@oxy.so/services 4.0.7 → 6.1.0

package/lib/module/ui/components/signIn/accountFlowParts.js

@@ -0,0 +1,235 @@
+"use strict";
+
+/**
+ * The pieces auth.oxy.so's account pages share (ADR 0029 D3): creating a
+ * passkey account, recovering one, deleting one. Each is a page of the IdP
+ * built from the same sign-in shell as `OxySignInPanel`, so they read as one
+ * product; the passkey belongs to auth.oxy.so, so none of them runs anywhere
+ * else.
+ */
+
+import { useState } from 'react';
+import { StyleSheet, View } from 'react-native';
+import { Button } from '@oxy.so/bloom/button';
+import { useTheme } from '@oxy.so/bloom/theme';
+import { TextField, TextFieldHint, TextFieldInput, TextFieldLabel } from '@oxy.so/bloom/text-field';
+import { Text } from '@oxy.so/bloom/typography';
+import { EMAIL_CODE_LENGTH, EMAIL_VERIFICATION_ERROR_CODES } from '@oxy.so/contracts';
+import { useOxy } from "../../context/OxyContext.js";
+import { useI18n } from "../../hooks/useI18n.js";
+import { SubtleLink } from "../authChooser/primitives.js";
+import { OxyAuthScreen, OxyAuthScreenHeader } from "./OxyAuthScreen.js";
+import { describePasskeyError, isRateLimited } from "./passkeyError.js";
+
+/** The API error code a thrown SDK error carries (`error.code`), if any. */
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+function errorCode(error) {
+  const code = error?.code;
+  return typeof code === 'string' ? code : undefined;
+}
+
+/** A failure of an account page, in the person's language. */
+export function describeAccountFlowError(error, t) {
+  switch (errorCode(error)) {
+    case EMAIL_VERIFICATION_ERROR_CODES.codeInvalid:
+      return t('emailCode.errors.codeInvalid');
+    case EMAIL_VERIFICATION_ERROR_CODES.tooManyAttempts:
+      return t('emailCode.errors.tooManyAttempts');
+    case EMAIL_VERIFICATION_ERROR_CODES.ticketInvalid:
+    case EMAIL_VERIFICATION_ERROR_CODES.ticketRequired:
+      return t('emailCode.errors.expired');
+    case EMAIL_VERIFICATION_ERROR_CODES.unavailable:
+      return t('emailCode.errors.unavailable');
+    default:
+      if (isRateLimited(error)) return t('emailCode.errors.rateLimited');
+      return describePasskeyError(error, t);
+  }
+}
+
+/** Whether the confirmation this flow holds is gone and it must start again. */
+export function isTicketExpired(error) {
+  const code = errorCode(error);
+  return code === EMAIL_VERIFICATION_ERROR_CODES.ticketInvalid || code === EMAIL_VERIFICATION_ERROR_CODES.ticketRequired;
+}
+
+/** One labelled input, the way the sign-in screen draws its username. */
+export const AccountFlowField = ({
+  label,
+  value,
+  onChange,
+  onSubmit,
+  error,
+  disabled,
+  placeholder,
+  autoComplete,
+  keyboardType,
+  maxLength,
+  testID
+}) => /*#__PURE__*/_jsxs(View, {
+  style: styles.field,
+  children: [/*#__PURE__*/_jsx(TextFieldLabel, {
+    children: label
+  }), /*#__PURE__*/_jsx(TextField, {
+    invalid: error !== null,
+    disabled: disabled,
+    radius: 999,
+    style: styles.input,
+    children: /*#__PURE__*/_jsx(TextFieldInput, {
+      testID: testID,
+      label: label,
+      value: value,
+      onValueChange: onChange,
+      placeholder: placeholder,
+      autoComplete: autoComplete,
+      keyboardType: keyboardType,
+      maxLength: maxLength,
+      autoCapitalize: "none",
+      autoCorrect: false,
+      autoFocus: true,
+      returnKeyType: "go",
+      onSubmitEditing: onSubmit,
+      "aria-required": true
+    })
+  }), error ? /*#__PURE__*/_jsx(TextFieldHint, {
+    invalid: true,
+    children: error
+  }) : null]
+});
+
