@oxyhq/services 13.2.0 → 14.0.0

package/lib/commonjs/ui/session/index.js

@@ -0,0 +1,52 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "accountIdsOf", {
+  enumerable: true,
+  get: function () {
+    return _projectSessionState.accountIdsOf;
+  }
+});
+Object.defineProperty(exports, "activeSessionIdOf", {
+  enumerable: true,
+  get: function () {
+    return _projectSessionState.activeSessionIdOf;
+  }
+});
+Object.defineProperty(exports, "activeUserOf", {
+  enumerable: true,
+  get: function () {
+    return _projectSessionState.activeUserOf;
+  }
+});
+Object.defineProperty(exports, "createSessionClient", {
+  enumerable: true,
+  get: function () {
+    return _createSessionClient.createSessionClient;
+  }
+});
+Object.defineProperty(exports, "createSessionClientHost", {
+  enumerable: true,
+  get: function () {
+    return _sessionClientHost.createSessionClientHost;
+  }
+});
+Object.defineProperty(exports, "createTokenTransport", {
+  enumerable: true,
+  get: function () {
+    return _tokenTransport.createTokenTransport;
+  }
+});
+Object.defineProperty(exports, "deviceStateToClientSessions", {
+  enumerable: true,
+  get: function () {
+    return _projectSessionState.deviceStateToClientSessions;
+  }
+});
+var _createSessionClient = require("./createSessionClient.js");
+var _sessionClientHost = require("./sessionClientHost.js");
+var _tokenTransport = require("./tokenTransport.js");
+var _projectSessionState = require("./projectSessionState.js");
+//# sourceMappingURL=index.js.map

package/lib/commonjs/ui/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_createSessionClient","require","_sessionClientHost","_tokenTransport","_projectSessionState"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,IAAAA,oBAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAD,OAAA;AACA,IAAAE,eAAA,GAAAF,OAAA;AACA,IAAAG,oBAAA,GAAAH,OAAA","ignoreList":[]}

package/lib/commonjs/ui/session/projectSessionState.js

@@ -0,0 +1,86 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.accountIdsOf = accountIdsOf;
+exports.activeSessionIdOf = activeSessionIdOf;
+exports.activeUserOf = activeUserOf;
+exports.deviceStateToClientSessions = deviceStateToClientSessions;
+/**
+ * Pure projection helpers: `DeviceSessionState` (the device-scoped
+ * multi-account session-sync state produced by `@oxyhq/core`'s
+ * `SessionClient`) -> the shapes `OxyContext` renders today
+ * (`ClientSession[]`, an active session id, an active `User`).
+ *
+ * No I/O. The caller fetches profiles via
+ * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
+ * from the result before calling `deviceStateToClientSessions` /
+ * `activeUserOf`.
+ */
+
+/**
+ * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
+ *
+ * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
+ * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
+ * wire value is an epoch-ms number) as a provisional value. Fase 3-B
+ * rewrites `ClientSession` to make `expiresAt`/`lastActive` optional (they
+ * are not derivable from `DeviceSessionState`).
+ *
+ * `usersById` is accepted for signature symmetry with `activeUserOf` even
+ * though `ClientSession` only stores `userId` — a session is still
+ * projected for an account whose id is absent from `usersById` (no
+ * placeholder user is fabricated).
+ */
+function deviceStateToClientSessions(state, usersById) {
+  const provisionalTimestamp = new Date(state.updatedAt).toISOString();
+  return state.accounts.map(account => ({
+    sessionId: account.sessionId,
+    deviceId: state.deviceId,
+    // provisional: Fase 3-B rewrites ClientSession to make expiresAt/lastActive
+    // optional (they are not in DeviceSessionState)
+    expiresAt: provisionalTimestamp,
+    lastActive: provisionalTimestamp,
+    userId: account.accountId,
+    isCurrent: account.accountId === state.activeAccountId,
+    authuser: account.authuser
+  }));
+}
+
+/**
+ * The active account's `sessionId`, or `null` when there is no state or no
+ * active account is set.
+ */
+function activeSessionIdOf(state) {
+  if (state === null || state.activeAccountId === null) {
+    return null;
+  }
+  const activeAccountId = state.activeAccountId;
+  const activeAccount = state.accounts.find(account => account.accountId === activeAccountId);
+  return activeAccount?.sessionId ?? null;
+}
+
+/**
+ * The active account's `User`, resolved from `usersById`. `null` when there
+ * is no state, no active account is set, or the active account id is absent
+ * from `usersById`.
+ */
+function activeUserOf(state, usersById) {
+  if (state === null || state.activeAccountId === null) {
+    return null;
+  }
+  return usersById.get(state.activeAccountId) ?? null;
+}
+
+/**
+ * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
+ * fetch. `[]` for `null` state.
+ */
+function accountIdsOf(state) {
+  if (state === null) {
+    return [];
+  }
+  return state.accounts.map(account => account.accountId);
+}
+//# sourceMappingURL=projectSessionState.js.map

