@oxyhq/services 13.3.0 → 14.0.1

package/lib/typescript/commonjs/ui/hooks/useSwitchableAccounts.d.ts

@@ -0,0 +1,162 @@
+import type { User, AccountNode, AccountRelationship, AccountKind, AccountMember } from '@oxyhq/core';
+/**
+ * The per-account user shape carried by a {@link SwitchableAccount}. The SDK's
+ * canonical {@link User} document — either the freshest `useOxy().user` (the
+ * active row), a profile resolved via `oxyServices.getUsersByIds()` (every other
+ * device row), or the `account` document embedded in an account-graph node.
+ */
+export type SwitchableAccountUser = User;
+/**
+ * One account the signed-in user can switch INTO, in the uniform switch model.
+ *
+ * A switchable account is either a device sign-in, an account-graph node (owned
+ * org / shared-with-you), or BOTH (an account that has been switched into
+ * becomes a device session while still being a graph node — the two are deduped
+ * into a single row). Every row carries a canonical `accountId` (the uniform
+ * switch key passed to `switchToAccount`); `sessionId` is present IFF the
+ * account is currently signed in on THIS device.
+ */
+export interface SwitchableAccount {
+    /**
+     * Canonical account id (the underlying `User._id`). The single key EVERY
+     * switch uses — `switchToAccount(accountId)`. Always present.
+     */
+    accountId: string;
+    /**
+     * Device session id, present IFF this account is signed in on THIS device.
+     * Absent for a graph account not yet switched into. Used only for
+     * device-scoped actions (per-account sign-out via `removeSession`); switching
+     * ALWAYS goes through `switchToAccount(accountId)`.
+     */
+    sessionId?: string;
+    /**
+     * Device-local refresh-cookie slot index (0..N-1), when the underlying
+     * `ClientSession` carries one (web silent-switch). Absent on native and for
+     * graph-only rows.
+     */
+    authuser?: number;
+    /** Whether this account is the currently-active one. */
+    isCurrent: boolean;
+    /** Whether this account is signed in on THIS device (has a `sessionId`). */
+    onDevice: boolean;
+    /**
+     * The caller's relationship to this account when it appears in the account
+     * graph: `self` (the caller's own personal account), `owner` (an org/project/
+     * bot the caller owns), or `member` (shared with the caller). Absent for an
+     * independent device sign-in that is NOT in the active account's graph.
+     */
+    relationship?: AccountRelationship;
+    /** Account classification (personal/organization/…). Cosmetic badge only. */
+    kind?: AccountKind;
+    /** Parent account id for 2-level tree grouping, or `null` for a root. */
+    parentAccountId?: string | null;
+    /**
+     * The caller's effective membership (role + permissions) in this account when
+     * it appears in the graph, or `null`/absent otherwise. Use `permissions` to
+     * gate per-account settings UI.
+     */
+    callerMembership?: AccountMember | null;
+    /** Friendly display name (never blank — falls back to a handle/sentinel). */
+    displayName: string;
+    /**
+     * Real account email, or `null` when the account genuinely has none. NEVER a
+     * synthesized `username@oxy.so` — a missing email falls back to the `@handle`
+     * secondary line.
+     */
+    email: string | null;
+    /** Resolved avatar thumbnail URL, or `undefined` when the account has no avatar. */
+    avatarUrl?: string;
+    /** Account's preferred Bloom color preset, or `null` when unset. */
+    color: string | null;
+    /** The underlying per-account user payload. */
+    user: SwitchableAccountUser;
+}
+export interface UseSwitchableAccountsResult {
+    /** Every switchable account (device sign-ins + linked graph accounts). */
+    accounts: SwitchableAccount[];
+    /** True until the per-device-account profile fetch settles. */
+    isLoading: boolean;
+    /** The currently-active session id (mirrors `useOxy().activeSessionId`). */
+    currentSessionId: string | null;
+}
+/** The minimal device-session shape {@link buildSwitchableAccounts} reads. */
+export interface SwitchableSessionInput {
+    sessionId: string;
+    userId?: string;
