@oxy.so/services 6.1.0 → 8.0.0

package/lib/typescript/commonjs/webauthn/passkeyClient.web.d.ts

@@ -1,36 +0,0 @@
-/**
- * Passkey / WebAuthn ceremony client — WEB implementation.
- *
- * The browser half of the passkey flow: it drives `navigator.credentials`
- * through `@simplewebauthn/browser`, turning the OPAQUE options the server
- * emitted (`OxyServices.webauthn{Register,Login}Options`) into the opaque
- * response the matching `verify` endpoint consumes. Oxy never owns those wire
- * shapes — `@simplewebauthn/browser` does — so options flow in as `unknown` and
- * the single cast at this boundary hands them to the library's own types.
- *
- * This file is selected ONLY on web (react-native-web / Vite RNW): the sibling
- * `passkeyClient.native.ts` + the clean default `passkeyClient.ts` deliberately
- * do NOT import `@simplewebauthn/browser` (a browser-only dependency), per the
- * platform-split rule. Native passkeys are Commons' job — there is no WebAuthn
- * ceremony off the web.
- */
-import { type RegistrationResponseJSON, type AuthenticationResponseJSON } from '@simplewebauthn/browser';
-/**
- * True iff this browser can run a WebAuthn ceremony (exposes the
- * `PublicKeyCredential` global). Gate all passkey UI/entrypoints on this so an
- * unsupported browser fails loudly rather than throwing mid-ceremony.
- */
-export declare function isPasskeySupported(): boolean;
-/**
- * Run the WebAuthn REGISTRATION ceremony (`navigator.credentials.create`) from
- * the server's opaque creation options, returning the opaque attestation
- * response for `OxyServices.webauthnRegisterVerify`.
- */
-export declare function runRegistrationCeremony(optionsJSON: unknown): Promise<RegistrationResponseJSON>;
-/**
- * Run the WebAuthn AUTHENTICATION ceremony (`navigator.credentials.get`) from
- * the server's opaque request options, returning the opaque assertion response
- * for `OxyServices.webauthnLoginVerify`.
- */
-export declare function runAuthenticationCeremony(optionsJSON: unknown): Promise<AuthenticationResponseJSON>;
-//# sourceMappingURL=passkeyClient.web.d.ts.map

package/lib/typescript/commonjs/webauthn/passkeyClient.web.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeyClient.web.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAEnC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAErC"}

package/lib/typescript/module/ui/components/signIn/OxyCreateAccountPanel.d.ts

@@ -1,24 +0,0 @@
-/**
- * Creating an Oxy account on the web (ADR 0029 D3), auth.oxy.so's `/signup`:
- *
- *   username → recovery email → the code sent to it → passkey → signed in
- *
- * A web account is a username, a passkey and a recovery email — no password, no
- * phrase, no key. The email is confirmed before the account exists, and is
- * used only to get back in (`OxyRecoverAccountPanel`). Commons stays the way to
- * hold your own key: the first step says so, and linking Commons later makes
- * the account self-custodied and deletes the email.
- *
- * Only on auth.oxy.so: the passkey belongs to that origin (RP ID `oxy.so`,
- * asserted only there), and an app's dialog opens this page in a window
- * (`OxySignUpPanel`'s `onCreateOnWeb`).
- */
-import type React from 'react';
-export interface OxyCreateAccountPanelProps {
-    /** The account exists and this origin is signed in as it. */
-    onSignedIn: () => void;
-    /** "Already have an account? Sign in". */
-    onSignIn: () => void;
-}
-export declare const OxyCreateAccountPanel: React.FC<OxyCreateAccountPanelProps>;
-//# sourceMappingURL=OxyCreateAccountPanel.d.ts.map

package/lib/typescript/module/ui/components/signIn/OxyCreateAccountPanel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OxyCreateAccountPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyCreateAccountPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA6B/B,MAAM,WAAW,0BAA0B;IACzC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC,0BAA0B,CA0JtE,CAAC"}

