React.ReactNode;
+}>;
+/**
+ * The screen while there is nothing to show yet. React Native's own indicator:
+ * `@oxy.so/bloom/loading` can tree-shake to `undefined` in a rolldown-vite
+ * production bundle when co-imported with `@oxy.so/bloom/button`.
+ */
+export declare const OxyAuthLoading: React.FC;
+/** "By continuing, you agree to our Terms of Service and Privacy Policy." */
+export declare const OxyAuthTerms: React.FC;
+//# sourceMappingURL=OxyAuthScreen.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/OxyAuthScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC/B;AAED,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAqBlE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAErF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,CAmBxF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAOlC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAiBhC,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/OxySignInPanel.d.ts

@@ -0,0 +1,43 @@
+/**
+ * THE Oxy sign-in screen. The account dialog every Oxy app opens and the
+ * auth.oxy.so page render this one component; only where it is mounted
+ * differs (`host`).
+ *
+ *   picker   a returning device: "Choose an account", then "Use another account"
+ *   entry    the header, the Commons way in, and the way in for someone with no
+ *            account. On auth.oxy.so (`page`) also the username with its
+ *            Continue — a username-first passkey sign-in, which takes a
+ *            platform passkey AND a hardware security key with no resident
+ *            credential (a U2F key such as a Titan) — and "or continue with" the
+ *            discoverable passkey. From `md` that page is Bloom `AuthCard`'s
+ *            split card, with the embedded QR over its photo carousel in the
+ *            right column; below `md` it is "Continue with Oxy" at the top.
+ *            In an app's dialog on the web, "Continue with Oxy" opens that page
+ *            in a window over the app, like "Sign in with Google": the browser's
+ *            session lives on auth.oxy.so, so every Oxy app shares it. On
+ *            native it is "Continue with Oxy" ("Get Commons" without Commons).
+ *
+ * `signInMethods.ts` owns which blocks a platform gets.
+ */
+import type React from 'react';
+export interface OxySignInPanelProps {
+    /** This screen signed the origin in. */
+    onSignedIn: () => void;
+    /** "New to Oxy? Create one". */
+    onCreateAccount: () => void;
+    /** "Lost your passkey? Recover your account" — auth.oxy.so's page only. */
+    onRecover?: () => void;
+    /** A handle to pre-fill, skipping the picker (a re-authentication). */
+    loginHint?: string;
+    /** The app being continued to, when there is one. */
+    appName?: string | null;
+    /**
+     * `dialog` — inside the account dialog, which the controller closes itself
+     * once a request it runs signs in, and where a request shows in place.
+     * `page`   — a page of its own (auth.oxy.so): a request opens the dialog to
+     * show it, and its completion is reported through `onSignedIn` too.
+     */
+    host?: 'dialog' | 'page';
+}
+export declare const OxySignInPanel: React.FC<OxySignInPanelProps>;
+//# sourceMappingURL=OxySignInPanel.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/OxySignInPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OxySignInPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxySignInPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA6B/B,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,gCAAgC;IAChC,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAySxD,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/OxySignUpPanel.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Account creation in the account dialog.
+ *
+ * On the web the account is made on auth.oxy.so, in its window over the app
+ * (`onCreateOnWeb`), and this app is signed in as it. On native, Commons
+ * creates the identity: straight in when it is installed, "Get Commons"
+ * otherwise.
+ */
+import type React from 'react';
+export interface OxySignUpPanelProps {
+    /** "Already have an account? Sign in". */
+    onSignIn: () => void;
+    /** The web's one action: auth.oxy.so's sign-up, in its window. */
+    onCreateOnWeb: () => void;
+}
+export declare const OxySignUpPanel: React.FC<OxySignUpPanelProps>;
+//# sourceMappingURL=OxySignUpPanel.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/OxySignUpPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OxySignUpPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxySignUpPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAkB/B,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,kEAAkE;IAClE,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAmDxD,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/artwork.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The photos the sign-in split card's carousel turns through. Shipped with the
+ * SDK and imported like its icon fonts, so every host serves them from its own
+ * origin — nothing to allow in anyone's CSP.
+ */
+import type { AuthMediaSlide } from '@oxy.so/bloom/auth-card';
+export declare const SIGN_IN_SLIDES: AuthMediaSlide[];
+//# sourceMappingURL=artwork.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/artwork.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artwork.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/artwork.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAM9D,eAAO,MAAM,cAAc,EAAE,cAAc,EAAmE,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/passkeyError.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The message for a failed passkey sign-in, and whether it was rate-limited.
+ *
+ * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
+ * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
+ * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
+ * looked for along the cause chain, and reported calmly instead of as the raw
+ * "The operation either timed out or was not allowed…".
+ */
+import type { Translate } from '../authChooser/types';
+/** How long the surface waits after a 429 before it lets the person retry. */
+export declare const RATE_LIMIT_SECONDS = 60;
+export declare function isRateLimited(error: unknown): boolean;
+/** The inline message for a passkey ceremony that did not sign anyone in. */
+export declare function describePasskeyError(error: unknown, t: Translate): string;
+//# sourceMappingURL=passkeyError.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/passkeyError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyError.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/passkeyError.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAqBrC,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAIzE"}

