@oxyhq/services 10.4.0 → 10.5.0

package/lib/typescript/commonjs/ui/components/AnotherDeviceQR.d.ts

@@ -0,0 +1,24 @@
+/**
+ * AnotherDeviceQR — the collapsed "Sign in on another device" disclosure shared
+ * by both sign-in containers (`SignInModal` on web, `OxyAuthScreen` on native).
+ *
+ * The QR code is always DEMOTED below the platform-primary "Continue with Oxy"
+ * action: you cannot scan your own screen, so the QR is only useful for handing
+ * sign-in to a SECOND device (scan with the Oxy Accounts app there). It lives
+ * inside a tap-to-expand disclosure so it never competes with the primary CTA.
+ *
+ * The QR plate stays white intentionally — high contrast is required for
+ * reliable scanning regardless of the app theme.
+ */
+import type React from 'react';
+export interface AnotherDeviceQRProps {
+    /** The QR payload (`oxyauth://<token>`). Empty string renders nothing. */
+    qrData: string;
+}
+/**
+ * Collapsed disclosure that reveals a high-contrast QR for signing in on a
+ * second device with the Oxy Accounts app.
+ */
+declare const AnotherDeviceQR: React.FC<AnotherDeviceQRProps>;
+export default AnotherDeviceQR;
+//# sourceMappingURL=AnotherDeviceQR.d.ts.map

package/lib/typescript/commonjs/ui/components/AnotherDeviceQR.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AnotherDeviceQR.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/AnotherDeviceQR.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,QAAA,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA0CnD,CAAC;AAqCF,eAAe,eAAe,CAAC"}

package/lib/typescript/commonjs/ui/components/SignInModal.d.ts

@@ -1,11 +1,16 @@
 /**
- * SignInModal - Full screen sign-in modal with QR code
+ * SignInModal - Web-first centered sign-in modal (Continue with Oxy)
  *
- * A semi-transparent full-screen modal that displays:
- * - QR code for scanning with Oxy Accounts app
- * - Button to open the Oxy Auth approval page
+ * A semi-transparent full-screen modal whose primary action is the one-tap
+ * "Continue with Oxy" approval flow. The QR code is demoted to a collapsed
+ * "Sign in on another device" disclosure (you can't scan your own screen).
  *
- * Animates with fade-in effect.
+ * ALL of the auth-session machinery (session-token creation, QR data, socket +
+ * polling, waiting/error/retry state, the open-auth handler, deep-link return,
+ * and cleanup) lives in the shared `useOxyAuthSession` hook, which the native
+ * `OxyAuthScreen` also consumes — neither container re-implements the transport.
+ *
+ * Animates with a fade + scale effect.
  */
 import type React from 'react';
 export declare const showSignInModal: () => void;

package/lib/typescript/commonjs/ui/components/SignInModal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyD/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAkYxB,CAAC;AA8FF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAuB/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EA8BxB,CAAC;AAgPF,eAAe,WAAW,CAAC"}