package/lib/commonjs/ui/session/projectSessionState.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["deviceStateToClientSessions","state","usersById","provisionalTimestamp","Date","updatedAt","toISOString","accounts","map","account","sessionId","deviceId","expiresAt","lastActive","userId","accountId","isCurrent","activeAccountId","authuser","activeSessionIdOf","activeAccount","find","activeUserOf","get","accountIdsOf"],"sourceRoot":"../../../../src","sources":["ui/session/projectSessionState.ts"],"mappings":";;;;;;;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,2BAA2BA,CACzCC,KAAyB,EACzBC,SAA4B,EACX;EACjB,MAAMC,oBAAoB,GAAG,IAAIC,IAAI,CAACH,KAAK,CAACI,SAAS,CAAC,CAACC,WAAW,CAAC,CAAC;EACpE,OAAOL,KAAK,CAACM,QAAQ,CAACC,GAAG,CAAEC,OAAO,KAAM;IACtCC,SAAS,EAAED,OAAO,CAACC,SAAS;IAC5BC,QAAQ,EAAEV,KAAK,CAACU,QAAQ;IACxB;IACA;IACAC,SAAS,EAAET,oBAAoB;IAC/BU,UAAU,EAAEV,oBAAoB;IAChCW,MAAM,EAAEL,OAAO,CAACM,SAAS;IACzBC,SAAS,EAAEP,OAAO,CAACM,SAAS,KAAKd,KAAK,CAACgB,eAAe;IACtDC,QAAQ,EAAET,OAAO,CAACS;EACpB,CAAC,CAAC,CAAC;AACL;;AAEA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAAClB,KAAgC,EAAiB;EACjF,IAAIA,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACgB,eAAe,KAAK,IAAI,EAAE;IACpD,OAAO,IAAI;EACb;EACA,MAAMA,eAAe,GAAGhB,KAAK,CAACgB,eAAe;EAC7C,MAAMG,aAAa,GAAGnB,KAAK,CAACM,QAAQ,CAACc,IAAI,CAAEZ,OAAO,IAAKA,OAAO,CAACM,SAAS,KAAKE,eAAe,CAAC;EAC7F,OAAOG,aAAa,EAAEV,SAAS,IAAI,IAAI;AACzC;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASY,YAAYA,CAC1BrB,KAAgC,EAChCC,SAA4B,EACf;EACb,IAAID,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACgB,eAAe,KAAK,IAAI,EAAE;IACpD,OAAO,IAAI;EACb;EACA,OAAOf,SAAS,CAACqB,GAAG,CAACtB,KAAK,CAACgB,eAAe,CAAC,IAAI,IAAI;AACrD;;AAEA;AACA;AACA;AACA;AACO,SAASO,YAAYA,CAACvB,KAAgC,EAAY;EACvE,IAAIA,KAAK,KAAK,IAAI,EAAE;IAClB,OAAO,EAAE;EACX;EACA,OAAOA,KAAK,CAACM,QAAQ,CAACC,GAAG,CAAEC,OAAO,IAAKA,OAAO,CAACM,SAAS,CAAC;AAC3D","ignoreList":[]}

package/lib/commonjs/ui/session/sessionClientHost.js

@@ -0,0 +1,30 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createSessionClientHost = createSessionClientHost;
+/**
+ * Thin `SessionClientHost` adapter over an `OxyServices` instance.
+ *
+ * `SessionClient` (in `@oxyhq/core`) is host-agnostic: it only needs a REST +
+ * token surface. `OxyServices` already exposes all of that except
+ * `getCurrentAccountId`, which has no direct equivalent — the adapter holds a
+ * mutable ref set by the caller (`OxyContext`, in Fase 3-B) via
+ * `setCurrentAccountId`.
+ */
+function createSessionClientHost(oxyServices) {
+  let currentAccountId = null;
+  return {
+    makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
+    getBaseURL: () => oxyServices.getBaseURL(),
+    getAccessToken: () => oxyServices.getAccessToken(),
+    onTokensChanged: listener => oxyServices.onTokensChanged(listener),
+    setTokens: accessToken => oxyServices.setTokens(accessToken),
+    getCurrentAccountId: () => currentAccountId,
+    setCurrentAccountId: id => {
+      currentAccountId = id;
+    }
+  };
+}
+//# sourceMappingURL=sessionClientHost.js.map

package/lib/commonjs/ui/session/sessionClientHost.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createSessionClientHost","oxyServices","currentAccountId","makeRequest","method","url","data","options","getBaseURL","getAccessToken","onTokensChanged","listener","setTokens","accessToken","getCurrentAccountId","setCurrentAccountId","id"],"sourceRoot":"../../../../src","sources":["ui/session/sessionClientHost.ts"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,uBAAuBA,CACrCC,WAAwB,EAC8C;EACtE,IAAIC,gBAA+B,GAAG,IAAI;EAC1C,OAAO;IACLC,WAAW,EAAEA,CAACC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,OAAO,KAAKN,WAAW,CAACE,WAAW,CAACC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,OAAO,CAAC;IAChGC,UAAU,EAAEA,CAAA,KAAMP,WAAW,CAACO,UAAU,CAAC,CAAC;IAC1CC,cAAc,EAAEA,CAAA,KAAMR,WAAW,CAACQ,cAAc,CAAC,CAAC;IAClDC,eAAe,EAAGC,QAAQ,IAAKV,WAAW,CAACS,eAAe,CAACC,QAAQ,CAAC;IACpEC,SAAS,EAAGC,WAAW,IAAKZ,WAAW,CAACW,SAAS,CAACC,WAAW,CAAC;IAC9DC,mBAAmB,EAAEA,CAAA,KAAMZ,gBAAgB;IAC3Ca,mBAAmB,EAAGC,EAAE,IAAK;MAC3Bd,gBAAgB,GAAGc,EAAE;IACvB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/tokenTransport.js

