@oxy.so/services 4.0.7 → 6.1.0

package/lib/commonjs/ui/components/signIn/OxySignUpPanel.js

@@ -0,0 +1,78 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.OxySignUpPanel = void 0;
+var _react = require("react");
+var _reactNative = require("react-native");
+var _button = require("@oxy.so/bloom/button");
+var _RiKey2Line = require("@oxy.so/bloom/icons/RiKey2Line");
+var _theme = require("@oxy.so/bloom/theme");
+var _toast = require("@oxy.so/bloom/toast");
+var _OxyContext = require("../../context/OxyContext.js");
+var _accountDialogSnapshot = require("../../hooks/accountDialogSnapshot.js");
+var _useI18n = require("../../hooks/useI18n.js");
+var _commonsStoreLinks = require("../../utils/commonsStoreLinks.js");
+var _isWebBrowser = require("../../utils/isWebBrowser.js");
+var _primitives = require("../authChooser/primitives.js");
+var _OxyAuthScreen = require("./OxyAuthScreen.js");
+var _jsxRuntime = require("react/jsx-runtime");
+/**
+ * Account creation in the account dialog.
+ *
+ * On the web the account is made on auth.oxy.so, in its window over the app
+ * (`onCreateOnWeb`), and this app is signed in as it. On native, Commons
+ * creates the identity: straight in when it is installed, "Get Commons"
+ * otherwise.
+ */
+
+/** Commons' own identity-creation deep link. */const COMMONS_CREATE_IDENTITY_URL = 'oxycommons://create-identity';
+const OxySignUpPanel = ({
+  onSignIn,
+  onCreateOnWeb
+}) => {
+  const theme = (0, _theme.useTheme)();
+  const {
+    t
+  } = (0, _useI18n.useI18n)();
+  const {
+    accountDialogController: controller
+  } = (0, _OxyContext.useOxy)();
+  const snapshot = (0, _accountDialogSnapshot.useAccountDialogSnapshot)(controller);
+  const web = (0, _isWebBrowser.isWebBrowser)();
+  const openExternal = (0, _react.useCallback)(url => {
+    Promise.resolve().then(() => _reactNative.Linking.openURL(url)).catch(() => _toast.toast.error(t('accountSwitcher.linkOpenFailed')));
+  }, [t]);
+  const commonsInstalled = snapshot.commonsAvailability === 'available';
+  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_OxyAuthScreen.OxyAuthScreen, {
+    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_OxyAuthScreen.OxyAuthScreenHeader, {
+      title: t('signup.title'),
+      description: web ? t('signup.webSubtitle') : t('signup.subtitle')
+    }), web ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
+      appearance: "solid",
+      tone: "action",
+      size: "lg",
+      fullWidth: true,
+      leadingIcon: _RiKey2Line.RiKey2Line,
+      onPress: onCreateOnWeb,
+      testID: "signup-open-identity",
+      children: t('signup.createAccount')
+    }) : /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
+      appearance: "solid",
+      tone: "action",
+      size: "lg",
+      fullWidth: true,
+      onPress: () => openExternal(commonsInstalled ? COMMONS_CREATE_IDENTITY_URL : (0, _commonsStoreLinks.getCommonsAcquisitionUrl)(_reactNative.Platform.OS)),
+      testID: "signup-commons",
+      children: commonsInstalled ? t('signup.createInCommons') : t('accountSwitcher.getCommons')
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
+      label: t('signup.backToSignInLink'),
+      theme: theme,
+      onPress: onSignIn,
+      testID: "back-to-sign-in"
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_OxyAuthScreen.OxyAuthTerms, {})]
+  });
+};
+exports.OxySignUpPanel = OxySignUpPanel;
+//# sourceMappingURL=OxySignUpPanel.js.map

