@oxy.so/services 6.1.0 → 6.2.0

package/lib/module/ui/components/signIn/signInMethods.js

@@ -3,40 +3,41 @@
 /**
  * Which sign-in methods a surface offers, from where it runs.
  *
- * One screen everywhere; only the transport behind each block changes:
+ * One screen everywhere, and sign-in happens IN it (ADR 0029 D1):
  *
- *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
- *    (the split card's right column from `md`, "Continue with Oxy" below it),
- *    the username with its Continue, and the passkey — asserted right here,
- *    on the one origin every Oxy passkey belongs to;
- *  - an app's account dialog on the web (`dialog`) opens that screen in a
- *    window over the app ("Continue with Oxy"), like "Sign in with Google":
- *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
- *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
- *    device that has no Commons to continue with.
+ *  - the COMMONS way in — on the web the embedded QR (the split card's right
+ *    column from `md`, with "Continue with Oxy" below `md`, where the screen
+ *    is the phone that would scan it); on native "Continue with Oxy", and
+ *    "Get Commons" on a device that has no Commons to continue with;
+ *  - the PASSKEY — it belongs to `oxy.so`, so it runs right here on auth.oxy.so
+ *    (`page`: the username with its Continue, and the discoverable passkey), and
+ *    in an app's dialog on the web it opens auth.oxy.so's window for that one
+ *    step (with account creation); native has none, Commons holds the identity.
  */
 
 /**
- * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
- * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `qr`          — the web: the embedded QR from `md`, "Continue with Oxy" below.
  * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
  *                 keychain, Commons on this device, a push, or the QR view).
  * `get-commons` — native, and Commons is not installed here.
  */
 
+/**
+ * `here`   — auth.oxy.so: the username and the passkey run on this page.
+ * `window` — an app's dialog on the web: the passkey opens auth.oxy.so's window.
+ * `none`   — native.
+ */
+
 export function resolveSignInMethods(facts) {
   if (facts.web) {
-    return facts.host === 'page' ? {
+    return {
       commons: 'qr',
-      passkey: true
-    } : {
-      commons: 'window',
-      passkey: false
+      passkey: facts.host === 'page' ? 'here' : 'window'
     };
   }
   return {
     commons: facts.commonsAvailability === 'unavailable' ? 'get-commons' : 'continue',
-    passkey: false
+    passkey: 'none'
   };
 }
 //# sourceMappingURL=signInMethods.js.map

package/lib/module/ui/components/signIn/signInMethods.js.map

@@ -1 +1 @@
-{"version":3,"names":["resolveSignInMethods","facts","web","host","commons","passkey","commonsAvailability"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/signInMethods.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkBA,OAAO,SAASA,oBAAoBA,CAACC,KAAyB,EAAiB;EAC7E,IAAIA,KAAK,CAACC,GAAG,EAAE;IACb,OAAOD,KAAK,CAACE,IAAI,KAAK,MAAM,GAAG;MAAEC,OAAO,EAAE,IAAI;MAAEC,OAAO,EAAE;IAAK,CAAC,GAAG;MAAED,OAAO,EAAE,QAAQ;MAAEC,OAAO,EAAE;IAAM,CAAC;EACzG;EACA,OAAO;IACLD,OAAO,EAAEH,KAAK,CAACK,mBAAmB,KAAK,aAAa,GAAG,aAAa,GAAG,UAAU;IACjFD,OAAO,EAAE;EACX,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["resolveSignInMethods","facts","web","commons","passkey","host","commonsAvailability"],"sourceRoot":"../../../../../src","sources":["ui/components/signIn/signInMethods.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;;AAiBA,OAAO,SAASA,oBAAoBA,CAACC,KAAyB,EAAiB;EAC7E,IAAIA,KAAK,CAACC,GAAG,EAAE;IACb,OAAO;MAAEC,OAAO,EAAE,IAAI;MAAEC,OAAO,EAAEH,KAAK,CAACI,IAAI,KAAK,MAAM,GAAG,MAAM,GAAG;IAAS,CAAC;EAC9E;EACA,OAAO;IACLF,OAAO,EAAEF,KAAK,CAACK,mBAAmB,KAAK,aAAa,GAAG,aAAa,GAAG,UAAU;IACjFF,OAAO,EAAE;EACX,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/context/OxyContext.js

