@oxyhq/services 16.0.0 → 18.0.0

package/lib/module/ui/hooks/useOxyAuthSession.js

@@ -1,495 +0,0 @@
-"use strict";
-
-/**
- * useOxyAuthSession — the single shared engine for the cross-app device-flow
- * sign-in ("Sign in with Oxy") used by BOTH containers:
- *
- *   - `SignInModal` (web centered modal)
- *   - `OxyAuthScreen` (native bottom sheet)
- *
- * Before this hook existed, those two files each re-implemented ~90% of the
- * same auth-session machinery (session-token creation, QR data, socket.io
- * `/auth-session` subscription, the HTTP polling fallback, waiting/error/retry
- * state, the open-auth handler, and cleanup) — and they had drifted (notably a
- * weaker `Math.random()` session token on native vs the crypto-secure one on
- * web). This hook owns ALL of it ONCE, with a clean typed surface, so the
- * containers only own their layout. The transport is functionally identical to
- * the previous implementations — this is a structural de-duplication, not a
- * behavior change.
- *
- * The native-only deep-link return path (`Linking` redirect handling) lives
- * HERE, gated to native via `Platform.OS`, so the web container never carries
- * native-only code while the two paths still cannot drift.
- */
-
-import { useState, useEffect, useCallback, useRef } from 'react';
-import { Linking, Platform } from 'react-native';
-import io from 'socket.io-client';
-import { createDebugLogger } from '@oxyhq/core';
-import { completeDeviceFlowSignIn } from "../../utils/deviceFlowSignIn.js";
-const debug = createDebugLogger('useOxyAuthSession');
-
-/**
- * Default destination for the "Create an Oxy account" / "Get Oxy Accounts"
- * link, shared by both containers. Reused as-is from the original native
- * `OxyAuthScreen` so no new route is invented.
- */
-export const OXY_ACCOUNTS_WEB_URL = 'https://accounts.oxy.so';
-
-/** Default central Oxy auth web origin used when no override can be resolved. */
-export const OXY_AUTH_WEB_URL = 'https://auth.oxy.so';
-
-/** Auth session expiration (5 minutes). */
-export const AUTH_SESSION_EXPIRY_MS = 5 * 60 * 1000;
-
-/** Polling interval (fallback if the socket fails) in milliseconds. */
-export const POLLING_INTERVAL_MS = 3000;
-
-/** The active device-flow session this client created and is waiting on. */
-
-/**
- * Extended `POST /auth/session/create` response (the "Sign in with Oxy" handoff
- * fields, Workstream C2). Both are optional so this hook degrades gracefully
- * when the handoff backend is not yet deployed — the legacy `oxyauth://<token>`
- * QR (`qrData`) remains the fallback.
- */
-
-/** Real-time auth-session socket payload (also matches the poll status shape). */
-
-/**
- * Resolve the central Oxy auth web origin from config or the API base URL.
- * Mirrors the resolution both containers previously inlined.
- */
-function resolveAuthWebBaseUrl(baseURL, authWebUrl) {
-  if (authWebUrl) {
-    return authWebUrl;
-  }
-  try {
-    const url = new URL(baseURL);
-    if (url.port === '3001') {
-      url.port = '3002';
-      return url.origin;
-    }
-    if (url.hostname.startsWith('api.')) {
-      url.hostname = `auth.${url.hostname.slice(4)}`;
-      return url.origin;
-    }
-  } catch {
-    // Malformed base URL — fall back to the default origin below.
-  }
-  return OXY_AUTH_WEB_URL;
-}
-
-/**
- * Resolve the deep-link redirect URI used on native so the auth web flow can
- * bounce back into the app. Prefers an explicit config value, otherwise derives
- * a clean (query/hash-stripped) URI from the app's initial deep link.
- */
-async function resolveAuthRedirectUri(authRedirectUri) {
-  if (authRedirectUri) {
-    return authRedirectUri;
-  }
-  try {
-    const initialUrl = await Linking.getInitialURL();
-    if (!initialUrl) {
-      return null;
-    }
-    const parsed = new URL(initialUrl);
-    parsed.search = '';
-    parsed.hash = '';
-    return parsed.toString();
-  } catch {
-    return null;
-  }
-}
-
-/** Parse the `session_id` / `error` params from a deep-link redirect URL. */
-function getRedirectParams(url) {
-  try {
-    const parsed = new URL(url);
-    const sessionId = parsed.searchParams.get('session_id') ?? undefined;
-    const error = parsed.searchParams.get('error') ?? undefined;
-    if (!sessionId && !error) {
-      return null;
-    }
-    return {
-      sessionId,
-      error
-    };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Generate a cryptographically random session token.
- *
- * 16 random bytes -> 32 hex chars (128 bits of entropy) — unguessable.
- * `crypto.getRandomValues` is guaranteed available because importing
- * `@oxyhq/core` installs a polyfill via `expo-crypto` on React Native. This is
- * the secure generator the web modal already used; the native screen previously
- * used a weaker `Math.random()` generator, which this consolidation removes.
- */
-function generateSessionToken() {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
-}
-
-/**
- * Owns the full device-flow auth-session lifecycle for one mounted sign-in
- * surface. Both `SignInModal` and `OxyAuthScreen` consume this; neither
- * re-implements the socket / polling / deep-link transport.
- *
- * Subscriptions (socket connect/disconnect, the poll interval, the native
- * deep-link listener, and unmount cleanup) are the legitimate `useEffect` use
- * WITH cleanup. No effect here computes derived UI state.
- */
-export function useOxyAuthSession(oxyServices, clientId, commitSession, options = {}) {
-  const {
-    onSignedIn
-  } = options;
-  const [authSession, setAuthSession] = useState(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [error, setError] = useState(null);
-  const [isWaiting, setIsWaiting] = useState(false);
-  // "Sign in with Oxy" handoff fields surfaced from the `create` response.