package/lib/typescript/module/ui/components/signIn/OxyRecoverAccountPanel.d.ts

@@ -1,20 +0,0 @@
-/**
- * Recovering a passkey account (ADR 0029 D3), auth.oxy.so's `/recover`:
- *
- *   username or email → the code sent to the recovery email → new passkey → signed in
- *
- * The first step answers the same whether or not the account exists, so it
- * never says who has one. An account that uses Commons has no recovery email:
- * it recovers in Commons with its phrase, and the first step says so. The new
- * passkey joins the ones the account has; lost ones are removed afterwards in
- * the account's security settings.
- */
-import type React from 'react';
-export interface OxyRecoverAccountPanelProps {
-    /** The account has a new passkey and this origin is signed in as it. */
-    onRecovered: () => void;
-    /** "Back to sign in". */
-    onSignIn: () => void;
-}
-export declare const OxyRecoverAccountPanel: React.FC<OxyRecoverAccountPanelProps>;
-//# sourceMappingURL=OxyRecoverAccountPanel.d.ts.map

package/lib/typescript/module/ui/components/signIn/OxyRecoverAccountPanel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"OxyRecoverAccountPanel.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/OxyRecoverAccountPanel.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyB/B,MAAM,WAAW,2BAA2B;IAC1C,wEAAwE;IACxE,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,2BAA2B,CA6GxE,CAAC"}

package/lib/typescript/module/ui/components/signIn/passkeyError.d.ts

@@ -1,16 +0,0 @@
-/**
- * The message for a failed passkey sign-in, and whether it was rate-limited.
- *
- * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
- * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
- * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
- * looked for along the cause chain, and reported calmly instead of as the raw
- * "The operation either timed out or was not allowed…".
- */
-import type { Translate } from '../authChooser/types.js';
-/** How long the surface waits after a 429 before it lets the person retry. */
-export declare const RATE_LIMIT_SECONDS = 60;
-export declare function isRateLimited(error: unknown): boolean;
-/** The inline message for a passkey ceremony that did not sign anyone in. */
-export declare function describePasskeyError(error: unknown, t: Translate): string;
-//# sourceMappingURL=passkeyError.d.ts.map

package/lib/typescript/module/ui/components/signIn/passkeyError.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeyError.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/signIn/passkeyError.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAEtD,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAqBrC,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,GAAG,MAAM,CAIzE"}

package/lib/typescript/module/ui/context/passkeyFlow.d.ts

@@ -1,92 +0,0 @@
-/**
- * Pure passkey (WebAuthn) sign-in / registration orchestration.
- *
- * Extracted from `OxyContext` so the fixed `options → ceremony → verify → commit`
- * ordering is unit-testable with injected deps — the exact pattern
- * `commitSessionFlow.ts` (`commitDeviceSetAndResolve`) uses. The context methods
- * (`signInWithPasskey` / `addPasskey`) are thin wrappers
- * that supply the real deps: the core `webauthn*` methods, the platform ceremony
- * client (`webauthn/passkeyClient`), and the internal `commitSession` funnel.
- *
- * Both GATE on `isSupported()` first (the platform client returns `false`
- * off the web) so an unsupported surface fails loudly before touching a ceremony.
- */
-import type { LoginResult, LoginSessionResult } from '@oxy.so/contracts';
-import type { CommitInput } from './oxyContextTypes.js';
-/**
- * The result of `OxyServices.webauthnRegisterVerify` — either the LINK branch
- * (`{ success, message }`, bearer present, no session) or the SIGNUP branch (a
- * full {@link LoginResult}, which carries a `sessionId` on its session arm).
- */
-export type PasskeyRegisterVerifyResult = {
-    success: true;
-    message: string;
-} | LoginResult;
-/** Thrown when a passkey flow is attempted on a surface that cannot run WebAuthn. */
-export declare const PASSKEY_UNSUPPORTED_MESSAGE = "Passkeys are not available in this environment. Use another sign-in method.";
-/** Injected dependencies for {@link runPasskeyLogin}. */
-export interface RunPasskeyLoginDeps {
-    isSupported: () => boolean;
-    getLoginOptions: (username?: string) => Promise<unknown>;
-    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
-    loginVerify: (response: unknown, envelope: {
-        deviceName?: string;
-        deviceFingerprint?: string;
-        deviceId?: string;
-    }) => Promise<LoginResult>;
-    commit: (input: CommitInput) => Promise<void>;
-    /**
-     * When present, scopes login options to that user's registered passkeys
-     * (username-first) — the path a NON-discoverable hardware key (e.g. a U2F
-     * security key) needs, since it can't be found by a usernameless ceremony.
-     * Omit for the discoverable / resident-credential path.
-     */
-    username?: string;
-    deviceId?: string;
-    deviceName?: string;
-    deviceFingerprint?: string;
-}
-/**
- * Passkey SIGN-IN. With no `username` this is the usernameless
- * (discoverable-credential) flow; with a `username` it is username-first —
- * the server scopes `allowCredentials` to that user's passkeys so a
- * non-discoverable hardware key (U2F/security key) can be selected. Either way:
- * request login options, run the authentication ceremony, verify, then commit
- * the session. A passkey assertion is itself the strong factor — sign-in always
- * resolves to a completed session.
- */
-export declare function runPasskeyLogin(deps: RunPasskeyLoginDeps): Promise<void>;
-/** Injected dependencies for {@link runPasskeyAdd}. */
-export interface RunPasskeyAddDeps {
-    isSupported: () => boolean;
-    getRegisterOptions: () => Promise<unknown>;
-    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
-    registerVerify: (response: unknown, envelope: {
-        deviceName?: string;
-    }) => Promise<PasskeyRegisterVerifyResult>;
-    onLinked: () => void;
-    deviceName?: string;
-}
-/**
- * ADD a passkey to the already-signed-in account (bearer present). The verify
- * link branch returns `{ success, message }` with NO session — so this never
- * commits a session; it just fires `onLinked` (which invalidates the
- * auth-methods query). A session arm here would be a server contract violation.
- */
-export declare function runPasskeyAdd(deps: RunPasskeyAddDeps): Promise<void>;
-/** Injected dependencies for {@link runPasskeyRegisterSignIn}. */
-export interface RunPasskeyRegisterSignInDeps {
-    isSupported: () => boolean;
-    getRegisterOptions: () => Promise<unknown>;
-    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
-    registerVerify: (response: unknown) => Promise<PasskeyRegisterVerifyResult>;
-    commit: (result: LoginSessionResult) => Promise<void>;
-}
-/**
- * Register a passkey SIGNED OUT and sign in with the account it belongs to —
- * a new passkey account (username + confirmed recovery email), or a recovery's
- * new passkey (ADR 0029 D3). Options, ceremony, verify, then commit; the verify
- * must mint a session, since there is no bearer to link to.
- */
-export declare function runPasskeyRegisterSignIn(deps: RunPasskeyRegisterSignInDeps): Promise<void>;
-//# sourceMappingURL=passkeyFlow.d.ts.map