@@ -668,10 +668,10 @@ export const OxyRuntimeProvider = ({
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id]);
 
-  // On the web an Oxy app signs in and creates accounts in auth.oxy.so's
-  // window over the app, like "Sign in with Google": the passkey belongs to
-  // that origin, and the browser's session lives there, shared by every Oxy
-  // app. A blocked window falls back to the same page in this tab.
+  // What only auth.oxy.so can do for an Oxy app on the web — assert the
+  // `oxy.so` passkey, create or recover a passkey account — runs in its window
+  // over the app, for that one step. A blocked window falls back to the same
+  // page in this tab.
   const continueOnAuth = useCallback(screen => startWebOAuthSignInForContext({
     redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
     transport: 'popup',

package/lib/module/ui/hooks/useSurfaceFrameWidth.js

@@ -0,0 +1,24 @@
+"use strict";
+
+import { createContext, useContext, useLayoutEffect } from 'react';
+
+/**
+ * A screen's say in how wide its surface is.
+ *
+ * `SurfaceScreen` is the ONE host that declares the surface's dialog frame, so
+ * a screen whose views need different widths (the account dialog: the 420 menu,
+ * the sign-in's 880 split card) hands its width to that host rather than
+ * declaring a second frame. A change morphs the centered card to it.
+ */
+export const SurfaceFrameWidthContext = /*#__PURE__*/createContext(null);
+
+/** Ask the surface for `maxWidth` (px) while this is mounted; `null` keeps the surface's own. */
+export function useSurfaceFrameWidth(maxWidth) {
+  const setWidth = useContext(SurfaceFrameWidthContext);
+  useLayoutEffect(() => {
+    if (!setWidth) return;
+    setWidth(maxWidth);
+    return () => setWidth(null);
+  }, [setWidth, maxWidth]);
+}
+//# sourceMappingURL=useSurfaceFrameWidth.js.map

package/lib/module/ui/hooks/useSurfaceFrameWidth.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createContext","useContext","useLayoutEffect","SurfaceFrameWidthContext","useSurfaceFrameWidth","maxWidth","setWidth"],"sourceRoot":"../../../../src","sources":["ui/hooks/useSurfaceFrameWidth.ts"],"mappings":";;AAAA,SAASA,aAAa,EAAEC,UAAU,EAAEC,eAAe,QAAQ,OAAO;;AAElE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,wBAAwB,gBAAGH,aAAa,CAA6C,IAAI,CAAC;;AAEvG;AACA,OAAO,SAASI,oBAAoBA,CAACC,QAAuB,EAAQ;EAClE,MAAMC,QAAQ,GAAGL,UAAU,CAACE,wBAAwB,CAAC;EACrDD,eAAe,CAAC,MAAM;IACpB,IAAI,CAACI,QAAQ,EAAE;IACfA,QAAQ,CAACD,QAAQ,CAAC;IAClB,OAAO,MAAMC,QAAQ,CAAC,IAAI,CAAC;EAC7B,CAAC,EAAE,CAACA,QAAQ,EAAED,QAAQ,CAAC,CAAC;AAC1B","ignoreList":[]}

package/lib/typescript/commonjs/ui/components/OxyAuthChooser.d.ts

@@ -16,8 +16,9 @@
  *
  *  - `accounts` → `AccountsMenuView` — the signed-in Oxy account menu.
  *  - `add` / `signin` → `OxySignInPanel` — THE sign-in screen, the one
- *    auth.oxy.so renders too: the device's accounts, then "Continue with
- *    Oxy" (on the web, auth.oxy.so's window over the app).
+ *    auth.oxy.so renders too: the device's accounts, then the Commons way in
+ *    (the embedded QR, or "Continue with Oxy"), then the passkey (on the web
+ *    in an app, auth.oxy.so's window for that one step).
  *  - `qr` → `SignInRequestView` — the ACTIVE REQUEST: the controller-bound
  *    wiring over the shared, presentational `OxySignInRequestSurface` (the same
  *    component the auth.oxy.so IdP mounts from its OAuth-bound request). It maps