package/lib/typescript/commonjs/ui/hooks/useOxyAuthSession.d.ts

@@ -0,0 +1,83 @@
+/**
+ * useOxyAuthSession — the single shared engine for the cross-app device-flow
+ * sign-in ("Sign in with Oxy") used by BOTH containers:
+ *
+ *   - `SignInModal` (web centered modal)
+ *   - `OxyAuthScreen` (native bottom sheet)
+ *
+ * Before this hook existed, those two files each re-implemented ~90% of the
+ * same auth-session machinery (session-token creation, QR data, socket.io
+ * `/auth-session` subscription, the HTTP polling fallback, waiting/error/retry
+ * state, the open-auth handler, and cleanup) — and they had drifted (notably a
+ * weaker `Math.random()` session token on native vs the crypto-secure one on
+ * web). This hook owns ALL of it ONCE, with a clean typed surface, so the
+ * containers only own their layout. The transport is functionally identical to
+ * the previous implementations — this is a structural de-duplication, not a
+ * behavior change.
+ *
+ * The native-only deep-link return path (`Linking` redirect handling) lives
+ * HERE, gated to native via `Platform.OS`, so the web container never carries
+ * native-only code while the two paths still cannot drift.
+ */
+import type { OxyServices, User } from '@oxyhq/core';
+/**
+ * Default destination for the "Create an Oxy account" / "Get Oxy Accounts"
+ * link, shared by both containers. Reused as-is from the original native
+ * `OxyAuthScreen` so no new route is invented.
+ */
+export declare const OXY_ACCOUNTS_WEB_URL = "https://accounts.oxy.so";
+/** Default central Oxy auth web origin used when no override can be resolved. */
+export declare const OXY_AUTH_WEB_URL = "https://auth.oxy.so";
+/** Auth session expiration (5 minutes). */
+export declare const AUTH_SESSION_EXPIRY_MS: number;
+/** Polling interval (fallback if the socket fails) in milliseconds. */
+export declare const POLLING_INTERVAL_MS = 3000;
+/** The active device-flow session this client created and is waiting on. */
+export interface AuthSession {
+    /** The secret high-entropy token that IS the device-flow credential. */
+    sessionToken: string;
+    /** Epoch ms after which the server rejects this session. */
+    expiresAt: number;
+}
+export interface UseOxyAuthSessionOptions {
+    /**
+     * Called after a fully completed sign-in (bearer claimed, session hydrated).
+     * The web modal closes itself here; the native screen forwards the user to
+     * its `onAuthenticated` prop. The hook itself stays presentation-agnostic.
+     */
+    onSignedIn?: (user: User) => void;
+}
+export interface UseOxyAuthSessionResult {
+    /** The active device-flow session, or `null` before/while it is created. */
+    authSession: AuthSession | null;
+    /** The QR payload string (`oxyauth://<token>`), or `''` when no session. */
+    qrData: string;
+    /** `true` while the session is being created (initial spinner). */
+    isLoading: boolean;
+    /** A user-facing error message, or `null`. Drives the retry UI. */
+    error: string | null;
+    /** `true` once a session exists and we are awaiting authorization. */
+    isWaiting: boolean;
+    /**
+     * Open the central Oxy auth approval surface for THIS device-flow session.
+     * On web this opens a centered approval popup; on native it opens the system
+     * browser (carrying a `redirect_uri` so the deep-link return path can fire).
+     * This is the action behind the platform-primary "Continue with Oxy" button.
+     */
+    openAuthApproval: () => Promise<void>;
+    /** Tear down the current session and create a fresh one (the retry action). */
+    retry: () => void;
+    /** Disconnect the socket and stop polling. Idempotent. */
+    cleanup: () => void;
+}
+/**
+ * Owns the full device-flow auth-session lifecycle for one mounted sign-in
+ * surface. Both `SignInModal` and `OxyAuthScreen` consume this; neither
+ * re-implements the socket / polling / deep-link transport.
+ *
+ * Subscriptions (socket connect/disconnect, the poll interval, the native
+ * deep-link listener, and unmount cleanup) are the legitimate `useEffect` use
+ * WITH cleanup. No effect here computes derived UI state.
+ */
+export declare function useOxyAuthSession(oxyServices: OxyServices, clientId: string | null, switchSession: ((sessionId: string) => Promise<User>) | undefined, options?: UseOxyAuthSessionOptions): UseOxyAuthSessionResult;
+//# sourceMappingURL=useOxyAuthSession.d.ts.map

package/lib/typescript/commonjs/ui/hooks/useOxyAuthSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOxyAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useOxyAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAMrD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAEpD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAoFD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACjE,OAAO,GAAE,wBAA6B,GACrC,uBAAuB,CA0WzB"}

package/lib/typescript/commonjs/ui/screens/OxyAuthScreen.d.ts

@@ -1,14 +1,18 @@
 /**
- * OxyAuthScreen - Sign in with Oxy
+ * OxyAuthScreen - Sign in with Oxy (native bottom-sheet container)
  *
- * This screen is used by OTHER apps in the Oxy ecosystem to authenticate users.
- * It presents two options:
- * 1. Scan QR code with Oxy Accounts app
- * 2. Open the Oxy Auth web flow
+ * Used by OTHER apps in the Oxy ecosystem to authenticate users. The primary
+ * action is the one-tap "Continue with Oxy" approval flow (opens the Oxy Auth
+ * web flow with a deep-link `redirect_uri` so the app→app return path can
+ * complete the sign-in). The QR code is demoted to a collapsed "Sign in on
+ * another device" disclosure — you can't scan your own screen.
  *
- * Uses WebSocket for real-time authorization updates (with polling fallback).
- * The Oxy Accounts app is where users manage their cryptographic identity.
- * This screen should NOT be used within the Accounts app itself.
+ * ALL of the auth-session machinery (session-token creation, QR data, socket +
+ * polling, the native deep-link return path, waiting/error/retry state, the
+ * open-auth handler, and cleanup) lives in the shared `useOxyAuthSession` hook,
+ * which the web `SignInModal` also consumes — neither container re-implements
+ * the transport. The Oxy Accounts app is where users manage their cryptographic
+ * identity; this screen should NOT be used within the Accounts app itself.
  */
 import type React from 'react';
 import type { BaseScreenProps } from '../types/navigation';