+    authuser?: number;
+}
+export interface BuildSwitchableAccountsInput {
+    /** Device sessions projected from the server-authoritative `SessionClient`. */
+    sessions: SwitchableSessionInput[];
+    /** The currently-active session id. */
+    activeSessionId: string | null;
+    /** The freshest copy of the active account's user (`useOxy().user`). */
+    liveUser: User | null;
+    isAuthenticated: boolean;
+    /** The account graph under the active account (`useOxy().accounts`). */
+    graph: AccountNode[];
+    /** Per-device-account profiles resolved via `getUsersByIds()`, keyed by id. */
+    profilesById: Map<string, User>;
+    locale: string;
+    /** Resolves a file id to a thumbnail URL (bound to `getFileDownloadUrl`). */
+    resolveAvatarUrl: (avatar: string | null | undefined) => string | undefined;
+}
+/**
+ * Resolve which entries are the current account, robustly.
+ *
+ * Primary signal: `entry.sessionId === activeSessionId` — both are projected
+ * from the same `SessionClient` state, so this normally matches exactly.
+ * Fallbacks exist only to bridge the brief window between the two sequential
+ * `updateSessions` / `setActiveSessionId` calls in `OxyContext.syncFromClient`,
+ * applied only when the `sessionId` match found nothing AND the user is
+ * authenticated:
+ *  1. Match the live `user.id` against each entry's per-account user id.
+ *  2. If still nothing and there is exactly one account, mark that one current.
+ *
+ * At most ONE entry is ever marked current. Runs over DEVICE rows only (graph
+ * rows are never active — the active account is always a device session), so the
+ * single-account fallback counts device rows.
+ *
+ * Pure & side-effect free so it is unit-testable without rendering React.
+ */
+export declare function markCurrentAccount(accounts: SwitchableAccount[], activeSessionId: string | null | undefined, liveUserId: string | null | undefined, isAuthenticated: boolean): SwitchableAccount[];
+/**
+ * Pure union of device sign-ins and account-graph nodes into the flat
+ * {@link SwitchableAccount}[] the switchers render. Extracted so the merge /
+ * dedup semantics are unit-testable without rendering React.
+ *
+ * Order: device rows first (in session order, current flagged), then graph-only
+ * rows (in graph order). An account present as BOTH a device session and a graph
+ * node is deduped into ONE device row enriched with the graph metadata
+ * (relationship / kind / parent / membership).
+ */
+export declare function buildSwitchableAccounts(input: BuildSwitchableAccountsInput): SwitchableAccount[];
+/**
+ * Resolve every account the signed-in user can switch into — device sign-ins
+ * AND linked graph accounts (owned orgs + shared-with-you) — as one flat list
+ * with real per-account name / email / avatar / color, deduped by account id.
+ *
+ * ## Data sources
+ *
+ * - Device sign-ins: `useOxy().sessions` — a `ClientSession[]` projected by
+ *   `OxyContext.syncFromClient` from the server-authoritative `SessionClient`.
+ *   Each session carries only `sessionId` + `userId`, so this hook additionally
+ *   fetches every device account's profile via `oxyServices.getUsersByIds()`.
+ *   The ACTIVE row always uses `useOxy().user` directly (the freshest copy).
+ * - Linked accounts: `useOxy().accounts` — the `AccountNode[]` graph the context
+ *   loads from `GET /accounts`. Each node already embeds its `account` `User`
+ *   document, so graph-only rows need no extra fetch.
+ *
+ * An account present as BOTH a device session and a graph node is deduped into
+ * ONE row (see {@link buildSwitchableAccounts}). EVERY row switches the same
+ * way — through `useOxy().switchToAccount(row.accountId)`.
+ *
+ * ## Error handling
+ *
+ * `getUsersByIds()` resolves to `[]` on a failed chunk (logged internally)
+ * rather than throwing. Device accounts whose profile could not be resolved are
+ * omitted until a subsequent fetch succeeds (except the active one, which never
+ * depends on this fetch); graph accounts are unaffected.
+ */
+export declare function useSwitchableAccounts(): UseSwitchableAccountsResult;
+//# sourceMappingURL=useSwitchableAccounts.d.ts.map