package/lib/typescript/commonjs/ui/components/OxyAuthChooser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoD/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAwXjD,CAAC;AA8BF,eAAe,cAAc,CAAC"}
+{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoD/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAwXjD,CAAC;AA8BF,eAAe,cAAc,CAAC"}

package/lib/typescript/commonjs/ui/components/SurfaceScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SurfaceScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAUnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAsFrE,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;IACzB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,iBAAS,aAAa,CAAC,EACrB,QAAQ,EACR,OAAO,EACP,iBAAwB,GACzB,EAAE,kBAAkB,4BAgKpB;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"SurfaceScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SurfaceScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAUnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAuFrE,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;IACzB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,iBAAS,aAAa,CAAC,EACrB,QAAQ,EACR,OAAO,EACP,iBAAwB,GACzB,EAAE,kBAAkB,4BAuKpB;AAED,eAAe,aAAa,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/OxyAuthScreen.d.ts

@@ -27,10 +27,16 @@ export declare const OxyAuthScreen: React.FC<{
     children: React.ReactNode;
     className?: string;
 }>;
-/** The split card: `children` on the left and, from `md`, `aside` on the right. */
+/**
+ * The split card: `children` on the left and, from `md`, `aside` on the right.
+ * `bare` inside a surface that already is the card (the account dialog): no
+ * border of its own, and the right column is a rounded tile within the
+ * dialog's margins.
+ */
 export declare const OxyAuthSplit: React.FC<{
     children: React.ReactNode;
     aside: React.ReactNode;
+    bare?: boolean;
 }>;
 /**
  * The screen while there is nothing to show yet. React Native's own indicator:

package/lib/typescript/commonjs/ui/components/signIn/OxyAuthScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC/B;AAED,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAqBlE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAErF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,CAmBxF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAOlC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAiBhC,CAAC"}
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC/B;AAED,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAqBlE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAErF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAuBxG,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAOlC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAiBhC,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/OxySignInPanel.d.ts

@@ -4,18 +4,18 @@
  * differs (`host`).
  *
  *   picker   a returning device: "Choose an account", then "Use another account"
- *   entry    the header, the Commons way in, and the way in for someone with no
- *            account. On auth.oxy.so (`page`) also the username with its
- *            Continue — a username-first passkey sign-in, which takes a
- *            platform passkey AND a hardware security key with no resident
- *            credential (a U2F key such as a Titan) — and "or continue with" the
- *            discoverable passkey. From `md` that page is Bloom `AuthCard`'s
- *            split card, with the embedded QR over its photo carousel in the
- *            right column; below `md` it is "Continue with Oxy" at the top.
- *            In an app's dialog on the web, "Continue with Oxy" opens that page
- *            in a window over the app, like "Sign in with Google": the browser's
- *            session lives on auth.oxy.so, so every Oxy app shares it. On
- *            native it is "Continue with Oxy" ("Get Commons" without Commons).
+ *   entry    the header, the Commons way in, the passkey, and the way in for
+ *            someone with no account. On the web, from `md`, the screen is
+ *            Bloom `AuthCard`'s split card and the Commons way in is the
+ *            embedded QR over its photo carousel, in the right column (the
+ *            account dialog grows to that card); below `md` it is "Continue
+ *            with Oxy" at the top. The passkey belongs to `oxy.so`: on
+ *            auth.oxy.so (`page`) it runs here — the username with its Continue,
+ *            a username-first ceremony that takes a hardware security key with
+ *            no resident credential too, and the discoverable passkey — and in
+ *            an app's dialog it opens auth.oxy.so's window for that one step, as
+ *            does "Create account". On native it is "Continue with Oxy" ("Get
+ *            Commons" without Commons).
  *
  * `signInMethods.ts` owns which blocks a platform gets.
  */