+/** The screen's one primary action. */
+export const AccountFlowAction = ({
+  label,
+  onPress,
+  pending,
+  disabled,
+  testID
+}) => /*#__PURE__*/_jsx(Button, {
+  appearance: "solid",
+  tone: "action",
+  size: "lg",
+  fullWidth: true,
+  loading: pending,
+  disabled: pending || disabled,
+  onPress: onPress,
+  testID: testID,
+  children: label
+});
+
+/** A line of body copy under the header. */
+export const AccountFlowNote = ({
+  children
+}) => {
+  const theme = useTheme();
+  return /*#__PURE__*/_jsx(Text, {
+    style: [styles.note, {
+      color: theme.colors.textSecondary
+    }],
+    children: children
+  });
+};
+
+/** Why a step failed, where it happened. */
+export const AccountFlowErrorLine = ({
+  message
+}) => {
+  const theme = useTheme();
+  return /*#__PURE__*/_jsx(Text, {
+    accessibilityRole: "alert",
+    style: [styles.note, {
+      color: theme.colors.error
+    }],
+    children: message
+  });
+};
+/** "Check your email": the 6-digit code a verification sent. */
+export const EmailCodeStep = ({
+  description,
+  verificationId,
+  onConfirmed,
+  onResend,
+  back
+}) => {
+  const theme = useTheme();
+  const {
+    t
+  } = useI18n();
+  const {
+    oxyServices
+  } = useOxy();
+  const [code, setCode] = useState('');
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState(null);
+  const [notice, setNotice] = useState(null);
+  const confirm = () => {
+    const digits = code.replace(/\D/g, '');
+    if (digits.length !== EMAIL_CODE_LENGTH || pending) {
+      setError(t('emailCode.errors.codeInvalid'));
+      return;
+    }
+    setError(null);
+    setPending(true);
+    oxyServices.confirmEmailVerification(verificationId, digits).then(onConfirmed).catch(reason => setError(describeAccountFlowError(reason, t))).finally(() => setPending(false));
+  };
+  const resend = () => {
+    setError(null);
+    setNotice(null);
+    setCode('');
+    onResend().then(() => setNotice(t('emailCode.resent'))).catch(reason => setError(describeAccountFlowError(reason, t)));
+  };
+  return /*#__PURE__*/_jsxs(OxyAuthScreen, {
+    children: [/*#__PURE__*/_jsx(OxyAuthScreenHeader, {
+      title: t('emailCode.title'),
+      description: description
+    }), /*#__PURE__*/_jsx(AccountFlowField, {
+      label: t('emailCode.label'),
+      value: code,
+      onChange: value => {
+        setCode(value);
+        if (error) setError(null);
+      },
+      onSubmit: confirm,
+      error: error,
+      disabled: pending,
+      placeholder: "000000",
+      autoComplete: "one-time-code",
+      keyboardType: "number-pad",
+      maxLength: EMAIL_CODE_LENGTH,
+      testID: "email-code"
+    }), notice ? /*#__PURE__*/_jsx(Text, {
+      style: [styles.note, {
+        color: theme.colors.textSecondary
+      }],
+      children: notice
+    }) : null, /*#__PURE__*/_jsx(AccountFlowAction, {
+      label: t('signin.actions.continue'),
+      onPress: confirm,
+      pending: pending,
+      testID: "email-code-continue"
+    }), /*#__PURE__*/_jsx(SubtleLink, {
+      label: t('emailCode.resend'),
+      theme: theme,
+      onPress: resend,
+      disabled: pending,
+      testID: "email-code-resend"
+    }), /*#__PURE__*/_jsx(SubtleLink, {
+      label: back.label,
+      theme: theme,
+      onPress: back.onPress,
+      disabled: pending,
+      testID: "email-code-back"
+    })]
+  });
+};
+const styles = StyleSheet.create({
+  field: {
+    gap: 6
+  },
+  input: {
+    height: 40
+  },
+  note: {
+    fontSize: 16,
+    lineHeight: 24
+  }
+});
+//# sourceMappingURL=accountFlowParts.js.map

