@oxyhq/services 14.0.1 → 15.0.0

package/lib/module/ui/session/authStore.js

@@ -0,0 +1,143 @@
+"use strict";
+
+/**
+ * Platform `AuthStateStore` for `@oxyhq/services`.
+ *
+ * The device-first session model persists the rotating refresh-token family
+ * head per origin (web) / per device (native). `@oxyhq/core` owns the store
+ * shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore`); this
+ * module only supplies the platform storage seam and wires the native device
+ * token to the SHARED keychain so every native Oxy app joins one DeviceSession:
+ *
+ *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
+ *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob
+ *    (refresh token) over `expo-secure-store` (AsyncStorage fallback), with the
+ *    long-lived DEVICE token delegated to `KeyManager`'s shared keychain
+ *    (`group.so.oxy.shared`) instead of per-app storage — so an in-app login on
+ *    any native Oxy app attributes to the SAME server-side DeviceSession.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+import { KeyManager, createWebAuthStateStore, createNativeAuthStateStore, logger } from '@oxyhq/core';
+import { createPlatformStorage, isReactNative } from "../utils/storageHelpers.js";
+
+// Variable indirection so Metro's static analyzer never traces expo-secure-store
+// into the web bundle; the module is native-only and optional.
+const SECURE_STORE_MODULE = 'expo-secure-store';
+let secureStorePromise = null;
+
+/**
+ * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
+ * unavailable — callers then fall back to AsyncStorage. Never throws.
+ */
+function loadSecureStore() {
+  if (!secureStorePromise) {
+    const moduleName = SECURE_STORE_MODULE;
+    secureStorePromise = import(moduleName).then(mod => {
+      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
+        return {
+          getItemAsync: mod.getItemAsync.bind(mod),
+          setItemAsync: mod.setItemAsync.bind(mod),
+          deleteItemAsync: mod.deleteItemAsync.bind(mod)
+        };
+      }
+      return null;
+    }).catch(() => null);
+  }
+  return secureStorePromise;
+}
+
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+function createNativeSecureKeyValueStorage() {
+  let asyncStorage = null;
+  const getAsyncStorage = async () => {
+    if (!asyncStorage) {
+      asyncStorage = await createPlatformStorage();
+    }
+    return asyncStorage;
+  };
+  return {
+    getItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        return secure.getItemAsync(key);
+      }
+      return (await getAsyncStorage()).getItem(key);
+    },
+    setItem: async (key, value) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.setItemAsync(key, value);
+        return;
+      }
+      await (await getAsyncStorage()).setItem(key, value);
+    },
+    removeItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.deleteItemAsync(key);
+        return;
+      }
+      await (await getAsyncStorage()).removeItem(key);
+    }
+  };
+}
+
+/**
+ * Build the platform {@link AuthStateStore} for this runtime.
+ *
+ * Native additionally routes the device token through the shared keychain so
+ * every native Oxy app shares one server-side DeviceSession; the session blob
+ * (refresh token) stays per-app in SecureStore. Best-effort keychain access —
+ * a locked/failed shared-keychain read degrades to "no device token" rather
+ * than throwing out of cold boot / refresh.
+ */
+export function createPlatformAuthStateStore() {
+  if (!isReactNative()) {
+    return createWebAuthStateStore();
+  }
+  const base = createNativeAuthStateStore(createNativeSecureKeyValueStorage());
+  return {
+    ...base,
+    loadDeviceToken: async () => {
+      try {
+        return await KeyManager.getSharedDeviceToken();
+      } catch (error) {
+        logger.debug('Shared device-token read failed (treating as none)', {
+          component: 'authStore',
+          method: 'loadDeviceToken'
+        }, error);
+        return null;
+      }
+    },
+    saveDeviceToken: async token => {
+      try {
+        await KeyManager.setSharedDeviceToken(token);
+      } catch (error) {
+        logger.debug('Shared device-token write failed (non-fatal)', {
+          component: 'authStore',
+          method: 'saveDeviceToken'
+        }, error);
+      }
+    },
+    clearDeviceToken: async () => {
+      try {
+        await KeyManager.clearSharedDeviceToken();
+      } catch (error) {
+        logger.debug('Shared device-token clear failed (non-fatal)', {
+          component: 'authStore',
+          method: 'clearDeviceToken'
+        }, error);
+      }
+    }
+  };
+}
+//# sourceMappingURL=authStore.js.map