package/lib/commonjs/ui/components/signIn/OxySignUpPanel.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","require","_reactNative","_button","_RiKey2Line","_theme","_toast","_OxyContext","_accountDialogSnapshot","_useI18n","_commonsStoreLinks","_isWebBrowser","_primitives","_OxyAuthScreen","_jsxRuntime","COMMONS_CREATE_IDENTITY_URL","OxySignUpPanel","onSignIn","onCreateOnWeb","theme","useTheme","t","useI18n","accountDialogController","controller","useOxy","snapshot","useAccountDialogSnapshot","web","isWebBrowser","openExternal","useCallback","url","Promise","resolve","then","Linking","openURL","catch","toast","error","commonsInstalled","commonsAvailability","jsxs","OxyAuthScreen","children","jsx","OxyAuthScreenHeader","title","description","Button","appearance","tone","size","fullWidth","leadingIcon","RiKey2Line","onPress","testID","getCommonsAcquisitionUrl","Platform","OS","SubtleLink","label","OxyAuthTerms","exports"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/OxySignUpPanel.tsx"],"mappings":";;;;;;AAUA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AACA,IAAAI,MAAA,GAAAJ,OAAA;AACA,IAAAK,MAAA,GAAAL,OAAA;AACA,IAAAM,WAAA,GAAAN,OAAA;AACA,IAAAO,sBAAA,GAAAP,OAAA;AACA,IAAAQ,QAAA,GAAAR,OAAA;AACA,IAAAS,kBAAA,GAAAT,OAAA;AACA,IAAAU,aAAA,GAAAV,OAAA;AACA,IAAAW,WAAA,GAAAX,OAAA;AACA,IAAAY,cAAA,GAAAZ,OAAA;AAAmF,IAAAa,WAAA,GAAAb,OAAA;AAtBnF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAiBA,gDACA,MAAMc,2BAA2B,GAAG,8BAA8B;AAS3D,MAAMC,cAA6C,GAAGA,CAAC;EAAEC,QAAQ;EAAEC;AAAc,CAAC,KAAK;EAC5F,MAAMC,KAAK,GAAG,IAAAC,eAAQ,EAAC,CAAC;EACxB,MAAM;IAAEC;EAAE,CAAC,GAAG,IAAAC,gBAAO,EAAC,CAAC;EACvB,MAAM;IAAEC,uBAAuB,EAAEC;EAAW,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EACxD,MAAMC,QAAQ,GAAG,IAAAC,+CAAwB,EAACH,UAAU,CAAC;EACrD,MAAMI,GAAG,GAAG,IAAAC,0BAAY,EAAC,CAAC;EAE1B,MAAMC,YAAY,GAAG,IAAAC,kBAAW,EAC7BC,GAAW,IAAK;IACfC,OAAO,CAACC,OAAO,CAAC,CAAC,CACdC,IAAI,CAAC,MAAMC,oBAAO,CAACC,OAAO,CAACL,GAAG,CAAC,CAAC,CAChCM,KAAK,CAAC,MAAMC,YAAK,CAACC,KAAK,CAACnB,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;EAClE,CAAC,EACD,CAACA,CAAC,CACJ,CAAC;EAED,MAAMoB,gBAAgB,GAAGf,QAAQ,CAACgB,mBAAmB,KAAK,WAAW;EAErE,oBACE,IAAA5B,WAAA,CAAA6B,IAAA,EAAC9B,cAAA,CAAA+B,aAAa;IAAAC,QAAA,gBACZ,IAAA/B,WAAA,CAAAgC,GAAA,EAACjC,cAAA,CAAAkC,mBAAmB;MAACC,KAAK,EAAE3B,CAAC,CAAC,cAAc,CAAE;MAAC4B,WAAW,EAAErB,GAAG,GAAGP,CAAC,CAAC,oBAAoB,CAAC,GAAGA,CAAC,CAAC,iBAAiB;IAAE,CAAE,CAAC,EACnHO,GAAG,gBACF,IAAAd,WAAA,CAAAgC,GAAA,EAAC3C,OAAA,CAAA+C,MAAM;MACLC,UAAU,EAAC,OAAO;MAClBC,IAAI,EAAC,QAAQ;MACbC,IAAI,EAAC,IAAI;MACTC,SAAS;MACTC,WAAW,EAAEC,sBAAW;MACxBC,OAAO,EAAEvC,aAAc;MACvBwC,MAAM,EAAC,sBAAsB;MAAAb,QAAA,EAE5BxB,CAAC,CAAC,sBAAsB;IAAC,CACpB,CAAC,gBAET,IAAAP,WAAA,CAAAgC,GAAA,EAAC3C,OAAA,CAAA+C,MAAM;MACLC,UAAU,EAAC,OAAO;MAClBC,IAAI,EAAC,QAAQ;MACbC,IAAI,EAAC,IAAI;MACTC,SAAS;MACTG,OAAO,EAAEA,CAAA,KACP3B,YAAY,CAACW,gBAAgB,GAAG1B,2BAA2B,GAAG,IAAA4C,2CAAwB,EAACC,qBAAQ,CAACC,EAAE,CAAC,CACpG;MACDH,MAAM,EAAC,gBAAgB;MAAAb,QAAA,EAEtBJ,gBAAgB,GAAGpB,CAAC,CAAC,wBAAwB,CAAC,GAAGA,CAAC,CAAC,4BAA4B;IAAC,CAC3E,CACT,eACD,IAAAP,WAAA,CAAAgC,GAAA,EAAClC,WAAA,CAAAkD,UAAU;MAACC,KAAK,EAAE1C,CAAC,CAAC,yBAAyB,CAAE;MAACF,KAAK,EAAEA,KAAM;MAACsC,OAAO,EAAExC,QAAS;MAACyC,MAAM,EAAC;IAAiB,CAAE,CAAC,eAC7G,IAAA5C,WAAA,CAAAgC,GAAA,EAACjC,cAAA,CAAAmD,YAAY,IAAE,CAAC;EAAA,CACH,CAAC;AAEpB,CAAC;AAACC,OAAA,CAAAjD,cAAA,GAAAA,cAAA","ignoreList":[]}

