@oxyhq/services 14.1.0 → 15.0.0

package/lib/module/ui/context/silentSessionRestore.js

@@ -1,53 +0,0 @@
-"use strict";
-
-/**
- * Silent, no-reload session-restore PRIMITIVE — the single shared
- * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
- * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
- * re-implements it; they compose it. Keeping one home avoids the two paths
- * drifting on "how do we mint a first-party token without a page reload".
- *
- * Platform-agnostic at the type level and returns plain data; the callers own
- * the side effects that differ between them (cold boot COMMITS the recovered
- * session into provider state; refresh only reads the freshly planted bearer).
- *
- * NOTE (session-sync cutover, Task 5): this file used to also export
- * `selectActiveRefreshAccount`, which picked the active account out of a
- * `refreshAllSessions` (`oxy_rt` refresh-cookie) snapshot. Deleted — its only
- * caller was the in-session refresh handler's now-deleted `refresh-cookie`
- * arm. The device account SET is server-authoritative via `SessionClient`
- * (`@oxyhq/core`) now.
- */
-
-import { autoDetectAuthWebUrl } from '@oxyhq/core';
-
-/**
- * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
- * durable cross-domain restore path that works WITHOUT a top-level navigation
- * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
- *
- * The instance is configured with the CENTRAL auth URL, so we explicitly point
- * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
- * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
- * IS the central host, so this also covers same-apex. When auto-detection bails
- * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
- * return `null`. `silentSignIn` plants the access token internally on success.
- *
- * @returns the recovered session (token already planted) when complete, else
- * `null` (no per-apex IdP, no session, or an incomplete iframe response).
- */
-export async function mintSessionViaPerApexIframe(oxyServices, timeoutMs) {
-  const perApexAuthUrl = autoDetectAuthWebUrl();
-  if (!perApexAuthUrl) {
-    return null;
-  }
-  const session = await oxyServices.silentSignIn?.({
-    authWebUrlOverride: perApexAuthUrl,
-    timeout: timeoutMs
-  });
-  if (!session?.user || !session.sessionId) {
-    return null;
-  }
-  return session;
-}
-//# sourceMappingURL=silentSessionRestore.js.map

package/lib/module/ui/context/silentSessionRestore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["autoDetectAuthWebUrl","mintSessionViaPerApexIframe","oxyServices","timeoutMs","perApexAuthUrl","session","silentSignIn","authWebUrlOverride","timeout","user","sessionId"],"sourceRoot":"../../../../src","sources":["ui/context/silentSessionRestore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,oBAAoB,QAAQ,aAAa;;AAElD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,2BAA2BA,CAC/CC,WAAwB,EACxBC,SAAiB,EACqB;EACtC,MAAMC,cAAc,GAAGJ,oBAAoB,CAAC,CAAC;EAC7C,IAAI,CAACI,cAAc,EAAE;IACnB,OAAO,IAAI;EACb;EACA,MAAMC,OAAO,GAAG,MAAMH,WAAW,CAACI,YAAY,GAAG;IAC/CC,kBAAkB,EAAEH,cAAc;IAClCI,OAAO,EAAEL;EACX,CAAC,CAAC;EACF,IAAI,CAACE,OAAO,EAAEI,IAAI,IAAI,CAACJ,OAAO,CAACK,SAAS,EAAE;IACxC,OAAO,IAAI;EACb;EACA,OAAOL,OAAO;AAChB","ignoreList":[]}

package/lib/module/ui/hooks/useWebSSO.js

@@ -1,24 +0,0 @@
-"use strict";
-
-/**
- * Platform detection helper for the web auth/session-sync surfaces.
- *
- * This module previously hosted a FedCM-based `useWebSSO` hook (Federated
- * Credential Management — Chrome-only). It was removed: FedCM is no longer
- * used anywhere in the client sign-in/cold-boot path (see `CrossDomainAuth`'s
- * doc comment in `@oxyhq/core` for the production sign-in loop that motivated
- * the removal). Cross-domain silent SSO is owned entirely by the
- * `silent-iframe` cold-boot step (per-apex `/auth/silent`) plus the terminal
- * `/sso` bounce in `OxyContext`.
- *
- * `isWebBrowser` is kept here (rather than moved) so every existing consumer
- * import path stays valid.
- */
-
-/**
- * Check if we're running in a web browser environment (not React Native)
- */
-export function isWebBrowser() {
-  return typeof window !== 'undefined' && typeof document !== 'undefined' && typeof document.documentElement !== 'undefined';
-}
-//# sourceMappingURL=useWebSSO.js.map