package/lib/module/ui/session/authStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["KeyManager","createWebAuthStateStore","createNativeAuthStateStore","logger","createPlatformStorage","isReactNative","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","then","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","getItem","key","secure","setItem","value","removeItem","createPlatformAuthStateStore","base","loadDeviceToken","getSharedDeviceToken","error","debug","component","method","saveDeviceToken","token","setSharedDeviceToken","clearDeviceToken","clearSharedDeviceToken"],"sourceRoot":"../../../../src","sources":["ui/session/authStore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEA,UAAU,EACVC,uBAAuB,EACvBC,0BAA0B,EAG1BC,MAAM,QACD,aAAa;AACpB,SAASC,qBAAqB,EAAEC,aAAa,QAAQ,4BAAyB;;AAE9E;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,MAAM,CAACE,UAAU,CAAC,CACpCC,IAAI,CAAEC,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOT,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAASU,iCAAiCA,CAAA,EAA0B;EAClE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAMd,qBAAqB,CAAC,CAAC;IAC9C;IACA,OAAOc,YAAY;EACrB,CAAC;EACD,OAAO;IACLE,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,OAAOA,MAAM,CAACV,YAAY,CAACS,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEC,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,YAAY,CAACQ,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAML,eAAe,CAAC,CAAC,EAAEI,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACR,eAAe,CAACO,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEM,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASK,4BAA4BA,CAAA,EAAmB;EAC7D,IAAI,CAACrB,aAAa,CAAC,CAAC,EAAE;IACpB,OAAOJ,uBAAuB,CAAC,CAAC;EAClC;EAEA,MAAM0B,IAAI,GAAGzB,0BAA0B,CAACe,iCAAiC,CAAC,CAAC,CAAC;EAC5E,OAAO;IACL,GAAGU,IAAI;IACPC,eAAe,EAAE,MAAAA,CAAA,KAAY;MAC3B,IAAI;QACF,OAAO,MAAM5B,UAAU,CAAC6B,oBAAoB,CAAC,CAAC;MAChD,CAAC,CAAC,OAAOC,KAAK,EAAE;QACd3B,MAAM,CAAC4B,KAAK,CACV,oDAAoD,EACpD;UAAEC,SAAS,EAAE,WAAW;UAAEC,MAAM,EAAE;QAAkB,CAAC,EACrDH,KACF,CAAC;QACD,OAAO,IAAI;MACb;IACF,CAAC;IACDI,eAAe,EAAE,MAAOC,KAAK,IAAK;MAChC,IAAI;QACF,MAAMnC,UAAU,CAACoC,oBAAoB,CAACD,KAAK,CAAC;MAC9C,CAAC,CAAC,OAAOL,KAAK,EAAE;QACd3B,MAAM,CAAC4B,KAAK,CACV,8CAA8C,EAC9C;UAAEC,SAAS,EAAE,WAAW;UAAEC,MAAM,EAAE;QAAkB,CAAC,EACrDH,KACF,CAAC;MACH;IACF,CAAC;IACDO,gBAAgB,EAAE,MAAAA,CAAA,KAAY;MAC5B,IAAI;QACF,MAAMrC,UAAU,CAACsC,sBAAsB,CAAC,CAAC;MAC3C,CAAC,CAAC,OAAOR,KAAK,EAAE;QACd3B,MAAM,CAAC4B,KAAK,CACV,8CAA8C,EAC9C;UAAEC,SAAS,EAAE,WAAW;UAAEC,MAAM,EAAE;QAAmB,CAAC,EACtDH,KACF,CAAC;MACH;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/createSessionClient.js

@@ -1,21 +1,36 @@
 "use strict";
 
-import { SessionClient } from '@oxyhq/core';
-import { createSessionClientHost } from "./sessionClientHost.js";
+import { io } from 'socket.io-client';
+import { SessionClient, createSessionClientHost } from '@oxyhq/core';
 import { createTokenTransport } from "./tokenTransport.js";
 
 /**
- * Wires a `SessionClient` for `@oxyhq/services`: builds the `SessionClientHost`
- * adapter (Task 1) and the platform `TokenTransport` (Task 3) over the given
- * `OxyServices` instance, and returns both the client and the host — the host
- * is returned (not just the client) so `OxyContext` (Fase 3-B) can call
- * `host.setCurrentAccountId(...)` as the active account changes.
+ * Wire a `SessionClient` for `@oxyhq/services`.
+ *
+ * The platform-agnostic parts (host adapter, client, projection helpers) live
+ * ONCE in `@oxyhq/core`; this thin factory only injects the pieces specific to
+ * the RN/Expo SDK:
+ *
+ *  - `socket.io-client`'s `io`, STATICALLY imported (socket.io-client is a real
+ *    dependency of `@oxyhq/services`) so realtime session sync never relies on
+ *    core's lazy dynamic import of a bare specifier — bundler-fragile in
+ *    Metro/Expo-web against the published core dist.
+ *  - the device-first {@link createTokenTransport}, which mints a fallback token
+ *    by rotating the persisted refresh family (`store`).
+ *
+ * `onUnauthenticated` fires when an applied device state has zero accounts (a
+ * device signout-all): the provider clears the persisted store + local state so
+ * a reload does not try to restore a dead session. The host is returned
+ * alongside the client so the caller can call `host.setCurrentAccountId(...)`
+ * as the active account changes.
  */
-export function createSessionClient(oxyServices) {
+export function createSessionClient(oxyServices, store, onUnauthenticated) {
   const host = createSessionClientHost(oxyServices);
-  const transport = createTokenTransport(oxyServices);
+  const transport = createTokenTransport(oxyServices, store);
   const client = new SessionClient(host, {
-    transport
+    transport,
+    socketFactory: io,
+    onUnauthenticated
   });
   return {
     client,