@@ -0,0 +1,77 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createTokenTransport = createTokenTransport;
+var _core = require("@oxyhq/core");
+var _useWebSSO = require("../hooks/useWebSSO.js");
+/**
+ * Platform `TokenTransport` for `SessionClient`: mints an access token when
+ * none is currently held, reusing the SAME primitives `OxyContext`'s cold
+ * boot already relies on (never re-implemented here):
+ *
+ * - web: `oxyServices.silentSignIn()` (per-apex `/auth/silent` iframe).
+ * - native: `oxyServices.signInWithSharedIdentity()` (app-group keychain).
+ *
+ * Both primitives plant the token internally on success (the "Sign-In Token
+ * Planting" rule) — `ensureActiveToken` never calls `setTokens` itself.
+ *
+ * `ensureActiveToken` treats a PRESENT token as sufficient in this phase; it
+ * does not decode/match the token's subject against `state.activeAccountId`
+ * (that refinement is Fase 3-B). Account switching itself is server-driven
+ * via the `activeToken` carried in the sync envelope — this transport is
+ * only the fallback used when the envelope carried no token.
+ *
+ * A failed mint is logged and swallowed: it must never throw out of
+ * `ensureActiveToken`, since that would crash the caller (the SessionClient
+ * socket handler in Fase 3-B).
+ */
+function createTokenTransport(oxyServices) {
+  // Coalesces concurrent mints: `SessionClient.applyState` can fire
+  // `ensureActiveToken` on rapid successive state pushes; a second call while a
+  // mint is already in flight must reuse it, not spawn a second silent iframe /
+  // shared-key challenge round-trip.
+  let inFlightMint = null;
+  return {
+    async ensureActiveToken(state) {
+      // Read the current token defensively: it is an in-memory getter that
+      // should never throw, but the documented contract is that this method
+      // never throws out — so a surprising throw is logged and treated as "no
+      // token" (fall through to mint) rather than rejecting the promise.
+      try {
+        if (oxyServices.getAccessToken()) {
+          return;
+        }
+      } catch (error) {
+        _core.logger.warn('ensureActiveToken: getAccessToken threw', {
+          component: 'TokenTransport'
+        }, error);
+      }
+      if (inFlightMint) {
+        return inFlightMint;
+      }
+      inFlightMint = (async () => {
+        try {
+          const session = (0, _useWebSSO.isWebBrowser)() ? await oxyServices.silentSignIn() : await oxyServices.signInWithSharedIdentity();
+          if (!session) {
+            _core.logger.debug('ensureActiveToken: platform mint returned no session', {
+              component: 'TokenTransport',
+              deviceId: state.deviceId
+            });
+          }
+        } catch (error) {
+          _core.logger.warn('ensureActiveToken: mint failed', {
+            component: 'TokenTransport'
+          }, error);
+        }
+      })();
+      try {
+        await inFlightMint;
+      } finally {
+        inFlightMint = null;
+      }
+    }
+  };
+}
+//# sourceMappingURL=tokenTransport.js.map

package/lib/commonjs/ui/session/tokenTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","_useWebSSO","createTokenTransport","oxyServices","inFlightMint","ensureActiveToken","state","getAccessToken","error","logger","warn","component","session","isWebBrowser","silentSignIn","signInWithSharedIdentity","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,UAAA,GAAAD,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,oBAAoBA,CAACC,WAAwB,EAAkB;EAC7E;EACA;EACA;EACA;EACA,IAAIC,YAAkC,GAAG,IAAI;EAE7C,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE;MACA;MACA;MACA;MACA,IAAI;QACF,IAAIH,WAAW,CAACI,cAAc,CAAC,CAAC,EAAE;UAChC;QACF;MACF,CAAC,CAAC,OAAOC,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,yCAAyC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MAChG;MAEA,IAAIJ,YAAY,EAAE;QAChB,OAAOA,YAAY;MACrB;MAEAA,YAAY,GAAG,CAAC,YAAY;QAC1B,IAAI;UACF,MAAMQ,OAAO,GAAG,IAAAC,uBAAY,EAAC,CAAC,GAC1B,MAAMV,WAAW,CAACW,YAAY,CAAC,CAAC,GAChC,MAAMX,WAAW,CAACY,wBAAwB,CAAC,CAAC;UAEhD,IAAI,CAACH,OAAO,EAAE;YACZH,YAAM,CAACO,KAAK,CAAC,sDAAsD,EAAE;cACnEL,SAAS,EAAE,gBAAgB;cAC3BM,QAAQ,EAAEX,KAAK,CAACW;YAClB,CAAC,CAAC;UACJ;QACF,CAAC,CAAC,OAAOT,KAAK,EAAE;UACdC,YAAM,CAACC,IAAI,CAAC,gCAAgC,EAAE;YAAEC,SAAS,EAAE;UAAiB,CAAC,EAAEH,KAAK,CAAC;QACvF;MACF,CAAC,EAAE,CAAC;MAEJ,IAAI;QACF,MAAMJ,YAAY;MACpB,CAAC,SAAS;QACRA,YAAY,GAAG,IAAI;MACrB;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/utils/activeAuthuser.js

@@ -3,53 +3,41 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.ACTIVE_AUTHUSER_KEY = void 0;
-exports.clearActiveAuthuser = clearActiveAuthuser;
 exports.clearSignedOut = clearSignedOut;
 exports.clearSsoBounceState = clearSsoBounceState;
 exports.isSilentRestoreSuppressed = isSilentRestoreSuppressed;
 exports.markSignedOut = markSignedOut;
 exports.readActiveAuthuser = readActiveAuthuser;
-exports.writeActiveAuthuser = writeActiveAuthuser;
 var _core = require("@oxyhq/core");
 /**
- * Web-only persistence of the active multi-account slot index.
+ * Web-only helpers around the retired `oxy_rt_${authuser}` multi-slot
+ * refresh-cookie scheme, PLUS the (unrelated, still load-bearing) deliberate
+ * sign-out / SSO-bounce gates.
  *
- * Google-style multi-account sign-in stores ONE refresh cookie per device
- * slot (`oxy_rt_${authuser}`, where `authuser` is an integer 0..N). The
- * server's `/auth/refresh-all` returns one entry per valid cookie; the
- * client must remember WHICH slot is currently active across reloads so
- * that the cold-boot snapshot resolves to the user's last selection
- * rather than always defaulting to slot 0.
- *
- * The persisted value is JUST the slot INDEX (a small integer) — never an
- * access token, refresh token, session id, or any user-identifying secret.
- * It is read by both `OxyContext` (cold-boot active selection) and the
- * session-management / auth-operations hooks (switch / logout).
+ * NOTE (session-sync cutover, Task 5): the device account SET is now
+ * server-authoritative via `SessionClient` (`@oxyhq/core`) — nothing in
+ * `@oxyhq/services` writes the persisted active-`authuser`-slot key anymore
+ * (`writeActiveAuthuser`/`clearActiveAuthuser` were deleted; their only
+ * callers were the deleted `establishDeviceRefreshSlot` sign-in registration
+ * and the deleted `switchToAccount`/`switchSession` slot bookkeeping).
+ * {@link readActiveAuthuser} is KEPT purely as an OPTIONAL restore hint:
+ * `OxyContext`'s `restoreStoredSession` cold-boot step reads it only to
+ * backfill `clientSession.authuser` for the active session when a legacy value
+ * happens to be present. It NO LONGER gates whether restore is attempted — the
+ * old guard that also required this marker made every web reload with a lapsed
+ * local bearer bail before any network validation (P0), and was replaced by a
+ * "bail only when there is nothing to restore" guard plus a valid-session
+ * election. Since nothing writes the key anymore, the backfill is dormant on
+ * fresh installs; it stays for legacy installs and costs nothing.
  *
  * Native (React Native) has no equivalent of these device-local cookies
  * and uses bearer-protected session ids directly, so these helpers no-op
  * outside the browser.
  */
 