package/lib/typescript/module/ui/context/passkeyFlow.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeyFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/passkeyFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAmB,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAAC;AAE3F,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,gFACuC,CAAC;AAehF,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,WAAW,EAAE,CACX,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9E;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,cAAc,EAAE,CACd,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC9B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1E;AAED,kEAAkE;AAClE,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhG"}

package/lib/typescript/module/ui/screens/FAQScreen.d.ts

@@ -1,5 +0,0 @@
-import type React from 'react';
-import type { BaseScreenProps } from '../types/navigation.js';
-declare const FAQScreen: React.FC<BaseScreenProps>;
-export default FAQScreen;
-//# sourceMappingURL=FAQScreen.d.ts.map

package/lib/typescript/module/ui/screens/FAQScreen.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"FAQScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/FAQScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAe/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAa3D,QAAA,MAAM,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAiKxC,CAAC;AAUF,eAAe,SAAS,CAAC"}

package/lib/typescript/module/ui/screens/FeedbackScreen.d.ts

@@ -1,5 +0,0 @@
-import type React from "react";
-import type { BaseScreenProps } from "../types/navigation.js";
-declare const FeedbackScreen: React.FC<BaseScreenProps>;
-export default FeedbackScreen;
-//# sourceMappingURL=FeedbackScreen.d.ts.map

package/lib/typescript/module/ui/screens/FeedbackScreen.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"FeedbackScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/FeedbackScreen.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAyC3D,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAuqB7C,CAAC;AAwBF,eAAe,cAAc,CAAC"}

package/lib/typescript/module/ui/screens/PremiumSubscriptionScreen.d.ts

@@ -1,5 +0,0 @@
-import type React from 'react';
-import type { BaseScreenProps } from '../types/navigation.js';
-declare const PremiumSubscriptionScreen: React.FC<BaseScreenProps>;
-export default PremiumSubscriptionScreen;
-//# sourceMappingURL=PremiumSubscriptionScreen.d.ts.map

package/lib/typescript/module/ui/screens/PremiumSubscriptionScreen.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PremiumSubscriptionScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/PremiumSubscriptionScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAsG3D,QAAA,MAAM,yBAAyB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAm+BxD,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/lib/typescript/module/ui/screens/SavesCollectionsScreen.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SavesCollectionsScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/SavesCollectionsScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA8B,MAAM,OAAO,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;;AAoK3D,wBAAkD"}