package/lib/typescript/commonjs/ui/components/signIn/OxySignInPanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxySignInPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxySignInPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA6B/B,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,gCAAgC;IAChC,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAySxD,CAAC"}
+{"version":3,"file":"OxySignInPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxySignInPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAiC/B,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,gCAAgC;IAChC,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAwTxD,CAAC"}

package/lib/typescript/commonjs/ui/components/signIn/signInMethods.d.ts

@@ -1,31 +1,34 @@
 /**
  * Which sign-in methods a surface offers, from where it runs.
  *
- * One screen everywhere; only the transport behind each block changes:
+ * One screen everywhere, and sign-in happens IN it (ADR 0029 D1):
  *
- *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
- *    (the split card's right column from `md`, "Continue with Oxy" below it),
- *    the username with its Continue, and the passkey — asserted right here,
- *    on the one origin every Oxy passkey belongs to;
- *  - an app's account dialog on the web (`dialog`) opens that screen in a
- *    window over the app ("Continue with Oxy"), like "Sign in with Google":
- *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
- *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
- *    device that has no Commons to continue with.
+ *  - the COMMONS way in — on the web the embedded QR (the split card's right
+ *    column from `md`, with "Continue with Oxy" below `md`, where the screen
+ *    is the phone that would scan it); on native "Continue with Oxy", and
+ *    "Get Commons" on a device that has no Commons to continue with;
+ *  - the PASSKEY — it belongs to `oxy.so`, so it runs right here on auth.oxy.so
+ *    (`page`: the username with its Continue, and the discoverable passkey), and
+ *    in an app's dialog on the web it opens auth.oxy.so's window for that one
+ *    step (with account creation); native has none, Commons holds the identity.
  */
 import type { CommonsAvailability } from '@oxy.so/core';
 /**
- * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
- * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `qr`          — the web: the embedded QR from `md`, "Continue with Oxy" below.
  * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
  *                 keychain, Commons on this device, a push, or the QR view).
  * `get-commons` — native, and Commons is not installed here.
  */
-export type CommonsEntry = 'qr' | 'window' | 'continue' | 'get-commons';
+export type CommonsEntry = 'qr' | 'continue' | 'get-commons';
+/**
+ * `here`   — auth.oxy.so: the username and the passkey run on this page.
+ * `window` — an app's dialog on the web: the passkey opens auth.oxy.so's window.
+ * `none`   — native.
+ */
+export type PasskeyEntry = 'here' | 'window' | 'none';
 export interface SignInMethods {
     commons: CommonsEntry;
-    /** The username and passkey block: only on auth.oxy.so. */
-    passkey: boolean;
+    passkey: PasskeyEntry;
 }
 export interface SignInSurfaceFacts {
     /** Rendering in a browser (react-native-web), not a native app. */

package/lib/typescript/commonjs/ui/components/signIn/signInMethods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signInMethods.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/signInMethods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,GAAG,EAAE,OAAO,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAQ7E"}
+{"version":3,"file":"signInMethods.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/signInMethods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,aAAa,CAAC;AAE7D;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,GAAG,EAAE,OAAO,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAQ7E"}