package/lib/typescript/commonjs/ui/hooks/useSwitchableAccounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSwitchableAccounts.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSwitchableAccounts.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACR,IAAI,EACJ,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,aAAa,EAChB,MAAM,aAAa,CAAC;AAKrB;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAC9B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACxC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+CAA+C;IAC/C,IAAI,EAAE,qBAAqB,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IACxC,0EAA0E;IAC1E,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IACzC,+EAA+E;IAC/E,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,uCAAuC;IACvC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,+EAA+E;IAC/E,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;CAC/E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAC9B,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,OAAO,GACzB,iBAAiB,EAAE,CAiCrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,iBAAiB,EAAE,CAoHhG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,IAAI,2BAA2B,CA2DnE"}

package/lib/typescript/commonjs/ui/hooks/useWebSSO.d.ts

@@ -1,58 +1,19 @@
 /**
- * Web SSO Hook
- *
- * Handles cross-domain SSO for web apps using FedCM (Federated Credential Management).
- *
- * FedCM is the modern, privacy-preserving standard for cross-domain identity federation.
- * It works across completely different TLDs (alia.onl, mention.earth, homiio.com, etc.)
- * without relying on third-party cookies.
- *
- * For browsers without FedCM support, users will need to click a sign-in button
- * which triggers redirect authentication.
- *
- * This is called automatically by OxyContext on web platforms.
- *
- * @see https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API
+ * Platform detection helper for the web auth/session-sync surfaces.
+ *
+ * This module previously hosted a FedCM-based `useWebSSO` hook (Federated
+ * Credential Management — Chrome-only). It was removed: FedCM is no longer
+ * used anywhere in the client sign-in/cold-boot path (see `CrossDomainAuth`'s
+ * doc comment in `@oxyhq/core` for the production sign-in loop that motivated
+ * the removal). Cross-domain silent SSO is owned entirely by the
+ * `silent-iframe` cold-boot step (per-apex `/auth/silent`) plus the terminal
+ * `/sso` bounce in `OxyContext`.
+ *
+ * `isWebBrowser` is kept here (rather than moved) so every existing consumer
+ * import path stays valid.
  */
-import type { OxyServices } from '@oxyhq/core';
-import type { SessionLoginResponse } from '@oxyhq/core';
-interface UseWebSSOOptions {
-    oxyServices: OxyServices;
-    onSessionFound: (session: SessionLoginResponse) => Promise<void>;
-    onSSOUnavailable?: () => void;
-    onError?: (error: Error) => void;
-    enabled?: boolean;
-}
-interface UseWebSSOResult {
-    /** Manually trigger SSO check */
-    checkSSO: () => Promise<SessionLoginResponse | null>;
-    /** Trigger interactive FedCM sign-in (shows browser UI) */
-    signInWithFedCM: () => Promise<SessionLoginResponse | null>;
-    /** Whether SSO check is in progress */
-    isChecking: boolean;
-    /** Whether FedCM is supported in this browser */
-    isFedCMSupported: boolean;
-}
 /**
  * Check if we're running in a web browser environment (not React Native)
  */
-declare function isWebBrowser(): boolean;
-/**
- * Hook for automatic cross-domain web SSO
- *
- * Uses FedCM (Federated Credential Management) - the modern browser-native
- * identity federation API. This is the same technology that powers
- * Google's cross-domain SSO (YouTube, Gmail, Maps, etc.).
- *
- * Key benefits:
- * - Works across different TLDs (alia.onl ↔ mention.earth ↔ homiio.com)
- * - No third-party cookies required
- * - Privacy-preserving (browser mediates identity, IdP can't track)
- * - Automatic silent sign-in after initial authentication
- *
- * For browsers without FedCM (Firefox, older browsers), automatic SSO
- * is not possible. Users will see a sign-in button instead.
- */
-export declare function useWebSSO({ oxyServices, onSessionFound, onSSOUnavailable, onError, enabled, }: UseWebSSOOptions): UseWebSSOResult;
-export { isWebBrowser };
+export declare function isWebBrowser(): boolean;
 //# sourceMappingURL=useWebSSO.d.ts.map

package/lib/typescript/commonjs/ui/hooks/useWebSSO.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxD,UAAU,gBAAgB;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrD,2DAA2D;IAC3D,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC5D,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA8BD;;GAEG;AACH,iBAAS,YAAY,IAAI,OAAO,CAI/B;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,EACxB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,OAAc,GACf,EAAE,gBAAgB,GAAG,eAAe,CAwHpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAItC"}

