@oxyhq/services 12.1.1 → 13.0.0

package/lib/typescript/module/utils/crossApex.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Cross-apex web detection for sign-in durability gating.
+ *
+ * On a web Relying Party whose registrable apex differs from the central Oxy
+ * Identity Provider apex (`oxy.so`), the ONLY sign-in completion that survives a
+ * page reload is the interactive "Continue with Oxy" IdP flow, because it is the
+ * only one that establishes a first-party `fedcm_session` cookie at
+ * `auth.<apex>` — the anchor the cross-domain cold-boot restore reads on reload.
+ *
+ * The other sign-in completions the SDK can drive do NOT plant a `fedcm_session`:
+ *   - password / public-key sign-in mints a bearer directly against the Oxy API
+ *     (its refresh cookie is host-scoped to `api.oxy.so` and `SameSite=Lax`, so
+ *     it is unreachable cross-site from the RP), and
+ *   - the Commons-app device-flow handoff (cross-device QR / same-device
+ *     deep-link) is approved OUTSIDE the browser, so no IdP browser session is
+ *     established.
+ * On a cross-apex RP each of these leaves the user signed in for the current
+ * page only — a reload logs them out. See OxyHQServices AGENTS.md
+ * "Auth / Session Contract".
+ *
+ * Same-apex `*.oxy.so` apps (e.g. `accounts.oxy.so`) are first-party with
+ * `api.oxy.so`: their refresh cookie rides same-site requests so reload restore
+ * works without `fedcm_session`, and they are therefore NOT gated.
+ *
+ * Returns `false` off-browser (React Native has no `window.location`) and for
+ * hosts without a registrable apex (localhost / raw IP / single-label dev
+ * hosts), so native and local development keep every sign-in method.
+ */
+/**
+ * Whether the given host is a web RP on a registrable apex other than the
+ * central Oxy IdP apex (`oxy.so`). See the module doc for why this gates the
+ * non-durable sign-in paths.
+ *
+ * @param hostname - The host to classify. Defaults to the current
+ *   `window.location.hostname`; resolves to `undefined` off-browser (React
+ *   Native / SSR), which yields `false`. The explicit parameter mirrors
+ *   `autoDetectAuthWebUrl(location?)` and keeps the predicate unit-testable
+ *   without manipulating the global `window.location`.
+ */
+export declare function isCrossApexWeb(hostname?: string | undefined): boolean;
+/**
+ * Thrown when an app attempts a direct (non-IdP) sign-in — password or
+ * public-key — on a cross-apex web RP, where such a sign-in would not survive a
+ * page reload because no `fedcm_session` is established (see {@link isCrossApexWeb}).
+ *
+ * Apps on a cross-apex apex must sign in through the interactive
+ * "Continue with Oxy" IdP flow (`OxySignInButton` / `showSignInModal()`), which
+ * plants the durable session.
+ */
+export declare class CrossApexDirectSignInError extends Error {
+    readonly name = "CrossApexDirectSignInError";
+    readonly code = "CROSS_APEX_DIRECT_SIGN_IN_UNSUPPORTED";
+    constructor();
+}
+//# sourceMappingURL=crossApex.d.ts.map

package/lib/typescript/module/utils/crossApex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossApex.d.ts","sourceRoot":"","sources":["../../../../src/utils/crossApex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,SAEN,GACZ,OAAO,CAMT;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,SAAkB,IAAI,gCAAgC;IACtD,QAAQ,CAAC,IAAI,2CAA2C;;CASzD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "12.1.1",
+  "version": "13.0.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -106,7 +106,7 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "0.5.0"
+    "@oxyhq/contracts": "0.6.0"
   },
   "devDependencies": {
     "nativewind": "5.0.0-preview.3",
@@ -152,7 +152,7 @@
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxyhq/bloom": ">=0.16.0",
-    "@oxyhq/core": "^3.17.0",
+    "@oxyhq/core": "^4.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@tanstack/query-async-storage-persister": "^5.100",

package/src/index.ts

@@ -180,6 +180,10 @@ export {
     extractErrorMessage,
 } from './ui/utils/errorHandlers';
 export type { HandleAuthErrorOptions } from './ui/utils/errorHandlers';
+// Thrown by `signInWithPassword` / `signIn` on a cross-apex web RP, where a
+// direct (non-IdP) sign-in would not survive a page reload — apps catch it to
+// route the user to the durable "Continue with Oxy" IdP flow.
+export { CrossApexDirectSignInError, isCrossApexWeb } from './utils/crossApex';
 
 // ---------------------------------------------------------------------------
 // File filtering
@@ -201,15 +205,23 @@ export type { FollowButtonProps, SingleFollowButtonProps, MultiFollowButtonProps
 export { LogoIcon } from './ui/components/logo/LogoIcon';
 export { LogoText } from './ui/components/logo/LogoText';
 
-// Acting-as banner for managed accounts
-export { default as ActingAsBanner } from './ui/components/ActingAsBanner';
+// Subtle "active account" context cue for the account graph (not Commons/DID).
+// Shows which account is active when the user has switched into a non-personal
+// account; reads as the current account, not as delegation.
+export { default as ActiveAccountBanner } from './ui/components/ActiveAccountBanner';
 
-// Unified account menu (popover on web, bottom-sheet style modal on native)
+// Unified account menu (device-only switcher — popover on web, sheet on native)
 export { default as AccountMenu } from './ui/components/AccountMenu';
 export type { AccountMenuProps, AccountMenuAnchor } from './ui/components/AccountMenu';
 export { default as AccountMenuButton } from './ui/components/AccountMenuButton';
 export type { AccountMenuButtonProps } from './ui/components/AccountMenuButton';
 