package/lib/module/ui/session/createSessionClient.js.map

@@ -1 +1 @@
-{"version":3,"names":["SessionClient","createSessionClientHost","createTokenTransport","createSessionClient","oxyServices","host","transport","client"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;AACA,SAASA,aAAa,QAAQ,aAAa;AAC3C,SAASC,uBAAuB,QAAQ,wBAAqB;AAC7D,SAASC,oBAAoB,QAAQ,qBAAkB;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,mBAAmBA,CAACC,WAAwB,EAG1D;EACA,MAAMC,IAAI,GAAGJ,uBAAuB,CAACG,WAAW,CAAC;EACjD,MAAME,SAAS,GAAGJ,oBAAoB,CAACE,WAAW,CAAC;EACnD,MAAMG,MAAM,GAAG,IAAIP,aAAa,CAACK,IAAI,EAAE;IAAEC;EAAU,CAAC,CAAC;EACrD,OAAO;IAAEC,MAAM;IAAEF;EAAK,CAAC;AACzB","ignoreList":[]}
+{"version":3,"names":["io","SessionClient","createSessionClientHost","createTokenTransport","createSessionClient","oxyServices","store","onUnauthenticated","host","transport","client","socketFactory"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;AAAA,SAASA,EAAE,QAAQ,kBAAkB;AACrC,SACEC,aAAa,EACbC,uBAAuB,QAGlB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,qBAAkB;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,mBAAmBA,CACjCC,WAAwB,EACxBC,KAAqB,EACrBC,iBAA8B,EAI9B;EACA,MAAMC,IAAI,GAAGN,uBAAuB,CAACG,WAAW,CAAC;EACjD,MAAMI,SAAS,GAAGN,oBAAoB,CAACE,WAAW,EAAEC,KAAK,CAAC;EAC1D,MAAMI,MAAM,GAAG,IAAIT,aAAa,CAACO,IAAI,EAAE;IAAEC,SAAS;IAAEE,aAAa,EAAEX,EAAE;IAAEO;EAAkB,CAAC,CAAC;EAC3F,OAAO;IAAEG,MAAM;IAAEF;EAAK,CAAC;AACzB","ignoreList":[]}

package/lib/module/ui/session/index.js

@@ -1,17 +1,17 @@
 "use strict";
 
 /**
- * Session-sync integration layer (Fase 3-A) — intra-package use only.
+ * Session-sync integration layer — intra-package use only.
  *
- * These modules let `@oxyhq/services` drive the platform-agnostic
- * `SessionClient` (in `@oxyhq/core`): a thin host adapter over `OxyServices`,
- * pure `DeviceSessionState → services` projection helpers, a platform token
- * transport, and the factory that wires them together. Nothing here is
- * re-exported from the package root — `OxyContext` consumes it directly in
- * Fase 3-B.
+ * `@oxyhq/core` owns the platform-agnostic `SessionClient`, its host adapter,
+ * and the pure `DeviceSessionState → services` projection helpers; those are
+ * re-exported straight from core here so `OxyContext` has one import site.
+ * `@oxyhq/services` supplies only the two platform pieces: the thin
+ * `createSessionClient` factory (injects socket.io-client `io` + the
+ * device-first token transport) and the `AuthStateStore` factory.
  */
 export { createSessionClient } from "./createSessionClient.js";
-export { createSessionClientHost } from "./sessionClientHost.js";
 export { createTokenTransport } from "./tokenTransport.js";
-export { accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions } from "./projectSessionState.js";
+export { createPlatformAuthStateStore } from "./authStore.js";
+export { createSessionClientHost, accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions } from '@oxyhq/core';
 //# sourceMappingURL=index.js.map

package/lib/module/ui/session/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["createSessionClient","createSessionClientHost","createTokenTransport","accountIdsOf","activeSessionIdOf","activeUserOf","deviceStateToClientSessions"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAQ,0BAAuB;AAC3D,SAASC,uBAAuB,QAAQ,wBAAqB;AAC7D,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SACEC,YAAY,EACZC,iBAAiB,EACjBC,YAAY,EACZC,2BAA2B,QACtB,0BAAuB","ignoreList":[]}
+{"version":3,"names":["createSessionClient","createTokenTransport","createPlatformAuthStateStore","createSessionClientHost","accountIdsOf","activeSessionIdOf","activeUserOf","deviceStateToClientSessions"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAQ,0BAAuB;AAC3D,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,4BAA4B,QAAQ,gBAAa;AAC1D,SACEC,uBAAuB,EACvBC,YAAY,EACZC,iBAAiB,EACjBC,YAAY,EACZC,2BAA2B,QACtB,aAAa","ignoreList":[]}

package/lib/module/ui/session/tokenTransport.js

@@ -1,41 +1,25 @@
 "use strict";
 