package/lib/typescript/commonjs/ui/session/createSessionClient.d.ts

@@ -0,0 +1,15 @@
+import type { OxyServices } from '@oxyhq/core';
+import { SessionClient } from '@oxyhq/core';
+import { createSessionClientHost } from './sessionClientHost';
+/**
+ * Wires a `SessionClient` for `@oxyhq/services`: builds the `SessionClientHost`
+ * adapter (Task 1) and the platform `TokenTransport` (Task 3) over the given
+ * `OxyServices` instance, and returns both the client and the host — the host
+ * is returned (not just the client) so `OxyContext` (Fase 3-B) can call
+ * `host.setCurrentAccountId(...)` as the active account changes.
+ */
+export declare function createSessionClient(oxyServices: OxyServices): {
+    client: SessionClient;
+    host: ReturnType<typeof createSessionClientHost>;
+};
+//# sourceMappingURL=createSessionClient.d.ts.map

package/lib/typescript/commonjs/ui/session/createSessionClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSessionClient.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/createSessionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAG9D;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG;IAC7D,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CAClD,CAKA"}

package/lib/typescript/commonjs/ui/session/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Session-sync integration layer (Fase 3-A) — intra-package use only.
+ *
+ * These modules let `@oxyhq/services` drive the platform-agnostic
+ * `SessionClient` (in `@oxyhq/core`): a thin host adapter over `OxyServices`,
+ * pure `DeviceSessionState → services` projection helpers, a platform token
+ * transport, and the factory that wires them together. Nothing here is
+ * re-exported from the package root — `OxyContext` consumes it directly in
+ * Fase 3-B.
+ */
+export { createSessionClient } from './createSessionClient';
+export { createSessionClientHost } from './sessionClientHost';
+export { createTokenTransport } from './tokenTransport';
+export { accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions, } from './projectSessionState';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/commonjs/ui/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC"}

package/lib/typescript/commonjs/ui/session/projectSessionState.d.ts

@@ -0,0 +1,45 @@
+import type { DeviceSessionState } from '@oxyhq/contracts';
+import type { ClientSession, User } from '@oxyhq/core';
+/**
+ * Pure projection helpers: `DeviceSessionState` (the device-scoped
+ * multi-account session-sync state produced by `@oxyhq/core`'s
+ * `SessionClient`) -> the shapes `OxyContext` renders today
+ * (`ClientSession[]`, an active session id, an active `User`).
+ *
+ * No I/O. The caller fetches profiles via
+ * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
+ * from the result before calling `deviceStateToClientSessions` /
+ * `activeUserOf`.
+ */
+/**
+ * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
+ *
+ * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
+ * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
+ * wire value is an epoch-ms number) as a provisional value. Fase 3-B
+ * rewrites `ClientSession` to make `expiresAt`/`lastActive` optional (they
+ * are not derivable from `DeviceSessionState`).
+ *
+ * `usersById` is accepted for signature symmetry with `activeUserOf` even
+ * though `ClientSession` only stores `userId` — a session is still
+ * projected for an account whose id is absent from `usersById` (no
+ * placeholder user is fabricated).
+ */
+export declare function deviceStateToClientSessions(state: DeviceSessionState, usersById: Map<string, User>): ClientSession[];
+/**
+ * The active account's `sessionId`, or `null` when there is no state or no
+ * active account is set.
+ */
+export declare function activeSessionIdOf(state: DeviceSessionState | null): string | null;
+/**
+ * The active account's `User`, resolved from `usersById`. `null` when there
+ * is no state, no active account is set, or the active account id is absent
+ * from `usersById`.
+ */
+export declare function activeUserOf(state: DeviceSessionState | null, usersById: Map<string, User>): User | null;
+/**
+ * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
+ * fetch. `[]` for `null` state.
+ */
+export declare function accountIdsOf(state: DeviceSessionState | null): string[];
+//# sourceMappingURL=projectSessionState.d.ts.map