package/lib/typescript/module/webauthn/passkeyClient.d.ts

@@ -1,20 +0,0 @@
-/**
- * Passkey / WebAuthn ceremony client — clean default (non-web) implementation.
- *
- * This is the base module TypeScript resolves for TYPES and any bundler that
- * does not pick a platform variant. It intentionally imports NOTHING browser-
- * specific (no `@simplewebauthn/browser`) so it stays safe for Metro, native
- * builds, and SSR. The real ceremony lives in `passkeyClient.web.ts`; native
- * passkeys are Commons' job, so there is no WebAuthn ceremony here.
- *
- * `isPasskeySupported()` returns `false` (no relying-party origin / no browser
- * WebAuthn API), and the ceremony helpers throw a clear error so a caller that
- * skipped the support gate fails loudly instead of silently.
- */
-/** Always `false` off the web — there is no relying-party origin or WebAuthn API. */
-export declare function isPasskeySupported(): boolean;
-/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
-export declare function runRegistrationCeremony(_optionsJSON: unknown): Promise<unknown>;
-/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
-export declare function runAuthenticationCeremony(_optionsJSON: unknown): Promise<unknown>;
-//# sourceMappingURL=passkeyClient.d.ts.map

package/lib/typescript/module/webauthn/passkeyClient.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeyClient.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,qFAAqF;AACrF,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,uFAAuF;AACvF,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAED,uFAAuF;AACvF,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF"}

package/lib/typescript/module/webauthn/passkeyClient.native.d.ts

@@ -1,15 +0,0 @@
-/**
- * Passkey / WebAuthn ceremony client — NATIVE implementation.
- *
- * React Native has no browser WebAuthn API, and Oxy's native passkey story is
- * Commons (shared-keychain / QR handoff), NOT `navigator.credentials`. So this
- * variant imports NOTHING browser-specific and mirrors the clean default:
- * unsupported, and the ceremony helpers throw if a caller skipped the gate.
- */
-/** Always `false` on native — there is no browser WebAuthn API. */
-export declare function isPasskeySupported(): boolean;
-/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
-export declare function runRegistrationCeremony(_optionsJSON: unknown): Promise<unknown>;
-/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
-export declare function runAuthenticationCeremony(_optionsJSON: unknown): Promise<unknown>;
-//# sourceMappingURL=passkeyClient.native.d.ts.map

package/lib/typescript/module/webauthn/passkeyClient.native.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeyClient.native.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.native.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,qFAAqF;AACrF,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAED,qFAAqF;AACrF,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF"}

package/lib/typescript/module/webauthn/passkeyClient.web.d.ts

@@ -1,36 +0,0 @@
-/**
- * Passkey / WebAuthn ceremony client — WEB implementation.
- *
- * The browser half of the passkey flow: it drives `navigator.credentials`
- * through `@simplewebauthn/browser`, turning the OPAQUE options the server
- * emitted (`OxyServices.webauthn{Register,Login}Options`) into the opaque
- * response the matching `verify` endpoint consumes. Oxy never owns those wire
- * shapes — `@simplewebauthn/browser` does — so options flow in as `unknown` and
- * the single cast at this boundary hands them to the library's own types.
- *
- * This file is selected ONLY on web (react-native-web / Vite RNW): the sibling
- * `passkeyClient.native.ts` + the clean default `passkeyClient.ts` deliberately
- * do NOT import `@simplewebauthn/browser` (a browser-only dependency), per the
- * platform-split rule. Native passkeys are Commons' job — there is no WebAuthn
- * ceremony off the web.
- */
-import { type RegistrationResponseJSON, type AuthenticationResponseJSON } from '@simplewebauthn/browser';
-/**
- * True iff this browser can run a WebAuthn ceremony (exposes the
- * `PublicKeyCredential` global). Gate all passkey UI/entrypoints on this so an
- * unsupported browser fails loudly rather than throwing mid-ceremony.
- */
-export declare function isPasskeySupported(): boolean;
-/**
- * Run the WebAuthn REGISTRATION ceremony (`navigator.credentials.create`) from
- * the server's opaque creation options, returning the opaque attestation
- * response for `OxyServices.webauthnRegisterVerify`.
- */
-export declare function runRegistrationCeremony(optionsJSON: unknown): Promise<RegistrationResponseJSON>;
-/**
- * Run the WebAuthn AUTHENTICATION ceremony (`navigator.credentials.get`) from
- * the server's opaque request options, returning the opaque assertion response
- * for `OxyServices.webauthnLoginVerify`.
- */
-export declare function runAuthenticationCeremony(optionsJSON: unknown): Promise<AuthenticationResponseJSON>;
-//# sourceMappingURL=passkeyClient.web.d.ts.map