package/lib/module/ui/components/signIn/accountFlowParts.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["useState","StyleSheet","View","Button","useTheme","TextField","TextFieldHint","TextFieldInput","TextFieldLabel","Text","EMAIL_CODE_LENGTH","EMAIL_VERIFICATION_ERROR_CODES","useOxy","useI18n","SubtleLink","OxyAuthScreen","OxyAuthScreenHeader","describePasskeyError","isRateLimited","jsx","_jsx","jsxs","_jsxs","errorCode","error","code","undefined","describeAccountFlowError","t","codeInvalid","tooManyAttempts","ticketInvalid","ticketRequired","unavailable","isTicketExpired","AccountFlowField","label","value","onChange","onSubmit","disabled","placeholder","autoComplete","keyboardType","maxLength","testID","style","styles","field","children","invalid","radius","input","onValueChange","autoCapitalize","autoCorrect","autoFocus","returnKeyType","onSubmitEditing","AccountFlowAction","onPress","pending","appearance","tone","size","fullWidth","loading","AccountFlowNote","theme","note","color","colors","textSecondary","AccountFlowErrorLine","message","accessibilityRole","EmailCodeStep","description","verificationId","onConfirmed","onResend","back","oxyServices","setCode","setPending","setError","notice","setNotice","confirm","digits","replace","length","confirmEmailVerification","then","catch","reason","finally","resend","title","create","gap","height","fontSize","lineHeight"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/accountFlowParts.tsx"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,QAAQ,QAAQ,OAAO;AAChC,SAASC,UAAU,EAAEC,IAAI,QAAQ,cAAc;AAC/C,SAASC,MAAM,QAAQ,sBAAsB;AAC7C,SAASC,QAAQ,QAAQ,qBAAqB;AAC9C,SAASC,SAAS,EAAEC,aAAa,EAAEC,cAAc,EAAEC,cAAc,QAAQ,0BAA0B;AACnG,SAASC,IAAI,QAAQ,0BAA0B;AAC/C,SAASC,iBAAiB,EAAEC,8BAA8B,QAA+C,mBAAmB;AAC5H,SAASC,MAAM,QAAQ,6BAA0B;AACjD,SAASC,OAAO,QAAQ,wBAAqB;AAE7C,SAASC,UAAU,QAAQ,8BAA2B;AACtD,SAASC,aAAa,EAAEC,mBAAmB,QAAQ,oBAAiB;AACpE,SAASC,oBAAoB,EAAEC,aAAa,QAAQ,mBAAgB;;AAEpE;AAAA,SAAAC,GAAA,IAAAC,IAAA,EAAAC,IAAA,IAAAC,KAAA;AACA,SAASC,SAASA,CAACC,KAAc,EAAsB;EACrD,MAAMC,IAAI,GAAID,KAAK,EAAgCC,IAAI;EACvD,OAAO,OAAOA,IAAI,KAAK,QAAQ,GAAGA,IAAI,GAAGC,SAAS;AACpD;;AAEA;AACA,OAAO,SAASC,wBAAwBA,CAACH,KAAc,EAAEI,CAAY,EAAU;EAC7E,QAAQL,SAAS,CAACC,KAAK,CAAC;IACtB,KAAKb,8BAA8B,CAACkB,WAAW;MAC7C,OAAOD,CAAC,CAAC,8BAA8B,CAAC;IAC1C,KAAKjB,8BAA8B,CAACmB,eAAe;MACjD,OAAOF,CAAC,CAAC,kCAAkC,CAAC;IAC9C,KAAKjB,8BAA8B,CAACoB,aAAa;IACjD,KAAKpB,8BAA8B,CAACqB,cAAc;MAChD,OAAOJ,CAAC,CAAC,0BAA0B,CAAC;IACtC,KAAKjB,8BAA8B,CAACsB,WAAW;MAC7C,OAAOL,CAAC,CAAC,8BAA8B,CAAC;IAC1C;MACE,IAAIV,aAAa,CAACM,KAAK,CAAC,EAAE,OAAOI,CAAC,CAAC,8BAA8B,CAAC;MAClE,OAAOX,oBAAoB,CAACO,KAAK,EAAEI,CAAC,CAAC;EACzC;AACF;;AAEA;AACA,OAAO,SAASM,eAAeA,CAACV,KAAc,EAAW;EACvD,MAAMC,IAAI,GAAGF,SAAS,CAACC,KAAK,CAAC;EAC7B,OAAOC,IAAI,KAAKd,8BAA8B,CAACoB,aAAa,IAAIN,IAAI,KAAKd,8BAA8B,CAACqB,cAAc;AACxH;;AAEA;AACA,OAAO,MAAMG,gBAYX,GAAGA,CAAC;EAAEC,KAAK;EAAEC,KAAK;EAAEC,QAAQ;EAAEC,QAAQ;EAAEf,KAAK;EAAEgB,QAAQ;EAAEC,WAAW;EAAEC,YAAY;EAAEC,YAAY;EAAEC,SAAS;EAAEC;AAAO,CAAC,kBACrHvB,KAAA,CAACpB,IAAI;EAAC4C,KAAK,EAAEC,MAAM,CAACC,KAAM;EAAAC,QAAA,gBACxB7B,IAAA,CAACZ,cAAc;IAAAyC,QAAA,EAAEb;EAAK,CAAiB,CAAC,eACxChB,IAAA,CAACf,SAAS;IAAC6C,OAAO,EAAE1B,KAAK,KAAK,IAAK;IAACgB,QAAQ,EAAEA,QAAS;IAACW,MAAM,EAAE,GAAI;IAACL,KAAK,EAAEC,MAAM,CAACK,KAAM;IAAAH,QAAA,eACvF7B,IAAA,CAACb,cAAc;MACbsC,MAAM,EAAEA,MAAO;MACfT,KAAK,EAAEA,KAAM;MACbC,KAAK,EAAEA,KAAM;MACbgB,aAAa,EAAEf,QAAS;MACxBG,WAAW,EAAEA,WAAY;MACzBC,YAAY,EAAEA,YAAa;MAC3BC,YAAY,EAAEA,YAAa;MAC3BC,SAAS,EAAEA,SAAU;MACrBU,cAAc,EAAC,MAAM;MACrBC,WAAW,EAAE,KAAM;MACnBC,SAAS;MACTC,aAAa,EAAC,IAAI;MAClBC,eAAe,EAAEnB,QAAS;MAC1B;IAAa,CACd;EAAC,CACO,CAAC,EACXf,KAAK,gBAAGJ,IAAA,CAACd,aAAa;IAAC4C,OAAO;IAAAD,QAAA,EAAEzB;EAAK,CAAgB,CAAC,GAAG,IAAI;AAAA,CAC1D,CACP;;AAED;AACA,OAAO,MAAMmC,iBAMX,GAAGA,CAAC;EAAEvB,KAAK;EAAEwB,OAAO;EAAEC,OAAO;EAAErB,QAAQ;EAAEK;AAAO,CAAC,kBACjDzB,IAAA,CAACjB,MAAM;EAAC2D,UAAU,EAAC,OAAO;EAACC,IAAI,EAAC,QAAQ;EAACC,IAAI,EAAC,IAAI;EAACC,SAAS;EAACC,OAAO,EAAEL,OAAQ;EAACrB,QAAQ,EAAEqB,OAAO,IAAIrB,QAAS;EAACoB,OAAO,EAAEA,OAAQ;EAACf,MAAM,EAAEA,MAAO;EAAAI,QAAA,EAC5Ib;AAAK,CACA,CACT;;AAED;AACA,OAAO,MAAM+B,eAAwD,GAAGA,CAAC;EAAElB;AAAS,CAAC,KAAK;EACxF,MAAMmB,KAAK,GAAGhE,QAAQ,CAAC,CAAC;EACxB,oBAAOgB,IAAA,CAACX,IAAI;IAACqC,KAAK,EAAE,CAACC,MAAM,CAACsB,IAAI,EAAE;MAAEC,KAAK,EAAEF,KAAK,CAACG,MAAM,CAACC;IAAc,CAAC,CAAE;IAAAvB,QAAA,EAAEA;EAAQ,CAAO,CAAC;AAC7F,CAAC;;AAED;AACA,OAAO,MAAMwB,oBAAmD,GAAGA,CAAC;EAAEC;AAAQ,CAAC,KAAK;EAClF,MAAMN,KAAK,GAAGhE,QAAQ,CAAC,CAAC;EACxB,oBACEgB,IAAA,CAACX,IAAI;IAACkE,iBAAiB,EAAC,OAAO;IAAC7B,KAAK,EAAE,CAACC,MAAM,CAACsB,IAAI,EAAE;MAAEC,KAAK,EAAEF,KAAK,CAACG,MAAM,CAAC/C;IAAM,CAAC,CAAE;IAAAyB,QAAA,EACjFyB;EAAO,CACJ,CAAC;AAEX,CAAC;AAaD;AACA,OAAO,MAAME,aAA2C,GAAGA,CAAC;EAAEC,WAAW;EAAEC,cAAc;EAAEC,WAAW;EAAEC,QAAQ;EAAEC;AAAK,CAAC,KAAK;EAC3H,MAAMb,KAAK,GAAGhE,QAAQ,CAAC,CAAC;EACxB,MAAM;IAAEwB;EAAE,CAAC,GAAGf,OAAO,CAAC,CAAC;EACvB,MAAM;IAAEqE;EAAY,CAAC,GAAGtE,MAAM,CAAC,CAAC;EAChC,MAAM,CAACa,IAAI,EAAE0D,OAAO,CAAC,GAAGnF,QAAQ,CAAC,EAAE,CAAC;EACpC,MAAM,CAAC6D,OAAO,