@oxyhq/services 14.0.1 → 15.0.0

package/lib/typescript/commonjs/ui/session/sessionClientHost.d.ts

@@ -1,14 +0,0 @@
-import type { OxyServices, SessionClientHost } from '@oxyhq/core';
-/**
- * Thin `SessionClientHost` adapter over an `OxyServices` instance.
- *
- * `SessionClient` (in `@oxyhq/core`) is host-agnostic: it only needs a REST +
- * token surface. `OxyServices` already exposes all of that except
- * `getCurrentAccountId`, which has no direct equivalent — the adapter holds a
- * mutable ref set by the caller (`OxyContext`, in Fase 3-B) via
- * `setCurrentAccountId`.
- */
-export declare function createSessionClientHost(oxyServices: OxyServices): SessionClientHost & {
-    setCurrentAccountId(id: string | null): void;
-};
-//# sourceMappingURL=sessionClientHost.d.ts.map

package/lib/typescript/commonjs/ui/session/sessionClientHost.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionClientHost.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sessionClientHost.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,GACvB,iBAAiB,GAAG;IAAE,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;CAAE,CAatE"}

package/lib/typescript/commonjs/ui/utils/activeAuthuser.d.ts

@@ -1,67 +0,0 @@
-/**
- * Web-only helpers around the retired `oxy_rt_${authuser}` multi-slot
- * refresh-cookie scheme, PLUS the (unrelated, still load-bearing) deliberate
- * sign-out / SSO-bounce gates.
- *
- * NOTE (session-sync cutover, Task 5): the device account SET is now
- * server-authoritative via `SessionClient` (`@oxyhq/core`) — nothing in
- * `@oxyhq/services` writes the persisted active-`authuser`-slot key anymore
- * (`writeActiveAuthuser`/`clearActiveAuthuser` were deleted; their only
- * callers were the deleted `establishDeviceRefreshSlot` sign-in registration
- * and the deleted `switchToAccount`/`switchSession` slot bookkeeping).
- * {@link readActiveAuthuser} is KEPT purely as an OPTIONAL restore hint:
- * `OxyContext`'s `restoreStoredSession` cold-boot step reads it only to
- * backfill `clientSession.authuser` for the active session when a legacy value
- * happens to be present. It NO LONGER gates whether restore is attempted — the
- * old guard that also required this marker made every web reload with a lapsed
- * local bearer bail before any network validation (P0), and was replaced by a
- * "bail only when there is nothing to restore" guard plus a valid-session
- * election. Since nothing writes the key anymore, the backfill is dormant on
- * fresh installs; it stays for legacy installs and costs nothing.
- *
- * Native (React Native) has no equivalent of these device-local cookies
- * and uses bearer-protected session ids directly, so these helpers no-op
- * outside the browser.
- */
-/**
- * Read the persisted active `authuser` slot index.
- *
- * Returns `null` on native, on a corrupted value, or when nothing has been
- * persisted yet (first visit). Callers treat `null` as "no preference" and
- * fall back to deterministic selection (lowest authuser).
- */
-export declare function readActiveAuthuser(): number | null;
-/**
- * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
- * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
- * the next cold boot does NOT silently re-mint a session from a still-live IdP
- * session (the per-apex `/auth/silent` iframe cold-boot step). Cleared by any
- * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
- * failure (best-effort).
- */
-export declare function markSignedOut(): void;
-/**
- * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
- * sign-in (password, account switch, device claim) so a real sign-in
- * fully re-enables automatic silent restore — there is no "stuck signed out"
- * state. No-ops on native / storage failure.
- */
-export declare function clearSignedOut(): void;
-/**
- * Whether AUTOMATIC silent restore is suppressed for the current origin because
- * the user deliberately signed out. Reads the durable flag through the core
- * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
- * storage failure (fail safe toward normal restore). Used to gate the
- * `silent-iframe` cold-boot step.
- */
-export declare function isSilentRestoreSuppressed(): boolean;
-/**
- * Clear all per-origin SSO bounce sessionStorage keys. Called ONLY on EXPLICIT
- * user sign-out (logout / logoutAll) — never on a cold-boot failure path — so a
- * fresh deliberate sign-in can re-probe the central IdP. Clearing on cold-boot
- * failure would reintroduce the redirect loop.
- *
- * No-ops on native and on any storage failure (best-effort).
- */
-export declare function clearSsoBounceState(): void;
-//# sourceMappingURL=activeAuthuser.d.ts.map