-import { logger } from '@oxyhq/core';
-import { isWebBrowser } from "../hooks/useWebSSO.js";
-
+import { refreshPersistedSession, logger } from '@oxyhq/core';
 /**
- * Platform `TokenTransport` for `SessionClient`: mints an access token when
- * none is currently held, reusing the SAME primitives `OxyContext`'s cold
- * boot already relies on (never re-implemented here):
- *
- * - web: `oxyServices.silentSignIn()` (per-apex `/auth/silent` iframe).
- * - native: `oxyServices.signInWithSharedIdentity()` (app-group keychain).
- *
- * Both primitives plant the token internally on success (the "Sign-In Token
- * Planting" rule) — `ensureActiveToken` never calls `setTokens` itself.
+ * Platform `TokenTransport` for `SessionClient` (device-first model).
  *
- * `ensureActiveToken` treats a PRESENT token as sufficient in this phase; it
- * does not decode/match the token's subject against `state.activeAccountId`
- * (that refinement is Fase 3-B). Account switching itself is server-driven
- * via the `activeToken` carried in the sync envelope — this transport is
- * only the fallback used when the envelope carried no token.
+ * `ensureActiveToken` is the fallback the client uses when a `session_state`
+ * push arrived WITHOUT an embedded `activeToken` and the app currently holds no
+ * bearer. It mints one through the ONE unified refresh path
+ * (`refreshPersistedSession`): rotate the persisted refresh-token family
+ * (`POST /auth/refresh-token`) and, on native, fall back to the shared-keychain
+ * re-mint. There is no FedCM/silent-iframe arm anymore — the per-origin
+ * persisted refresh token is the durable web credential.
  *
- * A failed mint is logged and swallowed: it must never throw out of
- * `ensureActiveToken`, since that would crash the caller (the SessionClient
- * socket handler in Fase 3-B).
+ * Concurrent pushes coalesce onto one in-flight mint. A failure is logged and
+ * swallowed: this method must never throw out (it runs inside the socket state
+ * handler).
  */
-export function createTokenTransport(oxyServices) {
-  // Coalesces concurrent mints: `SessionClient.applyState` can fire
-  // `ensureActiveToken` on rapid successive state pushes; a second call while a
-  // mint is already in flight must reuse it, not spawn a second silent iframe /
-  // shared-key challenge round-trip.
+export function createTokenTransport(oxyServices, store) {
   let inFlightMint = null;
   return {
     async ensureActiveToken(state) {
-      // Read the current token defensively: it is an in-memory getter that
-      // should never throw, but the documented contract is that this method
-      // never throws out — so a surprising throw is logged and treated as "no
-      // token" (fall through to mint) rather than rejecting the promise.
       try {
         if (oxyServices.getAccessToken()) {
           return;
@@ -50,15 +34,18 @@ export function createTokenTransport(oxyServices) {
       }
       inFlightMint = (async () => {
         try {
-          const session = isWebBrowser() ? await oxyServices.silentSignIn() : await oxyServices.signInWithSharedIdentity();
-          if (!session) {
-            logger.debug('ensureActiveToken: platform mint returned no session', {
+          const token = await refreshPersistedSession({
+            oxy: oxyServices,
+            store
+          });
+          if (!token) {
+            logger.debug('ensureActiveToken: refresh produced no session', {
               component: 'TokenTransport',
               deviceId: state.deviceId
             });
           }
         } catch (error) {
-          logger.warn('ensureActiveToken: mint failed', {
+          logger.warn('ensureActiveToken: refresh failed', {
             component: 'TokenTransport'
           }, error);
         }