package/lib/module/ui/hooks/useWebSSO.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["isWebBrowser","window","document","documentElement"],"sourceRoot":"../../../../src","sources":["ui/hooks/useWebSSO.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA,OAAO,SAASA,YAAYA,CAAA,EAAY;EACtC,OAAO,OAAOC,MAAM,KAAK,WAAW,IAC7B,OAAOC,QAAQ,KAAK,WAAW,IAC/B,OAAOA,QAAQ,CAACC,eAAe,KAAK,WAAW;AACxD","ignoreList":[]}

package/lib/module/ui/session/projectSessionState.js

@@ -1,79 +0,0 @@
-"use strict";
-
-/**
- * Pure projection helpers: `DeviceSessionState` (the device-scoped
- * multi-account session-sync state produced by `@oxyhq/core`'s
- * `SessionClient`) -> the shapes `OxyContext` renders today
- * (`ClientSession[]`, an active session id, an active `User`).
- *
- * No I/O. The caller fetches profiles via
- * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
- * from the result before calling `deviceStateToClientSessions` /
- * `activeUserOf`.
- */
-
-/**
- * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
- *
- * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
- * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
- * wire value is an epoch-ms number) as a provisional value. Fase 3-B
- * rewrites `ClientSession` to make `expiresAt`/`lastActive` optional (they
- * are not derivable from `DeviceSessionState`).
- *
- * `usersById` is accepted for signature symmetry with `activeUserOf` even
- * though `ClientSession` only stores `userId` — a session is still
- * projected for an account whose id is absent from `usersById` (no
- * placeholder user is fabricated).
- */
-export function deviceStateToClientSessions(state, usersById) {
-  const provisionalTimestamp = new Date(state.updatedAt).toISOString();
-  return state.accounts.map(account => ({
-    sessionId: account.sessionId,
-    deviceId: state.deviceId,
-    // provisional: Fase 3-B rewrites ClientSession to make expiresAt/lastActive
-    // optional (they are not in DeviceSessionState)
-    expiresAt: provisionalTimestamp,
-    lastActive: provisionalTimestamp,
-    userId: account.accountId,
-    isCurrent: account.accountId === state.activeAccountId,
-    authuser: account.authuser
-  }));
-}
-
-/**
- * The active account's `sessionId`, or `null` when there is no state or no
- * active account is set.
- */
-export function activeSessionIdOf(state) {
-  if (state === null || state.activeAccountId === null) {
-    return null;
-  }
-  const activeAccountId = state.activeAccountId;
-  const activeAccount = state.accounts.find(account => account.accountId === activeAccountId);
-  return activeAccount?.sessionId ?? null;
-}
-
-/**
- * The active account's `User`, resolved from `usersById`. `null` when there
- * is no state, no active account is set, or the active account id is absent
- * from `usersById`.
- */
-export function activeUserOf(state, usersById) {
-  if (state === null || state.activeAccountId === null) {
-    return null;
-  }
-  return usersById.get(state.activeAccountId) ?? null;
-}
-
-/**
- * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
- * fetch. `[]` for `null` state.
- */
-export function accountIdsOf(state) {
-  if (state === null) {
-    return [];
-  }
-  return state.accounts.map(account => account.accountId);
-}
-//# sourceMappingURL=projectSessionState.js.map

package/lib/module/ui/session/projectSessionState.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["deviceStateToClientSessions","state","usersById","provisionalTimestamp","Date","updatedAt","toISOString","accounts","map","account","sessionId","deviceId","expiresAt","lastActive","userId","accountId","isCurrent","activeAccountId","authuser","activeSessionIdOf","activeAccount","find","activeUserOf","get","accountIdsOf"],"sourceRoot":"../../../../src","sources":["ui/session/projectSessionState.ts"],"mappings":";;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,2BAA2BA,CACzCC,KAAyB,EACzBC,SAA4B,EACX;EACjB,MAAMC,oBAAoB,GAAG,IAAIC,IAAI,CAACH,KAAK,CAACI,SAAS,CAAC,CAACC,WAAW,CAAC,CAAC;EACpE,OAAOL,KAAK,CAACM,QAAQ,CAACC,GAAG,CAAEC,OAAO,KAAM;IACtCC,SAAS,EAAED,OAAO,CAACC,SAAS;IAC5BC,QAAQ,EAAEV,KAAK,CAACU,QAAQ;IACxB;IACA;IACAC,SAAS,EAAET,oBAAoB;IAC/BU,UAAU,EAAEV,oBAAoB;IAChCW,MAAM,EAAEL,OAAO,CAACM,SAAS;IACzBC,SAAS,EAAEP,OAAO,CAACM,SAAS,KAAKd,KAAK,CAACgB,eAAe;IACtDC,QAAQ,EAAET,OAAO,CAACS;EACpB,CAAC,CAAC,CAAC;AACL;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAAClB,KAAgC,EAAiB;EACjF,IAAIA,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACgB,eAAe,KAAK,IAAI,EAAE;IACpD,OAAO,IAAI;EACb;EACA,MAAMA,eAAe,GAAGhB,KAAK,CAACgB,eAAe;EAC7C,MAAMG,aAAa,GAAGnB,KAAK,CAACM,QAAQ,CAACc,IAAI,CAAEZ,OAAO,IAAKA,OAAO,CAACM,SAAS,KAAKE,eAAe,CAAC;EAC7F,OAAOG,aAAa,EAAEV,SAAS,IAAI,IAAI;AACzC;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASY,YAAYA,CAC1BrB,KAAgC,EAChCC,SAA4B,EACf;EACb,IAAID,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACgB,eAAe,KAAK,IAAI,EAAE;IACpD,OAAO,IAAI;EACb;EACA,OAAOf,SAAS,CAACqB,GAAG,CAACtB,KAAK,CAACgB,eAAe,CAAC,IAAI,IAAI;AACrD;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASO,YAAYA,CAACvB,KAAgC,EAAY;EACvE,IAAIA,KAAK,KAAK,IAAI,EAAE;IAClB,OAAO,EAAE;EACX;EACA,OAAOA,KAAK,CAACM,QAAQ,CAACC,GAAG,CAAEC,OAAO,IAAKA,OAAO,CAACM,SAAS,CAAC;AAC3D","ignoreList":[]}