-  const [authorizeCode, setAuthorizeCode] = useState(null);
-  const [qrPayload, setQrPayload] = useState(null);
-  const socketRef = useRef(null);
-  const pollingIntervalRef = useRef(null);
-  const isProcessingRef = useRef(false);
-  const linkingHandledRef = useRef(false);
-
-  // The latest `onSignedIn` callback, read via ref so the success handler does
-  // not need it in its dependency list (which would otherwise rebuild the
-  // socket/poll callbacks on every render where the container passes a new
-  // closure).
-  const onSignedInRef = useRef(onSignedIn);
-  onSignedInRef.current = onSignedIn;
-
-  // Cleanup socket and polling. Idempotent.
-  const cleanup = useCallback(() => {
-    setIsWaiting(false);
-    if (socketRef.current) {
-      socketRef.current.disconnect();
-      socketRef.current = null;
-    }
-    if (pollingIntervalRef.current) {
-      clearInterval(pollingIntervalRef.current);
-      pollingIntervalRef.current = null;
-    }
-  }, []);
-
-  // Handle successful authorization.
-  //
-  // The auth-session socket / poll (or deep-link return) hands us the
-  // authorized `sessionId`. Before any session-management code can use it we
-  // MUST first exchange the secret `sessionToken` (held only by this client,
-  // generated for THIS flow) for the first access token via
-  // `claimSessionByToken` — the device-flow equivalent of OAuth's
-  // code-for-token exchange (RFC 8628 §3.4).
-  //
-  // Without that exchange the SDK has no bearer token — the session is
-  // authorized server-side but the app never becomes authenticated and the UI
-  // sits "Waiting for authorization..." forever. Once `claimSessionByToken`
-  // plants the tokens in the HttpService, the claimed session is committed via
-  // `commitSession` (`useOxy().handleWebSession`) — the SAME path a fresh
-  // password sign-in or a silent cross-domain restore uses to register the
-  // account into the device's server-authoritative session set. It is NOT yet a
-  // member of that set, so
-  // `switchSession` (an account-SWITCH between accounts already on the
-  // device) is the wrong primitive here. Shared with both containers via
-  // `completeDeviceFlowSignIn` so the two paths cannot drift.
-  const handleAuthSuccess = useCallback(async (sessionId, sessionToken) => {
-    if (isProcessingRef.current) return;
-    isProcessingRef.current = true;
-    try {
-      if (!commitSession) {
-        throw new Error('Session commit unavailable');
-      }
-      const user = await completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId,
-        sessionToken,
-        commitSession
-      });
-      onSignedInRef.current?.(user);
-    } catch (err) {
-      debug.error('Error completing auth:', err);
-      setError('Authorization successful but failed to complete sign in. Please try again.');
-      isProcessingRef.current = false;
-    }
-  }, [oxyServices, commitSession]);
-
-  // Start polling for authorization.
-  //
-  // Idempotent: if a poll interval is already running this is a no-op, so the
-  // `connect_error` path (which also calls this) cannot stack a second interval
-  // on top of the always-on poll started in `generateAuthSession`.
-  const startPolling = useCallback(sessionToken => {
-    if (pollingIntervalRef.current) return;
-    pollingIntervalRef.current = setInterval(async () => {
-      if (isProcessingRef.current) return;
-      try {
-        const response = await oxyServices.makeRequest('GET', `/auth/session/status/${sessionToken}`, undefined, {
-          cache: false
-        });
-        if (response.authorized && response.sessionId) {
-          cleanup();
-          // Pass the original sessionToken (in closure) through; the claim
-          // exchange needs it to mint the first access token.
-          handleAuthSuccess(response.sessionId, sessionToken);
-        } else if (response.status === 'cancelled') {
-          cleanup();
-          setError('Authorization was denied.');
-        } else if (response.status === 'expired') {
-          cleanup();
-          setError('Session expired. Please try again.');
-        }
-      } catch (err) {
-        // Transient poll error — the next tick retries. Logged, never thrown.
-        debug.log('Auth polling error:', err);
-      }
-    }, POLLING_INTERVAL_MS);
-  }, [oxyServices, handleAuthSuccess, cleanup]);
-
-  // Connect to the auth-session socket for real-time updates.
-  const connectSocket = useCallback(sessionToken => {
-    const baseURL = oxyServices.getBaseURL();
-
-    // Connect to the auth-session namespace (no authentication required).
-    const socket = io(`${baseURL}/auth-session`, {
-      transports: ['websocket', 'polling'],
-      reconnection: true,
-      reconnectionAttempts: 3,
-      reconnectionDelay: 1000
-    });
-    socketRef.current = socket;
-    socket.on('connect', () => {
-      debug.log('Auth socket connected');
-      socket.emit('join', sessionToken);
-    });
-    socket.on('joined', () => {
-      debug.log('Joined auth session room');
-    });
-    socket.on('auth_update', payload => {
-      debug.log('Auth update received:', payload);
-      if (payload.status === 'authorized' && payload.sessionId) {
-        cleanup();
-        // `sessionToken` is this flow's secret credential (in closure) — pass
-        // it through so `handleAuthSuccess` can claim the first access token.
-        handleAuthSuccess(payload.sessionId, sessionToken);
-      } else if (payload.status === 'cancelled') {
-        cleanup();
-        setError('Authorization was denied.');
-      } else if (payload.status === 'expired') {
-        cleanup();
-        setError('Session expired. Please try again.');
-      }
-    });
-    socket.on('connect_error', err => {
-      debug.log('Socket connection error, falling back to polling:', err instanceof Error ? err.message : null);
-      // Realtime transport errored — fall back to polling. The poll is
-      // already running (started unconditionally in `generateAuthSession`),
-      // so `startPolling` here is a no-op backstop.
-      socket.disconnect();
-      startPolling(sessionToken);
-    });
-    socket.on('disconnect', () => {
-      debug.log('Auth socket disconnected');
-    });
-  }, [oxyServices, handleAuthSuccess, cleanup, startPolling]);
-
-  // Generate a new auth session.
