@oxyhq/services 10.0.0 → 10.1.0

package/lib/module/utils/deviceFlowSignIn.js

@@ -0,0 +1,51 @@
+"use strict";
+
+/**
+ * Shared, pure orchestration for completing the cross-app device-flow sign-in
+ * (the QR-code / "Open Oxy Auth" path used on native and web).
+ *
+ * THE BUG THIS FIXES (native): once another authenticated device approves the
+ * pending AuthSession, the originating client is notified (socket / poll /
+ * deep-link) with the authorized `sessionId`. Before any session-management
+ * code can use it, the client MUST exchange the secret 128-bit `sessionToken`
+ * (held only by this client, generated for THIS flow) for the first access
+ * token via `claimSessionByToken` — the device-flow equivalent of OAuth's
+ * code-for-token exchange (RFC 8628 §3.4).
+ *
+ * Skipping the claim leaves the SDK with NO bearer token, so the subsequent
+ * `switchSession` -> `getTokenBySession` (`GET /session/token/:id`) call 401s
+ * against the C1-hardened API: the session is authorized server-side but the
+ * app never becomes authenticated and the UI sits "Waiting for
+ * authorization..." forever. The web `SignInModal` already claimed first; the
+ * native `OxyAuthScreen` did not. Consolidating the claim→switch sequence here
+ * keeps both paths identical and unit-testable, and prevents future drift.
+ */
+
+/**
+ * The minimal `OxyServices` surface this orchestration needs. Kept as a
+ * structural type (rather than importing the full client) so the helper is
+ * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
+ * a test bundle.
+ */
+
+/**
+ * Complete a device-flow sign-in: claim the first access token with the secret
+ * `sessionToken` (planting the bearer), then hydrate the session via
+ * `switchSession`. Returns the authenticated user.
+ *
+ * Throws if either the claim or the switch fails; callers surface a retry UI.
+ */
+export async function completeDeviceFlowSignIn({
+  oxyServices,
+  sessionId,
+  sessionToken,
+  switchSession
+}) {
+  // 1) Plant the bearer + refresh tokens. Without this the bearer-protected
+  //    `getTokenBySession` inside `switchSession` 401s (the native regression).
+  await oxyServices.claimSessionByToken(sessionToken);
+
+  // 2) Bearer is now planted — hydrate the session through the normal path.
+  return switchSession(sessionId);
+}
+//# sourceMappingURL=deviceFlowSignIn.js.map

package/lib/module/utils/deviceFlowSignIn.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["completeDeviceFlowSignIn","oxyServices","sessionId","sessionToken","switchSession","claimSessionByToken"],"sourceRoot":"../../../src","sources":["utils/deviceFlowSignIn.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;;AA4BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeA,wBAAwBA,CAAC;EAC7CC,WAAW;EACXC,SAAS;EACTC,YAAY;EACZC;AAC+B,CAAC,EAAiB;EACjD;EACA;EACA,MAAMH,WAAW,CAACI,mBAAmB,CAACF,YAAY,CAAC;;EAEnD;EACA,OAAOC,aAAa,CAACF,SAAS,CAAC;AACjC","ignoreList":[]}

package/lib/typescript/commonjs/ui/components/SignInModal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAwD/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAsXxB,CAAC;AA8FF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyD/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAwXxB,CAAC;AA8FF,eAAe,WAAW,CAAC"}

package/lib/typescript/commonjs/ui/context/OxyContext.d.ts

@@ -45,7 +45,7 @@ export interface OxyContextState {
     handlePopupSession: (session: SessionLoginResponse) => Promise<void>;
     logout: (targetSessionId?: string) => Promise<void>;
     logoutAll: () => Promise<void>;
-    switchSession: (sessionId: string) => Promise<void>;
+    switchSession: (sessionId: string) => Promise<User>;
     removeSession: (sessionId: string) => Promise<void>;
     refreshSessions: () => Promise<void>;
     setLanguage: (languageId: string) => Promise<void>;

package/lib/typescript/commonjs/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAM/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AA8JD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAy4CzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA4D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAM/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AA8JD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA64CzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA4D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/lib/typescript/commonjs/ui/hooks/mutations/useServicesMutations.d.ts