package/lib/commonjs/ui/components/signIn/accountFlowParts.js

@@ -0,0 +1,244 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.EmailCodeStep = exports.AccountFlowNote = exports.AccountFlowField = exports.AccountFlowErrorLine = exports.AccountFlowAction = void 0;
+exports.describeAccountFlowError = describeAccountFlowError;
+exports.isTicketExpired = isTicketExpired;
+var _react = require("react");
+var _reactNative = require("react-native");
+var _button = require("@oxy.so/bloom/button");
+var _theme = require("@oxy.so/bloom/theme");
+var _textField = require("@oxy.so/bloom/text-field");
+var _typography = require("@oxy.so/bloom/typography");
+var _contracts = require("@oxy.so/contracts");
+var _OxyContext = require("../../context/OxyContext.js");
+var _useI18n = require("../../hooks/useI18n.js");
+var _primitives = require("../authChooser/primitives.js");
+var _OxyAuthScreen = require("./OxyAuthScreen.js");
+var _passkeyError = require("./passkeyError.js");
+var _jsxRuntime = require("react/jsx-runtime");
+/**
+ * The pieces auth.oxy.so's account pages share (ADR 0029 D3): creating a
+ * passkey account, recovering one, deleting one. Each is a page of the IdP
+ * built from the same sign-in shell as `OxySignInPanel`, so they read as one
+ * product; the passkey belongs to auth.oxy.so, so none of them runs anywhere
+ * else.
+ */
+
+/** The API error code a thrown SDK error carries (`error.code`), if any. */function errorCode(error) {
+  const code = error?.code;
+  return typeof code === 'string' ? code : undefined;
+}
+
+/** A failure of an account page, in the person's language. */
+function describeAccountFlowError(error, t) {
+  switch (errorCode(error)) {
+    case _contracts.EMAIL_VERIFICATION_ERROR_CODES.codeInvalid:
+      return t('emailCode.errors.codeInvalid');
+    case _contracts.EMAIL_VERIFICATION_ERROR_CODES.tooManyAttempts:
+      return t('emailCode.errors.tooManyAttempts');
+    case _contracts.EMAIL_VERIFICATION_ERROR_CODES.ticketInvalid:
+    case _contracts.EMAIL_VERIFICATION_ERROR_CODES.ticketRequired:
+      return t('emailCode.errors.expired');
+    case _contracts.EMAIL_VERIFICATION_ERROR_CODES.unavailable:
+      return t('emailCode.errors.unavailable');
+    default:
+      if ((0, _passkeyError.isRateLimited)(error)) return t('emailCode.errors.rateLimited');
+      return (0, _passkeyError.describePasskeyError)(error, t);
+  }
+}
+
+/** Whether the confirmation this flow holds is gone and it must start again. */
+function isTicketExpired(error) {
+  const code = errorCode(error);
+  return code === _contracts.EMAIL_VERIFICATION_ERROR_CODES.ticketInvalid || code === _contracts.EMAIL_VERIFICATION_ERROR_CODES.ticketRequired;
+}
+
+/** One labelled input, the way the sign-in screen draws its username. */
+const AccountFlowField = ({
+  label,
+  value,
+  onChange,
+  onSubmit,
+  error,
+  disabled,
+  placeholder,
+  autoComplete,
+  keyboardType,
+  maxLength,
+  testID
+}) => /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
+  style: styles.field,
+  children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_textField.TextFieldLabel, {
+    children: label
+  }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_textField.TextField, {
+    invalid: error !== null,
+    disabled: disabled,
+    radius: 999,
+    style: styles.input,
+    children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_textField.TextFieldInput, {
+      testID: testID,
+      label: label,
+      value: value,
+      onValueChange: onChange,
+      placeholder: placeholder,
+      autoComplete: autoComplete,
+      keyboardType: keyboardType,
+      maxLength: maxLength,
+      autoCapitalize: "none",
+      autoCorrect: false,
+      autoFocus: true,
+      returnKeyType: "go",
+      onSubmitEditing: onSubmit,
+      "aria-required": true
+    })
+  }), error ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_textField.TextFieldHint, {
+    invalid: true,
+    children: error
+  }) : null]
+});
+
+/** The screen's one primary action. */
+exports.AccountFlowField = AccountFlowField;
+const AccountFlowAction = ({
+  label,
+  onPress,
+  pending,
+  disabled,
+  testID
+}) => /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
+  appearance: "solid",
+  tone: "action",
+  size: "lg",
+  fullWidth: true,
+  loading: pending,
+  disabled: pending || disabled,
+  onPress: onPress,
+  testID: testID,
+  children: label
+});
+
+/** A line of body copy under the header. */
+exports.AccountFlowAction = AccountFlowAction;
+const AccountFlowNote = ({
+  children
+}) => {
+  const theme = (0, _theme.useTheme)();
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+    style: [styles.note, {
+      color: theme.colors.textSecondary
+    }],
+    children: children
+  });
+};
+
+/** Why a step failed, where it happened. */
+exports.AccountFlowNote = AccountFlowNote;
+const AccountFlowErrorLine = ({
+  message
+}) => {
+  const theme = (0, _theme.useTheme)();
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+    accessibilityRole: "alert",
+    style: [styles.note, {
+      color: theme.colors.error
+    }],
+    children: message
+  });
+};
+exports.AccountFlowErrorLine = AccountFlowErrorLine;
+/** "Check your email": the 6-digit code a verification sent. */
+const EmailCodeStep = ({
+  description,
+  verificationId,
+  onConfirmed,
+  onResend,
+  back
+}) => {
+  const theme = (0, _theme.useTheme)();
+  const {
+    t
+  } = (0, _useI18n.useI18n)();
+  const {
+    oxyServices
+  } = (0, _OxyContext.useOxy)();
+  const [code, setCode] = (0, _react.useState)('');
+  const [pending, setPending] = (0, _react.useState)(false);
+  const [error, setError] = (0, _react.useState)(null);
+  const [notice, setNotice] = (0, _react.useState)(null);
+  const confirm = () => {
+    const digits = code.replace(/\D/g, '');
+    if (digits.length !== _contracts.EMAIL_CODE_LENGTH || pending) {
+      setError(t('emailCode.errors.codeInvalid'));
+      return;
+    }
+    setError(null);
+    setPending(true);
+    oxyServices.confirmEmailVerification(verificationId, digits).then(onConfirmed).catch(reason => setError(describeAccountFlowError(reason, t))).finally(() => setPending(false));
+  };
+  const resend = () => {
+    setError(null);
+    setNotice(null);
+    setCode('');
+    onResend().then(() => setNotice(t('emailCode.resent'))).catch(reason => setError(describeAccountFlowError(reason, t)));
+  };
+  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_OxyAuthScreen.OxyAuthScreen, {
+    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_OxyAuthScreen.OxyAuthScreenHeader, {
+      title: t('emailCode.title'),
+      description: description
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(AccountFlowField, {
+      label: t('emailCode.label'),
+      value: code,
+      onChange: value => {
+        setCode(value);
+        if (error) setError(null);
+      },
+      onSubmit: confirm,
+      error: error,
+      disabled: pending,
+      placeholder: "000000",
+      autoComplete: "one-time-code",
+      keyboardType: "number-pad",
+      maxLength: _contracts.EMAIL_CODE_LENGTH,
+      testID: "email-code"
+    }), notice ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+      style: [styles.note, {
+        color: theme.colors.textSecondary
+      }],
+      children: notice
+    }) : null, /*#__PURE__*/(0, _jsxRuntime.jsx)(AccountFlowAction, {
+      label: t('signin.actions.continue'),
+      onPress: confirm,
+      pending: pending,
+      testID: "email-code-continue"
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
+      label: t('emailCode.resend'),
+      theme: theme,
+      onPress: resend,
+      disabled: pending,
+      testID: "email-code-resend"
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
+      label: back.label,
+      theme: theme,
+      onPress: back.onPress,
+      disabled: pending,
+      testID: "email-code-back"
+    })]
+  });
+};
+exports.EmailCodeStep = EmailCodeStep;
+const styles = _reactNative.StyleSheet.create({
+  field: {
+    gap: 6
+  },
+  input: {
+    height: 40
+  },
+  note: {
+    fontSize: 16,
+    lineHeight: 24
+  }
+});
+//# sourceMappingURL=accountFlowParts.js.map