-  const generateAuthSession = useCallback(async () => {
-    setIsLoading(true);
-    setError(null);
-    // Reset the handoff fields for the fresh session (also clears them on retry).
-    setAuthorizeCode(null);
-    setQrPayload(null);
-    isProcessingRef.current = false;
-
-    // The cross-app device sign-in flow identifies the requesting app by its
-    // real registered OAuth client id (ApplicationCredential publicKey).
-    // Without it the API cannot resolve the consent identity, so we fail fast
-    // with a clear configuration error rather than creating a session the
-    // server would reject.
-    if (!clientId) {
-      setError('This app is not configured for sign-in (missing clientId).');
-      setIsLoading(false);
-      return;
-    }
-    try {
-      const sessionToken = generateSessionToken();
-      const expiresAt = Date.now() + AUTH_SESSION_EXPIRY_MS;
-
-      // Register the auth session with the server. The response carries the
-      // "Sign in with Oxy" handoff fields (public `authorizeCode` + structured
-      // `qrPayload`) when the handoff backend is deployed; both are optional, so
-      // the legacy `oxyauth://<token>` QR path keeps working without them.
-      const createResponse = await oxyServices.makeRequest('POST', '/auth/session/create', {
-        sessionToken,
-        expiresAt,
-        clientId
-      }, {
-        cache: false
-      });
-      setAuthSession({
-        sessionToken,
-        expiresAt
-      });
-      setAuthorizeCode(createResponse?.authorizeCode ?? null);
-      setQrPayload(createResponse?.qrPayload ?? null);
-      setIsWaiting(true);
-
-      // Socket is the fast path; the poll is a transport-independent backstop
-      // that guarantees completion even if the socket connects but silently
-      // never delivers auth_update (RN transport / idle-timeout).
-      connectSocket(sessionToken);
-      startPolling(sessionToken);
-    } catch (err) {
-      setError((err instanceof Error ? err.message : null) || 'Failed to create auth session');
-    } finally {
-      setIsLoading(false);
-    }
-  }, [oxyServices, connectSocket, startPolling, clientId]);
-
-  // Open the central Oxy auth approval surface for this device-flow session.
-  // On web this is a centered popup; on native it opens the system browser,
-  // carrying a `redirect_uri` so the deep-link return path can complete the
-  // flow even if the socket/poll is slow.
-  const openAuthApproval = useCallback(async () => {
-    if (!authSession) return;
-    const authBaseUrl = resolveAuthWebBaseUrl(oxyServices.getBaseURL(), oxyServices.config?.authWebUrl);
-    const webUrl = new URL('/authorize', authBaseUrl);
-    webUrl.searchParams.set('token', authSession.sessionToken);
-    if (Platform.OS === 'web') {
-      // Open a separate approval window on web for the device-flow token.
-      const width = 500;
-      const height = 650;
-      const screenWidth = window.screen?.width ?? width;
-      const screenHeight = window.screen?.height ?? height;
-      const left = (screenWidth - width) / 2;
-      const top = (screenHeight - height) / 2;
-      window.open(webUrl.toString(), 'oxy-auth-approval', `width=${width},height=${height},left=${left},top=${top}`);
-      return;
-    }
-
-    // Native: carry a redirect URI so the auth web flow can bounce back in.
-    const redirectUri = await resolveAuthRedirectUri(oxyServices.config?.authRedirectUri);
-    if (redirectUri) {
-      webUrl.searchParams.set('redirect_uri', redirectUri);
-    }
-    try {
-      await Linking.openURL(webUrl.toString());
-    } catch (err) {
-      debug.error('Unable to open Oxy Auth:', err);
-      setError('Unable to open Oxy Auth. Please try again or use the QR code.');
-    }
-  }, [authSession, oxyServices]);
-
-  // Same-device "Sign in with Oxy" handoff: deep-link to the `qrPayload`
-  // (`oxycommons://approve?...`) so the native Oxy identity app opens directly
-  // to approve. The socket / poll already resolves the flow once the approval
-  // lands, so this only needs to launch the deep link. No-op when the handoff
-  // backend returned no `qrPayload`.
-  const openSameDeviceApproval = useCallback(async () => {
-    if (!qrPayload) {
-      return;
-    }
-    try {
-      await Linking.openURL(qrPayload);
-    } catch (err) {
-      debug.error('Unable to open the Oxy app for approval:', err);
-      setError('Unable to open the Oxy app. Scan the QR code from another device instead.');
-    }
-  }, [qrPayload]);
-
-  // Tear down and recreate the session (the retry action).
-  const retry = useCallback(() => {
-    cleanup();
-    generateAuthSession();
-  }, [generateAuthSession, cleanup]);
-
-  // Handle a native deep-link return carrying the authorized session_id.
-  const handleAuthRedirect = useCallback(url => {
-    const params = getRedirectParams(url);
-    if (!params) {
-      return;
-    }
-    if (params.error) {
-      cleanup();
-      setError('Authorization was denied.');
-      return;
-    }
-    if (params.sessionId) {
-      // The deep-link return carries only `session_id` — the secret
-      // `sessionToken` for this flow lives in component state (generated in
-      // `generateAuthSession`). Without it we cannot claim the first access
-      // token, so the flow would 401 in `handleAuthSuccess`. If it is somehow
-      // unavailable, fall through to the socket/poll path (which carries the
-      // token in closure) rather than attempting an unauthenticated claim.
-      const flowSessionToken = authSession?.sessionToken;
-      if (!flowSessionToken) {
-        return;
-      }
-      cleanup();
-      handleAuthSuccess(params.sessionId, flowSessionToken);
-    }
-  }, [authSession, cleanup, handleAuthSuccess]);
-
-  // Initialize the auth session once on mount.
-  // biome-ignore lint/correctness/useExhaustiveDependencies: this must run exactly once on mount; re-running on `generateAuthSession` identity changes would recreate the session mid-flow.
-  useEffect(() => {
-    generateAuthSession();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  // Native-only: handle the deep-link return from the auth web flow. Gated to
-  // native so the web container never carries this listener. The socket / poll
-  // path still resolves the flow if no deep link arrives.