-const ACTIVE_AUTHUSER_KEY = exports.ACTIVE_AUTHUSER_KEY = 'oxy_active_authuser';
-
-/**
- * Safely resolve `window.localStorage`, returning `null` when it is
- * unavailable. The PROPERTY ACCESS itself (`window.localStorage`) can throw a
- * `SecurityError` synchronously in opaque-origin / sandboxed iframes or when
- * storage is disabled — even `typeof window.localStorage` evaluates the getter
- * and throws. Every read/write in this module routes through here so the getter
- * throw is caught once, at the source, and callers stay clean. Returns `null`
- * off-web and on any access failure (fail safe).
- */
-function getLocalStorage() {
-  if (typeof window === 'undefined') return null;
-  try {
-    return window.localStorage ?? null;
-  } catch {
-    return null;
-  }
+const ACTIVE_AUTHUSER_KEY = 'oxy_active_authuser';
+function hasLocalStorage() {
+  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined';
 }
 function getSessionStorage() {
   if (typeof window === 'undefined') return null;
@@ -68,12 +56,11 @@ function getSessionStorage() {
  * fall back to deterministic selection (lowest authuser).
  */
 function readActiveAuthuser() {
-  const storage = getLocalStorage();
-  if (!storage) {
+  if (!hasLocalStorage()) {
     return null;
   }
   try {
-    const raw = storage.getItem(ACTIVE_AUTHUSER_KEY);
+    const raw = window.localStorage.getItem(ACTIVE_AUTHUSER_KEY);
     if (raw === null) return null;
     const parsed = Number.parseInt(raw, 10);
     if (!Number.isFinite(parsed) || parsed < 0) return null;
@@ -83,50 +70,18 @@ function readActiveAuthuser() {
   }
 }
 
-/**
- * Persist the active `authuser` slot index. No-ops on native and on any
- * storage failure (e.g. Safari private mode). Callers MUST NOT depend on
- * this succeeding — it is best-effort UX persistence, not authoritative.
- */
-function writeActiveAuthuser(authuser) {
-  if (!Number.isFinite(authuser) || authuser < 0) return;
-  const storage = getLocalStorage();
-  if (!storage) return;
-  try {
-    storage.setItem(ACTIVE_AUTHUSER_KEY, String(authuser));
-  } catch {
-    // Best-effort persistence; swallow QuotaExceededError / SecurityError.
-  }
-}
-
-/**
- * Clear the persisted active `authuser` slot index. Called on full sign-out
- * (logoutAll) so that the next cold boot doesn't try to resurrect a
- * cleared slot.
- */
-function clearActiveAuthuser() {
-  const storage = getLocalStorage();
-  if (!storage) return;
-  try {
-    storage.removeItem(ACTIVE_AUTHUSER_KEY);
-  } catch {
-    // Best-effort.
-  }
-}
-
 /**
  * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
  * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
  * the next cold boot does NOT silently re-mint a session from a still-live IdP
- * session (`fedcm-silent` / per-apex `/auth/silent` iframe). Cleared by any
+ * session (the per-apex `/auth/silent` iframe cold-boot step). Cleared by any
  * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
  * failure (best-effort).
  */
 function markSignedOut() {
-  const storage = getLocalStorage();
-  if (!storage) return;
+  if (!hasLocalStorage()) return;
   try {
-    storage.setItem((0, _core.ssoSignedOutKey)(window.location.origin), '1');
+    window.localStorage.setItem((0, _core.ssoSignedOutKey)(window.location.origin), '1');
   } catch {
     // Best-effort; swallow QuotaExceededError / SecurityError (private mode).
   }
@@ -134,15 +89,14 @@ function markSignedOut() {
 