package/lib/commonjs/ui/components/signIn/accountFlowParts.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","require","_reactNative","_button","_theme","_textField","_typography","_contracts","_OxyContext","_useI18n","_primitives","_OxyAuthScreen","_passkeyError","_jsxRuntime","errorCode","error","code","undefined","describeAccountFlowError","t","EMAIL_VERIFICATION_ERROR_CODES","codeInvalid","tooManyAttempts","ticketInvalid","ticketRequired","unavailable","isRateLimited","describePasskeyError","isTicketExpired","AccountFlowField","label","value","onChange","onSubmit","disabled","placeholder","autoComplete","keyboardType","maxLength","testID","jsxs","View","style","styles","field","children","jsx","TextFieldLabel","TextField","invalid","radius","input","TextFieldInput","onValueChange","autoCapitalize","autoCorrect","autoFocus","returnKeyType","onSubmitEditing","TextFieldHint","exports","AccountFlowAction","onPress","pending","Button","appearance","tone","size","fullWidth","loading","AccountFlowNote","theme","useTheme","Text","note","color","colors","textSecondary","AccountFlowErrorLine","message","accessibilityRole","EmailCodeStep","description","verificationId","onConfirmed","onResend","back","useI18n","oxyServices","useOxy","setCode","useState","setPending","setError","notice","setNotice","confirm","digits","replace","length","EMAIL_CODE_LENGTH","confirmEmailVerification","then","catch","reason","finally","resend","OxyAuthScreen","OxyAuthScreenHeader","title","SubtleLink","StyleSheet","create","gap","height","fontSize","lineHeight"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/accountFlowParts.tsx"],"mappings":";;;;;;;;AASA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AACA,IAAAM,UAAA,GAAAN,OAAA;AACA,IAAAO,WAAA,GAAAP,OAAA;AACA,IAAAQ,QAAA,GAAAR,OAAA;AAEA,IAAAS,WAAA,GAAAT,OAAA;AACA,IAAAU,cAAA,GAAAV,OAAA;AACA,IAAAW,aAAA,GAAAX,OAAA;AAAqE,IAAAY,WAAA,GAAAZ,OAAA;AArBrE;AACA;AACA;AACA;AACA;AACA;AACA;;AAiBA,4EACA,SAASa,SAASA,CAACC,KAAc,EAAsB;EACrD,MAAMC,IAAI,GAAID,KAAK,EAAgCC,IAAI;EACvD,OAAO,OAAOA,IAAI,KAAK,QAAQ,GAAGA,IAAI,GAAGC,SAAS;AACpD;;AAEA;AACO,SAASC,wBAAwBA,CAACH,KAAc,EAAEI,CAAY,EAAU;EAC7E,QAAQL,SAAS,CAACC,KAAK,CAAC;IACtB,KAAKK,yCAA8B,CAACC,WAAW;MAC7C,OAAOF,CAAC,CAAC,8BAA8B,CAAC;IAC1C,KAAKC,yCAA8B,CAACE,eAAe;MACjD,OAAOH,CAAC,CAAC,kCAAkC,CAAC;IAC9C,KAAKC,yCAA8B,CAACG,aAAa;IACjD,KAAKH,yCAA8B,CAACI,cAAc;MAChD,OAAOL,CAAC,CAAC,0BAA0B,CAAC;IACtC,KAAKC,yCAA8B,CAACK,WAAW;MAC7C,OAAON,CAAC,CAAC,8BAA8B,CAAC;IAC1C;MACE,IAAI,IAAAO,2BAAa,EAACX,KAAK,CAAC,EAAE,OAAOI,CAAC,CAAC,8BAA8B,CAAC;MAClE,OAAO,IAAAQ,kCAAoB,EAACZ,KAAK,EAAEI,CAAC,CAAC;EACzC;AACF;;AAEA;AACO,SAASS,eAAeA,CAACb,KAAc,EAAW;EACvD,MAAMC,IAAI,GAAGF,SAAS,CAACC,KAAK,CAAC;EAC7B,OAAOC,IAAI,KAAKI,yCAA8B,CAACG,aAAa,IAAIP,IAAI,KAAKI,yCAA8B,CAACI,cAAc;AACxH;;AAEA;AACO,MAAMK,gBAYX,GAAGA,CAAC;EAAEC,KAAK;EAAEC,KAAK;EAAEC,QAAQ;EAAEC,QAAQ;EAAElB,KAAK;EAAEmB,QAAQ;EAAEC,WAAW;EAAEC,YAAY;EAAEC,YAAY;EAAEC,SAAS;EAAEC;AAAO,CAAC,kBACrH,IAAA1B,WAAA,CAAA2B,IAAA,EAACtC,YAAA,CAAAuC,IAAI;EAACC,KAAK,EAAEC,MAAM,CAACC,KAAM;EAAAC,QAAA,gBACxB,IAAAhC,WAAA,CAAAiC,GAAA,EAACzC,UAAA,CAAA0C,cAAc;IAAAF,QAAA,EAAEf;EAAK,CAAiB,CAAC,eACxC,IAAAjB,WAAA,CAAAiC,GAAA,EAACzC,UAAA,CAAA2C,SAAS;IAACC,OAAO,EAAElC,KAAK,KAAK,IAAK;IAACmB,QAAQ,EAAEA,QAAS;IAACgB,MAAM,EAAE,GAAI;IAACR,KAAK,EAAEC,MAAM,CAACQ,KAAM;IAAAN,QAAA,eACvF,IAAAhC,WAAA,CAAAiC,GAAA,EAACzC,UAAA,CAAA+C,cAAc;MACbb,MAAM,EAAEA,MAAO;MACfT,KAAK,EAAEA,KAAM;MACbC,KAAK,EAAEA,KAAM;MACbsB,aAAa,EAAErB,QAAS;MACxBG,WAAW,EAAEA,WAAY;MACzBC,YAAY,EAAEA,YAAa;MAC3BC,YAAY,EAAEA,YAAa;MAC3BC,SAAS,EAAEA,SAAU;MACrBgB,cAAc,EAAC,MAAM;MACrBC,WAAW,EAAE,KAAM;MACnBC,SAAS;MACTC,aAAa,EAAC,IAAI;MAClBC,eAAe,EAAEzB,QAAS;MAC1B;IAAa,CACd;EAAC,CACO,CAAC,EACXlB,KAAK,gBAAG,IAAAF,WAAA,CAAAiC,GAAA,EAACzC,UAAA,CAAAsD,aAAa;IAACV,OAAO;IAAAJ,QAAA,EAAE9B;EAAK,CAAgB,CAAC,GAAG,IAAI;AAAA,CAC1D,CACP;;AAED;AAAA6C,OAAA,CAAA/B,gBAAA,GAAAA,gBAAA;AACO,MAAMgC,iBAMX,GAAGA,CAAC;EAAE/B,KAAK;EAAEgC,OAAO;EAAEC,OAAO;EAAE7B,QAAQ;EAAEK;AAAO,CAAC,kBACjD,IAAA1B,WAAA,CAAAiC,GAAA,EAAC3C,OAAA,CAAA6D,MAAM;EAACC,UAAU,EAAC,OAAO;EAACC,IAAI,EAAC,QAAQ;EAACC,IAAI,EAAC,IAAI;EAACC,SAAS;EAACC,OAAO,EAAEN,OAAQ;EAAC7B,QAAQ,EAAE6B,OAAO,IAAI7B,QAAS;EAAC4B,OAAO,EAAEA,OAAQ;EAACvB,MAAM,EAAEA,MAAO;EAAAM,QAAA,EAC5If;AAAK,CACA,CACT;;AAED;AAAA8B,OAAA,CAAAC,iBAAA,GAAAA,iBAAA;AACO,MAAMS,eAAwD,GAAGA,CAAC;EAAEzB;AAAS,CAAC,KAAK;EACxF,MAAM0B,KAAK,GAAG,IAAAC,eAAQ,EAAC,CAAC;EACxB,oBAAO,IAAA3D,WAAA,CAAAiC,GAAA,EAACxC,WAAA,CAAAmE,IAAI;IAAC/B,KAAK,EAAE,CAACC,MAAM,CAAC+B,IAAI,EAAE;MAAEC,KAAK,EAAEJ,KAAK,CAACK,MAAM,CAACC;IAAc,CAAC,CAAE;IAAAhC,QAAA,EAAEA;EAAQ,CAAO,CAAC;AAC7F,CAAC;;AAED;AAAAe,OAAA,CAAAU,eAAA,GAAAA,eAAA;AACO,MAAMQ,oBAAmD,GAAGA,CAAC;EAAEC;AAAQ,CAAC,KAAK;EAClF,MAAMR,KAAK,GAAG,IAAAC,eAAQ,EAAC,CAAC;EACxB,oBACE,IAAA3D,WAAA,CAAAiC,GAAA,EAACxC,WAAA,CAAAmE,IAAI;IAACO,iBAAiB,EAAC,OAAO;IAACtC,KAAK,EAAE,CAACC,MAAM,CAAC+B,IAAI,EAAE;MAAEC,KAAK,EAAEJ,KAAK,CAACK,MAAM,CAAC7D;IAAM,CAAC,CAAE;IAAA8B,QAAA,EACjFkC;EAAO,CACJ,CAAC;AAEX,CAAC;AAACnB,OAAA,CAAAkB,oBAAA,GAAAA,oBAAA;AAaF;AACO,MAAMG,aAA2C,GAAGA,CAAC;EAAEC,WAAW;EAAEC,cAAc;EAAEC,WAAW;EAAEC,QAAQ;EAAEC;AAAK,CAAC,KAAK;EAC3H,MAAMf,KAAK,GAAG,IAAAC,eAAQ,EAAC,CAAC;EACxB,MAAM;IAAErD;EAAE,CAAC,GAAG,IAAAoE,gBAAO,EAAC,CAAC;EACvB,MAAM;IAAEC;EAAY,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EAChC,MAAM,CAACzE,IAAI,EAAE0E,OAAO,CAAC,GAAG,IAAAC,eAAQ,EAAC,EAAE,CAAC;EACpC,MAAM,CAAC5B,OAAO,EAAE6B,UAAU,CAAC,GAAG,IAAAD,eAAQ,EAAC,KAAK,CAAC;EAC7C,MAAM,CAAC5E,KAAK,EAAE8E,QAAQ,CAAC,GAAG,IAAAF,eAAQ,EAAgB,IAAI,CAAC;EACvD,MAAM,CAACG,MAAM,EAAEC,SAAS,CAAC,GAAG,IAAAJ,eAAQ,EAAgB,IAAI,CAAC;EAEzD,MAAMK,OAAO,GAAGA,CAAA,KAAM;IACpB,MAAMC,MAAM,GAAGjF,IAAI,CAACkF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACtC,IAAID,MAAM,CAACE,MAAM,KAAKC,4BAAiB,IAAIrC,OAAO,EAAE;MAClD8B,QAAQ,CAAC1E,CAAC,CAAC,8BAA8B,CAAC,CAAC;MAC3C;IACF;IACA0E,QAAQ,CAAC,IAAI,CAAC;IACdD,UAAU,CAAC,IAAI,CAAC;IAChBJ,WAAW,CACRa,wBAAwB,CAAClB,cAAc,EAAEc,MAAM,CAAC,CAChDK,IAAI,CAAClB,WAAW,CAAC,CACjBmB,KAAK,CAAEC,MAAe,IAAKX,QAAQ,CAAC3E,wBAAwB,CAACsF,MAAM,EAAErF,CAAC,CAAC,CAAC,CAAC,CACzEsF,OAAO,CAAC,MAAMb,UAAU,CAAC,KAAK,CAAC,CAAC;EACrC,CAAC;EAED,MAAMc,MAAM,GAAGA,CAAA,KAAM;IACnBb,QAAQ,CAAC,IAAI,CAAC;IACdE,SAAS,CAAC,IAAI,CAAC;IACfL,OAAO,CAAC,EAAE,CAAC;IACXL,QAAQ,CAAC,CAAC,CACPiB,IAAI,CAAC,MAAMP,SAAS,CAAC5E,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAC5CoF,KAAK,CAAEC,MAAe,IAAKX,QAAQ,CAAC3E,wBAAwB,CAACsF,MAAM,EAAErF,CAAC,CAAC,CAAC,CAAC;EAC9E,CAAC;EAED,oBACE,IAAAN,WAAA,CAAA2B,IAAA,EAAC7B,cAAA,CAAAgG,aAAa;IAAA9D,QAAA,gBACZ,IAAAhC,WAAA,CAAAiC,GAAA,EAACnC,cAAA,CAAAiG,mBAAmB;MAACC,KAAK,EAAE1F,CAAC,CAAC,iBAAiB,CAAE;MAAC+D,WAAW,EAAEA;IAAY,CAAE,CAAC,eAC9E,IAAArE,WAAA,CAAAiC,GAAA,EAACjB,gBAAgB;MACfC,KAAK,EAAEX,CAAC,CAAC,iBAAiB,CAAE;MAC5BY,KAAK,EAAEf,IAAK;MACZgB,QAAQ,EAAGD,KAAK,IAAK;QACnB2D,OAAO,CAAC3D,KAAK,CAAC;QACd,IAAIhB,KAAK,EAAE8E,QAAQ,CAAC,IAAI,CAAC;MAC3B,CAAE;MACF5D,QAAQ,EAAE+D,OAAQ;MAClBjF,KAAK,EAAEA,KAAM;MACbmB,QAAQ,EAAE6B,OAAQ;MAClB5B,WAAW,EAAC,QAAQ;MACpBC,YAAY,EAAC,eAAe;MAC5BC,YAAY,EAAC,YAAY;MACzBC,SAAS,EAAE8D,4BAAkB;MAC7B7D,MAAM,EAAC;IAAY,CACpB,CAAC,EACDuD,MAAM,gBAAG,IAAAjF,WAAA,CAAAiC,GAAA,EAACxC,WAAA,CAAAmE,IAAI;MAAC/B,KAAK,EAAE,CAACC,MAAM,CAAC+B,IAAI,EAAE;QAAEC,KAAK,EAAEJ,KAAK,CAACK,MAAM,CAACC;MAAc,CAAC,CAAE;MAAAhC,QAAA,EAAEiD;IAAM,CAAO,CAAC,GAAG,IAAI,eACnG,IAAAjF,WAAA,CAAAiC,GAAA,EAACe,iBAAiB;MAAC/B,KAAK,EAAEX,CAAC,CAAC,yBAAyB,CAAE;MAAC2C,OAAO,EAAEkC,OAAQ;MAACjC,OAAO,EAAEA,OAAQ;MAACxB,MAAM,EAAC;IAAqB,CAAE,CAAC,eAC3H,IAAA1B,WAAA,CAAAiC,GAAA,EAACpC,WAAA,CAAAoG,UAAU;MAAChF,KAAK,EAAEX,CAAC,CAAC,kBAAkB,CAAE;MAACoD,KAAK,EAAEA,KAAM;MAACT,OAAO,EAAE4C,MAAO;MAACxE,QAAQ,EAAE6B,OAAQ;MAACxB,MAAM,EAAC;IAAmB,CAAE,CAAC,eACzH,IAAA1B,WAAA,CAAAiC,GAAA,EAACpC,WAAA,CAAAoG,UAAU;MAAChF,KAAK,EAAEwD,IAAI,CAACxD,KAAM;MAACyC,KAAK,EAAEA,KAAM;MAACT,OAAO,EAAEwB,IAAI,CAACxB,OAAQ;MAAC5B,QAAQ,EAAE6B,OAAQ;MAACxB,MAAM,EAAC;IAAiB,CAAE,CAAC;EAAA,CACrG,CAAC;AAEpB,CAAC;AAACqB,OAAA,CAAAqB,aAAA,GAAAA,aAAA;AAEF,MAAMtC,MAAM,GAAGoE,uBAAU,CAACC,MAAM,CAAC;EAC/BpE,KAAK,EAAE;IACLqE,GAAG,EAAE;EACP,CAAC;EACD9D,KAAK,EAAE;IACL+D,MAAM,EAAE;EACV,CAAC;EACDxC,IAAI,EAAE;IACJyC,QAAQ,EAAE,EAAE;IACZC,UAAU,EAAE;EACd;AACF,CAAC,CAAC","ignoreList":[]}