-  useEffect(() => {
-    if (Platform.OS === 'web') {
-      return;
-    }
-    const subscription = Linking.addEventListener('url', ({
-      url
-    }) => {
-      linkingHandledRef.current = true;
-      handleAuthRedirect(url);
-    });
-    Linking.getInitialURL().then(url => {
-      if (url && !linkingHandledRef.current) {
-        handleAuthRedirect(url);
-      }
-    }).catch(() => {
-      // Ignore linking errors; auth will still resolve via socket/polling.
-    });
-    return () => {
-      subscription.remove();
-    };
-  }, [handleAuthRedirect]);
-
-  // Clean up subscriptions on unmount.
-  useEffect(() => {
-    return () => {
-      cleanup();
-    };
-  }, [cleanup]);
-  const qrData = authSession ? `oxyauth://${authSession.sessionToken}` : '';
-  return {
-    authSession,
-    qrData,
-    authorizeCode,
-    qrPayload,
-    isLoading,
-    error,
-    isWaiting,
-    openAuthApproval,
-    openSameDeviceApproval,
-    retry,
-    cleanup
-  };
-}
-//# sourceMappingURL=useOxyAuthSession.js.map

package/lib/module/ui/hooks/useOxyAuthSession.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["useState","useEffect","useCallback","useRef","Linking","Platform","io","createDebugLogger","completeDeviceFlowSignIn","debug","OXY_ACCOUNTS_WEB_URL","OXY_AUTH_WEB_URL","AUTH_SESSION_EXPIRY_MS","POLLING_INTERVAL_MS","resolveAuthWebBaseUrl","baseURL","authWebUrl","url","URL","port","origin","hostname","startsWith","slice","resolveAuthRedirectUri","authRedirectUri","initialUrl","getInitialURL","parsed","search","hash","toString","getRedirectParams","sessionId","searchParams","get","undefined","error","generateSessionToken","bytes","Uint8Array","crypto","getRandomValues","Array","from","b","padStart","join","useOxyAuthSession","oxyServices","clientId","commitSession","options","onSignedIn","authSession","setAuthSession","isLoading","setIsLoading","setError","isWaiting","setIsWaiting","authorizeCode","setAuthorizeCode","qrPayload","setQrPayload","socketRef","pollingIntervalRef","isProcessingRef","linkingHandledRef","onSignedInRef","current","cleanup","disconnect","clearInterval","handleAuthSuccess","sessionToken","Error","user","err","startPolling","setInterval","response","makeRequest","cache","authorized","status","log","connectSocket","getBaseURL","socket","transports","reconnection","reconnectionAttempts","reconnectionDelay","on","emit","payload","message","generateAuthSession","expiresAt","Date","now","createResponse","openAuthApproval","authBaseUrl","config","webUrl","set","OS","width","height","screenWidth","window","screen","screenHeight","left","top","open","redirectUri","openURL","openSameDeviceApproval","retry","handleAuthRedirect","params","flowSessionToken","subscription","addEventListener","then","catch","remove","qrData"],"sourceRoot":"../../../../src","sources":["ui/hooks/useOxyAuthSession.