package/lib/typescript/commonjs/ui/screens/OxyAuthScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA2F3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAgb5C,CAAC;AA6FF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAyF5C,CAAC;AA8EF,eAAe,aAAa,CAAC"}

package/lib/typescript/module/ui/components/AnotherDeviceQR.d.ts

@@ -0,0 +1,24 @@
+/**
+ * AnotherDeviceQR — the collapsed "Sign in on another device" disclosure shared
+ * by both sign-in containers (`SignInModal` on web, `OxyAuthScreen` on native).
+ *
+ * The QR code is always DEMOTED below the platform-primary "Continue with Oxy"
+ * action: you cannot scan your own screen, so the QR is only useful for handing
+ * sign-in to a SECOND device (scan with the Oxy Accounts app there). It lives
+ * inside a tap-to-expand disclosure so it never competes with the primary CTA.
+ *
+ * The QR plate stays white intentionally — high contrast is required for
+ * reliable scanning regardless of the app theme.
+ */
+import type React from 'react';
+export interface AnotherDeviceQRProps {
+    /** The QR payload (`oxyauth://<token>`). Empty string renders nothing. */
+    qrData: string;
+}
+/**
+ * Collapsed disclosure that reveals a high-contrast QR for signing in on a
+ * second device with the Oxy Accounts app.
+ */
+declare const AnotherDeviceQR: React.FC<AnotherDeviceQRProps>;
+export default AnotherDeviceQR;
+//# sourceMappingURL=AnotherDeviceQR.d.ts.map

package/lib/typescript/module/ui/components/AnotherDeviceQR.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AnotherDeviceQR.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/AnotherDeviceQR.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,QAAA,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA0CnD,CAAC;AAqCF,eAAe,eAAe,CAAC"}

package/lib/typescript/module/ui/components/SignInModal.d.ts

@@ -1,11 +1,16 @@
 /**
- * SignInModal - Full screen sign-in modal with QR code
+ * SignInModal - Web-first centered sign-in modal (Continue with Oxy)
  *
- * A semi-transparent full-screen modal that displays:
- * - QR code for scanning with Oxy Accounts app
- * - Button to open the Oxy Auth approval page
+ * A semi-transparent full-screen modal whose primary action is the one-tap
+ * "Continue with Oxy" approval flow. The QR code is demoted to a collapsed
+ * "Sign in on another device" disclosure (you can't scan your own screen).
  *
- * Animates with fade-in effect.
+ * ALL of the auth-session machinery (session-token creation, QR data, socket +
+ * polling, waiting/error/retry state, the open-auth handler, deep-link return,
+ * and cleanup) lives in the shared `useOxyAuthSession` hook, which the native
+ * `OxyAuthScreen` also consumes — neither container re-implements the transport.
+ *
+ * Animates with a fade + scale effect.
  */
 import type React from 'react';
 export declare const showSignInModal: () => void;

package/lib/typescript/module/ui/components/SignInModal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyD/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAkYxB,CAAC;AA8FF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAuB/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EA8BxB,CAAC;AAgPF,eAAe,WAAW,CAAC"}