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts

@@ -125,10 +125,10 @@ export interface OxyContextState {
      */
     startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
     /**
-     * Sign in (`signin`), create an account (`signup`) or recover one
-     * (`recover`) in auth.oxy.so's window over the app, where the browser's
-     * shared Oxy session lives. Web only; call it from the press, so the window
-     * opens with the gesture.
+     * The passkey sign-in (`signin`), account creation (`signup`) or recovery
+     * (`recover`) in auth.oxy.so's window over the app — the one step the
+     * account dialog cannot run itself, since the passkey belongs to `oxy.so`.
+     * Web only; call it from the press, so the window opens with the gesture.
      */
     continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
     /**

package/lib/typescript/commonjs/ui/hooks/useSurfaceFrameWidth.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A screen's say in how wide its surface is.
+ *
+ * `SurfaceScreen` is the ONE host that declares the surface's dialog frame, so
+ * a screen whose views need different widths (the account dialog: the 420 menu,
+ * the sign-in's 880 split card) hands its width to that host rather than
+ * declaring a second frame. A change morphs the centered card to it.
+ */
+export declare const SurfaceFrameWidthContext: import("react").Context<((maxWidth: number | null) => void) | null>;
+/** Ask the surface for `maxWidth` (px) while this is mounted; `null` keeps the surface's own. */
+export declare function useSurfaceFrameWidth(maxWidth: number | null): void;
+//# sourceMappingURL=useSurfaceFrameWidth.d.ts.map

package/lib/typescript/commonjs/ui/hooks/useSurfaceFrameWidth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSurfaceFrameWidth.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSurfaceFrameWidth.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,sCAA6B,MAAM,GAAG,IAAI,KAAK,IAAI,SAAe,CAAC;AAExG,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAOlE"}

package/lib/typescript/module/ui/components/OxyAuthChooser.d.ts

@@ -16,8 +16,9 @@
  *
  *  - `accounts` → `AccountsMenuView` — the signed-in Oxy account menu.
  *  - `add` / `signin` → `OxySignInPanel` — THE sign-in screen, the one
- *    auth.oxy.so renders too: the device's accounts, then "Continue with
- *    Oxy" (on the web, auth.oxy.so's window over the app).
+ *    auth.oxy.so renders too: the device's accounts, then the Commons way in
+ *    (the embedded QR, or "Continue with Oxy"), then the passkey (on the web
+ *    in an app, auth.oxy.so's window for that one step).
  *  - `qr` → `SignInRequestView` — the ACTIVE REQUEST: the controller-bound
  *    wiring over the shared, presentational `OxySignInRequestSurface` (the same
  *    component the auth.oxy.so IdP mounts from its OAuth-bound request). It maps

package/lib/typescript/module/ui/components/OxyAuthChooser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoD/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAwXjD,CAAC;AA8BF,eAAe,cAAc,CAAC"}
+{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoD/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAwXjD,CAAC;AA8BF,eAAe,cAAc,CAAC"}

package/lib/typescript/module/ui/components/SurfaceScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SurfaceScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAUnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAA+B,CAAC;AAsFrE,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;IACzB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,iBAAS,aAAa,CAAC,EACrB,QAAQ,EACR,OAAO,EACP,iBAAwB,GACzB,EAAE,kBAAkB,4BAgKpB;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"SurfaceScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SurfaceScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8E,MAAM,OAAO,CAAC;AAUnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAA+B,CAAC;AAuFrE,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;IACzB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,iBAAS,aAAa,CAAC,EACrB,QAAQ,EACR,OAAO,EACP,iBAAwB,GACzB,EAAE,kBAAkB,4BAuKpB;AAED,eAAe,aAAa,CAAC"}

package/lib/typescript/module/ui/components/signIn/OxyAuthScreen.d.ts

@@ -27,10 +27,16 @@ export declare const OxyAuthScreen: React.FC<{
     children: React.ReactNode;
     className?: string;
 }>;
-/** The split card: `children` on the left and, from `md`, `aside` on the right. */
+/**
+ * The split card: `children` on the left and, from `md`, `aside` on the right.
+ * `bare` inside a surface that already is the card (the account dialog): no
+ * border of its own, and the right column is a rounded tile within the
+ * dialog's margins.
+ */
 export declare const OxyAuthSplit: React.FC<{
     children: React.ReactNode;
     aside: React.ReactNode;
+    bare?: boolean;
 }>;
 /**
  * The screen while there is nothing to show yet. React Native's own indicator:

package/lib/typescript/module/ui/components/signIn/OxyAuthScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC/B;AAED,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAqBlE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAErF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,CAmBxF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAOlC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAiBhC,CAAC"}
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC/B;AAED,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAqBlE,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAErF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAuBxG,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAOlC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,EAiBhC,CAAC"}

package/lib/typescript/module/ui/components/signIn/OxySignInPanel.d.ts

@@ -4,18 +4,18 @@
  * differs (`host`).
  *
  *   picker   a returning device: "Choose an account", then "Use another account"
- *   entry    the header, the Commons way in, and the way in for someone with no
- *            account. On auth.oxy.so (`page`) also the username with its
- *            Continue — a username-first passkey sign-in, which takes a
- *            platform passkey AND a hardware security key with no resident
- *            credential (a U2F key such as a Titan) — and "or continue with" the
- *            discoverable passkey. From `md` that page is Bloom `AuthCard`'s
- *            split card, with the embedded QR over its photo carousel in the
- *            right column; below `md` it is "Continue with Oxy" at the top.
- *            In an app's dialog on the web, "Continue with Oxy" opens that page
- *            in a window over the app, like "Sign in with Google": the browser's
- *            session lives on auth.oxy.so, so every Oxy app shares it. On
- *            native it is "Continue with Oxy" ("Get Commons" without Commons).
+ *   entry    the header, the Commons way in, the passkey, and the way in for
+ *            someone with no account. On the web, from `md`, the screen is
+ *            Bloom `AuthCard`'s split card and the Commons way in is the
+ *            embedded QR over its photo carousel, in the right column (the
+ *            account dialog grows to that card); below `md` it is "Continue
+ *            with Oxy" at the top. The passkey belongs to `oxy.so`: on
+ *            auth.oxy.so (`page`) it runs here — the username with its Continue,
+ *            a username-first ceremony that takes a hardware security key with
+ *            no resident credential too, and the discoverable passkey — and in
+ *            an app's dialog it opens auth.oxy.so's window for that one step, as
+ *            does "Create account". On native it is "Continue with Oxy" ("Get
+ *            Commons" without Commons).
  *
  * `signInMethods.ts` owns which blocks a platform gets.
  */

package/lib/typescript/module/ui/components/signIn/OxySignInPanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxySignInPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxySignInPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA6B/B,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,gCAAgC;IAChC,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAySxD,CAAC"}
+{"version":3,"file":"OxySignInPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxySignInPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAiC/B,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,gCAAgC;IAChC,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAwTxD,CAAC"}

package/lib/typescript/module/ui/components/signIn/signInMethods.d.ts

@@ -1,31 +1,34 @@
 /**
  * Which sign-in methods a surface offers, from where it runs.
  *
- * One screen everywhere; only the transport behind each block changes:
+ * One screen everywhere, and sign-in happens IN it (ADR 0029 D1):
  *
- *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
- *    (the split card's right column from `md`, "Continue with Oxy" below it),
- *    the username with its Continue, and the passkey — asserted right here,
- *    on the one origin every Oxy passkey belongs to;
- *  - an app's account dialog on the web (`dialog`) opens that screen in a
- *    window over the app ("Continue with Oxy"), like "Sign in with Google":
- *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
- *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
- *    device that has no Commons to continue with.
+ *  - the COMMONS way in — on the web the embedded QR (the split card's right
+ *    column from `md`, with "Continue with Oxy" below `md`, where the screen
+ *    is the phone that would scan it); on native "Continue with Oxy", and
+ *    "Get Commons" on a device that has no Commons to continue with;
+ *  - the PASSKEY — it belongs to `oxy.so`, so it runs right here on auth.oxy.so
+ *    (`page`: the username with its Continue, and the discoverable passkey), and
+ *    in an app's dialog on the web it opens auth.oxy.so's window for that one
+ *    step (with account creation); native has none, Commons holds the identity.
  */
 import type { CommonsAvailability } from '@oxy.so/core';
 /**
- * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
- * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `qr`          — the web: the embedded QR from `md`, "Continue with Oxy" below.
  * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
  *                 keychain, Commons on this device, a push, or the QR view).
  * `get-commons` — native, and Commons is not installed here.
  */
-export type CommonsEntry = 'qr' | 'window' | 'continue' | 'get-commons';
+export type CommonsEntry = 'qr' | 'continue' | 'get-commons';
+/**
+ * `here`   — auth.oxy.so: the username and the passkey run on this page.
+ * `window` — an app's dialog on the web: the passkey opens auth.oxy.so's window.
+ * `none`   — native.
+ */
+export type PasskeyEntry = 'here' | 'window' | 'none';
 export interface SignInMethods {
     commons: CommonsEntry;
-    /** The username and passkey block: only on auth.oxy.so. */
-    passkey: boolean;
+    passkey: PasskeyEntry;
 }
 export interface SignInSurfaceFacts {
     /** Rendering in a browser (react-native-web), not a native app. */