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,EAAEC,SAAS,EAAEC,WAAW,EAAEC,MAAM,QAAQ,OAAO;AAChE,SAASC,OAAO,EAAEC,QAAQ,QAAQ,cAAc;AAChD,OAAOC,EAAE,MAAuB,kBAAkB;AAElD,SAASC,iBAAiB,QAAQ,aAAa;AAC/C,SAASC,wBAAwB,QAAQ,iCAA8B;AAEvE,MAAMC,KAAK,GAAGF,iBAAiB,CAAC,mBAAmB,CAAC;;AAEpD;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMG,oBAAoB,GAAG,yBAAyB;;AAE7D;AACA,OAAO,MAAMC,gBAAgB,GAAG,qBAAqB;;AAErD;AACA,OAAO,MAAMC,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;;AAEnD;AACA,OAAO,MAAMC,mBAAmB,GAAG,IAAI;;AAEvC;;AAQA;AACA;AACA;AACA;AACA;AACA;;AAgBA;;AAgEA;AACA;AACA;AACA;AACA,SAASC,qBAAqBA,CAACC,OAAe,EAAEC,UAAmB,EAAU;EAC3E,IAAIA,UAAU,EAAE;IACd,OAAOA,UAAU;EACnB;EAEA,IAAI;IACF,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACH,OAAO,CAAC;IAC5B,IAAIE,GAAG,CAACE,IAAI,KAAK,MAAM,EAAE;MACvBF,GAAG,CAACE,IAAI,GAAG,MAAM;MACjB,OAAOF,GAAG,CAACG,MAAM;IACnB;IACA,IAAIH,GAAG,CAACI,QAAQ,CAACC,UAAU,CAAC,MAAM,CAAC,EAAE;MACnCL,GAAG,CAACI,QAAQ,GAAG,QAAQJ,GAAG,CAACI,QAAQ,CAACE,KAAK,CAAC,CAAC,CAAC,EAAE;MAC9C,OAAON,GAAG,CAACG,MAAM;IACnB;EACF,CAAC,CAAC,MAAM;IACN;EAAA;EAEF,OAAOT,gBAAgB;AACzB;;AAEA;AACA;AACA;AACA;AACA;AACA,eAAea,sBAAsBA,CAACC,eAAwB,EAA0B;EACtF,IAAIA,eAAe,EAAE;IACnB,OAAOA,eAAe;EACxB;EAEA,IAAI;IACF,MAAMC,UAAU,GAAG,MAAMtB,OAAO,CAACuB,aAAa,CAAC,CAAC;IAChD,IAAI,CAACD,UAAU,EAAE;MACf,OAAO,IAAI;IACb;IAEA,MAAME,MAAM,GAAG,IAAIV,GAAG,CAACQ,UAAU,CAAC;IAClCE,MAAM,CAACC,MAAM,GAAG,EAAE;IAClBD,MAAM,CAACE,IAAI,GAAG,EAAE;IAChB,OAAOF,MAAM,CAACG,QAAQ,CAAC,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA,SAASC,iBAAiBA,CAACf,GAAW,EAAiD;EACrF,IAAI;IACF,MAAMW,MAAM,GAAG,IAAIV,GAAG,CAACD,GAAG,CAAC;IAC3B,MAAMgB,SAAS,GAAGL,MAAM,CAACM,YAAY,CAACC,GAAG,CAAC,YAAY,CAAC,IAAIC,SAAS;IACpE,MAAMC,KAAK,GAAGT,MAAM,CAACM,YAAY,CAACC,GAAG,CAAC,OAAO,CAAC,IAAIC,SAAS;IAE3D,IAAI,CAACH,SAAS,IAAI,CAACI,KAAK,EAAE;MACxB,OAAO,IAAI;IACb;IAEA,OAAO;MAAEJ,SAAS;MAAEI;IAAM,CAAC;EAC7B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,oBAAoBA,CAAA,EAAW;EACtC,MAAMC,KAAK,GAAG,IAAIC,UAAU,CAAC,EAAE,CAAC;EAChCC,MAAM,CAACC,eAAe,CAACH,KAAK,CAAC;EAC7B,OAAOI,KAAK,CAACC,IAAI,CAACL,KAAK,EAAGM,CAAC,IAAKA,CAAC,CAACd,QAAQ,CAAC,EAAE,CAAC,CAACe,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAACC,IAAI,CAAC,EAAE,CAAC;AAC3E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAC/BC,WAAwB,EACxBC,QAAuB,EACvBC,aAA6E,EAC7EC,OAAiC,GAAG,CAAC,CAAC,EACb;EACzB,MAAM;IAAEC;EAAW,CAAC,GAAGD,OAAO;EAE9B,MAAM,CAACE,WAAW,EAAEC,cAAc,CAAC,GAAGvD,QAAQ,CAAqB,IAAI,CAAC;EACxE,MAAM,CAACwD,SAAS,EAAEC,YAAY,CAAC,GAAGzD,QAAQ,CAAC,IAAI,CAAC;EAChD,MAAM,CAACqC,KAAK,EAAEqB,QAAQ,CAAC,GAAG1D,QAAQ,CAAgB,IAAI,CAAC;EACvD,MAAM,CAAC2D,SAAS,EAAEC,YAAY,CAAC,GAAG5D,QAAQ,CAAC,KAAK,CAAC;EACjD;EACA,MAAM,CAAC6D,aAAa,EAAEC,gBAAgB,CAAC,GAAG9D,QAAQ,CAAgB,IAAI,CAAC;EACvE,MAAM,CAAC+D,SAAS,EAAEC,YAAY,CAAC,GAAGhE,QAAQ,CAAgB,IAAI,CAAC;EAE/D,MAAMiE,SAAS,GAAG9D,MAAM,CAAgB,IAAI,CAAC;EAC7C,MAAM+D,kBAAkB,GAAG/D,MAAM,CAAwC,IAAI,CAAC;EAC9E,MAAMgE,eAAe,GAAGhE,MAAM,CAAC,KAAK,CAAC;EACrC,MAAMiE,iBAAiB,GAAGjE,MAAM,CAAC,KAAK,CAAC;;EAEvC;EACA;EACA;EACA;EACA,MAAMkE,aAAa,GAAGlE,MAAM,CAACkD,UAAU,CAAC;EACxCgB,aAAa,CAACC,OAAO,GAAGjB,UAAU;;EAElC;EACA,MAAMkB,OAAO,GAAGrE,WAAW,CAAC,MAAM;IAChC0D,YAAY,CAAC,KAAK,CAAC;IAEnB,IAAIK,SAAS,CAACK,OAAO,EAAE;MACrBL,SAAS,CAACK,OAAO,CAACE,UAAU,CAAC,CAAC;MAC9BP,SAAS,CAACK,OAAO,GAAG,IAAI;IAC1B;IAEA,IAAIJ,kBAAkB,CAACI,OAAO,EAAE;MAC9BG,aAAa,CAACP,kBAAkB,CAACI,OAAO,CAAC;MACzCJ,kBAAkB,CAACI,OAAO,GAAG,IAAI;IACnC;EACF,CAAC,EAAE,EAAE,CAAC;;EAEN;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAMI,iBAAiB,GAAGxE,WAAW,CACnC,OAAO+B,SAAiB,EAAE0C,YAAoB,KAAK;IACjD,IAAIR,eAAe,CAACG,OAAO,EAAE;IAC7BH,eAAe,CAACG,OAAO,GAAG,IAAI;IAE9B,IAAI;MACF,IAAI,CAACnB,aAAa,EAAE;QAClB,MAAM,IAAIyB,KAAK,CAAC,4BAA4B,CAAC;MAC/C;MACA,MAAMC,IAAI,GAAG,MAAMrE,wBAAwB,CAAC;QAC1CyC,WAAW;QACXhB,SAAS;QACT0C,YAAY;QACZxB;MACF,CAAC,CAAC;MACFkB,aAAa,CAACC,OAAO,GAAGO,IAAI,CAAC;IAC/B,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZrE,KAAK,CAAC4B,KAAK,CAAC,wBAAwB,EAAEyC,GAAG,CAAC;MAC1CpB,QAAQ,CAAC,4EAA4E,CAAC;MACtFS,eAAe,CAACG,OAAO,GAAG,KAAK;IACjC;EACF,CAAC,EACD,CAACrB,WAAW,EAAEE,aAAa,CAC7B,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA,MAAM4B,YAAY,GAAG7E,WAAW,CAC7ByE,YAAoB,IAAK;IACxB,IAAIT,kBAAkB,CAACI,OAAO,EAAE;IAEhCJ,kBAAkB,CAACI,OAAO,GAAGU,WAAW,CAAC,YAAY;MACnD,IAAIb,eAAe,CAACG,OAAO,EAAE;MAE7B,IAAI;QACF,MAAMW,QAKL,GAAG,MAAMhC,WAAW,CAACiC,WAAW,CAC/B,KAAK,EACL,wBAAwBP,YAAY,EAAE,EACtCvC,SAAS,EACT;UAAE+C,KAAK,EAAE;QAAM,CACjB,CAAC;QAED,IAAIF,QAAQ,CAACG,UAAU,IAAIH,QAAQ,CAAChD,SAAS,EAAE;UAC7CsC,OAAO,CAAC,CAAC;UACT;UACA;UACAG,iBAAiB,CAACO,QAAQ,CAAChD,SAAS,EAAE0C,YAAY,CAAC;QACrD,CAAC,MAAM,IAAIM,QAAQ,CAACI,MAAM,KAAK,WAAW,EAAE;UAC1Cd,OAAO,CAAC,CAAC;UACTb,QAAQ,CAAC,2BAA2B,CAAC;QACvC,CAAC,MAAM,IAAIuB,QAAQ,CAACI,MAAM,KAAK,SAAS,EAAE;UACxCd,OAAO,CAAC,CAAC;UACTb,QAAQ,CAAC,oCAAoC,CAAC;QAChD;MACF,CAAC,CAAC,OAAOoB,GAAG,EAAE;QACZ;QACArE,KAAK,CAAC6E,GAAG,CAAC,qBAAqB,EAAER,GAAG,CAAC;MACvC;IACF,CAAC,EAAEjE,mBAAmB,CAAC;EACzB,CAAC,EACD,CAACoC,WAAW,EAAEyB,iBAAiB,EAAEH,OAAO,CAC1C,CAAC;;EAED;EACA,MAAMgB,aAAa,GAAGrF,WAAW,CAC9ByE,YAAoB,IAAK;IACxB,MAAM5D,OAAO,GAAGkC,WAAW,CAACuC,UAAU,CAAC,CAAC;;IAExC;IACA,MAAMC,MAAM,GAAGnF,EAAE,CAAC,GAAGS,OAAO,eAAe,EAAE;MAC3C2E,UAAU,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC;MACpCC,YAAY,EAAE,IAAI;MAClBC,oBAAoB,EAAE,CAAC;MACvBC,iBAAiB,EAAE;IACrB,CAAC,CAAC;IAEF5B,SAAS,CAACK,OAAO,GAAGmB,MAAM;IAE1BA,MAAM,CAACK,EAAE,CAAC,SAAS,EAAE,MAAM;MACzBrF,KAAK,CAAC6E,GAAG,CAAC,uBAAuB,CAAC;MAClCG,MAAM,CAACM,IAAI,CAAC,MAAM,EAAEpB,YAAY,CAAC;IACnC,CAAC,CAAC;IAEFc,MAAM,CAACK,EAAE,CAAC,QAAQ,EAAE,MAAM;MACxBrF,KAAK,CAAC6E,GAAG,CAAC,0BAA0B,CAAC;IACvC,CAAC,CAAC;IAEFG,MAAM,CAACK,EAAE,CAAC,aAAa,EAAGE,OAA0B,IAAK;MACvDvF,KAAK,CAAC6E,GAAG,CAAC,uBAAuB,EAAEU,OAAO,CAAC;MAE3C,IAAIA,OAAO,CAACX,MAAM,KAAK,YAAY,IAAIW,OAAO,CAAC/D,SAAS,EAAE;QACxDsC,OAAO,CAAC,CAAC;QACT;QACA;QACAG,iBAAiB,CAACsB,OAAO,CAAC/D,SAAS,EAAE0C,YAAY,CAAC;MACpD,CAAC,MAAM,IAAIqB,OAAO,CAACX,MAAM,KAAK,WAAW,EAAE;QACzCd,OAAO,CAAC,CAAC;QACTb,QAAQ,CAAC,2BAA2B,CAAC;MACvC,CAAC,MAAM,IAAIsC,OAAO,CAACX,MAAM,KAAK,SAAS,EAAE;QACvCd,OAAO,CAAC,CAAC;QACTb,QAAQ,CAAC,oCAAoC,CAAC;MAChD;IACF,CAAC,CAAC;IAEF+B,MAAM,CAACK,EAAE,CAAC,eAAe,EAAGhB,GAAG,IAAK;MAClCrE,KAAK,CAAC6E,GAAG,CACP,mDAAmD,EACnDR,GAAG,YAAYF,KAAK,GAAGE,GAAG,CAACmB,OAAO,GAAG,IACvC,CAAC;MACD;MACA;MACA;MACAR,MAAM,CAACjB,UAAU,CAAC,CAAC;MACnBO,YAAY,CAACJ,YAAY,CAAC;IAC5B,CAAC,CAAC;IAEFc,MAAM,CAACK,EAAE,CAAC,YAAY,EAAE,MAAM;MAC5BrF,KAAK,CAAC6E,GAAG,CAAC,0BAA0B,CAAC;IACvC,CAAC,CAAC;EACJ,CAAC,EACD,CAACrC,WAAW,EAAEyB,iBAAiB,EAAEH,OAAO,EAAEQ,YAAY,CACxD,CAAC;;EAED;EACA,MAAMmB,mBAAmB,GAAGhG,WAAW,CAAC,YAAY;IAClDuD,YAAY,CAAC,IAAI,CAAC;IAClBC,QAAQ,CAAC,IAAI,CAAC;IACd;IACAI,gBAAgB,CAAC,IAAI,CAAC;IACtBE,YAAY,CAAC,IAAI,CAAC;IAClBG,eAAe,CAACG,OAAO,GAAG,KAAK;;IAE/B;IACA;IACA;IACA;IACA;IACA,IAAI,CAACpB,QAAQ,EAAE;MACbQ,QAAQ,CAAC,4DAA4D,CAAC;MACtED,YAAY,CAAC,KAAK,CAAC;MACnB;IACF;IAEA,IAAI;MACF,MAAMkB,YAAY,GAAGrC,oBAAoB,CAAC,CAAC;MAC3C,MAAM6D,SAAS,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGzF,sBAAsB;;MAErD;MACA;MACA;MACA;MACA,MAAM0F,cAAc,GAAG,MAAMrD,WAAW,CAACiC,WAAW,CAClD,MAAM,EACN,sBAAsB,EACtB;QAAEP