@@ -1,7 +1,7 @@
 /**
  * Switch active session
  */
-export declare const useSwitchSession: () => import("@tanstack/react-query").UseMutationResult<void, Error, string, unknown>;
+export declare const useSwitchSession: () => import("@tanstack/react-query").UseMutationResult<import("@oxyhq/core").User, Error, string, unknown>;
 /**
  * Logout from a session
  */

package/lib/typescript/commonjs/ui/hooks/mutations/useServicesMutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useServicesMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useServicesMutations.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,eAAO,MAAM,gBAAgB,uFAuB5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB;;EAiD5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,qFAuBxB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,sFAuB/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,yFAoB3B,CAAC"}
+{"version":3,"file":"useServicesMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useServicesMutations.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,eAAO,MAAM,gBAAgB,6GAuB5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB;;EAiD5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,qFAuBxB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,sFAuB/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,yFAoB3B,CAAC"}

package/lib/typescript/commonjs/ui/screens/OxyAuthScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA0F3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAwY5C,CAAC;AA6FF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA2F3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAua5C,CAAC;AA6FF,eAAe,aAAa,CAAC"}

package/lib/typescript/commonjs/utils/deviceFlowSignIn.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Shared, pure orchestration for completing the cross-app device-flow sign-in
+ * (the QR-code / "Open Oxy Auth" path used on native and web).
+ *
+ * THE BUG THIS FIXES (native): once another authenticated device approves the
+ * pending AuthSession, the originating client is notified (socket / poll /
+ * deep-link) with the authorized `sessionId`. Before any session-management
+ * code can use it, the client MUST exchange the secret 128-bit `sessionToken`
+ * (held only by this client, generated for THIS flow) for the first access
+ * token via `claimSessionByToken` — the device-flow equivalent of OAuth's
+ * code-for-token exchange (RFC 8628 §3.4).
+ *
+ * Skipping the claim leaves the SDK with NO bearer token, so the subsequent
+ * `switchSession` -> `getTokenBySession` (`GET /session/token/:id`) call 401s
+ * against the C1-hardened API: the session is authorized server-side but the
+ * app never becomes authenticated and the UI sits "Waiting for
+ * authorization..." forever. The web `SignInModal` already claimed first; the
+ * native `OxyAuthScreen` did not. Consolidating the claim→switch sequence here
+ * keeps both paths identical and unit-testable, and prevents future drift.
+ */
+import type { User } from '@oxyhq/core';
+/**
+ * The minimal `OxyServices` surface this orchestration needs. Kept as a
+ * structural type (rather than importing the full client) so the helper is
+ * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
+ * a test bundle.
+ */
+export interface DeviceFlowClient {
+    /**
+     * Exchange the device-flow `sessionToken` for the first access + refresh
+     * token, planting them on the client. Single-use; replay is rejected by the
+     * API. No bearer required — the high-entropy `sessionToken` IS the credential.
+     */
+    claimSessionByToken: (sessionToken: string) => Promise<unknown>;
+}
+export interface CompleteDeviceFlowSignInOptions {
+    /** The OxyServices client (or any object exposing `claimSessionByToken`). */
+    oxyServices: DeviceFlowClient;
+    /** The authorized device session id, delivered by the socket / poll / link. */
+    sessionId: string;
+    /**
+     * The secret `sessionToken` generated for THIS flow and registered via
+     * `POST /auth/session/create`. Required to claim the first access token.
+     */
+    sessionToken: string;
+    /**
+     * The session-management `switchSession` from `useOxy()`. Hydrates the
+     * activated session (validates, fetches the user, persists, updates state).
+     * Runs AFTER the bearer is planted so its bearer-protected calls succeed.
+     */
+    switchSession: (sessionId: string) => Promise<User>;
+}
+/**
+ * Complete a device-flow sign-in: claim the first access token with the secret
+ * `sessionToken` (planting the bearer), then hydrate the session via
+ * `switchSession`. Returns the authenticated user.
+ *
+ * Throws if either the claim or the switch fails; callers surface a retry UI.
+ */
+export declare function completeDeviceFlowSignIn({ oxyServices, sessionId, sessionToken, switchSession, }: CompleteDeviceFlowSignInOptions): Promise<User>;
+//# sourceMappingURL=deviceFlowSignIn.d.ts.map