EAAEuB,UAAU,CAAC,GAAGpF,QAAQ,CAAC,KAAK,CAAC;EAC7C,MAAM,CAACwB,KAAK,EAAE6D,QAAQ,CAAC,GAAGrF,QAAQ,CAAgB,IAAI,CAAC;EACvD,MAAM,CAACsF,MAAM,EAAEC,SAAS,CAAC,GAAGvF,QAAQ,CAAgB,IAAI,CAAC;EAEzD,MAAMwF,OAAO,GAAGA,CAAA,KAAM;IACpB,MAAMC,MAAM,GAAGhE,IAAI,CAACiE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACtC,IAAID,MAAM,CAACE,MAAM,KAAKjF,iBAAiB,IAAImD,OAAO,EAAE;MAClDwB,QAAQ,CAACzD,CAAC,CAAC,8BAA8B,CAAC,CAAC;MAC3C;IACF;IACAyD,QAAQ,CAAC,IAAI,CAAC;IACdD,UAAU,CAAC,IAAI,CAAC;IAChBF,WAAW,CACRU,wBAAwB,CAACd,cAAc,EAAEW,MAAM,CAAC,CAChDI,IAAI,CAACd,WAAW,CAAC,CACjBe,KAAK,CAAEC,MAAe,IAAKV,QAAQ,CAAC1D,wBAAwB,CAACoE,MAAM,EAAEnE,CAAC,CAAC,CAAC,CAAC,CACzEoE,OAAO,CAAC,MAAMZ,UAAU,CAAC,KAAK,CAAC,CAAC;EACrC,CAAC;EAED,MAAMa,MAAM,GAAGA,CAAA,KAAM;IACnBZ,QAAQ,CAAC,IAAI,CAAC;IACdE,SAAS,CAAC,IAAI,CAAC;IACfJ,OAAO,CAAC,EAAE,CAAC;IACXH,QAAQ,CAAC,CAAC,CACPa,IAAI,CAAC,MAAMN,SAAS,CAAC3D,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAC5CkE,KAAK,CAAEC,MAAe,IAAKV,QAAQ,CAAC1D,wBAAwB,CAACoE,MAAM,EAAEnE,CAAC,CAAC,CAAC,CAAC;EAC9E,CAAC;EAED,oBACEN,KAAA,CAACP,aAAa;IAAAkC,QAAA,gBACZ7B,IAAA,CAACJ,mBAAmB;MAACkF,KAAK,EAAEtE,CAAC,CAAC,iBAAiB,CAAE;MAACiD,WAAW,EAAEA;IAAY,CAAE,CAAC,eAC9EzD,IAAA,CAACe,gBAAgB;MACfC,KAAK,EAAER,CAAC,CAAC,iBAAiB,CAAE;MAC5BS,KAAK,EAAEZ,IAAK;MACZa,QAAQ,EAAGD,KAAK,IAAK;QACnB8C,OAAO,CAAC9C,KAAK,CAAC;QACd,IAAIb,KAAK,EAAE6D,QAAQ,CAAC,IAAI,CAAC;MAC3B,CAAE;MACF9C,QAAQ,EAAEiD,OAAQ;MAClBhE,KAAK,EAAEA,KAAM;MACbgB,QAAQ,EAAEqB,OAAQ;MAClBpB,WAAW,EAAC,QAAQ;MACpBC,YAAY,EAAC,eAAe;MAC5BC,YAAY,EAAC,YAAY;MACzBC,SAAS,EAAElC,iBAAkB;MAC7BmC,MAAM,EAAC;IAAY,CACpB,CAAC,EACDyC,MAAM,gBAAGlE,IAAA,CAACX,IAAI;MAACqC,KAAK,EAAE,CAACC,MAAM,CAACsB,IAAI,EAAE;QAAEC,KAAK,EAAEF,KAAK,CAACG,MAAM,CAACC;MAAc,CAAC,CAAE;MAAAvB,QAAA,EAAEqC;IAAM,CAAO,CAAC,GAAG,IAAI,eACnGlE,IAAA,CAACuC,iBAAiB;MAACvB,KAAK,EAAER,CAAC,CAAC,yBAAyB,CAAE;MAACgC,OAAO,EAAE4B,OAAQ;MAAC3B,OAAO,EAAEA,OAAQ;MAAChB,MAAM,EAAC;IAAqB,CAAE,CAAC,eAC3HzB,IAAA,CAACN,UAAU;MAACsB,KAAK,EAAER,CAAC,CAAC,kBAAkB,CAAE;MAACwC,KAAK,EAAEA,KAAM;MAACR,OAAO,EAAEqC,MAAO;MAACzD,QAAQ,EAAEqB,OAAQ;MAAChB,MAAM,EAAC;IAAmB,CAAE,CAAC,eACzHzB,IAAA,CAACN,UAAU;MAACsB,KAAK,EAAE6C,IAAI,CAAC7C,KAAM;MAACgC,KAAK,EAAEA,KAAM;MAACR,OAAO,EAAEqB,IAAI,CAACrB,OAAQ;MAACpB,QAAQ,EAAEqB,OAAQ;MAAChB,MAAM,EAAC;IAAiB,CAAE,CAAC;EAAA,CACrG,CAAC;AAEpB,CAAC;AAED,MAAME,MAAM,GAAG9C,UAAU,CAACkG,MAAM,CAAC;EAC/BnD,KAAK,EAAE;IACLoD,GAAG,EAAE;EACP,CAAC;EACDhD,KAAK,EAAE;IACLiD,MAAM,EAAE;EACV,CAAC;EACDhC,IAAI,EAAE;IACJiC,QAAQ,EAAE,EAAE;IACZC,UAAU,EAAE;EACd;AACF,CAAC,CAAC","ignoreList":[]}