package/lib/typescript/commonjs/ui/utils/activeAuthuser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"activeAuthuser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/activeAuthuser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA2BH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAalD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAOrC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAMnD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAa1C"}

package/lib/typescript/commonjs/utils/crossApex.d.ts

@@ -1,55 +0,0 @@
-/**
- * Cross-apex web detection for sign-in durability gating.
- *
- * On a web Relying Party whose registrable apex differs from the central Oxy
- * Identity Provider apex (`oxy.so`), the ONLY sign-in completion that survives a
- * page reload is the interactive "Continue with Oxy" IdP flow, because it is the
- * only one that establishes a first-party `fedcm_session` cookie at
- * `auth.<apex>` — the anchor the cross-domain cold-boot restore reads on reload.
- *
- * The other sign-in completions the SDK can drive do NOT plant a `fedcm_session`:
- *   - password / public-key sign-in mints a bearer directly against the Oxy API
- *     (its refresh cookie is host-scoped to `api.oxy.so` and `SameSite=Lax`, so
- *     it is unreachable cross-site from the RP), and
- *   - the Commons-app device-flow handoff (cross-device QR / same-device
- *     deep-link) is approved OUTSIDE the browser, so no IdP browser session is
- *     established.
- * On a cross-apex RP each of these leaves the user signed in for the current
- * page only — a reload logs them out. See OxyHQServices AGENTS.md
- * "Auth / Session Contract".
- *
- * Same-apex `*.oxy.so` apps (e.g. `accounts.oxy.so`) are first-party with
- * `api.oxy.so`: their refresh cookie rides same-site requests so reload restore
- * works without `fedcm_session`, and they are therefore NOT gated.
- *
- * Returns `false` off-browser (React Native has no `window.location`) and for
- * hosts without a registrable apex (localhost / raw IP / single-label dev
- * hosts), so native and local development keep every sign-in method.
- */
-/**
- * Whether the given host is a web RP on a registrable apex other than the
- * central Oxy IdP apex (`oxy.so`). See the module doc for why this gates the
- * non-durable sign-in paths.
- *
- * @param hostname - The host to classify. Defaults to the current
- *   `window.location.hostname`; resolves to `undefined` off-browser (React
- *   Native / SSR), which yields `false`. The explicit parameter mirrors
- *   `autoDetectAuthWebUrl(location?)` and keeps the predicate unit-testable
- *   without manipulating the global `window.location`.
- */
-export declare function isCrossApexWeb(hostname?: string | undefined): boolean;
-/**
- * Thrown when an app attempts a direct (non-IdP) sign-in — password or
- * public-key — on a cross-apex web RP, where such a sign-in would not survive a
- * page reload because no `fedcm_session` is established (see {@link isCrossApexWeb}).
- *
- * Apps on a cross-apex apex must sign in through the interactive
- * "Continue with Oxy" IdP flow (`OxySignInButton` / `showSignInModal()`), which
- * plants the durable session.
- */
-export declare class CrossApexDirectSignInError extends Error {
-    readonly name = "CrossApexDirectSignInError";
-    readonly code = "CROSS_APEX_DIRECT_SIGN_IN_UNSUPPORTED";
-    constructor();
-}
-//# sourceMappingURL=crossApex.d.ts.map

package/lib/typescript/commonjs/utils/crossApex.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossApex.d.ts","sourceRoot":"","sources":["../../../../src/utils/crossApex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,SAEN,GACZ,OAAO,CAMT;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,SAAkB,IAAI,gCAAgC;IACtD,QAAQ,CAAC,IAAI,2CAA2C;;CASzD"}