package/lib/typescript/commonjs/utils/deviceFlowSignIn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceFlowSignIn.d.ts","sourceRoot":"","sources":["../../../../src/utils/deviceFlowSignIn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,+BAA+B;IAC9C,6EAA6E;IAC7E,WAAW,EAAE,gBAAgB,CAAC;IAC9B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,GACd,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjD"}

package/lib/typescript/module/ui/components/SignInModal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAwD/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAsXxB,CAAC;AA8FF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyD/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAwXxB,CAAC;AA8FF,eAAe,WAAW,CAAC"}

package/lib/typescript/module/ui/context/OxyContext.d.ts

@@ -45,7 +45,7 @@ export interface OxyContextState {
     handlePopupSession: (session: SessionLoginResponse) => Promise<void>;
     logout: (targetSessionId?: string) => Promise<void>;
     logoutAll: () => Promise<void>;
-    switchSession: (sessionId: string) => Promise<void>;
+    switchSession: (sessionId: string) => Promise<User>;
     removeSession: (sessionId: string) => Promise<void>;
     refreshSessions: () => Promise<void>;
     setLanguage: (languageId: string) => Promise<void>;

package/lib/typescript/module/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAM/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AA8JD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAy4CzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA4D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAqBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAM/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AA8JD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA64CzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA4D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/lib/typescript/module/ui/hooks/mutations/useServicesMutations.d.ts

@@ -1,7 +1,7 @@
 /**
  * Switch active session
  */
-export declare const useSwitchSession: () => import("@tanstack/react-query").UseMutationResult<void, Error, string, unknown>;
+export declare const useSwitchSession: () => import("@tanstack/react-query").UseMutationResult<import("@oxyhq/core").User, Error, string, unknown>;
 /**
  * Logout from a session
  */

package/lib/typescript/module/ui/hooks/mutations/useServicesMutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useServicesMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useServicesMutations.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,eAAO,MAAM,gBAAgB,uFAuB5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB;;EAiD5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,qFAuBxB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,sFAuB/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,yFAoB3B,CAAC"}
+{"version":3,"file":"useServicesMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useServicesMutations.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,eAAO,MAAM,gBAAgB,6GAuB5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB;;EAiD5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,qFAuBxB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,sFAuB/B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,yFAoB3B,CAAC"}

package/lib/typescript/module/ui/screens/OxyAuthScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA0F3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAwY5C,CAAC;AA6FF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA2F3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAua5C,CAAC;AA6FF,eAAe,aAAa,CAAC"}