package/lib/typescript/commonjs/ui/components/signIn/signInMethods.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Which sign-in methods a surface offers, from where it runs.
+ *
+ * One screen everywhere; only the transport behind each block changes:
+ *
+ *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
+ *    (the split card's right column from `md`, "Continue with Oxy" below it),
+ *    the username with its Continue, and the passkey — asserted right here,
+ *    on the one origin every Oxy passkey belongs to;
+ *  - an app's account dialog on the web (`dialog`) opens that screen in a
+ *    window over the app ("Continue with Oxy"), like "Sign in with Google":
+ *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
+ *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
+ *    device that has no Commons to continue with.
+ */
+import type { CommonsAvailability } from '@oxy.so/core';
+/**
+ * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
+ * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
+ *                 keychain, Commons on this device, a push, or the QR view).
+ * `get-commons` — native, and Commons is not installed here.
+ */
+export type CommonsEntry = 'qr' | 'window' | 'continue' | 'get-commons';
+export interface SignInMethods {
+    commons: CommonsEntry;
+    /** The username and passkey block: only on auth.oxy.so. */
+    passkey: boolean;
+}
+export interface SignInSurfaceFacts {
+    /** Rendering in a browser (react-native-web), not a native app. */
+    web: boolean;
+    /** `page` is auth.oxy.so; `dialog` is an app's account dialog. */
+    host: 'dialog' | 'page';
+    /** The controller's native probe for an installed Commons. */
+    commonsAvailability: CommonsAvailability;
+}
+export declare function resolveSignInMethods(facts: SignInSurfaceFacts): SignInMethods;
+//# sourceMappingURL=signInMethods.d.ts.map

package/lib/typescript/commonjs/ui/components/signIn/signInMethods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInMethods.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/signInMethods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,GAAG,EAAE,OAAO,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAQ7E"}

package/lib/typescript/commonjs/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAuF/B,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EAExB,MAAM,mBAAmB,CAAC;AAgB3B,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIhG,KAAK,0BAA0B,GAAG,IAAI,CACpC,eAAe,EACb,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CACtB,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAyvChE,CAAC;AAMF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,0BAA0B;;CAMxC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,eAAe,GAAG,IAAqC,CAAC;AAE1F,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,QAAO,0BAMpC,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAsF/B,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EAExB,MAAM,mBAAmB,CAAC;AAgB3B,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIhG,KAAK,0BAA0B,GAAG,IAAI,CACpC,eAAe,EACb,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CACtB,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA6vChE,CAAC;AAMF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,0BAA0B;;CAMxC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,eAAe,GAAG,IAAqC,CAAC;AAE1F,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,QAAO,0BAMpC,CAAC"}