package/lib/module/ui/session/sessionClientHost.js

@@ -1,26 +0,0 @@
-"use strict";
-
-/**
- * Thin `SessionClientHost` adapter over an `OxyServices` instance.
- *
- * `SessionClient` (in `@oxyhq/core`) is host-agnostic: it only needs a REST +
- * token surface. `OxyServices` already exposes all of that except
- * `getCurrentAccountId`, which has no direct equivalent — the adapter holds a
- * mutable ref set by the caller (`OxyContext`, in Fase 3-B) via
- * `setCurrentAccountId`.
- */
-export function createSessionClientHost(oxyServices) {
-  let currentAccountId = null;
-  return {
-    makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
-    getBaseURL: () => oxyServices.getBaseURL(),
-    getAccessToken: () => oxyServices.getAccessToken(),
-    onTokensChanged: listener => oxyServices.onTokensChanged(listener),
-    setTokens: accessToken => oxyServices.setTokens(accessToken),
-    getCurrentAccountId: () => currentAccountId,
-    setCurrentAccountId: id => {
-      currentAccountId = id;
-    }
-  };
-}
-//# sourceMappingURL=sessionClientHost.js.map

package/lib/module/ui/session/sessionClientHost.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["createSessionClientHost","oxyServices","currentAccountId","makeRequest","method","url","data","options","getBaseURL","getAccessToken","onTokensChanged","listener","setTokens","accessToken","getCurrentAccountId","setCurrentAccountId","id"],"sourceRoot":"../../../../src","sources":["ui/session/sessionClientHost.ts"],"mappings":";;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,uBAAuBA,CACrCC,WAAwB,EAC8C;EACtE,IAAIC,gBAA+B,GAAG,IAAI;EAC1C,OAAO;IACLC,WAAW,EAAEA,CAACC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,OAAO,KAAKN,WAAW,CAACE,WAAW,CAACC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,OAAO,CAAC;IAChGC,UAAU,EAAEA,CAAA,KAAMP,WAAW,CAACO,UAAU,CAAC,CAAC;IAC1CC,cAAc,EAAEA,CAAA,KAAMR,WAAW,CAACQ,cAAc,CAAC,CAAC;IAClDC,eAAe,EAAGC,QAAQ,IAAKV,WAAW,CAACS,eAAe,CAACC,QAAQ,CAAC;IACpEC,SAAS,EAAGC,WAAW,IAAKZ,WAAW,CAACW,SAAS,CAACC,WAAW,CAAC;IAC9DC,mBAAmB,EAAEA,CAAA,KAAMZ,gBAAgB;IAC3Ca,mBAAmB,EAAGC,EAAE,IAAK;MAC3Bd,gBAAgB,GAAGc,EAAE;IACvB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/utils/activeAuthuser.js