+// Unified account switcher (device sign-ins + account graph). `AccountMenuButton`
+// opens this; the `AccountSwitcherView` body also backs the `AccountSwitcher`
+// bottom-sheet route.
+export { default as AccountSwitcher, AccountSwitcherView } from './ui/components/AccountSwitcher';
+export type { AccountSwitcherProps, AccountSwitcherActions } from './ui/components/AccountSwitcher';
+
 // Unified device-account hook (hydrates every signed-in account on the device
 // with real name/email/avatar/color for the account switcher).
 export { useDeviceAccounts } from './ui/hooks/useDeviceAccounts';
@@ -219,12 +231,18 @@ export type {
     UseDeviceAccountsResult,
 } from './ui/hooks/useDeviceAccounts';
 
-// Unified "Manage your Oxy Account" screen
+// Unified "Manage your Oxy Account" screen (the caller's own personal account)
 export { default as ManageAccountScreen } from './ui/screens/ManageAccountScreen';
 export { default as NotificationsScreen } from './ui/screens/NotificationsScreen';
 export { default as PreferencesScreen } from './ui/screens/PreferencesScreen';
 export { default as ConnectedAppsScreen } from './ui/screens/ConnectedAppsScreen';
 
+// Account-graph screens (organization / project / bot accounts)
+export { default as AccountSwitcherScreen } from './ui/screens/AccountSwitcherScreen';
+export { default as CreateAccountScreen } from './ui/screens/CreateAccountScreen';
+export { default as AccountMembersScreen } from './ui/screens/AccountMembersScreen';
+export { default as AccountSettingsScreen } from './ui/screens/AccountSettingsScreen';
+
 // ---------------------------------------------------------------------------
 // Bottom-sheet navigation
 // ---------------------------------------------------------------------------

package/src/ui/components/AccountMenuButton.tsx

@@ -3,9 +3,11 @@ import { useCallback, useRef, useState } from 'react';
 import { TouchableOpacity, StyleSheet, Platform, type LayoutChangeEvent } from 'react-native';
 import { getAccountDisplayName } from '@oxyhq/core';
 import Avatar from './Avatar';
-import AccountMenu, { type AccountMenuAnchor } from './AccountMenu';
+import AccountSwitcher from './AccountSwitcher';
+import type { AccountMenuAnchor } from './AccountMenu';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from '../hooks/useI18n';
+import { showBottomSheet } from '../navigation/bottomSheetManager';
 
 export interface AccountMenuButtonProps {
     /** Avatar size (px). Defaults to 36 (Google account chip size). */
@@ -19,18 +21,27 @@ export interface AccountMenuButtonProps {
 const isWeb = Platform.OS === 'web';
 
 /**
- * Avatar entry-point that opens the unified {@link AccountMenu}. Reads the
- * active account from `useOxy()` — never receive user data via props.
+ * Avatar entry-point that opens the unified {@link AccountSwitcher}. Reads the
+ * EFFECTIVE active account from `useOxy().activeAccount` — never receives user
+ * data via props.
  *
- * Renders a small avatar chip (top-right friendly). Click → opens AccountMenu.
- * Pure component: owns only the open-state and the trigger's measured anchor.
+ * The chip reflects the account the user is currently switched into (an org /
+ * project / bot / shared account) exactly as it reflects their personal account:
+ * a switch makes the whole app — including this header avatar — become that
+ * account. `activeAccount` falls back to the personal user when no switch is
+ * active, so the chip always shows the current account.
+ *
+ * Renders a small avatar chip (top-right friendly). Click → opens the switcher
+ * (device sign-ins + account graph). Pure component: owns only the open-state
+ * and the trigger's measured anchor. Create-account and per-account settings
+ * route through the global bottom-sheet manager.
  */
 const AccountMenuButton: React.FC<AccountMenuButtonProps> = ({
     size = 36,
     onNavigateManage,
     onAddAccount,
 }) => {
-    const { user, oxyServices, isAuthenticated } = useOxy();
+    const { activeAccount, oxyServices, isAuthenticated } = useOxy();
     const { t, locale } = useI18n();
     const [open, setOpen] = useState(false);
     const [anchor, setAnchor] = useState<AccountMenuAnchor | null>(null);
@@ -66,9 +77,9 @@ const AccountMenuButton: React.FC<AccountMenuButtonProps> = ({
         }
     }, [measureAnchor, open]);
 
-    const displayName = getAccountDisplayName(user, locale);
-    const avatarUri = user?.avatar
-        ? oxyServices.getFileDownloadUrl(user.avatar, 'thumb')
+    const displayName = getAccountDisplayName(activeAccount, locale);
+    const avatarUri = activeAccount?.avatar
+        ? oxyServices.getFileDownloadUrl(activeAccount.avatar, 'thumb')
         : undefined;
 
     const accessibilityLabel = isAuthenticated
@@ -91,11 +102,15 @@ const AccountMenuButton: React.FC<AccountMenuButtonProps> = ({
             >
                 <Avatar uri={avatarUri} name={displayName} size={size} />
             </TouchableOpacity>
-            <AccountMenu
+            <AccountSwitcher
                 open={open}
                 onClose={handleClose}
                 onNavigateManage={onNavigateManage}
                 onAddAccount={onAddAccount}
+                onCreateAccount={() => showBottomSheet('CreateAccount')}
+                onOpenAccountSettings={(accountId) =>
+                    showBottomSheet({ screen: 'AccountSettings', props: { accountId } })
+                }
                 anchor={anchor}
             />
         </>