package/lib/typescript/commonjs/ui/context/commitSessionFlow.d.ts

@@ -1,5 +1,4 @@
 import type { User } from '@oxy.so/core';
-import type { WebAuthMode } from '../oauth/types';
 export interface CommitDeviceSetAndResolveDeps {
     /**
      * Whether this commit is a deliberate sign-in on THIS device (activates the
@@ -39,43 +38,4 @@ export interface CommitDeviceSetAndResolveDeps {
  * a DETACHED background task a moment later.
  */
 export declare function commitDeviceSetAndResolve(deps: CommitDeviceSetAndResolveDeps): Promise<void>;
-export interface MaybeSyncHubAfterCommitDeps {
-    /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
-    activate: boolean;
-    /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
-    hubSyncRequested: boolean;
-    /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
-    hubSyncEnabled: boolean;
-    /**
-     * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
-     * A first-class input: `'popup'` forbids the redirect outright.
-     */
-    webAuthMode: WebAuthMode;
-    /**
-     * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
-     * navigation was actually started.
-     */
-    syncHub: () => Promise<boolean>;
-}
-/**
- * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
- * official origins can silently restore a session on their next cold boot.
- *
- * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
- * on this legacy lane lives — and is tested — in one place. Returns whether the
- * full-page redirect was started; a failure is non-fatal and never propagates
- * (the sign-in itself already succeeded).
- *
- * Four gates, all of which must pass:
- * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
- * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
- * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
- * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
- *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
- *    bounces the tab defeats the entire point of the mode, no matter which
- *    commit path produced the session (issue #691, "Cold boot and cross-domain
- *    behavior"). Redirect mode — the default and the compatibility path — is
- *    unchanged, and this whole function disappears with it in phase 7b.
- */
-export declare function maybeSyncHubAfterCommit(deps: MaybeSyncHubAfterCommitDeps): Promise<boolean>;
 //# sourceMappingURL=commitSessionFlow.d.ts.map

package/lib/typescript/commonjs/ui/context/commitSessionFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commitSessionFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/commitSessionFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,sCAAsC;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,yEAAyE;IACzE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,gBAAgB,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CAoFf;AAED,MAAM,WAAW,2BAA2B;IAC1C,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,OAAO,CAAC,CAelB"}
+{"version":3,"file":"commitSessionFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/commitSessionFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAMzC,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,sCAAsC;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,yEAAyE;IACzE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,gBAAgB,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CAoFf"}

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode } from '@oxy.so/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode, OxyAuthScreen } from '@oxy.so/core';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -118,6 +118,13 @@ export interface OxyContextState {
      * resolve to `{ status: 'unsupported' }`.
      */
     startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
+    /**
+     * Sign in (`signin`), create an account (`signup`) or recover one
+     * (`recover`) in auth.oxy.so's window over the app, where the browser's
+     * shared Oxy session lives. Web only; call it from the press, so the window
+     * opens with the gesture.
+     */
+    continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
     /**
      * Ask the already-authenticated user for explicit OAuth consent to exact
      * application scopes. Must be called from a user gesture. Works on web and
@@ -210,14 +217,6 @@ export interface OxyRuntimeProviderProps {
      * @default false
      */
     backgroundSession?: boolean;
-    /**
-     * Whether this origin/app persists the durable device credential at all. See
-     * `OxyProviderProps.deviceCredentialStorage` for the full rule and the one
-     * caller of `'ephemeral'`.
-     *
-     * @default 'persistent'
-     */
-    deviceCredentialStorage?: 'persistent' | 'ephemeral';
     onAuthStateChange?: (user: User | null) => void;
     onError?: (error: ApiError) => void;
     /** Storage instance owned by the public provider; internal composition seam. */

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oxyContextTypes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/oxyContextTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9M,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,wFAAwF;IACxF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uHAAuH;IACvH,eAAe,EAAE,MAAM,CAAC;IACxB,4GAA4G;IAC5G,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAElC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;;OAIG;IACH,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE5F;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE1F,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,qFAAqF;IACrF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,6FAA6F;IAC7F,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAE7B,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAE/B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;IACrD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,gFAAgF;IAChF,eAAe,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,CAAC;CAC9D"}
+{"version":3,"file":"oxyContextTypes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/oxyContextTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7N,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3F,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,wFAAwF;IACxF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uHAAuH;IACvH,eAAe,EAAE,MAAM,CAAC;IACxB,4GAA4G;IAC5G,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAElC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;;OAIG;IACH,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE5F;;;;;OAKG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEzE;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE1F,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,qFAAqF;IACrF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5D,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,6FAA6F;IAC7F,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAE7B,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAE/B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,gFAAgF;IAChF,eAAe,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,mBAAmB,EAAE,kBAAkB,CAAC;CAC9D"}