package/lib/typescript/module/ui/context/inSessionTokenRefresh.d.ts

@@ -1,106 +0,0 @@
-/**
- * In-session access-token refresh for the React Native / Expo SDK.
- *
- * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
- * installed an `authRefreshHandler` on the owner `HttpService`, so
- * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
- * in-session token refresh on the RN path at all. A 15-minute access token
- * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
- * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
- * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
- * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
- * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
- *
- * THE FIX, two cooperating pieces both wired from `OxyContext`:
- *
- *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
- *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by composing the SAME silent-restore primitive cold boot uses
- *     ({@link mintSessionViaPerApexIframe}) — not a copy. The linked client
- *     (`createLinkedClient`) inherits the fix for free: its refresh delegates
- *     back to the owner's `refreshAccessToken`.
- *
- *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
- *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
- *     app-foreground), so the common case never even reaches the reactive
- *     401-then-recover flash.
- *
- * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
- * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
- * reimplement them, so the timer / foreground / per-request triggers collapse to
- * one network attempt (no refresh storm).
- *
- * NOTE (session-sync cutover, Task 5): the web arm chain used to fall through
- * to a same-apex `oxy_rt` refresh-cookie arm (`refreshAllSessions` +
- * `selectActiveRefreshAccount`). That arm is DELETED — the device account set
- * is now server-authoritative via `SessionClient` (`@oxyhq/core`), which
- * `OxyContext` bootstraps/reprojects independently of in-session token
- * refresh. `selectActiveRefreshAccount` had no other caller and was deleted
- * with it.
- */
-import type { OxyServices, AuthRefreshHandler } from '@oxyhq/core';
-/**
- * Lead time (ms) before access-token expiry at which the proactive scheduler
- * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
- * (60s) so the scheduled refresh and the request-time preflight refresh use the
- * same window — the scheduler simply fires it during idle/background instead of
- * waiting for the next request.
- */
-export declare const TOKEN_REFRESH_LEAD_MS = 60000;
-/**
- * Build the in-session `AuthRefreshHandler` for the owner client.
- *
- * Arms run in an explicit order; the first to plant a token wins. Each arm
- * resolves to the planted token (read back via `getAccessToken()` — the
- * underlying SDK call plants it internally) or `null`. A throw in one arm is
- * logged and treated as `null` so the chain continues.
- *
- *   NATIVE (Expo): shared cross-app identity key re-mint
- *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
- *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
- *     when the device holds no shared identity (e.g. a password-only native
- *     sign-in) so a genuinely dead session reconciles to logged-out rather than
- *     staying a zombie.
- *
- *   WEB: Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
- *     (shared verbatim with cold boot). The durable cross-apex path; also
- *     covers `*.oxy.so` (the per-apex host IS the central host there). There
- *     is no FedCM arm — FedCM was removed from the client sign-in/refresh path
- *     entirely (Chrome-only; see `CrossDomainAuth`'s doc comment in
- *     `@oxyhq/core` for the production sign-in loop that motivated the
- *     removal).
- *
- * NO RECURSION: no arm issues a request through the authed client's
- * `refreshAccessToken` path. The iframe transport is postMessage-based; the
- * follow-up `/session/user` fetch inside `silentSignIn`
- * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path.
- */
-export declare function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler;
-/**
- * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
- * down the timer and the foreground listener.
- */
-export interface TokenRefreshSchedulerHandle {
-    dispose(): void;
-}
-/**
- * Start the proactive in-session refresh scheduler against `oxyServices`.
- *
- * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
- * current access token's `exp`, calling `httpService.refreshAccessToken`
- * ('preflight') — which runs the installed handler and is deduped + cooldown-
- * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged` — so a
- * sign-out that clears the token cancels the timer) and, on web tab-focus /
- * native app-foreground, refreshes immediately if already inside the lead window
- * (a long-hidden tab throttles timers, so the token can be expired on return).
- *
- * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
- * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
- * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
- * refresh trigger in those cases.
- */
-export declare function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle;
-//# sourceMappingURL=inSessionTokenRefresh.d.ts.map

package/lib/typescript/module/ui/context/inSessionTokenRefresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAgBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAuC1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}