,YAAY;QAAEwB,SAAS;QAAEjD;MAAS,CAAC,EACrC;QAAEiC,KAAK,EAAE;MAAM,CACjB,CAAC;MAED5B,cAAc,CAAC;QAAEoB,YAAY;QAAEwB;MAAU,CAAC,CAAC;MAC3CrC,gBAAgB,CAACwC,cAAc,EAAEzC,aAAa,IAAI,IAAI,CAAC;MACvDG,YAAY,CAACsC,cAAc,EAAEvC,SAAS,IAAI,IAAI,CAAC;MAC/CH,YAAY,CAAC,IAAI,CAAC;;MAElB;MACA;MACA;MACA2B,aAAa,CAACZ,YAAY,CAAC;MAC3BI,YAAY,CAACJ,YAAY,CAAC;IAC5B,CAAC,CAAC,OAAOG,GAAY,EAAE;MACrBpB,QAAQ,CAAC,CAACoB,GAAG,YAAYF,KAAK,GAAGE,GAAG,CAACmB,OAAO,GAAG,IAAI,KAAK,+BAA+B,CAAC;IAC1F,CAAC,SAAS;MACRxC,YAAY,CAAC,KAAK,CAAC;IACrB;EACF,CAAC,EAAE,CAACR,WAAW,EAAEsC,aAAa,EAAER,YAAY,EAAE7B,QAAQ,CAAC,CAAC;;EAExD;EACA;EACA;EACA;EACA,MAAMqD,gBAAgB,GAAGrG,WAAW,CAAC,YAAY;IAC/C,IAAI,CAACoD,WAAW,EAAE;IAElB,MAAMkD,WAAW,GAAG1F,qBAAqB,CACvCmC,WAAW,CAACuC,UAAU,CAAC,CAAC,EACxBvC,WAAW,CAACwD,MAAM,EAAEzF,UACtB,CAAC;IACD,MAAM0F,MAAM,GAAG,IAAIxF,GAAG,CAAC,YAAY,EAAEsF,WAAW,CAAC;IACjDE,MAAM,CAACxE,YAAY,CAACyE,GAAG,CAAC,OAAO,EAAErD,WAAW,CAACqB,YAAY,CAAC;IAE1D,IAAItE,QAAQ,CAACuG,EAAE,KAAK,KAAK,EAAE;MACzB;MACA,MAAMC,KAAK,GAAG,GAAG;MACjB,MAAMC,MAAM,GAAG,GAAG;MAClB,MAAMC,WAAW,GAAGC,MAAM,CAACC,MAAM,EAAEJ,KAAK,IAAIA,KAAK;MACjD,MAAMK,YAAY,GAAGF,MAAM,CAACC,MAAM,EAAEH,MAAM,IAAIA,MAAM;MACpD,MAAMK,IAAI,GAAG,CAACJ,WAAW,GAAGF,KAAK,IAAI,CAAC;MACtC,MAAMO,GAAG,GAAG,CAACF,YAAY,GAAGJ,MAAM,IAAI,CAAC;MAEvCE,MAAM,CAACK,IAAI,CACTX,MAAM,CAAC3E,QAAQ,CAAC,CAAC,EACjB,mBAAmB,EACnB,SAAS8E,KAAK,WAAWC,MAAM,SAASK,IAAI,QAAQC,GAAG,EACzD,CAAC;MACD;IACF;;IAEA;IACA,MAAME,WAAW,GAAG,MAAM9F,sBAAsB,CAACyB,WAAW,CAACwD,MAAM,EAAEhF,eAAe,CAAC;IACrF,IAAI6F,WAAW,EAAE;MACfZ,MAAM,CAACxE,YAAY,CAACyE,GAAG,CAAC,cAAc,EAAEW,WAAW,CAAC;IACtD;IAEA,IAAI;MACF,MAAMlH,OAAO,CAACmH,OAAO,CAACb,MAAM,CAAC3E,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,OAAO+C,GAAG,EAAE;MACZrE,KAAK,CAAC4B,KAAK,CAAC,0BAA0B,EAAEyC,GAAG,CAAC;MAC5CpB,QAAQ,CAAC,+DAA+D,CAAC;IAC3E;EACF,CAAC,EAAE,CAACJ,WAAW,EAAEL,WAAW,CAAC,CAAC;;EAE9B;EACA;EACA;EACA;EACA;EACA,MAAMuE,sBAAsB,GAAGtH,WAAW,CAAC,YAAY;IACrD,IAAI,CAAC6D,SAAS,EAAE;MACd;IACF;IACA,IAAI;MACF,MAAM3D,OAAO,CAACmH,OAAO,CAACxD,SAAS,CAAC;IAClC,CAAC,CAAC,OAAOe,GAAG,EAAE;MACZrE,KAAK,CAAC4B,KAAK,CAAC,0CAA0C,EAAEyC,GAAG,CAAC;MAC5DpB,QAAQ,CAAC,2EAA2E,CAAC;IACvF;EACF,CAAC,EAAE,CAACK,SAAS,CAAC,CAAC;;EAEf;EACA,MAAM0D,KAAK,GAAGvH,WAAW,CAAC,MAAM;IAC9BqE,OAAO,CAAC,CAAC;IACT2B,mBAAmB,CAAC,CAAC;EACvB,CAAC,EAAE,CAACA,mBAAmB,EAAE3B,OAAO,CAAC,CAAC;;EAElC;EACA,MAAMmD,kBAAkB,GAAGxH,WAAW,CACnCe,GAAW,IAAK;IACf,MAAM0G,MAAM,GAAG3F,iBAAiB,CAACf,GAAG,CAAC;IACrC,IAAI,CAAC0G,MAAM,EAAE;MACX;IACF;IAEA,IAAIA,MAAM,CAACtF,KAAK,EAAE;MAChBkC,OAAO,CAAC,CAAC;MACTb,QAAQ,CAAC,2BAA2B,CAAC;MACrC;IACF;IAEA,IAAIiE,MAAM,CAAC1F,SAAS,EAAE;MACpB;MACA;MACA;MACA;MACA;MACA;MACA,MAAM2F,gBAAgB,GAAGtE,WAAW,EAAEqB,YAAY;MAClD,IAAI,CAACiD,gBAAgB,EAAE;QACrB;MACF;MACArD,OAAO,CAAC,CAAC;MACTG,iBAAiB,CAACiD,MAAM,CAAC1F,SAAS,EAAE2F,gBAAgB,CAAC;IACvD;EACF,CAAC,EACD,CAACtE,WAAW,EAAEiB,OAAO,EAAEG,iBAAiB,CAC1C,CAAC;;EAED;EACA;EACAzE,SAAS,CAAC,MAAM;IACdiG,mBAAmB,CAAC,CAAC;IACrB;EACF,CAAC,EAAE,EAAE,CAAC;;EAEN;EACA;EACA;EACAjG,SAAS,CAAC,MAAM;IACd,IAAII,QAAQ,CAACuG,EAAE,KAAK,KAAK,EAAE;MACzB;IACF;IAEA,MAAMiB,YAAY,GAAGzH,OAAO,CAAC0H,gBAAgB,CAAC,KAAK,EAAE,CAAC;MAAE7G;IAAI,CAAC,KAAK;MAChEmD,iBAAiB,CAACE,OAAO,GAAG,IAAI;MAChCoD,kBAAkB,CAACzG,GAAG,CAAC;IACzB,CAAC,CAAC;IAEFb,OAAO,CAACuB,aAAa,CAAC,CAAC,CACpBoG,IAAI,CAAE9G,GAAG,IAAK;MACb,IAAIA,GAAG,IAAI,CAACmD,iBAAiB,CAACE,OAAO,EAAE