package/lib/typescript/commonjs/ui/hooks/accountDialogSnapshot.d.ts

@@ -1,4 +1,4 @@
-import type { AccountDialogSnapshot } from '@oxy.so/core';
+import type { AccountDialogController, AccountDialogSnapshot } from '@oxy.so/core';
 /**
  * The snapshot `useSyncExternalStore` reads before a controller exists.
  *
@@ -12,4 +12,10 @@ import type { AccountDialogSnapshot } from '@oxy.so/core';
  * compiler point at one place.
  */
 export declare const EMPTY_ACCOUNT_DIALOG_SNAPSHOT: AccountDialogSnapshot;
+/**
+ * Bind a surface to `controller`'s snapshot (the inert one while there is no
+ * controller). `getSnapshot` returns a stable reference between changes, so
+ * it is `useSyncExternalStore`-safe.
+ */
+export declare function useAccountDialogSnapshot(controller: AccountDialogController | null): AccountDialogSnapshot;
 //# sourceMappingURL=accountDialogSnapshot.d.ts.map

package/lib/typescript/commonjs/ui/hooks/accountDialogSnapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountDialogSnapshot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/accountDialogSnapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBA0B3C,CAAC"}
+{"version":3,"file":"accountDialogSnapshot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/accountDialogSnapshot.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBA2B3C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,uBAAuB,GAAG,IAAI,GAAG,qBAAqB,CAU1G"}

package/lib/typescript/commonjs/ui/hooks/useDeviceSwitcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useDeviceSwitcher.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useDeviceSwitcher.ts"],"names":[],"mappings":"AACA,OAAO,EAGH,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC5B,MAAM,cAAc,CAAC;AAKtB,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,gEAAgE;IAChE,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,6DAA6D;IAC7D,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qEAAqE;IACrE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,+EAA+E;IAC/E,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,uEAAuE;IACvE,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,IAAI,uBAAuB,CAmD3D"}
+{"version":3,"file":"useDeviceSwitcher.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useDeviceSwitcher.ts"],"names":[],"mappings":"AACA,OAAO,EAGH,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC5B,MAAM,cAAc,CAAC;AAKtB,MAAM,WAAW,uBAAuB;IACpC;;;;;;;OAOG;IACH,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,gEAAgE;IAChE,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,6DAA6D;IAC7D,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,qEAAqE;IACrE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,+EAA+E;IAC/E,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,uEAAuE;IACvE,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,IAAI,uBAAuB,CA2C3D"}

package/lib/typescript/commonjs/ui/oauth/browserAuthTransport.d.ts

@@ -13,6 +13,7 @@
  * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
  * remains the native lane and is untouched by this module.
  */
+import { type OxyAuthScreen } from '@oxy.so/core';
 import type { OxyServices } from '@oxy.so/core';
 import type { OAuthPopupHandle, OAuthSessionCommitInput, WebAuthMode, WebOAuthSignInResult } from './types';
 /** Provider-owned wiring for a web sign-in — everything that is not per-press. */
@@ -49,6 +50,14 @@ export interface StartWebOAuthSignInOptions {
     popup?: OAuthPopupHandle | null;
     /** Requested scope; defaults to the SDK's standard sign-in scope. */
     scope?: string;
+    /**
+     * The transport for this press, whatever the provider's `webAuthMode`. An
+     * Oxy app's own account dialog asks for `popup`: auth.oxy.so's window over
+     * the app, where the browser's shared session lives.
+     */
+    transport?: WebAuthMode;
+    /** The IdP screen a person with no session there lands on. */
+    screen?: OxyAuthScreen;
     /** Popup timeout override (ms). */
     timeoutMs?: number;
 }

package/lib/typescript/commonjs/ui/oauth/browserAuthTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browserAuthTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/browserAuthTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMhD,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EAEX,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAEjB,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wDAAwD;AACxD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAsF/B"}
+{"version":3,"file":"browserAuthTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/browserAuthTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMhD,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EAEX,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAEjB,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wDAAwD;AACxD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAuF/B"}