package/lib/module/ui/session/tokenTransport.js.map

@@ -1 +1 @@
-{"version":3,"names":["logger","isWebBrowser","createTokenTransport","oxyServices","inFlightMint","ensureActiveToken","state","getAccessToken","error","warn","component","session","silentSignIn","signInWithSharedIdentity","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;AAEA,SAASA,MAAM,QAAQ,aAAa;AACpC,SAASC,YAAY,QAAQ,uBAAoB;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAACC,WAAwB,EAAkB;EAC7E;EACA;EACA;EACA;EACA,IAAIC,YAAkC,GAAG,IAAI;EAE7C,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE;MACA;MACA;MACA;MACA,IAAI;QACF,IAAIH,WAAW,CAACI,cAAc,CAAC,CAAC,EAAE;UAChC;QACF;MACF,CAAC,CAAC,OAAOC,KAAK,EAAE;QACdR,MAAM,CAACS,IAAI,CAAC,yCAAyC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MAChG;MAEA,IAAIJ,YAAY,EAAE;QAChB,OAAOA,YAAY;MACrB;MAEAA,YAAY,GAAG,CAAC,YAAY;QAC1B,IAAI;UACF,MAAMO,OAAO,GAAGV,YAAY,CAAC,CAAC,GAC1B,MAAME,WAAW,CAACS,YAAY,CAAC,CAAC,GAChC,MAAMT,WAAW,CAACU,wBAAwB,CAAC,CAAC;UAEhD,IAAI,CAACF,OAAO,EAAE;YACZX,MAAM,CAACc,KAAK,CAAC,sDAAsD,EAAE;cACnEJ,SAAS,EAAE,gBAAgB;cAC3BK,QAAQ,EAAET,KAAK,CAACS;YAClB,CAAC,CAAC;UACJ;QACF,CAAC,CAAC,OAAOP,KAAK,EAAE;UACdR,MAAM,CAACS,IAAI,CAAC,gCAAgC,EAAE;YAAEC,SAAS,EAAE;UAAiB,CAAC,EAAEF,KAAK,CAAC;QACvF;MACF,CAAC,EAAE,CAAC;MAEJ,IAAI;QACF,MAAMJ,YAAY;MACpB,CAAC,SAAS;QACRA,YAAY,GAAG,IAAI;MACrB;IACF;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["refreshPersistedSession","logger","createTokenTransport","oxyServices","store","inFlightMint","ensureActiveToken","state","getAccessToken","error","warn","component","token","oxy","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;AAAA,SACEA,uBAAuB,EACvBC,MAAM,QAID,aAAa;AAGpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAClCC,WAAwB,EACxBC,KAAqB,EACL;EAChB,IAAIC,YAAkC,GAAG,IAAI;EAE7C,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI;QACF,IAAIJ,WAAW,CAACK,cAAc,CAAC,CAAC,EAAE;UAChC;QACF;MACF,CAAC,CAAC,OAAOC,KAAK,EAAE;QACdR,MAAM,CAACS,IAAI,CAAC,yCAAyC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MAChG;MAEA,IAAIJ,YAAY,EAAE;QAChB,OAAOA,YAAY;MACrB;MAEAA,YAAY,GAAG,CAAC,YAAY;QAC1B,IAAI;UACF,MAAMO,KAAK,GAAG,MAAMZ,uBAAuB,CAAC;YAAEa,GAAG,EAAEV,WAAW;YAAEC;UAAM,CAAC,CAAC;UACxE,IAAI,CAACQ,KAAK,EAAE;YACVX,MAAM,CAACa,KAAK,CAAC,gDAAgD,EAAE;cAC7DH,SAAS,EAAE,gBAAgB;cAC3BI,QAAQ,EAAER,KAAK,CAACQ;YAClB,CAAC,CAAC;UACJ;QACF,CAAC,CAAC,OAAON,KAAK,EAAE;UACdR,MAAM,CAACS,IAAI,CAAC,mCAAmC,EAAE;YAAEC,SAAS,EAAE;UAAiB,CAAC,EAAEF,KAAK,CAAC;QAC1F;MACF,CAAC,EAAE,CAAC;MAEJ,IAAI;QACF,MAAMJ,YAAY;MACpB,CAAC,SAAS;QACRA,YAAY,GAAG,IAAI;MACrB;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/utils/isWebBrowser.js

@@ -0,0 +1,11 @@
+"use strict";
+
+/**
+ * Web-browser detection for `@oxyhq/services`.
+ *
+ * The predicate now lives ONCE in `@oxyhq/core` (`isWebBrowser`) so services and
+ * auth-sdk share the exact same DOM probe. This module re-exposes it under the
+ * existing internal import path so consumers stay unchanged.
+ */
+export { isWebBrowser } from '@oxyhq/core';
+//# sourceMappingURL=isWebBrowser.js.map

package/lib/module/ui/utils/isWebBrowser.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isWebBrowser"],"sourceRoot":"../../../../src","sources":["ui/utils/isWebBrowser.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,YAAY,QAAQ,aAAa","ignoreList":[]}

package/lib/module/utils/deviceFlowSignIn.js

@@ -33,7 +33,7 @@
  * unit-testable.
  */
 
-import { KeyManager, establishIdpSessionAfterClaim } from '@oxyhq/core';
+import { KeyManager } from '@oxyhq/core';
 
 /**
  * The minimal `OxyServices` surface this orchestration needs. Kept as a
@@ -41,8 +41,6 @@ import { KeyManager, establishIdpSessionAfterClaim } from '@oxyhq/core';
  * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
  * a test bundle.
  *
- * Extends {@link SsoEstablishClient} (`requestSsoEstablishUrl`) so the WEB
- * post-claim durable-session hop can be driven off the same client.
  */
 