 /**
  * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
- * sign-in (password, FedCM, account switch, device claim) so a real sign-in
+ * sign-in (password, account switch, device claim) so a real sign-in
  * fully re-enables automatic silent restore — there is no "stuck signed out"
  * state. No-ops on native / storage failure.
  */
 function clearSignedOut() {
-  const storage = getLocalStorage();
-  if (!storage) return;
+  if (!hasLocalStorage()) return;
   try {
-    storage.removeItem((0, _core.ssoSignedOutKey)(window.location.origin));
+    window.localStorage.removeItem((0, _core.ssoSignedOutKey)(window.location.origin));
   } catch {
     // Best-effort.
   }
@@ -153,12 +107,14 @@ function clearSignedOut() {
  * the user deliberately signed out. Reads the durable flag through the core
  * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
  * storage failure (fail safe toward normal restore). Used to gate the
- * `fedcm-silent` and `silent-iframe` cold-boot steps.
+ * `silent-iframe` cold-boot step.
  */
 function isSilentRestoreSuppressed() {
-  const storage = getLocalStorage();
-  if (!storage) return false;
-  return (0, _core.silentRestoreSuppressed)(storage, window.location.origin);
+  // Unlike its try/catch-wrapped siblings this reads `window.location.origin`
+  // directly, so guard it: an RN polyfill can expose `localStorage` without a
+  // `location`, which would throw here. Fail safe toward normal restore.
+  if (!hasLocalStorage() || typeof window.location === 'undefined') return false;
+  return (0, _core.silentRestoreSuppressed)(window.localStorage, window.location.origin);
 }
 