@@ -1,134 +0,0 @@
-"use strict";
-
-/**
- * Web-only helpers around the retired `oxy_rt_${authuser}` multi-slot
- * refresh-cookie scheme, PLUS the (unrelated, still load-bearing) deliberate
- * sign-out / SSO-bounce gates.
- *
- * NOTE (session-sync cutover, Task 5): the device account SET is now
- * server-authoritative via `SessionClient` (`@oxyhq/core`) — nothing in
- * `@oxyhq/services` writes the persisted active-`authuser`-slot key anymore
- * (`writeActiveAuthuser`/`clearActiveAuthuser` were deleted; their only
- * callers were the deleted `establishDeviceRefreshSlot` sign-in registration
- * and the deleted `switchToAccount`/`switchSession` slot bookkeeping).
- * {@link readActiveAuthuser} is KEPT purely as an OPTIONAL restore hint:
- * `OxyContext`'s `restoreStoredSession` cold-boot step reads it only to
- * backfill `clientSession.authuser` for the active session when a legacy value
- * happens to be present. It NO LONGER gates whether restore is attempted — the
- * old guard that also required this marker made every web reload with a lapsed
- * local bearer bail before any network validation (P0), and was replaced by a
- * "bail only when there is nothing to restore" guard plus a valid-session
- * election. Since nothing writes the key anymore, the backfill is dormant on
- * fresh installs; it stays for legacy installs and costs nothing.
- *
- * Native (React Native) has no equivalent of these device-local cookies
- * and uses bearer-protected session ids directly, so these helpers no-op
- * outside the browser.
- */
-
-import { ssoAttemptedKey, ssoNoSessionKey, ssoGuardKey, ssoStateKey, ssoDestKey, ssoSignedOutKey, silentRestoreSuppressed } from '@oxyhq/core';
-const ACTIVE_AUTHUSER_KEY = 'oxy_active_authuser';
-function hasLocalStorage() {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined';
-}
-function getSessionStorage() {
-  if (typeof window === 'undefined') return null;
-  try {
-    return window.sessionStorage ?? null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Read the persisted active `authuser` slot index.
- *
- * Returns `null` on native, on a corrupted value, or when nothing has been
- * persisted yet (first visit). Callers treat `null` as "no preference" and
- * fall back to deterministic selection (lowest authuser).
- */
-export function readActiveAuthuser() {
-  if (!hasLocalStorage()) {
-    return null;
-  }
-  try {
-    const raw = window.localStorage.getItem(ACTIVE_AUTHUSER_KEY);
-    if (raw === null) return null;
-    const parsed = Number.parseInt(raw, 10);
-    if (!Number.isFinite(parsed) || parsed < 0) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
- * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
- * the next cold boot does NOT silently re-mint a session from a still-live IdP
- * session (the per-apex `/auth/silent` iframe cold-boot step). Cleared by any
- * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
- * failure (best-effort).
- */
-export function markSignedOut() {
-  if (!hasLocalStorage()) return;
-  try {
-    window.localStorage.setItem(ssoSignedOutKey(window.location.origin), '1');
-  } catch {
-    // Best-effort; swallow QuotaExceededError / SecurityError (private mode).
-  }
-}
-
-/**
- * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
- * sign-in (password, account switch, device claim) so a real sign-in
- * fully re-enables automatic silent restore — there is no "stuck signed out"
- * state. No-ops on native / storage failure.
- */
-export function clearSignedOut() {
-  if (!hasLocalStorage()) return;
-  try {
-    window.localStorage.removeItem(ssoSignedOutKey(window.location.origin));
-  } catch {
-    // Best-effort.
-  }
-}
-
-/**
- * Whether AUTOMATIC silent restore is suppressed for the current origin because
- * the user deliberately signed out. Reads the durable flag through the core
- * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
- * storage failure (fail safe toward normal restore). Used to gate the
- * `silent-iframe` cold-boot step.
- */
-export function isSilentRestoreSuppressed() {
-  // Unlike its try/catch-wrapped siblings this reads `window.location.origin`
-  // directly, so guard it: an RN polyfill can expose `localStorage` without a
-  // `location`, which would throw here. Fail safe toward normal restore.
-  if (!hasLocalStorage() || typeof window.location === 'undefined') return false;
-  return silentRestoreSuppressed(window.localStorage, window.location.origin);
-}
-
-/**
- * Clear all per-origin SSO bounce sessionStorage keys. Called ONLY on EXPLICIT
- * user sign-out (logout / logoutAll) — never on a cold-boot failure path — so a
- * fresh deliberate sign-in can re-probe the central IdP. Clearing on cold-boot
- * failure would reintroduce the redirect loop.
- *
- * No-ops on native and on any storage failure (best-effort).
- */
-export function clearSsoBounceState() {
-  const storage = getSessionStorage();
-  if (!storage) return;
-  try {
-    const origin = window.location.origin;
-    storage.removeItem(ssoAttemptedKey(origin));
-    storage.removeItem(ssoNoSessionKey(origin));
-    storage.removeItem(ssoGuardKey(origin));
-    storage.removeItem(ssoStateKey(origin));
-    storage.removeItem(ssoDestKey(origin));
-  } catch {
-    // Best-effort; swallow SecurityError (e.g. Safari private mode).
-  }
-}
-//# sourceMappingURL=activeAuthuser.js.map