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts

@@ -8,6 +8,7 @@
  * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
  * identical, which is what lets both lanes converge on one completion path.
  */
+import { type OxyAuthScreen } from '@oxy.so/core';
 import type { OAuthHandshake } from './types';
 /** Inputs for {@link prepareAuthorizeRequest}. */
 export interface PrepareAuthorizeRequestParams {
@@ -25,6 +26,8 @@ export interface PrepareAuthorizeRequestParams {
      * not a guarantee — an IdP with no opener still redirects.
      */
     responseMode?: 'web_message';
+    /** The IdP screen a person with no session there lands on. */
+    screen?: OxyAuthScreen;
 }
 /** A ready-to-use authorize request plus the secrets that finish it. */
 export interface PreparedAuthorizeRequest {

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthHandshake.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthHandshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAkBnC"}
+{"version":3,"file":"oauthHandshake.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthHandshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAgE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAChH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAmBnC"}

package/lib/typescript/commonjs/ui/oauth/oauthPopup.d.ts

@@ -11,10 +11,9 @@
  *   is still being handled. Anything awaited first (resolving the application,
  *   generating PKCE) loses it and the popup is silently blocked. So the window
  *   is opened EMPTY up front and navigated once the authorize URL exists —
- *   the same shape as `passkeyHubPopup.ts`.
+ *   a plain function a test can substitute.
  * - **No close event.** A cross-origin popup fires nothing when the user
- *   dismisses it; polling `closed` is the only mechanism (as in core's
- *   `AccountDialogController.watchPopup`).
+ *   dismisses it; polling `closed` is the only mechanism.
  * - **No cross-origin reads.** The popup's URL, title, and document are all
  *   opaque. The authorization result arrives ONLY as a `postMessage`.
  */

package/lib/typescript/commonjs/ui/oauth/oauthPopup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthPopup.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAKvD;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAkCtD;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,gBAAgB,GAAG,IAAI,CASxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAOpE;AA2CD,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,EAAE,gBAAgB,CAAC;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B"}
+{"version":3,"file":"oauthPopup.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAKvD;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAkCtD;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,gBAAgB,GAAG,IAAI,CASxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAOpE;AA2CD,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,EAAE,gBAAgB,CAAC;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B"}

package/lib/typescript/commonjs/ui/screens/ManageAccountScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ManageAccountScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/ManageAccountScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAwB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAgD3D;;;;;;;GAOG;AACH,QAAA,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAw2BlD,CAAC;AAYF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ManageAccountScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/ManageAccountScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAwB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAgD3D;;;;;;;GAOG;AACH,QAAA,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAu2BlD,CAAC;AAYF,eAAe,mBAAmB,CAAC"}

package/lib/typescript/commonjs/ui/session/authStore.d.ts

@@ -7,7 +7,6 @@
  * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
  * `createMemoryAuthStateStore`); this module only selects the seam:
  *
- *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
  *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
  *    the shared `createNativeSecureKeyValueStorage()` adapter
@@ -35,20 +34,6 @@ export interface PlatformAuthStateStoreOptions {
      * a decision a storage seam gets to make.
      */
     sessionMode?: SessionMode;
-    /**
-     * Whether this origin/app may persist a durable device credential AT ALL.
-     *
-     * `'ephemeral'` stores nothing durable and mirrors nothing: the session lives
-     * in memory for the lifetime of the page and is gone on reload. Its one caller
-     * is `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
-     * where the durable credential for the browser profile is the server-side
-     * DeviceSession behind the `__Host-oxy-device` handle.
-     *
-     * See `OxyProviderProps.deviceCredentialStorage` for why the answer to "let the
-     * hub be authoritative" is to stop persisting the other credential rather than
-     * to consult it second.
-     */
-    storage?: 'persistent' | 'ephemeral';
 }
 /**
  * Build the platform {@link AuthStateStore} for this runtime.
@@ -56,21 +41,6 @@ export interface PlatformAuthStateStoreOptions {
  * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
  * token) per-app in SecureStore; the SDK re-mints the access token from the
  * device credential on the next cold boot.
- *
- * ## The ephemeral check is FIRST, and the order is load-bearing
- *
- * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
- * never reach the native path — and therefore can never reach the shared-slot
- * mirroring wrapper. Checked after that branch instead, an origin that has
- * declined to persist a credential would publish one into the device-wide slot
- * every sibling app adopts on cold boot: it would keep nothing itself while
- * deciding which session five other apps boot into.
- *
- * That is unreachable today because the only ephemeral caller is a web origin, so
- * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
- * of guarantee that stops holding when someone adds the second caller, so it is
- * structural here rather than incidental, and
- * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
  */
 export declare function createPlatformAuthStateStore(options?: PlatformAuthStateStoreOptions): AuthStateStore;
 //# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/commonjs/ui/session/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAKtB,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,cAAc,CAiBhB"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAKtB,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,cAAc,CAWhB"}