package/lib/typescript/module/webauthn/passkeyClient.web.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeyClient.web.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAEnC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAErC"}

package/src/ui/components/signIn/OxyCreateAccountPanel.tsx

@@ -1,207 +0,0 @@
-/**
- * Creating an Oxy account on the web (ADR 0029 D3), auth.oxy.so's `/signup`:
- *
- *   username → recovery email → the code sent to it → passkey → signed in
- *
- * A web account is a username, a passkey and a recovery email — no password, no
- * phrase, no key. The email is confirmed before the account exists, and is
- * used only to get back in (`OxyRecoverAccountPanel`). Commons stays the way to
- * hold your own key: the first step says so, and linking Commons later makes
- * the account self-custodied and deletes the email.
- *
- * Only on auth.oxy.so: the passkey belongs to that origin (RP ID `oxy.so`,
- * asserted only there), and an app's dialog opens this page in a window
- * (`OxySignUpPanel`'s `onCreateOnWeb`).
- */
-
-import type React from 'react';
-import { useState } from 'react';
-import { Linking, Platform } from 'react-native';
-import { useTheme } from '@oxy.so/bloom/theme';
-import { toast } from '@oxy.so/bloom/toast';
-import { DeviceManager } from '@oxy.so/core';
-import { emailAddressSchema } from '@oxy.so/contracts';
-import { useOxy } from '../../context/OxyContext';
-import { runPasskeyRegisterSignIn } from '../../context/passkeyFlow';
-import { useI18n } from '../../hooks/useI18n';
-import { getCommonsAcquisitionUrl } from '../../utils/commonsStoreLinks';
-import { isPasskeySupported, runRegistrationCeremony } from '../../../webauthn/passkeyClient';
-import { SubtleLink } from '../authChooser/primitives';
-import { OxyAuthScreen, OxyAuthScreenHeader, OxyAuthTerms } from './OxyAuthScreen';
-import {
-  AccountFlowAction,
-  AccountFlowErrorLine,
-  AccountFlowField,
-  EmailCodeStep,
-  describeAccountFlowError,
-  isTicketExpired,
-} from './accountFlowParts';
-
-type Step =
-  | { name: 'username' }
-  | { name: 'email' }
-  | { name: 'code'; verificationId: string }
-  | { name: 'passkey'; emailTicket: string };
-
-export interface OxyCreateAccountPanelProps {
-  /** The account exists and this origin is signed in as it. */
-  onSignedIn: () => void;
-  /** "Already have an account? Sign in". */
-  onSignIn: () => void;
-}
-
-export const OxyCreateAccountPanel: React.FC<OxyCreateAccountPanelProps> = ({ onSignedIn, onSignIn }) => {
-  const theme = useTheme();
-  const { t } = useI18n();
-  const { oxyServices, handleWebSession } = useOxy();
-  const [step, setStep] = useState<Step>({ name: 'username' });
-  const [username, setUsername] = useState('');
-  const [email, setEmail] = useState('');
-  const [pending, setPending] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const run = (work: () => Promise<void>) => {
-    if (pending) return;
-    setError(null);
-    setPending(true);
-    work()
-      .catch((reason: unknown) => {
-        if (isTicketExpired(reason)) setStep({ name: 'email' });
-        setError(describeAccountFlowError(reason, t));
-      })
-      .finally(() => setPending(false));
-  };
-
-  const submitUsername = () => {
-    const handle = username.trim();
-    if (!handle) {
-      setError(t('signup.username.required'));
-      return;
-    }
-    run(async () => {
-      const { available } = await oxyServices.checkUsernameAvailability(handle);
-      if (!available) throw new Error(t('signup.username.taken'));
-      setStep({ name: 'email' });
-    });
-  };
-
-  const sendCode = async (address: string) => {
-    const { verificationId } = await oxyServices.startEmailVerification({ purpose: 'signup', email: address });
-    setStep({ name: 'code', verificationId });
-  };
-
-  const submitEmail = () => {
-    const parsed = emailAddressSchema.safeParse(email);
-    if (!parsed.success) {
-      setError(t('signup.email.invalid'));
-      return;
-    }
-    setEmail(parsed.data);
-    run(() => sendCode(parsed.data));
-  };
-