package/lib/module/ui/utils/activeAuthuser.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["ssoAttemptedKey","ssoNoSessionKey","ssoGuardKey","ssoStateKey","ssoDestKey","ssoSignedOutKey","silentRestoreSuppressed","ACTIVE_AUTHUSER_KEY","hasLocalStorage","window","localStorage","getSessionStorage","sessionStorage","readActiveAuthuser","raw","getItem","parsed","Number","parseInt","isFinite","markSignedOut","setItem","location","origin","clearSignedOut","removeItem","isSilentRestoreSuppressed","clearSsoBounceState","storage"],"sourceRoot":"../../../../src","sources":["ui/utils/activeAuthuser.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACEA,eAAe,EACfC,eAAe,EACfC,WAAW,EACXC,WAAW,EACXC,UAAU,EACVC,eAAe,EACfC,uBAAuB,QAClB,aAAa;AAEpB,MAAMC,mBAAmB,GAAG,qBAAqB;AAEjD,SAASC,eAAeA,CAAA,EAAY;EAClC,OAAO,OAAOC,MAAM,KAAK,WAAW,IAAI,OAAOA,MAAM,CAACC,YAAY,KAAK,WAAW;AACpF;AAEA,SAASC,iBAAiBA,CAAA,EAAmB;EAC3C,IAAI,OAAOF,MAAM,KAAK,WAAW,EAAE,OAAO,IAAI;EAC9C,IAAI;IACF,OAAOA,MAAM,CAACG,cAAc,IAAI,IAAI;EACtC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,kBAAkBA,CAAA,EAAkB;EAClD,IAAI,CAACL,eAAe,CAAC,CAAC,EAAE;IACtB,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMM,GAAG,GAAGL,MAAM,CAACC,YAAY,CAACK,OAAO,CAACR,mBAAmB,CAAC;IAC5D,IAAIO,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;IAC7B,MAAME,MAAM,GAAGC,MAAM,CAACC,QAAQ,CAACJ,GAAG,EAAE,EAAE,CAAC;IACvC,IAAI,CAACG,MAAM,CAACE,QAAQ,CAACH,MAAM,CAAC,IAAIA,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;IACvD,OAAOA,MAAM;EACf,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASI,aAAaA,CAAA,EAAS;EACpC,IAAI,CAACZ,eAAe,CAAC,CAAC,EAAE;EACxB,IAAI;IACFC,MAAM,CAACC,YAAY,CAACW,OAAO,CAAChB,eAAe,CAACI,MAAM,CAACa,QAAQ,CAACC,MAAM,CAAC,EAAE,GAAG,CAAC;EAC3E,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,cAAcA,CAAA,EAAS;EACrC,IAAI,CAAChB,eAAe,CAAC,CAAC,EAAE;EACxB,IAAI;IACFC,MAAM,CAACC,YAAY,CAACe,UAAU,CAACpB,eAAe,CAACI,MAAM,CAACa,QAAQ,CAACC,MAAM,CAAC,CAAC;EACzE,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASG,yBAAyBA,CAAA,EAAY;EACnD;EACA;EACA;EACA,IAAI,CAAClB,eAAe,CAAC,CAAC,IAAI,OAAOC,MAAM,CAACa,QAAQ,KAAK,WAAW,EAAE,OAAO,KAAK;EAC9E,OAAOhB,uBAAuB,CAACG,MAAM,CAACC,YAAY,EAAED,MAAM,CAACa,QAAQ,CAACC,MAAM,CAAC;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASI,mBAAmBA,CAAA,EAAS;EAC1C,MAAMC,OAAO,GAAGjB,iBAAiB,CAAC,CAAC;EACnC,IAAI,CAACiB,OAAO,EAAE;EACd,IAAI;IACF,MAAML,MAAM,GAAGd,MAAM,CAACa,QAAQ,CAACC,MAAM;IACrCK,OAAO,CAACH,UAAU,CAACzB,eAAe,CAACuB,MAAM,CAAC,CAAC;IAC3CK,OAAO,CAACH,UAAU,CAACxB,eAAe,CAACsB,MAAM,CAAC,CAAC;IAC3CK,OAAO,CAACH,UAAU,CAACvB,WAAW,CAACqB,MAAM,CAAC,CAAC;IACvCK,OAAO,CAACH,UAAU,CAACtB,WAAW,CAACoB,MAAM,CAAC,CAAC;IACvCK,OAAO,CAACH,UAAU,CAACrB,UAAU,CAACmB,MAAM,CAAC,CAAC;EACxC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ","ignoreList":[]}