package/lib/typescript/module/utils/deviceFlowSignIn.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Shared, pure orchestration for completing the cross-app device-flow sign-in
+ * (the QR-code / "Open Oxy Auth" path used on native and web).
+ *
+ * THE BUG THIS FIXES (native): once another authenticated device approves the
+ * pending AuthSession, the originating client is notified (socket / poll /
+ * deep-link) with the authorized `sessionId`. Before any session-management
+ * code can use it, the client MUST exchange the secret 128-bit `sessionToken`
+ * (held only by this client, generated for THIS flow) for the first access
+ * token via `claimSessionByToken` — the device-flow equivalent of OAuth's
+ * code-for-token exchange (RFC 8628 §3.4).
+ *
+ * Skipping the claim leaves the SDK with NO bearer token, so the subsequent
+ * `switchSession` -> `getTokenBySession` (`GET /session/token/:id`) call 401s
+ * against the C1-hardened API: the session is authorized server-side but the
+ * app never becomes authenticated and the UI sits "Waiting for
+ * authorization..." forever. The web `SignInModal` already claimed first; the
+ * native `OxyAuthScreen` did not. Consolidating the claim→switch sequence here
+ * keeps both paths identical and unit-testable, and prevents future drift.
+ */
+import type { User } from '@oxyhq/core';
+/**
+ * The minimal `OxyServices` surface this orchestration needs. Kept as a
+ * structural type (rather than importing the full client) so the helper is
+ * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
+ * a test bundle.
+ */
+export interface DeviceFlowClient {
+    /**
+     * Exchange the device-flow `sessionToken` for the first access + refresh
+     * token, planting them on the client. Single-use; replay is rejected by the
+     * API. No bearer required — the high-entropy `sessionToken` IS the credential.
+     */
+    claimSessionByToken: (sessionToken: string) => Promise<unknown>;
+}
+export interface CompleteDeviceFlowSignInOptions {
+    /** The OxyServices client (or any object exposing `claimSessionByToken`). */
+    oxyServices: DeviceFlowClient;
+    /** The authorized device session id, delivered by the socket / poll / link. */
+    sessionId: string;
+    /**
+     * The secret `sessionToken` generated for THIS flow and registered via
+     * `POST /auth/session/create`. Required to claim the first access token.
+     */
+    sessionToken: string;
+    /**
+     * The session-management `switchSession` from `useOxy()`. Hydrates the
+     * activated session (validates, fetches the user, persists, updates state).
+     * Runs AFTER the bearer is planted so its bearer-protected calls succeed.
+     */
+    switchSession: (sessionId: string) => Promise<User>;
+}
+/**
+ * Complete a device-flow sign-in: claim the first access token with the secret
+ * `sessionToken` (planting the bearer), then hydrate the session via
+ * `switchSession`. Returns the authenticated user.
+ *
+ * Throws if either the claim or the switch fails; callers surface a retry UI.
+ */
+export declare function completeDeviceFlowSignIn({ oxyServices, sessionId, sessionToken, switchSession, }: CompleteDeviceFlowSignInOptions): Promise<User>;
+//# sourceMappingURL=deviceFlowSignIn.d.ts.map

package/lib/typescript/module/utils/deviceFlowSignIn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceFlowSignIn.d.ts","sourceRoot":"","sources":["../../../../src/utils/deviceFlowSignIn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,+BAA+B;IAC9C,6EAA6E;IAC7E,WAAW,EAAE,gBAAgB,CAAC;IAC9B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,GACd,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/components/SignInModal.tsx

@@ -35,6 +35,7 @@ import { Loading } from '@oxyhq/bloom/loading';
 import { useOxy } from '../context/OxyContext';
 import OxyLogo from './OxyLogo';
 import { createDebugLogger } from '@oxyhq/core';
+import { completeDeviceFlowSignIn } from '../../utils/deviceFlowSignIn';
 
 const debug = createDebugLogger('SignInModal');
 
@@ -153,16 +154,18 @@ const SignInModal: React.FC = () => {
         isProcessingRef.current = true;
 
         try {
-            // Plant the bearer + refresh tokens for this newly-authorized
-            // session. Single-use — replay attempts on this sessionToken
-            // are rejected by the API.
-            await oxyServices.claimSessionByToken(sessionToken);
-
-            // Now the SDK has a bearer token, the normal session
-            // management path can hydrate state from the sessionId.
-            if (switchSession) {
-                await switchSession(sessionId);
+            // Claim the first access token with the secret sessionToken, then
+            // hydrate the session. Shared with the native `OxyAuthScreen` via
+            // `completeDeviceFlowSignIn` so the two paths cannot drift.
+            if (!switchSession) {
+                throw new Error('Session management unavailable');
             }
+            await completeDeviceFlowSignIn({
+                oxyServices,
+                sessionId,
+                sessionToken,
+                switchSession,
+            });
 