package/lib/commonjs/ui/components/signIn/artwork.js

@@ -0,0 +1,21 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.SIGN_IN_SLIDES = void 0;
+var _slide = _interopRequireDefault(require("../../../assets/signIn/slide-1.jpg"));
+var _slide2 = _interopRequireDefault(require("../../../assets/signIn/slide-2.jpg"));
+var _slide3 = _interopRequireDefault(require("../../../assets/signIn/slide-3.jpg"));
+var _slide4 = _interopRequireDefault(require("../../../assets/signIn/slide-4.jpg"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+/**
+ * The photos the sign-in split card's carousel turns through. Shipped with the
+ * SDK and imported like its icon fonts, so every host serves them from its own
+ * origin — nothing to allow in anyone's CSP.
+ */
+
+const SIGN_IN_SLIDES = exports.SIGN_IN_SLIDES = [_slide.default, _slide2.default, _slide3.default, _slide4.default].map(source => ({
+  source
+}));
+//# sourceMappingURL=artwork.js.map

package/lib/commonjs/ui/components/signIn/artwork.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_slide","_interopRequireDefault","require","_slide2","_slide3","_slide4","e","__esModule","default","SIGN_IN_SLIDES","exports","slide1","slide2","slide3","slide4","map","source"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/artwork.ts"],"mappings":";;;;;;AAOA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,OAAA,GAAAJ,sBAAA,CAAAC,OAAA;AAAwD,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAVxD;AACA;AACA;AACA;AACA;;AAQO,MAAMG,cAAgC,GAAAC,OAAA,CAAAD,cAAA,GAAG,CAACE,cAAM,EAAEC,eAAM,EAAEC,eAAM,EAAEC,eAAM,CAAC,CAACC,GAAG,CAAEC,MAAM,KAAM;EAAEA;AAAO,CAAC,CAAC,CAAC","ignoreList":[]}

package/lib/commonjs/ui/components/signIn/passkeyError.js

@@ -0,0 +1,46 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.RATE_LIMIT_SECONDS = void 0;
+exports.describePasskeyError = describePasskeyError;
+exports.isRateLimited = isRateLimited;
+/**
+ * The message for a failed passkey sign-in, and whether it was rate-limited.
+ *
+ * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
+ * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
+ * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
+ * looked for along the cause chain, and reported calmly instead of as the raw
+ * "The operation either timed out or was not allowed…".
+ */
+
+/** How long the surface waits after a 429 before it lets the person retry. */
+const RATE_LIMIT_SECONDS = exports.RATE_LIMIT_SECONDS = 60;
+function isCancellation(error) {
+  let current = error;
+  for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
+    if (current.name === 'NotAllowedError' || current.name === 'AbortError') return true;
+    // `@simplewebauthn/browser`'s stable code for an aborted ceremony.
+    if (current.code === 'ERROR_CEREMONY_ABORTED') return true;
+    current = current.cause;
+  }
+  return false;
+}
+
+/** An HTTP status off a thrown SDK error (ApiError- or axios-shaped). */
+function errorStatus(error) {
+  return error?.status ?? error?.response?.status;
+}
+function isRateLimited(error) {
+  return errorStatus(error) === 429;
+}
+
+/** The inline message for a passkey ceremony that did not sign anyone in. */
+function describePasskeyError(error, t) {
+  if (isCancellation(error)) return t('signin.errors.passkeyCancelled');
+  if (error instanceof Error && error.message.trim().length > 0) return error.message;
+  return t('signin.errors.passkeyFailed');
+}
+//# sourceMappingURL=passkeyError.js.map

package/lib/commonjs/ui/components/signIn/passkeyError.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["RATE_LIMIT_SECONDS","exports","isCancellation","error","current","depth","Error","name","code","cause","errorStatus","status","response","isRateLimited","describePasskeyError","t","message","trim","length"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/passkeyError.ts"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACO,MAAMA,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,EAAE;AAEpC,SAASE,cAAcA,CAACC,KAAc,EAAW;EAC/C,IAAIC,OAAgB,GAAGD,KAAK;EAC5B,KAAK,IAAIE,KAAK,GAAG,CAAC,EAAEA,KAAK,GAAG,CAAC,IAAID,OAAO,YAAYE,KAAK,EAAED,KAAK,IAAI,CAAC,EAAE;IACrE,IAAID,OAAO,CAACG,IAAI,KAAK,iBAAiB,IAAIH,OAAO,CAACG,IAAI,KAAK,YAAY,EAAE,OAAO,IAAI;IACpF;IACA,IAAKH,OAAO,CAAwBI,IAAI,KAAK,wBAAwB,EAAE,OAAO,IAAI;IAClFJ,OAAO,GAAIA,OAAO,CAAyBK,KAAK;EAClD;EACA,OAAO,KAAK;AACd;;AAEA;AACA,SAASC,WAAWA,CAACP,KAAc,EAAsB;EACvD,OACGA,KAAK,EAAsCQ,MAAM,IACjDR,KAAK,EAAqDS,QAAQ,EAAED,MAAM;AAE/E;AAEO,SAASE,aAAaA,CAACV,KAAc,EAAW;EACrD,OAAOO,WAAW,CAACP,KAAK,CAAC,KAAK,GAAG;AACnC;;AAEA;AACO,SAASW,oBAAoBA,CAACX,KAAc,EAAEY,CAAY,EAAU;EACzE,IAAIb,cAAc,CAACC,KAAK,CAAC,EAAE,OAAOY,CAAC,CAAC,gCAAgC,CAAC;EACrE,IAAIZ,KAAK,YAAYG,KAAK,IAAIH,KAAK,CAACa,OAAO,CAACC,IAAI,CAAC,CAAC,CAACC,MAAM,GAAG,CAAC,EAAE,OAAOf,KAAK,CAACa,OAAO;EACnF,OAAOD,CAAC,CAAC,6BAA6B,CAAC;AACzC","ignoreList":[]}