package/lib/typescript/commonjs/ui/session/projectSessionState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectSessionState.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/projectSessionState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;;;;;;;GAUG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAC3B,aAAa,EAAE,CAajB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAC3B,IAAI,GAAG,IAAI,CAKb;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,EAAE,CAKvE"}

package/lib/typescript/commonjs/ui/session/sessionClientHost.d.ts

@@ -0,0 +1,14 @@
+import type { OxyServices, SessionClientHost } from '@oxyhq/core';
+/**
+ * Thin `SessionClientHost` adapter over an `OxyServices` instance.
+ *
+ * `SessionClient` (in `@oxyhq/core`) is host-agnostic: it only needs a REST +
+ * token surface. `OxyServices` already exposes all of that except
+ * `getCurrentAccountId`, which has no direct equivalent — the adapter holds a
+ * mutable ref set by the caller (`OxyContext`, in Fase 3-B) via
+ * `setCurrentAccountId`.
+ */
+export declare function createSessionClientHost(oxyServices: OxyServices): SessionClientHost & {
+    setCurrentAccountId(id: string | null): void;
+};
+//# sourceMappingURL=sessionClientHost.d.ts.map

package/lib/typescript/commonjs/ui/session/sessionClientHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionClientHost.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sessionClientHost.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,GACvB,iBAAiB,GAAG;IAAE,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;CAAE,CAatE"}

package/lib/typescript/commonjs/ui/session/tokenTransport.d.ts

@@ -0,0 +1,24 @@
+import type { OxyServices, TokenTransport } from '@oxyhq/core';
+/**
+ * Platform `TokenTransport` for `SessionClient`: mints an access token when
+ * none is currently held, reusing the SAME primitives `OxyContext`'s cold
+ * boot already relies on (never re-implemented here):
+ *
+ * - web: `oxyServices.silentSignIn()` (per-apex `/auth/silent` iframe).
+ * - native: `oxyServices.signInWithSharedIdentity()` (app-group keychain).
+ *
+ * Both primitives plant the token internally on success (the "Sign-In Token
+ * Planting" rule) — `ensureActiveToken` never calls `setTokens` itself.
+ *
+ * `ensureActiveToken` treats a PRESENT token as sufficient in this phase; it
+ * does not decode/match the token's subject against `state.activeAccountId`
+ * (that refinement is Fase 3-B). Account switching itself is server-driven
+ * via the `activeToken` carried in the sync envelope — this transport is
+ * only the fallback used when the envelope carried no token.
+ *
+ * A failed mint is logged and swallowed: it must never throw out of
+ * `ensureActiveToken`, since that would crash the caller (the SessionClient
+ * socket handler in Fase 3-B).
+ */
+export declare function createTokenTransport(oxyServices: OxyServices): TokenTransport;
+//# sourceMappingURL=tokenTransport.d.ts.map

package/lib/typescript/commonjs/ui/session/tokenTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenTransport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI/D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,cAAc,CAiD7E"}