-  // The ceremony opens the browser's passkey prompt, so it starts from the press.
-  const createPasskey = (emailTicket: string) =>
-    run(() =>
-      runPasskeyRegisterSignIn({
-        isSupported: isPasskeySupported,
-        getRegisterOptions: () => oxyServices.webauthnRegisterOptions({ username: username.trim() }),
-        runCeremony: runRegistrationCeremony,
-        registerVerify: (response) =>
-          oxyServices.webauthnRegisterVerify(response, {
-            username: username.trim(),
-            email,
-            emailTicket,
-            deviceFingerprint: JSON.stringify(DeviceManager.getDeviceFingerprint()),
-          }),
-        commit: async (session) => {
-          await handleWebSession(session);
-          onSignedIn();
-        },
-      }),
-    );
-
-  const getCommons = () => {
-    Promise.resolve()
-      .then(() => Linking.openURL(getCommonsAcquisitionUrl(Platform.OS)))
-      .catch(() => toast.error(t('accountSwitcher.linkOpenFailed')));
-  };
-
-  switch (step.name) {
-    case 'code':
-      return (
-        <EmailCodeStep
-          description={t('emailCode.sentTo', { email })}
-          verificationId={step.verificationId}
-          onConfirmed={({ ticket }) => {
-            setError(null);
-            setStep({ name: 'passkey', emailTicket: ticket });
-          }}
-          onResend={() => sendCode(email)}
-          back={{ label: t('emailCode.changeEmail'), onPress: () => setStep({ name: 'email' }) }}
-        />
-      );
-    case 'passkey':
-      return (
-        <OxyAuthScreen>
-          <OxyAuthScreenHeader title={t('signup.passkey.title')} description={t('signup.passkey.subtitle')} />
-          {error ? <AccountFlowErrorLine message={error} /> : null}
-          <AccountFlowAction
-            label={t('signup.passkey.action')}
-            onPress={() => createPasskey(step.emailTicket)}
-            pending={pending}
-            testID="signup-create-passkey"
-          />
-          <OxyAuthTerms />
-        </OxyAuthScreen>
-      );
-    case 'email':
-      return (
-        <OxyAuthScreen>
-          <OxyAuthScreenHeader title={t('signup.email.title')} description={t('signup.email.subtitle')} />
-          <AccountFlowField
-            label={t('signup.email.label')}
-            value={email}
-            onChange={(value) => {
-              setEmail(value);
-              if (error) setError(null);
-            }}
-            onSubmit={submitEmail}
-            error={error}
-            disabled={pending}
-            placeholder={t('signup.email.placeholder')}
-            autoComplete="email"
-            keyboardType="email-address"
-            testID="signup-email"
-          />
-          <AccountFlowAction label={t('signin.actions.continue')} onPress={submitEmail} pending={pending} testID="signup-email-continue" />
-          <SubtleLink label={t('signin.actions.back')} theme={theme} onPress={() => setStep({ name: 'username' })} testID="signup-back" />
-          <OxyAuthTerms />
-        </OxyAuthScreen>
-      );
-    default:
-      return (
-        <OxyAuthScreen>
-          <OxyAuthScreenHeader title={t('signup.title')} description={t('signup.webSubtitle')} />
-          <AccountFlowField
-            label={t('signup.username.label')}
-            value={username}
-            onChange={(value) => {
-              setUsername(value);
-              if (error) setError(null);
-            }}
-            onSubmit={submitUsername}
-            error={error}
-            disabled={pending}
-            placeholder={t('signup.username.placeholder')}
-            autoComplete="username"
-            testID="signup-username"
-          />
-          <AccountFlowAction label={t('signin.actions.continue')} onPress={submitUsername} pending={pending} testID="signup-username-continue" />
-          <SubtleLink label={t('signup.commonsInstead')} theme={theme} onPress={getCommons} testID="signup-commons-instead" />
-          <SubtleLink label={t('signup.backToSignInLink')} theme={theme} onPress={onSignIn} testID="back-to-sign-in" />
-          <OxyAuthTerms />
-        </OxyAuthScreen>
-      );
-  }
-};