package/lib/module/utils/crossApex.js

@@ -1,69 +0,0 @@
-"use strict";
-
-/**
- * Cross-apex web detection for sign-in durability gating.
- *
- * On a web Relying Party whose registrable apex differs from the central Oxy
- * Identity Provider apex (`oxy.so`), the ONLY sign-in completion that survives a
- * page reload is the interactive "Continue with Oxy" IdP flow, because it is the
- * only one that establishes a first-party `fedcm_session` cookie at
- * `auth.<apex>` — the anchor the cross-domain cold-boot restore reads on reload.
- *
- * The other sign-in completions the SDK can drive do NOT plant a `fedcm_session`:
- *   - password / public-key sign-in mints a bearer directly against the Oxy API
- *     (its refresh cookie is host-scoped to `api.oxy.so` and `SameSite=Lax`, so
- *     it is unreachable cross-site from the RP), and
- *   - the Commons-app device-flow handoff (cross-device QR / same-device
- *     deep-link) is approved OUTSIDE the browser, so no IdP browser session is
- *     established.
- * On a cross-apex RP each of these leaves the user signed in for the current
- * page only — a reload logs them out. See OxyHQServices AGENTS.md
- * "Auth / Session Contract".
- *
- * Same-apex `*.oxy.so` apps (e.g. `accounts.oxy.so`) are first-party with
- * `api.oxy.so`: their refresh cookie rides same-site requests so reload restore
- * works without `fedcm_session`, and they are therefore NOT gated.
- *
- * Returns `false` off-browser (React Native has no `window.location`) and for
- * hosts without a registrable apex (localhost / raw IP / single-label dev
- * hosts), so native and local development keep every sign-in method.
- */
-
-import { registrableApex, CENTRAL_IDP_APEX } from '@oxyhq/core';
-
-/**
- * Whether the given host is a web RP on a registrable apex other than the
- * central Oxy IdP apex (`oxy.so`). See the module doc for why this gates the
- * non-durable sign-in paths.
- *
- * @param hostname - The host to classify. Defaults to the current
- *   `window.location.hostname`; resolves to `undefined` off-browser (React
- *   Native / SSR), which yields `false`. The explicit parameter mirrors
- *   `autoDetectAuthWebUrl(location?)` and keeps the predicate unit-testable
- *   without manipulating the global `window.location`.
- */
-export function isCrossApexWeb(hostname = typeof window !== 'undefined' ? window.location?.hostname : undefined) {
-  if (!hostname) {
-    return false;
-  }
-  const apex = registrableApex(hostname);
-  return apex !== null && apex !== CENTRAL_IDP_APEX;
-}
-
-/**
- * Thrown when an app attempts a direct (non-IdP) sign-in — password or
- * public-key — on a cross-apex web RP, where such a sign-in would not survive a
- * page reload because no `fedcm_session` is established (see {@link isCrossApexWeb}).
- *
- * Apps on a cross-apex apex must sign in through the interactive
- * "Continue with Oxy" IdP flow (`OxySignInButton` / `showSignInModal()`), which
- * plants the durable session.
- */
-export class CrossApexDirectSignInError extends Error {
-  name = 'CrossApexDirectSignInError';
-  code = 'CROSS_APEX_DIRECT_SIGN_IN_UNSUPPORTED';
-  constructor() {
-    super('Direct sign-in is unavailable on this domain because the session would ' + 'not survive a page reload. Use "Continue with Oxy" to sign in through ' + 'the Oxy identity provider.');
-  }
-}
-//# sourceMappingURL=crossApex.js.map

package/lib/module/utils/crossApex.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["registrableApex","CENTRAL_IDP_APEX","isCrossApexWeb","hostname","window","location","undefined","apex","CrossApexDirectSignInError","Error","name","code","constructor"],"sourceRoot":"../../../src","sources":["utils/crossApex.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,eAAe,EAAEC,gBAAgB,QAAQ,aAAa;;AAE/D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,cAAcA,CAC5BC,QAA4B,GAAG,OAAOC,MAAM,KAAK,WAAW,GACxDA,MAAM,CAACC,QAAQ,EAAEF,QAAQ,GACzBG,SAAS,EACJ;EACT,IAAI,CAACH,QAAQ,EAAE;IACb,OAAO,KAAK;EACd;EACA,MAAMI,IAAI,GAAGP,eAAe,CAACG,QAAQ,CAAC;EACtC,OAAOI,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAKN,gBAAgB;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMO,0BAA0B,SAASC,KAAK,CAAC;EAClCC,IAAI,GAAG,4BAA4B;EAC5CC,IAAI,GAAG,uCAAuC;EAEvDC,WAAWA,CAAA,EAAG;IACZ,KAAK,CACH,yEAAyE,GACvE,wEAAwE,GACxE,4BACJ,CAAC;EACH;AACF","ignoreList":[]}