package/lib/module/ui/components/signIn/artwork.js

@@ -0,0 +1,16 @@
+"use strict";
+
+/**
+ * The photos the sign-in split card's carousel turns through. Shipped with the
+ * SDK and imported like its icon fonts, so every host serves them from its own
+ * origin — nothing to allow in anyone's CSP.
+ */
+
+import slide1 from '../../../assets/signIn/slide-1.jpg';
+import slide2 from '../../../assets/signIn/slide-2.jpg';
+import slide3 from '../../../assets/signIn/slide-3.jpg';
+import slide4 from '../../../assets/signIn/slide-4.jpg';
+export const SIGN_IN_SLIDES = [slide1, slide2, slide3, slide4].map(source => ({
+  source
+}));
+//# sourceMappingURL=artwork.js.map

package/lib/module/ui/components/signIn/artwork.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["slide1","slide2","slide3","slide4","SIGN_IN_SLIDES","map","source"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/artwork.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAGA,OAAOA,MAAM,MAAM,oCAAoC;AACvD,OAAOC,MAAM,MAAM,oCAAoC;AACvD,OAAOC,MAAM,MAAM,oCAAoC;AACvD,OAAOC,MAAM,MAAM,oCAAoC;AAEvD,OAAO,MAAMC,cAAgC,GAAG,CAACJ,MAAM,EAAEC,MAAM,EAAEC,MAAM,EAAEC,MAAM,CAAC,CAACE,GAAG,CAAEC,MAAM,KAAM;EAAEA;AAAO,CAAC,CAAC,CAAC","ignoreList":[]}

package/lib/module/ui/components/signIn/passkeyError.js

@@ -0,0 +1,40 @@
+"use strict";
+
+/**
+ * The message for a failed passkey sign-in, and whether it was rate-limited.
+ *
+ * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
+ * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
+ * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
+ * looked for along the cause chain, and reported calmly instead of as the raw
+ * "The operation either timed out or was not allowed…".
+ */
+
+/** How long the surface waits after a 429 before it lets the person retry. */
+export const RATE_LIMIT_SECONDS = 60;
+function isCancellation(error) {
+  let current = error;
+  for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
+    if (current.name === 'NotAllowedError' || current.name === 'AbortError') return true;
+    // `@simplewebauthn/browser`'s stable code for an aborted ceremony.
+    if (current.code === 'ERROR_CEREMONY_ABORTED') return true;
+    current = current.cause;
+  }
+  return false;
+}
+
+/** An HTTP status off a thrown SDK error (ApiError- or axios-shaped). */
+function errorStatus(error) {
+  return error?.status ?? error?.response?.status;
+}
+export function isRateLimited(error) {
+  return errorStatus(error) === 429;
+}
+
+/** The inline message for a passkey ceremony that did not sign anyone in. */
+export function describePasskeyError(error, t) {
+  if (isCancellation(error)) return t('signin.errors.passkeyCancelled');
+  if (error instanceof Error && error.message.trim().length > 0) return error.message;
+  return t('signin.errors.passkeyFailed');
+}
+//# sourceMappingURL=passkeyError.js.map