 /**

package/lib/commonjs/ui/utils/activeAuthuser.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","ACTIVE_AUTHUSER_KEY","exports","getLocalStorage","window","localStorage","getSessionStorage","sessionStorage","readActiveAuthuser","storage","raw","getItem","parsed","Number","parseInt","isFinite","writeActiveAuthuser","authuser","setItem","String","clearActiveAuthuser","removeItem","markSignedOut","ssoSignedOutKey","location","origin","clearSignedOut","isSilentRestoreSuppressed","silentRestoreSuppressed","clearSsoBounceState","ssoAttemptedKey","ssoNoSessionKey","ssoGuardKey","ssoStateKey","ssoDestKey"],"sourceRoot":"../../../../src","sources":["ui/utils/activeAuthuser.ts"],"mappings":";;;;;;;;;;;;;AAoBA,IAAAA,KAAA,GAAAC,OAAA;AApBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA,MAAMC,mBAAmB,GAAAC,OAAA,CAAAD,mBAAA,GAAG,qBAAqB;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASE,eAAeA,CAAA,EAAmB;EACzC,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE,OAAO,IAAI;EAC9C,IAAI;IACF,OAAOA,MAAM,CAACC,YAAY,IAAI,IAAI;EACpC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;AAEA,SAASC,iBAAiBA,CAAA,EAAmB;EAC3C,IAAI,OAAOF,MAAM,KAAK,WAAW,EAAE,OAAO,IAAI;EAC9C,IAAI;IACF,OAAOA,MAAM,CAACG,cAAc,IAAI,IAAI;EACtC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAAA,EAAkB;EAClD,MAAMC,OAAO,GAAGN,eAAe,CAAC,CAAC;EACjC,IAAI,CAACM,OAAO,EAAE;IACZ,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMC,GAAG,GAAGD,OAAO,CAACE,OAAO,CAACV,mBAAmB,CAAC;IAChD,IAAIS,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;IAC7B,MAAME,MAAM,GAAGC,MAAM,CAACC,QAAQ,CAACJ,GAAG,EAAE,EAAE,CAAC;IACvC,IAAI,CAACG,MAAM,CAACE,QAAQ,CAACH,MAAM,CAAC,IAAIA,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;IACvD,OAAOA,MAAM;EACf,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASI,mBAAmBA,CAACC,QAAgB,EAAQ;EAC1D,IAAI,CAACJ,MAAM,CAACE,QAAQ,CAACE,QAAQ,CAAC,IAAIA,QAAQ,GAAG,CAAC,EAAE;EAChD,MAAMR,OAAO,GAAGN,eAAe,CAAC,CAAC;EACjC,IAAI,CAACM,OAAO,EAAE;EACd,IAAI;IACFA,OAAO,CAACS,OAAO,CAACjB,mBAAmB,EAAEkB,MAAM,CAACF,QAAQ,CAAC,CAAC;EACxD,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASG,mBAAmBA,CAAA,EAAS;EAC1C,MAAMX,OAAO,GAAGN,eAAe,CAAC,CAAC;EACjC,IAAI,CAACM,OAAO,EAAE;EACd,IAAI;IACFA,OAAO,CAACY,UAAU,CAACpB,mBAAmB,CAAC;EACzC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASqB,aAAaA,CAAA,EAAS;EACpC,MAAMb,OAAO,GAAGN,eAAe,CAAC,CAAC;EACjC,IAAI,CAACM,OAAO,EAAE;EACd,IAAI;IACFA,OAAO,CAACS,OAAO,CAAC,IAAAK,qBAAe,EAACnB,MAAM,CAACoB,QAAQ,CAACC,MAAM,CAAC,EAAE,GAAG,CAAC;EAC/D,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,cAAcA,CAAA,EAAS;EACrC,MAAMjB,OAAO,GAAGN,eAAe,CAAC,CAAC;EACjC,IAAI,CAACM,OAAO,EAAE;EACd,IAAI;IACFA,OAAO,CAACY,UAAU,CAAC,IAAAE,qBAAe,EAACnB,MAAM,CAACoB,QAAQ,CAACC,MAAM,CAAC,CAAC;EAC7D,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,yBAAyBA,CAAA,EAAY;EACnD,MAAMlB,OAAO,GAAGN,eAAe,CAAC,CAAC;EACjC,IAAI,CAACM,OAAO,EAAE,OAAO,KAAK;EAC1B,OAAO,IAAAmB,6BAAuB,EAACnB,OAAO,EAAEL,MAAM,CAACoB,QAAQ,CAACC,MAAM,CAAC;AACjE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,mBAAmBA,CAAA,EAAS;EAC1C,MAAMpB,OAAO,GAAGH,iBAAiB,CAAC,CAAC;EACnC,IAAI,CAACG,OAAO,EAAE;EACd,IAAI;IACF,MAAMgB,MAAM,GAAGrB,MAAM,CAACoB,QAAQ,CAACC,MAAM;IACrChB,OAAO,CAACY,UAAU,CAAC,IAAAS,qBAAe,EAACL,MAAM,CAAC,CAAC;IAC3ChB,OAAO,CAACY,UAAU,CAAC,IAAAU,qBAAe,EAACN,MAAM,CAAC,CAAC;IAC3ChB,OAAO,CAACY,UAAU,CAAC,IAAAW,iBAAW,EAACP,MAAM,CAAC,CAAC;IACvChB,OAAO,CAACY,UAAU,CAAC,IAAAY,iBAAW,EAACR,MAAM,CAAC,CAAC;IACvChB,OAAO,CAACY,UAAU,CAAC,IAAAa,gBAAU,EAACT,MAAM,CAAC,CAAC;EACxC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ","ignoreList":[]}
+{"version":3,"names":["_core","require","ACTIVE_AUTHUSER_KEY","hasLocalStorage","window","localStorage","getSessionStorage","sessionStorage","readActiveAuthuser","raw","getItem","parsed","Number","parseInt","isFinite","markSignedOut","setItem","ssoSignedOutKey","location","origin","clearSignedOut","removeItem","isSilentRestoreSuppressed","silentRestoreSuppressed","clearSsoBounceState","storage","ssoAttemptedKey","ssoNoSessionKey","ssoGuardKey","ssoStateKey","ssoDestKey"],"sourceRoot":"../../../../src","sources":["ui/utils/activeAuthuser.ts"],"mappings":";;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AA1BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA,MAAMC,mBAAmB,GAAG,qBAAqB;AAEjD,SAASC,eAAeA,CAAA,EAAY;EAClC,OAAO,OAAOC,MAAM,KAAK,WAAW,IAAI,OAAOA,MAAM,CAACC,YAAY,KAAK,WAAW;AACpF;AAEA,SAASC,iBAAiBA,CAAA,EAAmB;EAC3C,IAAI,OAAOF,MAAM,KAAK,WAAW,EAAE,OAAO,IAAI;EAC9C,IAAI;IACF,OAAOA,MAAM,CAACG,cAAc,IAAI,IAAI;EACtC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAAA,EAAkB;EAClD,IAAI,CAACL,eAAe,CAAC,CAAC,EAAE;IACtB,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMM,GAAG,GAAGL,MAAM,CAACC,YAAY,CAACK,OAAO,CAACR,mBAAmB,CAAC;IAC5D,IAAIO,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;IAC7B,MAAME,MAAM,GAAGC,MAAM,CAACC,QAAQ,CAACJ,GAAG,EAAE,EAAE,CAAC;IACvC,IAAI,CAACG,MAAM,CAACE,QAAQ,CAACH,MAAM,CAAC,IAAIA,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;IACvD,OAAOA,MAAM;EACf,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,aAAaA,CAAA,EAAS;EACpC,IAAI,CAACZ,eAAe,CAAC,CAAC,EAAE;EACxB,IAAI;IACFC,MAAM,CAACC,YAAY,CAACW,OAAO,CAAC,IAAAC,qBAAe,EAACb,MAAM,CAACc,QAAQ,CAACC,MAAM,CAAC,EAAE,GAAG,CAAC;EAC3E,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,cAAcA,CAAA,EAAS;EACrC,IAAI,CAACjB,eAAe,CAAC,CAAC,EAAE;EACxB,IAAI;IACFC,MAAM,CAACC,YAAY,CAACgB,UAAU,CAAC,IAAAJ,qBAAe,EAACb,MAAM,CAACc,QAAQ,CAACC,MAAM,CAAC,CAAC;EACzE,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,yBAAyBA,CAAA,EAAY;EACnD;EACA;EACA;EACA,IAAI,CAACnB,eAAe,CAAC,CAAC,IAAI,OAAOC,MAAM,CAACc,QAAQ,KAAK,WAAW,EAAE,OAAO,KAAK;EAC9E,OAAO,IAAAK,6BAAuB,EAACnB,MAAM,CAACC,YAAY,EAAED,MAAM,CAACc,QAAQ,CAACC,MAAM,CAAC;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,mBAAmBA,CAAA,EAAS;EAC1C,MAAMC,OAAO,GAAGnB,iBAAiB,CAAC,CAAC;EACnC,IAAI,CAACmB,OAAO,EAAE;EACd,IAAI;IACF,MAAMN,MAAM,GAAGf,MAAM,CAACc,QAAQ,CAACC,MAAM;IACrCM,OAAO,CAACJ,UAAU,CAAC,IAAAK,qBAAe,EAACP,MAAM,CAAC,CAAC;IAC3CM,OAAO,CAACJ,UAAU,CAAC,IAAAM,qBAAe,EAACR,MAAM,CAAC,CAAC;IAC3CM,OAAO,CAACJ,UAAU,CAAC,IAAAO,iBAAW,EAACT,MAAM,CAAC,CAAC;IACvCM,OAAO,CAACJ,UAAU,CAAC,IAAAQ,iBAAW,EAACV,MAAM,CAAC,CAAC;IACvCM,OAAO,CAACJ,UAAU,CAAC,IAAAS,gBAAU,EAACX,MAAM,CAAC,CAAC;EACxC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ","ignoreList":[]}