package/lib/typescript/commonjs/ui/utils/activeAuthuser.d.ts

@@ -1,23 +1,28 @@
 /**
- * Web-only persistence of the active multi-account slot index.
+ * Web-only helpers around the retired `oxy_rt_${authuser}` multi-slot
+ * refresh-cookie scheme, PLUS the (unrelated, still load-bearing) deliberate
+ * sign-out / SSO-bounce gates.
  *
- * Google-style multi-account sign-in stores ONE refresh cookie per device
- * slot (`oxy_rt_${authuser}`, where `authuser` is an integer 0..N). The
- * server's `/auth/refresh-all` returns one entry per valid cookie; the
- * client must remember WHICH slot is currently active across reloads so
- * that the cold-boot snapshot resolves to the user's last selection
- * rather than always defaulting to slot 0.
- *
- * The persisted value is JUST the slot INDEX (a small integer) — never an
- * access token, refresh token, session id, or any user-identifying secret.
- * It is read by both `OxyContext` (cold-boot active selection) and the
- * session-management / auth-operations hooks (switch / logout).
+ * NOTE (session-sync cutover, Task 5): the device account SET is now
+ * server-authoritative via `SessionClient` (`@oxyhq/core`) — nothing in
+ * `@oxyhq/services` writes the persisted active-`authuser`-slot key anymore
+ * (`writeActiveAuthuser`/`clearActiveAuthuser` were deleted; their only
+ * callers were the deleted `establishDeviceRefreshSlot` sign-in registration
+ * and the deleted `switchToAccount`/`switchSession` slot bookkeeping).
+ * {@link readActiveAuthuser} is KEPT purely as an OPTIONAL restore hint:
+ * `OxyContext`'s `restoreStoredSession` cold-boot step reads it only to
+ * backfill `clientSession.authuser` for the active session when a legacy value
+ * happens to be present. It NO LONGER gates whether restore is attempted — the
+ * old guard that also required this marker made every web reload with a lapsed
+ * local bearer bail before any network validation (P0), and was replaced by a
+ * "bail only when there is nothing to restore" guard plus a valid-session
+ * election. Since nothing writes the key anymore, the backfill is dormant on
+ * fresh installs; it stays for legacy installs and costs nothing.
  *
  * Native (React Native) has no equivalent of these device-local cookies
  * and uses bearer-protected session ids directly, so these helpers no-op
  * outside the browser.
  */
-declare const ACTIVE_AUTHUSER_KEY = "oxy_active_authuser";
 /**
  * Read the persisted active `authuser` slot index.
  *
@@ -26,30 +31,18 @@ declare const ACTIVE_AUTHUSER_KEY = "oxy_active_authuser";
  * fall back to deterministic selection (lowest authuser).
  */
 export declare function readActiveAuthuser(): number | null;
-/**
- * Persist the active `authuser` slot index. No-ops on native and on any
- * storage failure (e.g. Safari private mode). Callers MUST NOT depend on
- * this succeeding — it is best-effort UX persistence, not authoritative.
- */
-export declare function writeActiveAuthuser(authuser: number): void;
-/**
- * Clear the persisted active `authuser` slot index. Called on full sign-out
- * (logoutAll) so that the next cold boot doesn't try to resurrect a
- * cleared slot.
- */
-export declare function clearActiveAuthuser(): void;
 /**
  * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
  * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
  * the next cold boot does NOT silently re-mint a session from a still-live IdP
- * session (`fedcm-silent` / per-apex `/auth/silent` iframe). Cleared by any
+ * session (the per-apex `/auth/silent` iframe cold-boot step). Cleared by any
  * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
  * failure (best-effort).
  */
 export declare function markSignedOut(): void;
 /**
  * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
- * sign-in (password, FedCM, account switch, device claim) so a real sign-in
+ * sign-in (password, account switch, device claim) so a real sign-in
  * fully re-enables automatic silent restore — there is no "stuck signed out"
  * state. No-ops on native / storage failure.
  */
@@ -59,7 +52,7 @@ export declare function clearSignedOut(): void;
  * the user deliberately signed out. Reads the durable flag through the core
  * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
  * storage failure (fail safe toward normal restore). Used to gate the
- * `fedcm-silent` and `silent-iframe` cold-boot steps.
+ * `silent-iframe` cold-boot step.
  */
 export declare function isSilentRestoreSuppressed(): boolean;
 /**
@@ -71,5 +64,4 @@ export declare function isSilentRestoreSuppressed(): boolean;
  * No-ops on native and on any storage failure (best-effort).
  */
 export declare function clearSsoBounceState(): void;
-export { ACTIVE_AUTHUSER_KEY };
 //# sourceMappingURL=activeAuthuser.d.ts.map

package/lib/typescript/commonjs/ui/utils/activeAuthuser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activeAuthuser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/activeAuthuser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,QAAA,MAAM,mBAAmB,wBAAwB,CAAC;AA6BlD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAclD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAQ1C;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAQpC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAQrC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAa1C;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"activeAuthuser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/activeAuthuser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA2BH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAalD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAOrC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAMnD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAa1C"}