 /**
@@ -58,8 +56,7 @@ export async function completeDeviceFlowSignIn({
   oxyServices,
   sessionId,
   sessionToken,
-  commitSession,
-  establishDeps
+  commitSession
 }) {
   // 1) Plant the bearer + refresh tokens. The claim response is also persisted
   //    to native shared secure storage so a later cold boot has a bearer before
@@ -85,25 +82,25 @@ export async function completeDeviceFlowSignIn({
 
   // 2) Bearer is now planted — commit the session through the same path a
   //    fresh sign-in uses so it is registered into the device's
-  //    server-authoritative session set instead of an account switch.
+  //    server-authoritative session set instead of an account switch. Thread
+  //    the rotating refresh token so the commit funnel persists a durable
+  //    session that survives a reload.
   await commitSession({
     sessionId: claimed.sessionId || sessionId,
     deviceId: claimed.deviceId ?? '',
     expiresAt: claimed.expiresAt ?? '',
     user: minimalUser,
-    accessToken: claimed.accessToken
+    accessToken: claimed.accessToken,
+    ...(claimed.refreshToken ? {
+      refreshToken: claimed.refreshToken
+    } : {})
   });
 
-  // 3) WEB durable-session hop (no-op on native). A device-flow claim plants
-  //    ONLY in-memory tokens — no IdP `fedcm_session` cookie is ever planted, so
-  //    a reload cannot re-mint a token and the session is lost. Now that the
-  //    session is committed AND durably persisted (step 2), plant the per-apex
-  //    IdP cookie via ONE top-level establish hop. Single attempt; total (never
-  //    throws) — an establish failure leaves the committed session as-is. On web
-  //    success it navigates away, so it is the LAST step: the browser tears the
-  //    page down on the next tick, after `claimed.user` is returned to the
-  //    caller's `onSignedIn`.
-  await establishIdpSessionAfterClaim(oxyServices, establishDeps ?? {});
+  // The commit funnel persisted the rotating refresh family and registered the
+  // account into the device set, so a reload restores the session locally (web:
+  // stored-tokens / same-apex web-session; native: shared keychain) WITHOUT any
+  // IdP `fedcm_session` cookie or top-level establish hop.
+
   return claimed.user;
 }
 //# sourceMappingURL=deviceFlowSignIn.js.map