package/lib/typescript/module/ui/components/signIn/signInMethods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signInMethods.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/signInMethods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,GAAG,EAAE,OAAO,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAQ7E"}
+{"version":3,"file":"signInMethods.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/signInMethods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,aAAa,CAAC;AAE7D;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,GAAG,EAAE,OAAO,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,8DAA8D;IAC9D,mBAAmB,EAAE,mBAAmB,CAAC;CAC1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAQ7E"}

package/lib/typescript/module/ui/context/oxyContextTypes.d.ts

@@ -125,10 +125,10 @@ export interface OxyContextState {
      */
     startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
     /**
-     * Sign in (`signin`), create an account (`signup`) or recover one
-     * (`recover`) in auth.oxy.so's window over the app, where the browser's
-     * shared Oxy session lives. Web only; call it from the press, so the window
-     * opens with the gesture.
+     * The passkey sign-in (`signin`), account creation (`signup`) or recovery
+     * (`recover`) in auth.oxy.so's window over the app — the one step the
+     * account dialog cannot run itself, since the passkey belongs to `oxy.so`.
+     * Web only; call it from the press, so the window opens with the gesture.
      */
     continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
     /**

package/lib/typescript/module/ui/hooks/useSurfaceFrameWidth.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A screen's say in how wide its surface is.
+ *
+ * `SurfaceScreen` is the ONE host that declares the surface's dialog frame, so
+ * a screen whose views need different widths (the account dialog: the 420 menu,
+ * the sign-in's 880 split card) hands its width to that host rather than
+ * declaring a second frame. A change morphs the centered card to it.
+ */
+export declare const SurfaceFrameWidthContext: import("react").Context<((maxWidth: number | null) => void) | null>;
+/** Ask the surface for `maxWidth` (px) while this is mounted; `null` keeps the surface's own. */
+export declare function useSurfaceFrameWidth(maxWidth: number | null): void;
+//# sourceMappingURL=useSurfaceFrameWidth.d.ts.map

package/lib/typescript/module/ui/hooks/useSurfaceFrameWidth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSurfaceFrameWidth.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSurfaceFrameWidth.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,sCAA6B,MAAM,GAAG,IAAI,KAAK,IAAI,SAAe,CAAC;AAExG,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAOlE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "6.1.0",
+  "version": "6.2.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/components/OxyAuthChooser.tsx

@@ -16,8 +16,9 @@
  *
  *  - `accounts` → `AccountsMenuView` — the signed-in Oxy account menu.
  *  - `add` / `signin` → `OxySignInPanel` — THE sign-in screen, the one
- *    auth.oxy.so renders too: the device's accounts, then "Continue with
- *    Oxy" (on the web, auth.oxy.so's window over the app).
+ *    auth.oxy.so renders too: the device's accounts, then the Commons way in
+ *    (the embedded QR, or "Continue with Oxy"), then the passkey (on the web
+ *    in an app, auth.oxy.so's window for that one step).
  *  - `qr` → `SignInRequestView` — the ACTIVE REQUEST: the controller-bound
  *    wiring over the shared, presentational `OxySignInRequestSurface` (the same
  *    component the auth.oxy.so IdP mounts from its OAuth-bound request). It maps
@@ -112,10 +113,10 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
   // so the two switchers cannot drift.
   const { principals } = useDeviceSwitcher();
 