package/lib/typescript/module/ui/context/silentSessionRestore.d.ts

@@ -1,36 +0,0 @@
-/**
- * Silent, no-reload session-restore PRIMITIVE — the single shared
- * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
- * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
- * re-implements it; they compose it. Keeping one home avoids the two paths
- * drifting on "how do we mint a first-party token without a page reload".
- *
- * Platform-agnostic at the type level and returns plain data; the callers own
- * the side effects that differ between them (cold boot COMMITS the recovered
- * session into provider state; refresh only reads the freshly planted bearer).
- *
- * NOTE (session-sync cutover, Task 5): this file used to also export
- * `selectActiveRefreshAccount`, which picked the active account out of a
- * `refreshAllSessions` (`oxy_rt` refresh-cookie) snapshot. Deleted — its only
- * caller was the in-session refresh handler's now-deleted `refresh-cookie`
- * arm. The device account SET is server-authoritative via `SessionClient`
- * (`@oxyhq/core`) now.
- */
-import type { OxyServices, SessionLoginResponse } from '@oxyhq/core';
-/**
- * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
- * durable cross-domain restore path that works WITHOUT a top-level navigation
- * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
- *
- * The instance is configured with the CENTRAL auth URL, so we explicitly point
- * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
- * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
- * IS the central host, so this also covers same-apex. When auto-detection bails
- * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
- * return `null`. `silentSignIn` plants the access token internally on success.
- *
- * @returns the recovered session (token already planted) when complete, else
- * `null` (no per-apex IdP, no session, or an incomplete iframe response).
- */
-export declare function mintSessionViaPerApexIframe(oxyServices: OxyServices, timeoutMs: number): Promise<SessionLoginResponse | null>;
-//# sourceMappingURL=silentSessionRestore.d.ts.map

package/lib/typescript/module/ui/context/silentSessionRestore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"silentSessionRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/silentSessionRestore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGrE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAatC"}

package/lib/typescript/module/ui/hooks/useWebSSO.d.ts

@@ -1,19 +0,0 @@
-/**
- * Platform detection helper for the web auth/session-sync surfaces.
- *
- * This module previously hosted a FedCM-based `useWebSSO` hook (Federated
- * Credential Management — Chrome-only). It was removed: FedCM is no longer
- * used anywhere in the client sign-in/cold-boot path (see `CrossDomainAuth`'s
- * doc comment in `@oxyhq/core` for the production sign-in loop that motivated
- * the removal). Cross-domain silent SSO is owned entirely by the
- * `silent-iframe` cold-boot step (per-apex `/auth/silent`) plus the terminal
- * `/sso` bounce in `OxyContext`.
- *
- * `isWebBrowser` is kept here (rather than moved) so every existing consumer
- * import path stays valid.
- */
-/**
- * Check if we're running in a web browser environment (not React Native)
- */
-export declare function isWebBrowser(): boolean;
-//# sourceMappingURL=useWebSSO.d.ts.map

package/lib/typescript/module/ui/hooks/useWebSSO.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAItC"}

package/lib/typescript/module/ui/session/projectSessionState.d.ts

@@ -1,45 +0,0 @@
-import type { DeviceSessionState } from '@oxyhq/contracts';
-import type { ClientSession, User } from '@oxyhq/core';
-/**
- * Pure projection helpers: `DeviceSessionState` (the device-scoped
- * multi-account session-sync state produced by `@oxyhq/core`'s
- * `SessionClient`) -> the shapes `OxyContext` renders today
- * (`ClientSession[]`, an active session id, an active `User`).
- *
- * No I/O. The caller fetches profiles via
- * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
- * from the result before calling `deviceStateToClientSessions` /
- * `activeUserOf`.
- */
-/**
- * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
- *
- * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
- * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
- * wire value is an epoch-ms number) as a provisional value. Fase 3-B
- * rewrites `ClientSession` to make `expiresAt`/`lastActive` optional (they
- * are not derivable from `DeviceSessionState`).
- *
- * `usersById` is accepted for signature symmetry with `activeUserOf` even
- * though `ClientSession` only stores `userId` — a session is still
- * projected for an account whose id is absent from `usersById` (no
- * placeholder user is fabricated).
- */
-export declare function deviceStateToClientSessions(state: DeviceSessionState, usersById: Map<string, User>): ClientSession[];
-/**
- * The active account's `sessionId`, or `null` when there is no state or no
- * active account is set.
- */
-export declare function activeSessionIdOf(state: DeviceSessionState | null): string | null;
-/**
- * The active account's `User`, resolved from `usersById`. `null` when there
- * is no state, no active account is set, or the active account id is absent
- * from `usersById`.
- */
-export declare function activeUserOf(state: DeviceSessionState | null, usersById: Map<string, User>): User | null;
-/**
- * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
- * fetch. `[]` for `null` state.
- */
-export declare function accountIdsOf(state: DeviceSessionState | null): string[];
-//# sourceMappingURL=projectSessionState.d.ts.map