             hideSignInModal();
         } catch (err) {

package/src/ui/context/OxyContext.tsx

@@ -97,7 +97,7 @@ export interface OxyContextState {
   // Session management
   logout: (targetSessionId?: string) => Promise<void>;
   logoutAll: () => Promise<void>;
-  switchSession: (sessionId: string) => Promise<void>;
+  switchSession: (sessionId: string) => Promise<User>;
   removeSession: (sessionId: string) => Promise<void>;
   refreshSessions: () => Promise<void>;
   setLanguage: (languageId: string) => Promise<void>;
@@ -1555,8 +1555,12 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   });
 
   const switchSessionForContext = useCallback(
-    async (sessionId: string): Promise<void> => {
-      await switchSession(sessionId);
+    async (sessionId: string): Promise<User> => {
+      // Propagate the activated user so callers (the device-flow sign-in,
+      // `useSwitchSession`'s cache write, account chooser) receive it. The
+      // underlying session-management `switchSession` already resolves the
+      // `User`; the previous `Promise<void>` wrapper discarded it.
+      return switchSession(sessionId);
     },
     [switchSession],
   );
@@ -1776,7 +1780,7 @@ const LOADING_STATE: OxyContextState = {
   handlePopupSession: () => rejectMissingProvider<void>(),
   logout: () => rejectMissingProvider<void>(),
   logoutAll: () => rejectMissingProvider<void>(),
-  switchSession: () => rejectMissingProvider<void>(),
+  switchSession: () => rejectMissingProvider<User>(),
   removeSession: () => rejectMissingProvider<void>(),
   refreshSessions: () => rejectMissingProvider<void>(),
   setLanguage: () => rejectMissingProvider<void>(),

package/src/ui/screens/OxyAuthScreen.tsx

@@ -30,6 +30,7 @@ import { useOxy } from '../context/OxyContext';
 import QRCode from 'react-native-qrcode-svg';
 import OxyLogo from '../components/OxyLogo';
 import { createDebugLogger } from '@oxyhq/core';
+import { completeDeviceFlowSignIn } from '../../utils/deviceFlowSignIn';
 
 const debug = createDebugLogger('OxyAuthScreen');
 
@@ -119,7 +120,7 @@ const OxyAuthScreen: React.FC<BaseScreenProps> = ({
   theme,
 }) => {
   const bloomTheme = useTheme();
-  const { oxyServices, signIn, switchSession, clientId } = useOxy();
+  const { oxyServices, switchSession, clientId } = useOxy();
 
   const [authSession, setAuthSession] = useState<AuthSession | null>(null);
   const [isLoading, setIsLoading] = useState(true);
@@ -132,25 +133,42 @@ const OxyAuthScreen: React.FC<BaseScreenProps> = ({
   const isProcessingRef = useRef(false);
   const linkingHandledRef = useRef(false);
 
-  // Handle successful authorization
-  const handleAuthSuccess = useCallback(async (sessionId: string) => {
+  // Handle successful authorization.
+  //
+  // The auth-session socket / poll (or deep-link return) hands us the
+  // authorized `sessionId`. Before any session-management code can touch it we
+  // MUST first exchange the secret `sessionToken` (held only by this client,
+  // generated for THIS flow) for the first access token via
+  // `claimSessionByToken` — the device-flow equivalent of OAuth's
+  // code-for-token exchange (RFC 8628 §3.4).
+  //
+  // Without that exchange the SDK has no bearer token, so the subsequent
+  // `switchSession` -> `getTokenBySession` call (`GET /session/token/:id`) 401s
+  // against the C1-hardened API — the session is authorized server-side but the
+  // app never becomes authenticated and the sheet sits "Waiting for
+  // authorization..." forever. Once `claimSessionByToken` plants the tokens in
+  // the HttpService, the rest of the session wiring flows through the normal
+  // `switchSession` path. This mirrors `SignInModal`'s web flow exactly.
+  const handleAuthSuccess = useCallback(async (sessionId: string, sessionToken: string) => {
     if (isProcessingRef.current) return;
     isProcessingRef.current = true;
 