package/lib/typescript/module/ui/hooks/useOxyAuthSession.d.ts

@@ -0,0 +1,83 @@
+/**
+ * useOxyAuthSession — the single shared engine for the cross-app device-flow
+ * sign-in ("Sign in with Oxy") used by BOTH containers:
+ *
+ *   - `SignInModal` (web centered modal)
+ *   - `OxyAuthScreen` (native bottom sheet)
+ *
+ * Before this hook existed, those two files each re-implemented ~90% of the
+ * same auth-session machinery (session-token creation, QR data, socket.io
+ * `/auth-session` subscription, the HTTP polling fallback, waiting/error/retry
+ * state, the open-auth handler, and cleanup) — and they had drifted (notably a
+ * weaker `Math.random()` session token on native vs the crypto-secure one on
+ * web). This hook owns ALL of it ONCE, with a clean typed surface, so the
+ * containers only own their layout. The transport is functionally identical to
+ * the previous implementations — this is a structural de-duplication, not a
+ * behavior change.
+ *
+ * The native-only deep-link return path (`Linking` redirect handling) lives
+ * HERE, gated to native via `Platform.OS`, so the web container never carries
+ * native-only code while the two paths still cannot drift.
+ */
+import type { OxyServices, User } from '@oxyhq/core';
+/**
+ * Default destination for the "Create an Oxy account" / "Get Oxy Accounts"
+ * link, shared by both containers. Reused as-is from the original native
+ * `OxyAuthScreen` so no new route is invented.
+ */
+export declare const OXY_ACCOUNTS_WEB_URL = "https://accounts.oxy.so";
+/** Default central Oxy auth web origin used when no override can be resolved. */
+export declare const OXY_AUTH_WEB_URL = "https://auth.oxy.so";
+/** Auth session expiration (5 minutes). */
+export declare const AUTH_SESSION_EXPIRY_MS: number;
+/** Polling interval (fallback if the socket fails) in milliseconds. */
+export declare const POLLING_INTERVAL_MS = 3000;
+/** The active device-flow session this client created and is waiting on. */
+export interface AuthSession {
+    /** The secret high-entropy token that IS the device-flow credential. */
+    sessionToken: string;
+    /** Epoch ms after which the server rejects this session. */
+    expiresAt: number;
+}
+export interface UseOxyAuthSessionOptions {
+    /**
+     * Called after a fully completed sign-in (bearer claimed, session hydrated).
+     * The web modal closes itself here; the native screen forwards the user to
+     * its `onAuthenticated` prop. The hook itself stays presentation-agnostic.
+     */
+    onSignedIn?: (user: User) => void;
+}
+export interface UseOxyAuthSessionResult {
+    /** The active device-flow session, or `null` before/while it is created. */
+    authSession: AuthSession | null;
+    /** The QR payload string (`oxyauth://<token>`), or `''` when no session. */
+    qrData: string;
+    /** `true` while the session is being created (initial spinner). */
+    isLoading: boolean;
+    /** A user-facing error message, or `null`. Drives the retry UI. */
+    error: string | null;
+    /** `true` once a session exists and we are awaiting authorization. */
+    isWaiting: boolean;
+    /**
+     * Open the central Oxy auth approval surface for THIS device-flow session.
+     * On web this opens a centered approval popup; on native it opens the system
+     * browser (carrying a `redirect_uri` so the deep-link return path can fire).
+     * This is the action behind the platform-primary "Continue with Oxy" button.
+     */
+    openAuthApproval: () => Promise<void>;
+    /** Tear down the current session and create a fresh one (the retry action). */
+    retry: () => void;
+    /** Disconnect the socket and stop polling. Idempotent. */
+    cleanup: () => void;
+}
+/**
+ * Owns the full device-flow auth-session lifecycle for one mounted sign-in
+ * surface. Both `SignInModal` and `OxyAuthScreen` consume this; neither
+ * re-implements the socket / polling / deep-link transport.
+ *
+ * Subscriptions (socket connect/disconnect, the poll interval, the native
+ * deep-link listener, and unmount cleanup) are the legitimate `useEffect` use
+ * WITH cleanup. No effect here computes derived UI state.
+ */
+export declare function useOxyAuthSession(oxyServices: OxyServices, clientId: string | null, switchSession: ((sessionId: string) => Promise<User>) | undefined, options?: UseOxyAuthSessionOptions): UseOxyAuthSessionResult;
+//# sourceMappingURL=useOxyAuthSession.d.ts.map

package/lib/typescript/module/ui/hooks/useOxyAuthSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOxyAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useOxyAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAMrD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAEpD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;CACnB;AAWD,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sEAAsE;IACtE,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAoFD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,aAAa,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACjE,OAAO,GAAE,wBAA6B,GACrC,uBAAuB,CA0WzB"}

package/lib/typescript/module/ui/screens/OxyAuthScreen.d.ts

@@ -1,14 +1,18 @@
 /**
- * OxyAuthScreen - Sign in with Oxy
+ * OxyAuthScreen - Sign in with Oxy (native bottom-sheet container)
  *
- * This screen is used by OTHER apps in the Oxy ecosystem to authenticate users.
- * It presents two options:
- * 1. Scan QR code with Oxy Accounts app
- * 2. Open the Oxy Auth web flow
+ * Used by OTHER apps in the Oxy ecosystem to authenticate users. The primary
+ * action is the one-tap "Continue with Oxy" approval flow (opens the Oxy Auth
+ * web flow with a deep-link `redirect_uri` so the app→app return path can
+ * complete the sign-in). The QR code is demoted to a collapsed "Sign in on
+ * another device" disclosure — you can't scan your own screen.
  *
- * Uses WebSocket for real-time authorization updates (with polling fallback).
- * The Oxy Accounts app is where users manage their cryptographic identity.
- * This screen should NOT be used within the Accounts app itself.
+ * ALL of the auth-session machinery (session-token creation, QR data, socket +
+ * polling, the native deep-link return path, waiting/error/retry state, the
+ * open-auth handler, and cleanup) lives in the shared `useOxyAuthSession` hook,
+ * which the web `SignInModal` also consumes — neither container re-implements
+ * the transport. The Oxy Accounts app is where users manage their cryptographic
+ * identity; this screen should NOT be used within the Accounts app itself.
  */
 import type React from 'react';
 import type { BaseScreenProps } from '../types/navigation';