package/lib/typescript/module/ui/session/projectSessionState.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"projectSessionState.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/projectSessionState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;;;;;;;GAUG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAC3B,aAAa,EAAE,CAajB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAC3B,IAAI,GAAG,IAAI,CAKb;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,EAAE,CAKvE"}

package/lib/typescript/module/ui/session/sessionClientHost.d.ts

@@ -1,14 +0,0 @@
-import type { OxyServices, SessionClientHost } from '@oxyhq/core';
-/**
- * Thin `SessionClientHost` adapter over an `OxyServices` instance.
- *
- * `SessionClient` (in `@oxyhq/core`) is host-agnostic: it only needs a REST +
- * token surface. `OxyServices` already exposes all of that except
- * `getCurrentAccountId`, which has no direct equivalent — the adapter holds a
- * mutable ref set by the caller (`OxyContext`, in Fase 3-B) via
- * `setCurrentAccountId`.
- */
-export declare function createSessionClientHost(oxyServices: OxyServices): SessionClientHost & {
-    setCurrentAccountId(id: string | null): void;
-};
-//# sourceMappingURL=sessionClientHost.d.ts.map

package/lib/typescript/module/ui/session/sessionClientHost.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionClientHost.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sessionClientHost.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,GACvB,iBAAiB,GAAG;IAAE,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;CAAE,CAatE"}

package/lib/typescript/module/ui/utils/activeAuthuser.d.ts

@@ -1,67 +0,0 @@
-/**
- * Web-only helpers around the retired `oxy_rt_${authuser}` multi-slot
- * refresh-cookie scheme, PLUS the (unrelated, still load-bearing) deliberate
- * sign-out / SSO-bounce gates.
- *
- * NOTE (session-sync cutover, Task 5): the device account SET is now
- * server-authoritative via `SessionClient` (`@oxyhq/core`) — nothing in
- * `@oxyhq/services` writes the persisted active-`authuser`-slot key anymore
- * (`writeActiveAuthuser`/`clearActiveAuthuser` were deleted; their only
- * callers were the deleted `establishDeviceRefreshSlot` sign-in registration
- * and the deleted `switchToAccount`/`switchSession` slot bookkeeping).
- * {@link readActiveAuthuser} is KEPT purely as an OPTIONAL restore hint:
- * `OxyContext`'s `restoreStoredSession` cold-boot step reads it only to
- * backfill `clientSession.authuser` for the active session when a legacy value
- * happens to be present. It NO LONGER gates whether restore is attempted — the
- * old guard that also required this marker made every web reload with a lapsed
- * local bearer bail before any network validation (P0), and was replaced by a
- * "bail only when there is nothing to restore" guard plus a valid-session
- * election. Since nothing writes the key anymore, the backfill is dormant on
- * fresh installs; it stays for legacy installs and costs nothing.
- *
- * Native (React Native) has no equivalent of these device-local cookies
- * and uses bearer-protected session ids directly, so these helpers no-op
- * outside the browser.
- */
-/**
- * Read the persisted active `authuser` slot index.
- *
- * Returns `null` on native, on a corrupted value, or when nothing has been
- * persisted yet (first visit). Callers treat `null` as "no preference" and
- * fall back to deterministic selection (lowest authuser).
- */
-export declare function readActiveAuthuser(): number | null;
-/**
- * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
- * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
- * the next cold boot does NOT silently re-mint a session from a still-live IdP
- * session (the per-apex `/auth/silent` iframe cold-boot step). Cleared by any
- * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
- * failure (best-effort).
- */
-export declare function markSignedOut(): void;
-/**
- * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
- * sign-in (password, account switch, device claim) so a real sign-in
- * fully re-enables automatic silent restore — there is no "stuck signed out"
- * state. No-ops on native / storage failure.
- */
-export declare function clearSignedOut(): void;
-/**
- * Whether AUTOMATIC silent restore is suppressed for the current origin because
- * the user deliberately signed out. Reads the durable flag through the core
- * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
- * storage failure (fail safe toward normal restore). Used to gate the
- * `silent-iframe` cold-boot step.
- */
-export declare function isSilentRestoreSuppressed(): boolean;
-/**
- * Clear all per-origin SSO bounce sessionStorage keys. Called ONLY on EXPLICIT
- * user sign-out (logout / logoutAll) — never on a cold-boot failure path — so a
- * fresh deliberate sign-in can re-probe the central IdP. Clearing on cold-boot
- * failure would reintroduce the redirect loop.
- *
- * No-ops on native and on any storage failure (best-effort).
- */
-export declare function clearSsoBounceState(): void;
-//# sourceMappingURL=activeAuthuser.d.ts.map