package/lib/typescript/commonjs/ui/types/navigation.d.ts

@@ -126,32 +126,6 @@ export interface OxyProviderProps {
      * @default false
      */
     backgroundSession?: boolean;
-    /**
-     * Whether this origin/app may persist the durable device credential
-     * (`deviceId` + `deviceSecret`) at all.
-     *
-     * `'persistent'` (the default, and every app's behaviour) stores it — web
-     * localStorage per origin, SecureStore per app on native — so the SDK can
-     * re-mint an access token on the next cold boot.
-     *
-     * `'ephemeral'` stores NOTHING durable: the session lives in memory for the
-     * lifetime of the page and is gone on reload. It exists for ONE caller,
-     * `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
-     * where the durable credential for the browser profile is the server-side
-     * DeviceSession behind the `__Host-oxy-device` handle. Two durable
-     * credentials for one origin is the dual authority that phase exists to
-     * remove — revoking the hub while a localStorage secret still mints would
-     * make a sign-out look like it worked — so the way to let the hub be
-     * authoritative is to stop persisting the other one, not to consult it
-     * second.
-     *
-     * Do NOT reach for this to make an app "more private". A relying-party
-     * origin set to `'ephemeral'` simply signs the user out on every reload,
-     * because nothing else on that origin remembers the device.
-     *
-     * @default 'persistent'
-     */
-    deviceCredentialStorage?: 'persistent' | 'ephemeral';
     /**
      * Wires the app's OWN i18n library to Oxy's resolved language, so the
      * account (or, signed out, the device/guest locale) drives the app's

package/lib/typescript/commonjs/ui/types/navigation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGrC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,uBAAuB,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD"}
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGrC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD"}

package/lib/typescript/module/index.d.ts

@@ -93,8 +93,14 @@ export { LogoText } from './ui/components/logo/LogoText.js';
 export { default as ProfileButton } from './ui/components/ProfileButton.js';
 export type { ProfileButtonProps } from './ui/components/ProfileButton.js';
 export type { AccountDialogMenuItem } from './ui/navigation/accountDialogManager.js';
-export { default as OxyAuthChooser } from './ui/components/OxyAuthChooser.js';
-export type { OxyAuthChooserProps } from './ui/components/OxyAuthChooser.js';
+export { OxySignInPanel } from './ui/components/signIn/OxySignInPanel.js';
+export type { OxySignInPanelProps } from './ui/components/signIn/OxySignInPanel.js';
+export { OxySignUpPanel } from './ui/components/signIn/OxySignUpPanel.js';
+export type { OxySignUpPanelProps } from './ui/components/signIn/OxySignUpPanel.js';
+export { OxyAccountPicker } from './ui/components/signIn/OxyAccountPicker.js';
+export type { OxyAccountPickerProps } from './ui/components/signIn/OxyAccountPicker.js';
+export { OxyAuthScreen, OxyAuthScreenHeader, OxyAuthLoading, OxyAuthTerms, } from './ui/components/signIn/OxyAuthScreen.js';
+export type { OxyAuthScreenHeaderProps } from './ui/components/signIn/OxyAuthScreen.js';
 export { OxySignInRequestSurface } from './ui/components/OxySignInRequestSurface.js';
 export type { OxySignInRequestSurfaceProps } from './ui/components/OxySignInRequestSurface.js';
 export type { OxySignInSurfaceAction } from './ui/components/authChooser/types.js';