package/lib/module/ui/components/signIn/passkeyError.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["RATE_LIMIT_SECONDS","isCancellation","error","current","depth","Error","name","code","cause","errorStatus","status","response","isRateLimited","describePasskeyError","t","message","trim","length"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/passkeyError.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA,OAAO,MAAMA,kBAAkB,GAAG,EAAE;AAEpC,SAASC,cAAcA,CAACC,KAAc,EAAW;EAC/C,IAAIC,OAAgB,GAAGD,KAAK;EAC5B,KAAK,IAAIE,KAAK,GAAG,CAAC,EAAEA,KAAK,GAAG,CAAC,IAAID,OAAO,YAAYE,KAAK,EAAED,KAAK,IAAI,CAAC,EAAE;IACrE,IAAID,OAAO,CAACG,IAAI,KAAK,iBAAiB,IAAIH,OAAO,CAACG,IAAI,KAAK,YAAY,EAAE,OAAO,IAAI;IACpF;IACA,IAAKH,OAAO,CAAwBI,IAAI,KAAK,wBAAwB,EAAE,OAAO,IAAI;IAClFJ,OAAO,GAAIA,OAAO,CAAyBK,KAAK;EAClD;EACA,OAAO,KAAK;AACd;;AAEA;AACA,SAASC,WAAWA,CAACP,KAAc,EAAsB;EACvD,OACGA,KAAK,EAAsCQ,MAAM,IACjDR,KAAK,EAAqDS,QAAQ,EAAED,MAAM;AAE/E;AAEA,OAAO,SAASE,aAAaA,CAACV,KAAc,EAAW;EACrD,OAAOO,WAAW,CAACP,KAAK,CAAC,KAAK,GAAG;AACnC;;AAEA;AACA,OAAO,SAASW,oBAAoBA,CAACX,KAAc,EAAEY,CAAY,EAAU;EACzE,IAAIb,cAAc,CAACC,KAAK,CAAC,EAAE,OAAOY,CAAC,CAAC,gCAAgC,CAAC;EACrE,IAAIZ,KAAK,YAAYG,KAAK,IAAIH,KAAK,CAACa,OAAO,CAACC,IAAI,CAAC,CAAC,CAACC,MAAM,GAAG,CAAC,EAAE,OAAOf,KAAK,CAACa,OAAO;EACnF,OAAOD,CAAC,CAAC,6BAA6B,CAAC;AACzC","ignoreList":[]}

package/lib/module/ui/components/signIn/signInMethods.js

@@ -0,0 +1,42 @@
+"use strict";
+
+/**
+ * Which sign-in methods a surface offers, from where it runs.
+ *
+ * One screen everywhere; only the transport behind each block changes:
+ *
+ *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
+ *    (the split card's right column from `md`, "Continue with Oxy" below it),
+ *    the username with its Continue, and the passkey — asserted right here,
+ *    on the one origin every Oxy passkey belongs to;
+ *  - an app's account dialog on the web (`dialog`) opens that screen in a
+ *    window over the app ("Continue with Oxy"), like "Sign in with Google":
+ *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
+ *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
+ *    device that has no Commons to continue with.
+ */
+
+/**
+ * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
+ * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
+ *                 keychain, Commons on this device, a push, or the QR view).
+ * `get-commons` — native, and Commons is not installed here.
+ */
+
+export function resolveSignInMethods(facts) {
+  if (facts.web) {
+    return facts.host === 'page' ? {
+      commons: 'qr',
+      passkey: true
+    } : {
+      commons: 'window',
+      passkey: false
+    };
+  }
+  return {
+    commons: facts.commonsAvailability === 'unavailable' ? 'get-commons' : 'continue',
+    passkey: false
+  };
+}
+//# sourceMappingURL=signInMethods.js.map

package/lib/module/ui/components/signIn/signInMethods.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["resolveSignInMethods","facts","web","host","commons","passkey","commonsAvailability"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/signInMethods.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkBA,OAAO,SAASA,oBAAoBA,CAACC,KAAyB,EAAiB;EAC7E,IAAIA,KAAK,CAACC,GAAG,EAAE;IACb,OAAOD,KAAK,CAACE,IAAI,KAAK,MAAM,GAAG;MAAEC,OAAO,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAK,CAAC,GAAG;MAAED,OAAO,EAAE,QAAQ;MAAEC,OAAO,EAAE;IAAM,CAAC;EACzG;EACA,OAAO;IACLD,OAAO,EAAEH,KAAK,CAACK,mBAAmB,KAAK,aAAa,GAAG,aAAa,GAAG,UAAU;IACjFD,OAAO,EAAE;EACX,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/context/OxyContext.js