package/lib/typescript/module/ui/utils/activeAuthuser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"activeAuthuser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/activeAuthuser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA2BH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAalD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAOrC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAMnD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAa1C"}

package/lib/typescript/module/utils/crossApex.d.ts

@@ -1,55 +0,0 @@
-/**
- * Cross-apex web detection for sign-in durability gating.
- *
- * On a web Relying Party whose registrable apex differs from the central Oxy
- * Identity Provider apex (`oxy.so`), the ONLY sign-in completion that survives a
- * page reload is the interactive "Continue with Oxy" IdP flow, because it is the
- * only one that establishes a first-party `fedcm_session` cookie at
- * `auth.<apex>` — the anchor the cross-domain cold-boot restore reads on reload.
- *
- * The other sign-in completions the SDK can drive do NOT plant a `fedcm_session`:
- *   - password / public-key sign-in mints a bearer directly against the Oxy API
- *     (its refresh cookie is host-scoped to `api.oxy.so` and `SameSite=Lax`, so
- *     it is unreachable cross-site from the RP), and
- *   - the Commons-app device-flow handoff (cross-device QR / same-device
- *     deep-link) is approved OUTSIDE the browser, so no IdP browser session is
- *     established.
- * On a cross-apex RP each of these leaves the user signed in for the current
- * page only — a reload logs them out. See OxyHQServices AGENTS.md
- * "Auth / Session Contract".
- *
- * Same-apex `*.oxy.so` apps (e.g. `accounts.oxy.so`) are first-party with
- * `api.oxy.so`: their refresh cookie rides same-site requests so reload restore
- * works without `fedcm_session`, and they are therefore NOT gated.
- *
- * Returns `false` off-browser (React Native has no `window.location`) and for
- * hosts without a registrable apex (localhost / raw IP / single-label dev
- * hosts), so native and local development keep every sign-in method.
- */
-/**
- * Whether the given host is a web RP on a registrable apex other than the
- * central Oxy IdP apex (`oxy.so`). See the module doc for why this gates the
- * non-durable sign-in paths.
- *
- * @param hostname - The host to classify. Defaults to the current
- *   `window.location.hostname`; resolves to `undefined` off-browser (React
- *   Native / SSR), which yields `false`. The explicit parameter mirrors
- *   `autoDetectAuthWebUrl(location?)` and keeps the predicate unit-testable
- *   without manipulating the global `window.location`.
- */
-export declare function isCrossApexWeb(hostname?: string | undefined): boolean;
-/**
- * Thrown when an app attempts a direct (non-IdP) sign-in — password or
- * public-key — on a cross-apex web RP, where such a sign-in would not survive a
- * page reload because no `fedcm_session` is established (see {@link isCrossApexWeb}).
- *
- * Apps on a cross-apex apex must sign in through the interactive
- * "Continue with Oxy" IdP flow (`OxySignInButton` / `showSignInModal()`), which
- * plants the durable session.
- */
-export declare class CrossApexDirectSignInError extends Error {
-    readonly name = "CrossApexDirectSignInError";
-    readonly code = "CROSS_APEX_DIRECT_SIGN_IN_UNSUPPORTED";
-    constructor();
-}
-//# sourceMappingURL=crossApex.d.ts.map

package/lib/typescript/module/utils/crossApex.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crossApex.d.ts","sourceRoot":"","sources":["../../../../src/utils/crossApex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,SAEN,GACZ,OAAO,CAMT;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,SAAkB,IAAI,gCAAgC;IACtD,QAAQ,CAAC,IAAI,2CAA2C;;CASzD"}