package/lib/typescript/commonjs/ui/context/inSessionTokenRefresh.d.ts

@@ -1,106 +0,0 @@
-/**
- * In-session access-token refresh for the React Native / Expo SDK.
- *
- * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
- * installed an `authRefreshHandler` on the owner `HttpService`, so
- * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
- * in-session token refresh on the RN path at all. A 15-minute access token
- * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
- * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
- * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
- * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
- * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
- *
- * THE FIX, two cooperating pieces both wired from `OxyContext`:
- *
- *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
- *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by composing the SAME silent-restore primitive cold boot uses
- *     ({@link mintSessionViaPerApexIframe}) — not a copy. The linked client
- *     (`createLinkedClient`) inherits the fix for free: its refresh delegates
- *     back to the owner's `refreshAccessToken`.
- *
- *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
- *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
- *     app-foreground), so the common case never even reaches the reactive
- *     401-then-recover flash.
- *
- * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
- * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
- * reimplement them, so the timer / foreground / per-request triggers collapse to
- * one network attempt (no refresh storm).
- *
- * NOTE (session-sync cutover, Task 5): the web arm chain used to fall through
- * to a same-apex `oxy_rt` refresh-cookie arm (`refreshAllSessions` +
- * `selectActiveRefreshAccount`). That arm is DELETED — the device account set
- * is now server-authoritative via `SessionClient` (`@oxyhq/core`), which
- * `OxyContext` bootstraps/reprojects independently of in-session token
- * refresh. `selectActiveRefreshAccount` had no other caller and was deleted
- * with it.
- */
-import type { OxyServices, AuthRefreshHandler } from '@oxyhq/core';
-/**
- * Lead time (ms) before access-token expiry at which the proactive scheduler
- * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
- * (60s) so the scheduled refresh and the request-time preflight refresh use the
- * same window — the scheduler simply fires it during idle/background instead of
- * waiting for the next request.
- */
-export declare const TOKEN_REFRESH_LEAD_MS = 60000;
-/**
- * Build the in-session `AuthRefreshHandler` for the owner client.
- *
- * Arms run in an explicit order; the first to plant a token wins. Each arm
- * resolves to the planted token (read back via `getAccessToken()` — the
- * underlying SDK call plants it internally) or `null`. A throw in one arm is
- * logged and treated as `null` so the chain continues.
- *
- *   NATIVE (Expo): shared cross-app identity key re-mint
- *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
- *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
- *     when the device holds no shared identity (e.g. a password-only native
- *     sign-in) so a genuinely dead session reconciles to logged-out rather than
- *     staying a zombie.
- *
- *   WEB: Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
- *     (shared verbatim with cold boot). The durable cross-apex path; also
- *     covers `*.oxy.so` (the per-apex host IS the central host there). There
- *     is no FedCM arm — FedCM was removed from the client sign-in/refresh path
- *     entirely (Chrome-only; see `CrossDomainAuth`'s doc comment in
- *     `@oxyhq/core` for the production sign-in loop that motivated the
- *     removal).
- *
- * NO RECURSION: no arm issues a request through the authed client's
- * `refreshAccessToken` path. The iframe transport is postMessage-based; the
- * follow-up `/session/user` fetch inside `silentSignIn`
- * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path.
- */
-export declare function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler;
-/**
- * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
- * down the timer and the foreground listener.
- */
-export interface TokenRefreshSchedulerHandle {
-    dispose(): void;
-}
-/**
- * Start the proactive in-session refresh scheduler against `oxyServices`.
- *
- * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
- * current access token's `exp`, calling `httpService.refreshAccessToken`
- * ('preflight') — which runs the installed handler and is deduped + cooldown-
- * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged` — so a
- * sign-out that clears the token cancels the timer) and, on web tab-focus /
- * native app-foreground, refreshes immediately if already inside the lead window
- * (a long-hidden tab throttles timers, so the token can be expired on return).
- *
- * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
- * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
- * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
- * refresh trigger in those cases.
- */
-export declare function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle;
-//# sourceMappingURL=inSessionTokenRefresh.d.ts.map

package/lib/typescript/commonjs/ui/context/inSessionTokenRefresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAgBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAuC1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}