package/lib/typescript/module/ui/screens/OxyAuthScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA2F3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAgb5C,CAAC;AA6FF,eAAe,aAAa,CAAC"}
+{"version":3,"file":"OxyAuthScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/screens/OxyAuthScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,QAAA,MAAM,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAyF5C,CAAC;AA8EF,eAAe,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "10.4.0",
+  "version": "10.5.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/components/AnotherDeviceQR.tsx

@@ -0,0 +1,111 @@
+/**
+ * AnotherDeviceQR — the collapsed "Sign in on another device" disclosure shared
+ * by both sign-in containers (`SignInModal` on web, `OxyAuthScreen` on native).
+ *
+ * The QR code is always DEMOTED below the platform-primary "Continue with Oxy"
+ * action: you cannot scan your own screen, so the QR is only useful for handing
+ * sign-in to a SECOND device (scan with the Oxy Accounts app there). It lives
+ * inside a tap-to-expand disclosure so it never competes with the primary CTA.
+ *
+ * The QR plate stays white intentionally — high contrast is required for
+ * reliable scanning regardless of the app theme.
+ */
+
+import type React from 'react';
+import { useState, useCallback } from 'react';
+import { View, Text, TouchableOpacity, StyleSheet } from 'react-native';
+import QRCode from 'react-native-qrcode-svg';
+import { useTheme } from '@oxyhq/bloom/theme';
+
+export interface AnotherDeviceQRProps {
+  /** The QR payload (`oxyauth://<token>`). Empty string renders nothing. */
+  qrData: string;
+}
+
+/** Size, in px, of the rendered QR symbol. */
+const QR_SIZE = 200;
+
+/**
+ * Collapsed disclosure that reveals a high-contrast QR for signing in on a
+ * second device with the Oxy Accounts app.
+ */
+const AnotherDeviceQR: React.FC<AnotherDeviceQRProps> = ({ qrData }) => {
+  const { colors } = useTheme();
+  const [expanded, setExpanded] = useState(false);
+
+  const toggle = useCallback(() => {
+    setExpanded((prev) => !prev);
+  }, []);
+
+  if (!qrData) {
+    return null;
+  }
+
+  return (
+    <View style={styles.container}>
+      <TouchableOpacity
+        style={styles.toggle}
+        onPress={toggle}
+        accessibilityRole="button"
+        accessibilityState={{ expanded }}
+        accessibilityHint="Reveals a QR code to sign in using the Oxy Accounts app on another device"
+      >
+        <Text style={styles.toggleText} className="text-muted-foreground">
+          Sign in on another device
+        </Text>
+        <Text style={styles.chevron} className="text-muted-foreground">
+          {expanded ? '✕' : '›'}
+        </Text>
+      </TouchableOpacity>
+
+      {expanded && (
+        <View style={styles.body}>
+          {/* The QR plate is intentionally white for scan reliability. */}
+          <View style={[styles.qrPlate, { backgroundColor: '#FFFFFF' }]}>
+            <QRCode value={qrData} size={QR_SIZE} backgroundColor="#FFFFFF" color="#000000" />
+          </View>
+          <Text style={[styles.hint, { color: colors.textSecondary }]}>
+            Scan with the Oxy Accounts app
+          </Text>
+        </View>
+      )}
+    </View>
+  );
+};
+
+const styles = StyleSheet.create({
+  container: {
+    width: '100%',
+    alignItems: 'center',
+  },
+  toggle: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    justifyContent: 'center',
+    paddingVertical: 12,
+    paddingHorizontal: 8,
+  },
+  toggleText: {
+    fontSize: 14,
+    fontWeight: '600',
+  },
+  chevron: {
+    fontSize: 16,
+    marginLeft: 8,
+  },
+  body: {
+    alignItems: 'center',
+    marginTop: 8,
+  },
+  qrPlate: {
+    padding: 16,
+    borderRadius: 16,
+  },
+  hint: {
+    marginTop: 12,
+    fontSize: 12,
+    textAlign: 'center',
+  },
+});
+
+export default AnotherDeviceQR;