package/lib/commonjs/ui/utils/sessionHelpers.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.validateSessionBatch = exports.mapSessionsToClient = exports.fetchSessionsWithFallback = void 0;
+exports.mapSessionsToClient = exports.fetchSessionsWithFallback = void 0;
 /**
  * Service type for session helpers.
  * Uses 'unknown' to work around TypeScript mixin composition type inference issues.
@@ -57,55 +57,5 @@ const fetchSessionsWithFallback = async (oxyServices, sessionId, {
     return mapSessionsToClient(userSessions, fallbackDeviceId, fallbackUserId);
   }
 };
-
-/**
- * Validate multiple sessions concurrently with configurable concurrency.
- *
- * @param oxyServices - Oxy service instance
- * @param sessionIds - Session identifiers to validate
- * @param options - Validation options
- */
 exports.fetchSessionsWithFallback = fetchSessionsWithFallback;
-const validateSessionBatch = async (oxyServices, sessionIds, {
-  useHeaderValidation = true,
-  maxConcurrency = 5
-} = {}) => {
-  if (!sessionIds.length) {
-    return [];
-  }
-  const uniqueSessionIds = Array.from(new Set(sessionIds));
-  const safeConcurrency = Math.max(1, Math.min(maxConcurrency, uniqueSessionIds.length));
-  const results = [];
-  let index = 0;
-  const worker = async () => {
-    while (index < uniqueSessionIds.length) {
-      const currentIndex = index;
-      index += 1;
-      const sessionId = uniqueSessionIds[currentIndex];
-      try {
-        const validation = await oxyServices.validateSession(sessionId, {
-          useHeaderValidation
-        });
-        const valid = Boolean(validation?.valid);
-        results.push({
-          sessionId,
-          valid,
-          user: validation?.user,
-          raw: validation
-        });
-      } catch (error) {
-        results.push({
-          sessionId,
-          valid: false,
-          error
-        });
-      }
-    }
-  };
-  await Promise.all(Array.from({
-    length: safeConcurrency
-  }, worker));
-  return results;
-};
-exports.validateSessionBatch = validateSessionBatch;
 //# sourceMappingURL=sessionHelpers.js.map