package/lib/typescript/commonjs/ui/utils/sessionHelpers.d.ts

@@ -26,17 +26,6 @@ export interface FetchSessionsWithFallbackOptions {
     fallbackUserId?: string;
     logger?: (message: string, error?: unknown) => void;
 }
-export interface ValidateSessionBatchOptions {
-    useHeaderValidation?: boolean;
-    maxConcurrency?: number;
-}
-export interface SessionValidationResult {
-    sessionId: string;
-    valid: boolean;
-    user?: unknown;
-    raw?: unknown;
-    error?: unknown;
-}
 /**
  * Normalize backend session payloads into `ClientSession` objects.
  *
@@ -55,13 +44,5 @@ export declare const mapSessionsToClient: (sessions: DeviceSession[], fallbackDe
  * @param options - Optional fallback options
  */
 export declare const fetchSessionsWithFallback: (oxyServices: OxyServicesAny, sessionId: string, { fallbackDeviceId, fallbackUserId, logger, }?: FetchSessionsWithFallbackOptions) => Promise<ClientSession[]>;
-/**
- * Validate multiple sessions concurrently with configurable concurrency.
- *
- * @param oxyServices - Oxy service instance
- * @param sessionIds - Session identifiers to validate
- * @param options - Validation options
- */
-export declare const validateSessionBatch: (oxyServices: OxyServicesAny, sessionIds: string[], { useHeaderValidation, maxConcurrency }?: ValidateSessionBatchOptions) => Promise<SessionValidationResult[]>;
 export {};
 //# sourceMappingURL=sessionHelpers.d.ts.map

package/lib/typescript/commonjs/ui/utils/sessionHelpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionHelpers.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/sessionHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,UAAU,aAAa;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,IAAI,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AAEH,KAAK,cAAc,GAAG,GAAG,CAAC;AAE1B,MAAM,WAAW,gCAAgC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU,aAAa,EAAE,EACzB,mBAAmB,MAAM,EACzB,iBAAiB,MAAM,KACtB,aAAa,EAgBf,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GACpC,aAAa,cAAc,EAC3B,WAAW,MAAM,EACjB,gDAIG,gCAAqC,KACvC,OAAO,CAAC,aAAa,EAAE,CAYzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,aAAa,cAAc,EAC3B,YAAY,MAAM,EAAE,EACpB,0CAAoD,2BAAgC,KACnF,OAAO,CAAC,uBAAuB,EAAE,CAuCnC,CAAC"}
+{"version":3,"file":"sessionHelpers.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/sessionHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,UAAU,aAAa;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,IAAI,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;GAKG;AAEH,KAAK,cAAc,GAAG,GAAG,CAAC;AAE1B,MAAM,WAAW,gCAAgC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU,aAAa,EAAE,EACzB,mBAAmB,MAAM,EACzB,iBAAiB,MAAM,KACtB,aAAa,EAgBf,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GACpC,aAAa,cAAc,EAC3B,WAAW,MAAM,EACjB,gDAIG,gCAAqC,KACvC,OAAO,CAAC,aAAa,EAAE,CAYzB,CAAC"}