     try {
-      // Switch to the new session (this will get token, user data, and update state)
-      if (switchSession) {
-        const user = await switchSession(sessionId);
-        if (onAuthenticated) {
-          onAuthenticated(user);
-        }
-      } else {
-        // Fallback if switchSession not available (shouldn't happen, but for safety)
-        await oxyServices.getTokenBySession(sessionId);
-        const user = await oxyServices.getUserBySession(sessionId);
-        if (onAuthenticated) {
-          onAuthenticated(user);
-        }
+      // Claim the first access token with the secret sessionToken, then
+      // hydrate the session. The claim step is what the native screen was
+      // previously missing — see `completeDeviceFlowSignIn`. `switchSession`
+      // is always provided by the context here; the helper requires it.
+      if (!switchSession) {
+        throw new Error('Session management unavailable');
+      }
+      const user = await completeDeviceFlowSignIn({
+        oxyServices,
+        sessionId,
+        sessionToken,
+        switchSession,
+      });
+      if (onAuthenticated) {
+        onAuthenticated(user);
       }
     } catch (err) {
       debug.error('Error completing auth:', err);
@@ -189,7 +207,9 @@ const OxyAuthScreen: React.FC<BaseScreenProps> = ({
 
       if (payload.status === 'authorized' && payload.sessionId) {
         cleanup();
-        handleAuthSuccess(payload.sessionId);
+        // `sessionToken` is this flow's secret credential (in closure) — pass
+        // it through so `handleAuthSuccess` can claim the first access token.
+        handleAuthSuccess(payload.sessionId, sessionToken);
       } else if (payload.status === 'cancelled') {
         cleanup();
         setError('Authorization was denied.');
@@ -228,7 +248,9 @@ const OxyAuthScreen: React.FC<BaseScreenProps> = ({
 
         if (response.authorized && response.sessionId) {
           cleanup();
-          handleAuthSuccess(response.sessionId);
+          // Pass the original sessionToken (in closure) through; the claim
+          // exchange needs it to mint the first access token.
+          handleAuthSuccess(response.sessionId, sessionToken);
         } else if (response.status === 'cancelled') {
           cleanup();
           setError('Authorization was denied.');
@@ -379,10 +401,20 @@ const OxyAuthScreen: React.FC<BaseScreenProps> = ({
     }
 
     if (params.sessionId) {
+      // The deep-link return carries only `session_id` — the secret
+      // `sessionToken` for this flow lives in component state (generated in
+      // `generateAuthSession`). Without it we cannot claim the first access
+      // token, so the flow would 401 in `handleAuthSuccess`. If it is somehow
+      // unavailable, fall through to the socket/poll path (which carries the
+      // token in closure) rather than attempting an unauthenticated claim.
+      const flowSessionToken = authSession?.sessionToken;
+      if (!flowSessionToken) {
+        return;
+      }
       cleanup();
-      handleAuthSuccess(params.sessionId);
+      handleAuthSuccess(params.sessionId, flowSessionToken);
     }
-  }, [cleanup, handleAuthSuccess]);
+  }, [authSession, cleanup, handleAuthSuccess]);
 