package/lib/typescript/commonjs/ui/context/silentSessionRestore.d.ts

@@ -1,36 +0,0 @@
-/**
- * Silent, no-reload session-restore PRIMITIVE — the single shared
- * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
- * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
- * re-implements it; they compose it. Keeping one home avoids the two paths
- * drifting on "how do we mint a first-party token without a page reload".
- *
- * Platform-agnostic at the type level and returns plain data; the callers own
- * the side effects that differ between them (cold boot COMMITS the recovered
- * session into provider state; refresh only reads the freshly planted bearer).
- *
- * NOTE (session-sync cutover, Task 5): this file used to also export
- * `selectActiveRefreshAccount`, which picked the active account out of a
- * `refreshAllSessions` (`oxy_rt` refresh-cookie) snapshot. Deleted — its only
- * caller was the in-session refresh handler's now-deleted `refresh-cookie`
- * arm. The device account SET is server-authoritative via `SessionClient`
- * (`@oxyhq/core`) now.
- */
-import type { OxyServices, SessionLoginResponse } from '@oxyhq/core';
-/**
- * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
- * durable cross-domain restore path that works WITHOUT a top-level navigation
- * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
- *
- * The instance is configured with the CENTRAL auth URL, so we explicitly point
- * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
- * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
- * IS the central host, so this also covers same-apex. When auto-detection bails
- * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
- * return `null`. `silentSignIn` plants the access token internally on success.
- *
- * @returns the recovered session (token already planted) when complete, else
- * `null` (no per-apex IdP, no session, or an incomplete iframe response).
- */
-export declare function mintSessionViaPerApexIframe(oxyServices: OxyServices, timeoutMs: number): Promise<SessionLoginResponse | null>;
-//# sourceMappingURL=silentSessionRestore.d.ts.map

package/lib/typescript/commonjs/ui/context/silentSessionRestore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"silentSessionRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/silentSessionRestore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGrE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAatC"}

package/lib/typescript/commonjs/ui/hooks/useWebSSO.d.ts

@@ -1,19 +0,0 @@
-/**
- * Platform detection helper for the web auth/session-sync surfaces.
- *
- * This module previously hosted a FedCM-based `useWebSSO` hook (Federated
- * Credential Management — Chrome-only). It was removed: FedCM is no longer
- * used anywhere in the client sign-in/cold-boot path (see `CrossDomainAuth`'s
- * doc comment in `@oxyhq/core` for the production sign-in loop that motivated
- * the removal). Cross-domain silent SSO is owned entirely by the
- * `silent-iframe` cold-boot step (per-apex `/auth/silent`) plus the terminal
- * `/sso` bounce in `OxyContext`.
- *
- * `isWebBrowser` is kept here (rather than moved) so every existing consumer
- * import path stays valid.
- */
-/**
- * Check if we're running in a web browser environment (not React Native)
- */
-export declare function isWebBrowser(): boolean;
-//# sourceMappingURL=useWebSSO.d.ts.map

package/lib/typescript/commonjs/ui/hooks/useWebSSO.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;GAEG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAItC"}

package/lib/typescript/commonjs/ui/session/projectSessionState.d.ts

@@ -1,45 +0,0 @@
-import type { DeviceSessionState } from '@oxyhq/contracts';
-import type { ClientSession, User } from '@oxyhq/core';
-/**
- * Pure projection helpers: `DeviceSessionState` (the device-scoped
- * multi-account session-sync state produced by `@oxyhq/core`'s
- * `SessionClient`) -> the shapes `OxyContext` renders today
- * (`ClientSession[]`, an active session id, an active `User`).
- *
- * No I/O. The caller fetches profiles via
- * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
- * from the result before calling `deviceStateToClientSessions` /
- * `activeUserOf`.
- */
-/**
- * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
- *
- * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
- * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
- * wire value is an epoch-ms number) as a provisional value. Fase 3-B
- * rewrites `ClientSession` to make `expiresAt`/`lastActive` optional (they
- * are not derivable from `DeviceSessionState`).
- *
- * `usersById` is accepted for signature symmetry with `activeUserOf` even
- * though `ClientSession` only stores `userId` — a session is still
- * projected for an account whose id is absent from `usersById` (no
- * placeholder user is fabricated).
- */
-export declare function deviceStateToClientSessions(state: DeviceSessionState, usersById: Map<string, User>): ClientSession[];
-/**
- * The active account's `sessionId`, or `null` when there is no state or no
- * active account is set.
- */
-export declare function activeSessionIdOf(state: DeviceSessionState | null): string | null;
-/**
- * The active account's `User`, resolved from `usersById`. `null` when there
- * is no state, no active account is set, or the active account id is absent
- * from `usersById`.
- */
-export declare function activeUserOf(state: DeviceSessionState | null, usersById: Map<string, User>): User | null;
-/**
- * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
- * fetch. `[]` for `null` state.
- */
-export declare function accountIdsOf(state: DeviceSessionState | null): string[];
-//# sourceMappingURL=projectSessionState.d.ts.map

package/lib/typescript/commonjs/ui/session/projectSessionState.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"projectSessionState.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/projectSessionState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;;;;;;;GAUG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAC3B,aAAa,EAAE,CAajB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAC3B,IAAI,GAAG,IAAI,CAKb;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,EAAE,CAKvE"}