package/lib/commonjs/ui/utils/sessionHelpers.js.map

@@ -1 +1 @@
-{"version":3,"names":["mapSessionsToClient","sessions","fallbackDeviceId","fallbackUserId","now","Date","map","session","sessionId","deviceId","expiresAt","getTime","toISOString","lastActive","userId","user","id","_id","toString","undefined","isCurrent","Boolean","exports","fetchSessionsWithFallback","oxyServices","logger","deviceSessions","getDeviceSessions","error","__DEV__","userSessions","getSessionsBySessionId","validateSessionBatch","sessionIds","useHeaderValidation","maxConcurrency","length","uniqueSessionIds","Array","from","Set","safeConcurrency","Math","max","min","results","index","worker","currentIndex","validation","validateSession","valid","push","raw","Promise","all"],"sourceRoot":"../../../../src","sources":["ui/utils/sessionHelpers.ts"],"mappings":";;;;;;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMA,mBAAmB,GAAGA,CACjCC,QAAyB,EACzBC,gBAAyB,EACzBC,cAAuB,KACH;EACpB,MAAMC,GAAG,GAAG,IAAIC,IAAI,CAAC,CAAC;EAEtB,OAAOJ,QAAQ,CAACK,GAAG,CAAEC,OAAO,KAAM;IAChCC,SAAS,EAAED,OAAO,CAACC,SAAS;IAC5BC,QAAQ,EAAEF,OAAO,CAACE,QAAQ,IAAIP,gBAAgB,IAAI,EAAE;IACpDQ,SAAS,EAAEH,OAAO,CAACG,SAAS,IAAI,IAAIL,IAAI,CAACD,GAAG,CAACO,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAACC,WAAW,CAAC,CAAC;IAC/FC,UAAU,EAAEN,OAAO,CAACM,UAAU,IAAIT,GAAG,CAACQ,WAAW,CAAC,CAAC;IACnDE,MAAM,EACJP,OAAO,CAACQ,IAAI,EAAEC,EAAE,IAChBT,OAAO,CAACO,MAAM,KACbP,OAAO,CAACQ,IAAI,EAAEE,GAAG,GAAGV,OAAO,CAACQ,IAAI,CAACE,GAAG,CAACC,QAAQ,CAAC,CAAC,GAAGC,SAAS,CAAC,IAC7DhB,cAAc,IACd,EAAE;IACJiB,SAAS,EAAEC,OAAO,CAACd,OAAO,CAACa,SAAS;EACtC,CAAC,CAAC,CAAC;AACL,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AARAE,OAAA,CAAAtB,mBAAA,GAAAA,mBAAA;AASO,MAAMuB,yBAAyB,GAAG,MAAAA,CACvCC,WAA2B,EAC3BhB,SAAiB,EACjB;EACEN,gBAAgB;EAChBC,cAAc;EACdsB;AACgC,CAAC,GAAG,CAAC,CAAC,KACX;EAC7B,IAAI;IACF,MAAMC,cAAc,GAAG,MAAMF,WAAW,CAACG,iBAAiB,CAACnB,SAAS,CAAC;IACrE,OAAOR,mBAAmB,CAAC0B,cAAc,EAAExB,gBAAgB,EAAEC,cAAc,CAAC;EAC9E,CAAC,CAAC,OAAOyB,KAAK,EAAE;IACd,IAAIC,OAAO,IAAIJ,MAAM,EAAE;MACrBA,MAAM,CAAC,8DAA8D,EAAEG,KAAK,CAAC;IAC/E;IAEA,MAAME,YAAY,GAAG,MAAMN,WAAW,CAACO,sBAAsB,CAACvB,SAAS,CAAC;IACxE,OAAOR,mBAAmB,CAAC8B,YAAY,EAAE5B,gBAAgB,EAAEC,cAAc,CAAC;EAC5E;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AANAmB,OAAA,CAAAC,yBAAA,GAAAA,yBAAA;AAOO,MAAMS,oBAAoB,GAAG,MAAAA,CAClCR,WAA2B,EAC3BS,UAAoB,EACpB;EAAEC,mBAAmB,GAAG,IAAI;EAAEC,cAAc,GAAG;AAA+B,CAAC,GAAG,CAAC,CAAC,KAC7C;EACvC,IAAI,CAACF,UAAU,CAACG,MAAM,EAAE;IACtB,OAAO,EAAE;EACX;EAEA,MAAMC,gBAAgB,GAAGC,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAACP,UAAU,CAAC,CAAC;EACxD,MAAMQ,eAAe,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC,EAAED,IAAI,CAACE,GAAG,CAACT,cAAc,EAAEE,gBAAgB,CAACD,MAAM,CAAC,CAAC;EACtF,MAAMS,OAAkC,GAAG,EAAE;EAC7C,IAAIC,KAAK,GAAG,CAAC;EAEb,MAAMC,MAAM,GAAG,MAAAA,CAAA,KAAY;IACzB,OAAOD,KAAK,GAAGT,gBAAgB,CAACD,MAAM,EAAE;MACtC,MAAMY,YAAY,GAAGF,KAAK;MAC1BA,KAAK,IAAI,CAAC;MACV,MAAMtC,SAAS,GAAG6B,gBAAgB,CAACW,YAAY,CAAC;MAEhD,IAAI;QACF,MAAMC,UAAU,GAAG,MAAMzB,WAAW,CAAC0B,eAAe,CAAC1C,SAAS,EAAE;UAAE0B;QAAoB,CAAC,CAAC;QACxF,MAAMiB,KAAK,GAAG9B,OAAO,CAAC4B,UAAU,EAAEE,KAAK,CAAC;QAExCN,OAAO,CAACO,IAAI,CAAC;UACX5C,SAAS;UACT2C,KAAK;UACLpC,IAAI,EAAEkC,UAAU,EAAElC,IAAI;UACtBsC,GAAG,EAAEJ;QACP,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOrB,KAAK,EAAE;QACdiB,OAAO,CAACO,IAAI,CAAC;UACX5C,SAAS;UACT2C,KAAK,EAAE,KAAK;UACZvB;QACF,CAAC,CAAC;MACJ;IACF;EACF,CAAC;EAED,MAAM0B,OAAO,CAACC,GAAG,CAACjB,KAAK,CAACC,IAAI,CAAC;IAAEH,MAAM,EAAEK;EAAgB,CAAC,EAAEM,MAAM,CAAC,CAAC;EAElE,OAAOF,OAAO;AAChB,CAAC;AAACvB,OAAA,CAAAU,oBAAA,GAAAA,oBAAA","ignoreList":[]}
+{"version":3,"names":["mapSessionsToClient","sessions","fallbackDeviceId","fallbackUserId","now","Date","map","session","sessionId","deviceId","expiresAt","getTime","toISOString","lastActive","userId","user","id","_id","toString","undefined","isCurrent","Boolean","exports","fetchSessionsWithFallback","oxyServices","logger","deviceSessions","getDeviceSessions","error","__DEV__","userSessions","getSessionsBySessionId"],"sourceRoot":"../../../../src","sources":["ui/utils/sessionHelpers.ts"],"mappings":";;;;;;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMA,mBAAmB,GAAGA,CACjCC,QAAyB,EACzBC,gBAAyB,EACzBC,cAAuB,KACH;EACpB,MAAMC,GAAG,GAAG,IAAIC,IAAI,CAAC,CAAC;EAEtB,OAAOJ,QAAQ,CAACK,GAAG,CAAEC,OAAO,KAAM;IAChCC,SAAS,EAAED,OAAO,CAACC,SAAS;IAC5BC,QAAQ,EAAEF,OAAO,CAACE,QAAQ,IAAIP,gBAAgB,IAAI,EAAE;IACpDQ,SAAS,EAAEH,OAAO,CAACG,SAAS,IAAI,IAAIL,IAAI,CAACD,GAAG,CAACO,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAACC,WAAW,CAAC,CAAC;IAC/FC,UAAU,EAAEN,OAAO,CAACM,UAAU,IAAIT,GAAG,CAACQ,WAAW,CAAC,CAAC;IACnDE,MAAM,EACJP,OAAO,CAACQ,IAAI,EAAEC,EAAE,IAChBT,OAAO,CAACO,MAAM,KACbP,OAAO,CAACQ,IAAI,EAAEE,GAAG,GAAGV,OAAO,CAACQ,IAAI,CAACE,GAAG,CAACC,QAAQ,CAAC,CAAC,GAAGC,SAAS,CAAC,IAC7DhB,cAAc,IACd,EAAE;IACJiB,SAAS,EAAEC,OAAO,CAACd,OAAO,CAACa,SAAS;EACtC,CAAC,CAAC,CAAC;AACL,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AARAE,OAAA,CAAAtB,mBAAA,GAAAA,mBAAA;AASO,MAAMuB,yBAAyB,GAAG,MAAAA,CACvCC,WAA2B,EAC3BhB,SAAiB,EACjB;EACEN,gBAAgB;EAChBC,cAAc;EACdsB;AACgC,CAAC,GAAG,CAAC,CAAC,KACX;EAC7B,IAAI;IACF,MAAMC,cAAc,GAAG,MAAMF,WAAW,CAACG,iBAAiB,CAACnB,SAAS,CAAC;IACrE,OAAOR,mBAAmB,CAAC0B,cAAc,EAAExB,gBAAgB,EAAEC,cAAc,CAAC;EAC9E,CAAC,CAAC,OAAOyB,KAAK,EAAE;IACd,IAAIC,OAAO,IAAIJ,MAAM,EAAE;MACrBA,MAAM,CAAC,8DAA8D,EAAEG,KAAK,CAAC;IAC/E;IAEA,MAAME,YAAY,GAAG,MAAMN,WAAW,CAACO,sBAAsB,CAACvB,SAAS,CAAC;IACxE,OAAOR,mBAAmB,CAAC8B,YAAY,EAAE5B,gBAAgB,EAAEC,cAAc,CAAC;EAC5E;AACF,CAAC;AAACmB,OAAA,CAAAC,yBAAA,GAAAA,yBAAA","ignoreList":[]}