   useEffect(() => {
     if (Platform.OS === 'web') {

package/src/utils/__tests__/deviceFlowSignIn.test.ts

@@ -0,0 +1,104 @@
+/**
+ * @jest-environment node
+ *
+ * Regression coverage for the NATIVE device-flow sign-in bug:
+ *
+ *   On native, tapping "Sign In with Oxy" opens `OxyAuthScreen`, which creates
+ *   a device-flow AuthSession and opens auth.oxy.so/authorize. The user signs
+ *   in successfully, the API authorizes the session and notifies the client via
+ *   the auth-session socket — but the screen then called `switchSession`
+ *   DIRECTLY without first claiming the bearer with the secret `sessionToken`.
+ *   `switchSession` -> `getTokenBySession` (`GET /session/token/:id`) requires a
+ *   bearer the client did not yet hold, so it 401'd: the session was authorized
+ *   server-side but the app never became authenticated ("nothing happens").
+ *
+ *   The web `SignInModal` already claimed first; the native screen did not.
+ *   `completeDeviceFlowSignIn` consolidates the claim->switch sequence so both
+ *   paths are identical. These tests pin the ORDER (claim before switch) and the
+ *   fail-fast behaviour.
+ */
+
+import type { User } from '@oxyhq/core';
+import {
+  completeDeviceFlowSignIn,
+  type DeviceFlowClient,
+} from '../deviceFlowSignIn';
+
+const SESSION_ID = 'session-id-123';
+const SESSION_TOKEN = 'a'.repeat(32);
+const USER = { id: 'user-1', username: 'nate', privacySettings: {} } as User;
+
+describe('completeDeviceFlowSignIn', () => {
+  it('claims the sessionToken BEFORE switching the session', async () => {
+    const order: string[] = [];
+
+    const oxyServices: DeviceFlowClient = {
+      claimSessionByToken: jest.fn(async (token: string) => {
+        expect(token).toBe(SESSION_TOKEN);
+        order.push('claim');
+      }),
+    };
+    const switchSession = jest.fn(async (sessionId: string): Promise<User> => {
+      expect(sessionId).toBe(SESSION_ID);
+      order.push('switch');
+      return USER;
+    });
+
+    const user = await completeDeviceFlowSignIn({
+      oxyServices,
+      sessionId: SESSION_ID,
+      sessionToken: SESSION_TOKEN,
+      switchSession,
+    });
+
+    expect(order).toEqual(['claim', 'switch']);
+    expect(oxyServices.claimSessionByToken).toHaveBeenCalledWith(SESSION_TOKEN);
+    expect(switchSession).toHaveBeenCalledWith(SESSION_ID);
+    expect(user).toBe(USER);
+  });
+
+  it('does NOT switch the session when the claim fails (the native regression)', async () => {
+    const claimError = new Error('claim failed (401)');
+    const oxyServices: DeviceFlowClient = {
+      claimSessionByToken: jest.fn(async () => {
+        throw claimError;
+      }),
+    };
+    const switchSession = jest.fn(async (): Promise<User> => USER);
+
+    await expect(
+      completeDeviceFlowSignIn({
+        oxyServices,
+        sessionId: SESSION_ID,
+        sessionToken: SESSION_TOKEN,
+        switchSession,
+      }),
+    ).rejects.toThrow('claim failed (401)');
+
+    // The bearer was never planted, so we must not attempt the bearer-protected
+    // switch — surfacing the failure to the caller instead.
+    expect(switchSession).not.toHaveBeenCalled();
+  });
+
+  it('propagates a switchSession failure after a successful claim', async () => {
+    const switchError = new Error('session invalid');
+    const oxyServices: DeviceFlowClient = {
+      claimSessionByToken: jest.fn(async () => undefined),
+    };
+    const switchSession = jest.fn(async (): Promise<User> => {
+      throw switchError;
+    });
+
+    await expect(
+      completeDeviceFlowSignIn({
+        oxyServices,
+        sessionId: SESSION_ID,
+        sessionToken: SESSION_TOKEN,
+        switchSession,
+      }),
+    ).rejects.toThrow('session invalid');
+
+    expect(oxyServices.claimSessionByToken).toHaveBeenCalledTimes(1);
+    expect(switchSession).toHaveBeenCalledTimes(1);
+  });
+});