@@ -2,11 +2,10 @@
 
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
 import { Linking, Platform } from 'react-native';
-import { OxyServices, oxyClient } from '@oxy.so/core';
+import { DeviceManager, OxyServices, oxyClient } from '@oxy.so/core';
 import { KeyManager, establishIdentitySession, installAuthRefreshHandler, startTokenRefreshScheduler, createAccountDialogController, logger as loggerUtil } from '@oxy.so/core';
 import { registerAccountDialogControls, notifyAccountDialogVisibility } from "../navigation/accountDialogManager.js";
 import { redirectToAuthorize } from "../components/oauthNavigation.js";
-import { openPasskeyHubPopup } from "../components/passkeyHubPopup.js";
 import { startWebOAuthSignIn } from "../oauth/browserAuthTransport.js";
 import { requestOAuthConsent } from "../oauth/explicitOAuthConsent.js";
 import { isWebBrowser } from "../utils/isWebBrowser.js";
@@ -66,7 +65,6 @@ export const OxyRuntimeProvider = ({
   sessionMode = 'account',
   webAuthMode = 'popup',
   backgroundSession = false,
-  deviceCredentialStorage = 'persistent',
   platformStorage,
   onAuthStateChange,
   onError
@@ -91,16 +89,10 @@ export const OxyRuntimeProvider = ({
 
   // The device-first persisted auth-state store (per-origin device credential on
   // web; SecureStore session blob on native). Built ONCE per provider mount.
-  //
-  // `deviceCredentialStorage` is mount-time configuration for the same reason
-  // `sessionMode` is: it decides where the durable credential lives, and letting
-  // it change mid-flight would mean a session that started ephemeral could begin
-  // writing one.
   const authStoreRef = useRef(null);
   if (!authStoreRef.current) {
     authStoreRef.current = createPlatformAuthStateStore({
-      sessionMode,
-      storage: deviceCredentialStorage
+      sessionMode
     });
   }
   const authStore = authStoreRef.current;
@@ -676,6 +668,16 @@ export const OxyRuntimeProvider = ({
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id]);
 
+  // On the web an Oxy app signs in and creates accounts in auth.oxy.so's
+  // window over the app, like "Sign in with Google": the passkey belongs to
+  // that origin, and the browser's session lives there, shared by every Oxy
+  // app. A blocked window falls back to the same page in this tab.
+  const continueOnAuth = useCallback(screen => startWebOAuthSignInForContext({
+    redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
+    transport: 'popup',
+    screen
+  }), [startWebOAuthSignInForContext, authRedirectUri]);
+
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
@@ -745,11 +747,6 @@ export const OxyRuntimeProvider = ({
       // controller short-circuits, so `redirectToAuthorize` never runs for the
       // `oxycommons://` payload.
       canOpenApp: isWebBrowser() ? undefined : url => Linking.canOpenURL(url),
-      // Web-only: lets `startPasskeyHubSignIn` open the auth.oxy.so passkey hub
-      // popup (b2) for a non-Oxy origin. `undefined` on native — there is no
-      // popup concept there, and off-origin passkey sign-in isn't reachable
-      // (Commons owns the native flow).
-      openPopup: isWebBrowser() ? openPasskeyHubPopup : undefined,
       // Which surface a sign-in starts from — a FACT only this consumer can
       // supply (headless core never touches a platform global). It decides
       // whether automatic delivery may take the same-device Commons deep link;
@@ -870,7 +867,9 @@ export const OxyRuntimeProvider = ({
       username: opts?.username,
       deviceId: persisted?.deviceId,
       deviceName: opts?.deviceName,
-      deviceFingerprint: opts?.deviceFingerprint
+      // The same shape every other sign-in path sends; the server only reads it
+      // to place a device that has no persisted id yet.
+      deviceFingerprint: opts?.deviceFingerprint ?? JSON.stringify(DeviceManager.getDeviceFingerprint())
     });
   }, [oxyServices, authStore, commitSession]);
 
@@ -1151,6 +1150,7 @@ export const OxyRuntimeProvider = ({
     revokeSuspiciousSignIn,
     handleWebSession,
     startWebOAuthSignIn: startWebOAuthSignInForContext,
+    continueOnAuth,
     requestOAuthConsent: requestOAuthConsentForContext,
     logout,
     logoutAll,
@@ -1178,7 +1178,7 @@ export const OxyRuntimeProvider = ({
     switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPasskey, addPasskey, removePasskey, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPasskey, addPasskey, removePasskey, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, continueOnAuth, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   const authActionsValue = useMemo(() => ({
     signIn,
     logout,