package/lib/module/utils/deviceFlowSignIn.js.map

@@ -1 +1 @@
-{"version":3,"names":["KeyManager","establishIdpSessionAfterClaim","completeDeviceFlowSignIn","oxyServices","sessionId","sessionToken","commitSession","establishDeps","claimed","claimSessionByToken","accessToken","storeSharedSession","user","Error","minimalUser","id","username","name","avatar","undefined","deviceId","expiresAt"],"sourceRoot":"../../../src","sources":["utils/deviceFlowSignIn.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACEA,UAAU,EACVC,6BAA6B,QAMxB,aAAa;;AAUpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAqCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,wBAAwBA,CAAC;EAC7CC,WAAW;EACXC,SAAS;EACTC,YAAY;EACZC,aAAa;EACbC;AAC+B,CAAC,EAAiB;EACjD;EACA;EACA;EACA,MAAMC,OAAO,GAAG,MAAML,WAAW,CAACM,mBAAmB,CAACJ,YAAY,CAAC;EACnE,IAAIG,OAAO,EAAEE,WAAW,EAAE;IACxB,MAAMV,UAAU,CAACW,kBAAkB,CAACH,OAAO,CAACJ,SAAS,IAAIA,SAAS,EAAEI,OAAO,CAACE,WAAW,CAAC;EAC1F;EAEA,IAAI,CAACF,OAAO,EAAEE,WAAW,IAAI,CAACF,OAAO,CAACI,IAAI,EAAE;IAC1C,MAAM,IAAIC,KAAK,CAAC,mDAAmD,CAAC;EACtE;;EAEA;EACA;EACA;EACA;EACA,MAAMC,WAA4B,GAAG;IACnCC,EAAE,EAAEP,OAAO,CAACI,IAAI,CAACG,EAAE;IACnBC,QAAQ,EAAER,OAAO,CAACI,IAAI,CAACI,QAAQ;IAC/BC,IAAI,EAAET,OAAO,CAACI,IAAI,CAACK,IAAI;IACvBC,MAAM,EAAEV,OAAO,CAACI,IAAI,CAACM,MAAM,IAAIC;EACjC,CAAC;;EAED;EACA;EACA;EACA,MAAMb,aAAa,CAAC;IAClBF,SAAS,EAAEI,OAAO,CAACJ,SAAS,IAAIA,SAAS;IACzCgB,QAAQ,EAAEZ,OAAO,CAACY,QAAQ,IAAI,EAAE;IAChCC,SAAS,EAAEb,OAAO,CAACa,SAAS,IAAI,EAAE;IAClCT,IAAI,EAAEE,WAAW;IACjBJ,WAAW,EAAEF,OAAO,CAACE;EACvB,CAAC,CAAC;;EAEF;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMT,6BAA6B,CAACE,WAAW,EAAEI,aAAa,IAAI,CAAC,CAAC,CAAC;EAErE,OAAOC,OAAO,CAACI,IAAI;AACrB","ignoreList":[]}
+{"version":3,"names":["KeyManager","completeDeviceFlowSignIn","oxyServices","sessionId","sessionToken","commitSession","claimed","claimSessionByToken","accessToken","storeSharedSession","user","Error","minimalUser","id","username","name","avatar","undefined","deviceId","expiresAt","refreshToken"],"sourceRoot":"../../../src","sources":["utils/deviceFlowSignIn.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACEA,UAAU,QAIL,aAAa;;AAepB;AACA;AACA;AACA;AACA;AACA;AACA;;AAkCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,wBAAwBA,CAAC;EAC7CC,WAAW;EACXC,SAAS;EACTC,YAAY;EACZC;AAC+B,CAAC,EAAiB;EACjD;EACA;EACA;EACA,MAAMC,OAAO,GAAG,MAAMJ,WAAW,CAACK,mBAAmB,CAACH,YAAY,CAAC;EACnE,IAAIE,OAAO,EAAEE,WAAW,EAAE;IACxB,MAAMR,UAAU,CAACS,kBAAkB,CAACH,OAAO,CAACH,SAAS,IAAIA,SAAS,EAAEG,OAAO,CAACE,WAAW,CAAC;EAC1F;EAEA,IAAI,CAACF,OAAO,EAAEE,WAAW,IAAI,CAACF,OAAO,CAACI,IAAI,EAAE;IAC1C,MAAM,IAAIC,KAAK,CAAC,mDAAmD,CAAC;EACtE;;EAEA;EACA;EACA;EACA;EACA,MAAMC,WAA4B,GAAG;IACnCC,EAAE,EAAEP,OAAO,CAACI,IAAI,CAACG,EAAE;IACnBC,QAAQ,EAAER,OAAO,CAACI,IAAI,CAACI,QAAQ;IAC/BC,IAAI,EAAET,OAAO,CAACI,IAAI,CAACK,IAAI;IACvBC,MAAM,EAAEV,OAAO,CAACI,IAAI,CAACM,MAAM,IAAIC;EACjC,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA,MAAMZ,aAAa,CAAC;IAClBF,SAAS,EAAEG,OAAO,CAACH,SAAS,IAAIA,SAAS;IACzCe,QAAQ,EAAEZ,OAAO,CAACY,QAAQ,IAAI,EAAE;IAChCC,SAAS,EAAEb,OAAO,CAACa,SAAS,IAAI,EAAE;IAClCT,IAAI,EAAEE,WAAW;IACjBJ,WAAW,EAAEF,OAAO,CAACE,WAAW;IAChC,IAAIF,OAAO,CAACc,YAAY,GAAG;MAAEA,YAAY,EAAEd,OAAO,CAACc;IAAa,CAAC,GAAG,CAAC,CAAC;EACxE,CAAC,CAAC;;EAEF;EACA;EACA;EACA;;EAEA,OAAOd,OAAO,CAACI,IAAI;AACrB","ignoreList":[]}

package/lib/typescript/commonjs/index.d.ts

@@ -47,7 +47,6 @@ export type { MutationStatus } from './ui/hooks/useMutationStatus';
 export { useOnlineStatus } from './ui/hooks/useOnlineStatus';
 export { handleAuthError, isInvalidSessionError, isTimeoutOrNetworkError, extractErrorMessage, } from './ui/utils/errorHandlers';
 export type { HandleAuthErrorOptions } from './ui/utils/errorHandlers';
-export { CrossApexDirectSignInError, isCrossApexWeb } from './utils/crossApex';
 export { useFileFiltering } from './ui/hooks/useFileFiltering';
 export type { ViewMode, SortBy, SortOrder } from './ui/hooks/useFileFiltering';
 export { default as Avatar } from './ui/components/Avatar';

package/lib/typescript/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAKxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACH,aAAa,EACb,SAAS,IAAI,cAAc,EAC3B,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAKpE,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,sBAAsB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,yBAAyB,GAC5B,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACH,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACH,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAClB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACR,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAQjE,OAAO,EACH,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GACjC,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAK7D,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAIvE,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAK/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK/E,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAGzD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACjF,YAAY,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAKhF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAKvF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAClG,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAMpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,YAAY,EACR,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,GAC9B,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGlF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAKtF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAKxD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAKxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACH,aAAa,EACb,SAAS,IAAI,cAAc,EAC3B,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAKpE,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACH,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,sBAAsB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,yBAAyB,GAC5B,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EACH,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,GAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACH,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAClB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACR,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAQjE,OAAO,EACH,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GACjC,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAK7D,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAKvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK/E,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAGzD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACjF,YAAY,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAKhF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAKvF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAClG,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAMpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,YAAY,EACR,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,GAC9B,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGlF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAKtF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAKxD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}