-  // On the web every sign-in and sign-up runs in auth.oxy.so's window over the
-  // app (`continueOnAuth`): the passkey belongs to that origin, and the
-  // browser's session lives there, shared by every Oxy app. Native has no
-  // passkey path: Commons owns identity there ('none').
+  // Sign-in happens in this dialog. On the web the passkey and account
+  // creation open auth.oxy.so's window for that one step (`continueOnAuth`):
+  // the passkey belongs to that origin. Native has no passkey path: Commons
+  // owns identity there ('none').
   const passkeyMode = useMemo<PasskeyMode>(() => (isWebBrowser() ? 'hub' : 'none'), []);
 
   /** auth.oxy.so's window; this surface closes once it signs the app in. */

package/src/ui/components/SurfaceScreen.tsx

@@ -24,6 +24,7 @@ import {
   SurfaceHeaderContext,
   type SurfaceHeaderContent,
 } from '../hooks/useSurfaceHeader';
+import { SurfaceFrameWidthContext } from '../hooks/useSurfaceFrameWidth';
 import type { BaseScreenProps } from '../types/navigation';
 
 /** Error boundary catching screen render failures, so one bad screen cannot blank the surface. */
@@ -213,17 +214,22 @@ function SurfaceScreen({
   // container to a near-full-height, wider card and shrinks back on exit. Resolve
   // its viewport-relative height to px here (the Dialog clamps to the viewport).
   const { height: viewportHeight } = useWindowDimensions();
+  //
+  // A screen may also ask for a width of its own (`useSurfaceFrameWidth`) when
+  // its views differ in width; the width joins the frame's identity so each
+  // change morphs.
+  const [screenWidth, setScreenWidth] = useState<number | null>(null);
   const frameSize = useMemo(() => {
     const spec = config.frameSize;
-    if (!spec) return undefined;
+    if (!spec && screenWidth === null) return undefined;
     const height =
-      spec.heightRatio !== undefined ? Math.round(viewportHeight * spec.heightRatio) : undefined;
-    return { height, maxWidth: spec.maxWidth };
-  }, [config.frameSize, viewportHeight]);
+      spec?.heightRatio !== undefined ? Math.round(viewportHeight * spec.heightRatio) : undefined;
+    return { height, maxWidth: screenWidth ?? spec?.maxWidth };
+  }, [config.frameSize, viewportHeight, screenWidth]);
   useDialogFrame(
     useMemo(
-      () => ({ key: `${top.route}#${top.step}`, morph: config.morph, size: frameSize }),
-      [top.route, top.step, config.morph, frameSize],
+      () => ({ key: `${top.route}#${top.step}#${screenWidth ?? ''}`, morph: config.morph, size: frameSize }),
+      [top.route, top.step, screenWidth, config.morph, frameSize],
     ),
   );
   // Show a back affordance whenever the surface can navigate back — either an
@@ -273,11 +279,13 @@ function SurfaceScreen({
 
   return (
     <SurfaceHeaderContext.Provider value={headerContext}>
-      <ScreenErrorBoundary screenName={top.route}>
-        <Suspense fallback={<ScreenPending />}>
-          <ScreenComponent {...screenProps} />
-        </Suspense>
-      </ScreenErrorBoundary>
+      <SurfaceFrameWidthContext.Provider value={setScreenWidth}>
+        <ScreenErrorBoundary screenName={top.route}>
+          <Suspense fallback={<ScreenPending />}>
+            <ScreenComponent {...screenProps} />
+          </Suspense>
+        </ScreenErrorBoundary>
+      </SurfaceFrameWidthContext.Provider>
     </SurfaceHeaderContext.Provider>
   );
 }