package/lib/typescript/commonjs/utils/deviceFlowSignIn.d.ts

@@ -2,31 +2,52 @@
  * Shared, pure orchestration for completing the cross-app device-flow sign-in
  * (the QR-code / "Open Oxy Auth" path used on native and web).
  *
- * THE BUG THIS FIXES (native): once another authenticated device approves the
- * pending AuthSession, the originating client is notified (socket / poll /
- * deep-link) with the authorized `sessionId`. Before any session-management
- * code can use it, the client MUST exchange the secret 128-bit `sessionToken`
- * (held only by this client, generated for THIS flow) for the first access
- * token via `claimSessionByToken` — the device-flow equivalent of OAuth's
- * code-for-token exchange (RFC 8628 §3.4).
+ * THE FIRST BUG THIS FIXES (native): once another authenticated device
+ * approves the pending AuthSession, the originating client is notified
+ * (socket / poll / deep-link) with the authorized `sessionId`. Before any
+ * session-management code can use it, the client MUST exchange the secret
+ * 128-bit `sessionToken` (held only by this client, generated for THIS flow)
+ * for the first access token via `claimSessionByToken` — the device-flow
+ * equivalent of OAuth's code-for-token exchange (RFC 8628 §3.4).
+ *
+ * THE SECOND BUG THIS FIXES (session-sync cutover regression): the
+ * freshly-claimed session is NOT yet registered in the device's
+ * server-authoritative session set — nothing has run
+ * `sessionClient.addCurrentAccount()` for it — so it must NOT be committed
+ * through `switchSession`. That path is now an account-SWITCH between
+ * accounts already registered on this device (`OxyContext`'s
+ * `switchSessionForContext`), and throws `No device account found for
+ * session "..."` for anything else, surfacing as "Authorization successful
+ * but failed to complete sign in." Instead the claimed session must be
+ * committed through the SAME path a fresh password sign-in uses —
+ * `useOxy().handleWebSession` (`OxyContext`'s `handleWebSSOSession`) — which
+ * registers the account into the device set, persists it durably, and
+ * hydrates the full user profile.
  *
  * Skipping the claim leaves the SDK with NO bearer token: the session is
  * authorized server-side but the app never becomes authenticated and the UI
- * sits "Waiting for authorization..." forever. Consolidating the claim→switch
- * sequence here keeps native and web identical and unit-testable.
+ * sits "Waiting for authorization..." forever. Consolidating the
+ * claim->commit sequence here keeps native and web identical and
+ * unit-testable.
  */
-import { type User } from '@oxyhq/core';
+import { type EstablishAfterClaimDeps, type SessionLoginResponse, type SsoEstablishClient, type User } from '@oxyhq/core';
 interface DeviceFlowClaimResult {
     accessToken?: string;
     sessionId?: string;
+    deviceId?: string;
+    expiresAt?: string;
+    user?: User;
 }
 /**
  * The minimal `OxyServices` surface this orchestration needs. Kept as a
  * structural type (rather than importing the full client) so the helper is
  * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
  * a test bundle.
+ *
+ * Extends {@link SsoEstablishClient} (`requestSsoEstablishUrl`) so the WEB
+ * post-claim durable-session hop can be driven off the same client.
  */
-export interface DeviceFlowClient {
+export interface DeviceFlowClient extends SsoEstablishClient {
     /**
      * Exchange the device-flow `sessionToken` for the first access + refresh
      * token, planting them on the client. Single-use; replay is rejected by the
@@ -45,19 +66,30 @@ export interface CompleteDeviceFlowSignInOptions {
      */
     sessionToken: string;
     /**
-     * The session-management `switchSession` from `useOxy()`. Hydrates the
-     * activated session (validates, fetches the user, persists, updates state).
-     * Runs AFTER the bearer is planted so its bearer-protected calls succeed.
+     * `useOxy().handleWebSession` — commits the freshly-claimed session into
+     * context state through the SAME path a password sign-in uses:
+     * registers the account into the device's server-authoritative session set,
+     * persists it durably, and hydrates the full user profile. Runs AFTER the
+     * bearer is planted so its bearer-protected calls succeed.
+     */
+    commitSession: (session: SessionLoginResponse) => Promise<void>;
+    /**
+     * Injectable web seams for the post-claim durable-session establish hop
+     * ({@link establishIdpSessionAfterClaim}). Omit in production — the defaults
+     * resolve to `window.*` (and no-op off-web / on native). Tests inject fakes to
+     * drive the web path deterministically.
      */
-    switchSession: (sessionId: string) => Promise<User>;
+    establishDeps?: EstablishAfterClaimDeps;
 }
 /**
  * Complete a device-flow sign-in: claim the first access token with the secret
- * `sessionToken` (planting the bearer), then hydrate the session via
- * `switchSession`. Returns the authenticated user.
+ * `sessionToken` (planting the bearer), then commit the resulting session via
+ * `commitSession` (registers it into the device's server-authoritative session
+ * set and hydrates the full user). Returns the authenticated user.
  *
- * Throws if either the claim or the switch fails; callers surface a retry UI.
+ * Throws if the claim did not return a usable session, or if either the claim
+ * or the commit fails; callers surface a retry UI.
  */
-export declare function completeDeviceFlowSignIn({ oxyServices, sessionId, sessionToken, switchSession, }: CompleteDeviceFlowSignInOptions): Promise<User>;
+export declare function completeDeviceFlowSignIn({ oxyServices, sessionId, sessionToken, commitSession, establishDeps, }: CompleteDeviceFlowSignInOptions): Promise<User>;
 export {};
 //# sourceMappingURL=deviceFlowSignIn.d.ts.map