package/lib/commonjs/ui/components/signIn/signInMethods.js

@@ -0,0 +1,46 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.resolveSignInMethods = resolveSignInMethods;
+/**
+ * Which sign-in methods a surface offers, from where it runs.
+ *
+ * One screen everywhere; only the transport behind each block changes:
+ *
+ *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
+ *    (the split card's right column from `md`, "Continue with Oxy" below it),
+ *    the username with its Continue, and the passkey — asserted right here,
+ *    on the one origin every Oxy passkey belongs to;
+ *  - an app's account dialog on the web (`dialog`) opens that screen in a
+ *    window over the app ("Continue with Oxy"), like "Sign in with Google":
+ *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
+ *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
+ *    device that has no Commons to continue with.
+ */
+
+/**
+ * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
+ * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
+ *                 keychain, Commons on this device, a push, or the QR view).
+ * `get-commons` — native, and Commons is not installed here.
+ */
+
+function resolveSignInMethods(facts) {
+  if (facts.web) {
+    return facts.host === 'page' ? {
+      commons: 'qr',
+      passkey: true
+    } : {
+      commons: 'window',
+      passkey: false
+    };
+  }
+  return {
+    commons: facts.commonsAvailability === 'unavailable' ? 'get-commons' : 'continue',
+    passkey: false
+  };
+}
+//# sourceMappingURL=signInMethods.js.map

package/lib/commonjs/ui/components/signIn/signInMethods.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["resolveSignInMethods","facts","web","host","commons","passkey","commonsAvailability"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/signInMethods.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkBO,SAASA,oBAAoBA,CAACC,KAAyB,EAAiB;EAC7E,IAAIA,KAAK,CAACC,GAAG,EAAE;IACb,OAAOD,KAAK,CAACE,IAAI,KAAK,MAAM,GAAG;MAAEC,OAAO,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAK,CAAC,GAAG;MAAED,OAAO,EAAE,QAAQ;MAAEC,OAAO,EAAE;IAAM,CAAC;EACzG;EACA,OAAO;IACLD,OAAO,EAAEH,KAAK,CAACK,mBAAmB,KAAK,aAAa,GAAG,aAAa,GAAG,UAAU;IACjFD,OAAO,EAAE;EACX,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/context/OxyContext.js

@@ -9,7 +9,6 @@ var _reactNative = require("react-native");
 var _core = require("@oxy.so/core");
 var _accountDialogManager = require("../navigation/accountDialogManager.js");
 var _oauthNavigation = require("../components/oauthNavigation.js");
-var _passkeyHubPopup = require("../components/passkeyHubPopup.js");
 var _browserAuthTransport = require("../oauth/browserAuthTransport.js");
 var _explicitOAuthConsent = require("../oauth/explicitOAuthConsent.js");
 var _isWebBrowser = require("../utils/isWebBrowser.js");
@@ -70,7 +69,6 @@ const OxyRuntimeProvider = ({
   sessionMode = 'account',
   webAuthMode = 'popup',
   backgroundSession = false,
-  deviceCredentialStorage = 'persistent',
   platformStorage,
   onAuthStateChange,
   onError
@@ -95,16 +93,10 @@ const OxyRuntimeProvider = ({
 
   // The device-first persisted auth-state store (per-origin device credential on
   // web; SecureStore session blob on native). Built ONCE per provider mount.
-  //
-  // `deviceCredentialStorage` is mount-time configuration for the same reason
-  // `sessionMode` is: it decides where the durable credential lives, and letting
-  // it change mid-flight would mean a session that started ephemeral could begin
-  // writing one.
   const authStoreRef = (0, _react.useRef)(null);
   if (!authStoreRef.current) {
     authStoreRef.current = (0, _index2.createPlatformAuthStateStore)({
-      sessionMode,
-      storage: deviceCredentialStorage
+      sessionMode
     });
   }
   const authStore = authStoreRef.current;
@@ -680,6 +672,16 @@ const OxyRuntimeProvider = ({
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id]);
 
+  // On the web an Oxy app signs in and creates accounts in auth.oxy.so's
+  // window over the app, like "Sign in with Google": the passkey belongs to
+  // that origin, and the browser's session lives there, shared by every Oxy
+  // app. A blocked window falls back to the same page in this tab.
+  const continueOnAuth = (0, _react.useCallback)(screen => startWebOAuthSignInForContext({
+    redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
+    transport: 'popup',
+    screen
+  }), [startWebOAuthSignInForContext, authRedirectUri]);
+
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
@@ -749,11 +751,6 @@ const OxyRuntimeProvider = ({
       // controller short-circuits, so `redirectToAuthorize` never runs for the
       // `oxycommons://` payload.
       canOpenApp: (0, _isWebBrowser.isWebBrowser)() ? undefined : url => _reactNative.Linking.canOpenURL(url),
-      // Web-only: lets `startPasskeyHubSignIn` open the auth.oxy.so passkey hub
-      // popup (b2) for a non-Oxy origin. `undefined` on native — there is no
-      // popup concept there, and off-origin passkey sign-in isn't reachable
-      // (Commons owns the native flow).
-      openPopup: (0, _isWebBrowser.isWebBrowser)() ? _passkeyHubPopup.openPasskeyHubPopup : undefined,
       // Which surface a sign-in starts from — a FACT only this consumer can
       // supply (headless core never touches a platform global). It decides
       // whether automatic delivery may take the same-device Commons deep link;
@@ -874,7 +871,9 @@ const OxyRuntimeProvider = ({
       username: opts?.username,
       deviceId: persisted?.deviceId,
       deviceName: opts?.deviceName,
-      deviceFingerprint: opts?.deviceFingerprint
+      // The same shape every other sign-in path sends; the server only reads it
+      // to place a device that has no persisted id yet.
+      deviceFingerprint: opts?.deviceFingerprint ?? JSON.stringify(_core.DeviceManager.getDeviceFingerprint())
     });
   }, [oxyServices, authStore, commitSession]);
 
@@ -1155,6 +1154,7 @@ const OxyRuntimeProvider = ({
     revokeSuspiciousSignIn,
     handleWebSession,
     startWebOAuthSignIn: startWebOAuthSignInForContext,
+    continueOnAuth,
     requestOAuthConsent: requestOAuthConsentForContext,
     logout,
     logoutAll,
@@ -1182,7 +1182,7 @@ const OxyRuntimeProvider = ({
     switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPasskey, addPasskey, removePasskey, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPasskey, addPasskey, removePasskey, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, continueOnAuth, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   const authActionsValue = (0, _react.useMemo)(() => ({
     signIn,
     logout,