package/lib/typescript/commonjs/ui/components/SignInAccountChooser.d.ts

@@ -0,0 +1,29 @@
+import type React from 'react';
+import type { SwitchableAccount } from '../hooks/useSwitchableAccounts';
+export interface SignInAccountChooserProps {
+    /** Accounts available on this device / in the caller's graph, current first. */
+    accounts: SwitchableAccount[];
+    /** Selecting a row — the active account continues, others switch into. */
+    onSelectAccount: (account: SwitchableAccount) => void;
+    /** "Use another account" → reveal the sign-in options (password / QR / add). */
+    onUseAnother: () => void;
+    /** The account id currently being switched into (shows a per-row spinner). */
+    pendingAccountId?: string | null;
+    /** Disables every row while a selection is in flight. */
+    disabled?: boolean;
+}
+/**
+ * Google-style account chooser (React Native). Lists every account the user can
+ * continue as — device sign-ins + linked graph accounts, from
+ * {@link SwitchableAccount} — plus a "Use another account" affordance. Rendered
+ * as the FRONT screen of the sign-in surfaces (`SignInModal` web,
+ * `OxyAuthScreen` native) whenever accounts exist; selecting a row funnels into
+ * the SAME `switchToAccount` path the account switcher uses. When no accounts
+ * exist the surfaces skip this and show the sign-in options directly.
+ *
+ * Presentational + chrome-agnostic (no modal/sheet wrapper, no data fetching) so
+ * both containers reuse it and it is unit-testable in isolation.
+ */
+export declare const SignInAccountChooser: React.FC<SignInAccountChooserProps>;
+export default SignInAccountChooser;
+//# sourceMappingURL=SignInAccountChooser.d.ts.map

package/lib/typescript/commonjs/ui/components/SignInAccountChooser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInAccountChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInAccountChooser.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,WAAW,yBAAyB;IACtC,gFAAgF;IAChF,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,eAAe,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,gFAAgF;IAChF,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC,yBAAyB,CA4EpE,CAAC;AAoDF,eAAe,oBAAoB,CAAC"}

package/lib/typescript/commonjs/ui/components/SignInModal.d.ts

@@ -1,16 +1,21 @@
 /**
- * SignInModal - Web-first centered sign-in modal (Continue with Oxy)
+ * SignInModal — web-first centered sign-in modal.
  *
- * A semi-transparent full-screen modal whose primary action is the one-tap
- * "Continue with Oxy" approval flow. The QR code is demoted to a collapsed
- * "Sign in on another device" disclosure (you can't scan your own screen).
+ * Two phases, Google-style:
+ *  1. Account chooser (FRONT screen, shown when the device/user already has
+ *     accounts): pick an account to continue as — one tap switches through the
+ *     SAME `switchToAccount` path the account switcher uses — or "Use another
+ *     account" to reveal the sign-in options.
+ *  2. Sign-in options: the first-party password flow (identifier → password →
+ *     optional 2FA, `usePasswordSignIn`) as the PRIMARY action, with the
+ *     cross-app device flow (same-device deep-link + "sign in on another device"
+ *     QR) as a SECONDARY option below an "or" divider.
  *
- * ALL of the auth-session machinery (session-token creation, QR data, socket +
- * polling, waiting/error/retry state, the open-auth handler, deep-link return,
- * and cleanup) lives in the shared `useOxyAuthSession` hook, which the native
- * `OxyAuthScreen` also consumes — neither container re-implements the transport.
- *
- * Animates with a fade + scale effect.
+ * When there are no accounts the modal opens straight on the sign-in options.
+ * The device-flow machinery lives in the shared `useOxyAuthSession` hook (the
+ * native `OxyAuthScreen` consumes it too — neither container re-implements the
+ * transport). Animates with a fade + scale; per-phase content cross-fades and
+ * respects reduced motion.
  */
 import type React from 'react';
 export declare const showSignInModal: () => void;

package/lib/typescript/commonjs/ui/components/SignInModal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAwB/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EA8BxB,CAAC;AA8QF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"SignInModal.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/SignInModal.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA8B/B,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,eAAe,YAI3B,CAAC;AAEF,eAAO,MAAM,oBAAoB,eAAqB,CAAC;AAEvD,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB,GAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,KAAG,CAAC,MAAM,IAAI,CAGxF,CAAC;AAEF,QAAA,MAAM,WAAW,EAAE,KAAK,CAAC,EAkBxB,CAAC;AAybF,eAAe,WAAW,CAAC"}