;QACrCoD,kBAAkB,CAACzG,GAAG,CAAC;MACzB;IACF,CAAC,CAAC,CACD+G,KAAK,CAAC,MAAM;MACX;IAAA,CACD,CAAC;IAEJ,OAAO,MAAM;MACXH,YAAY,CAACI,MAAM,CAAC,CAAC;IACvB,CAAC;EACH,CAAC,EAAE,CAACP,kBAAkB,CAAC,CAAC;;EAExB;EACAzH,SAAS,CAAC,MAAM;IACd,OAAO,MAAM;MACXsE,OAAO,CAAC,CAAC;IACX,CAAC;EACH,CAAC,EAAE,CAACA,OAAO,CAAC,CAAC;EAEb,MAAM2D,MAAM,GAAG5E,WAAW,GAAG,aAAaA,WAAW,CAACqB,YAAY,EAAE,GAAG,EAAE;EAEzE,OAAO;IACLrB,WAAW;IACX4E,MAAM;IACNrE,aAAa;IACbE,SAAS;IACTP,SAAS;IACTnB,KAAK;IACLsB,SAAS;IACT4C,gBAAgB;IAChBiB,sBAAsB;IACtBC,KAAK;IACLlD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/hooks/usePasswordSignIn.js

@@ -1,165 +0,0 @@
-"use strict";
-
-/**
- * `usePasswordSignIn` — the first-party password sign-in state machine.
- *
- * Drives the in-app "Sign in with Oxy" password flow shared by the web
- * `SignInModal` and the native `OxyAuthScreen`: identifier → password → optional
- * two-factor. It is a thin UI state machine over the context methods
- * `signInWithPassword` + `completeTwoFactorSignIn` (which own the network call,
- * the persisted-refresh commit, and the device-set registration) — so both
- * surfaces present an identical flow without re-implementing any transport.
- *
- * On a committed session `onSignedIn` fires (the modal/screen closes); the
- * device-first cold boot / SessionClient projection then drive the app into the
- * authenticated state.
- */
-import { useCallback, useMemo, useRef, useState } from 'react';
-import { useOxy } from "../context/OxyContext.js";
-import { handleAuthError } from "../utils/errorHandlers.js";
-export function usePasswordSignIn(options = {}) {
-  const {
-    signInWithPassword,
-    completeTwoFactorSignIn
-  } = useOxy();
-  const {
-    onSignedIn
-  } = options;
-  const [step, setStep] = useState('identifier');
-  const [identifier, setIdentifier] = useState('');
-  const [password, setPassword] = useState('');
-  const [code, setCode] = useState('');
-  const [useBackupCode, setUseBackupCode] = useState(false);
-  const [error, setError] = useState(null);
-  const [isSubmitting, setIsSubmitting] = useState(false);
-  const [loginToken, setLoginToken] = useState(null);
-
-  // Synchronous in-flight guard. `isSubmitting` state drives the UI, but a rapid
-  // double-tap fires both handlers in the SAME tick — before React re-renders —
-  // so a state read would still see `false` on the second call and double-fire
-  // the network request (rate-limit + race). This ref is set/checked
-  // synchronously, so the second call is a true no-op.
-  const submittingRef = useRef(false);
-  const surfaceError = useCallback((err, defaultMessage) => {
-    setError(handleAuthError(err, {
-      defaultMessage,
-      code: 'PASSWORD_SIGN_IN_ERROR'
-    }));
-  }, []);
-  const submitIdentifier = useCallback(() => {
-    if (!identifier.trim()) {
-      setError('Enter your username or email');
-      return;
-    }
-    setError(null);
-    setStep('password');
-  }, [identifier]);
-  const submitPassword = useCallback(async () => {
-    // A second call while one is already in flight is a no-op (double-tap guard).
-    if (submittingRef.current) {
-      return;
-    }
-    if (!password) {
-      setError('Enter your password');
-      return;
-    }
-    setError(null);
-    submittingRef.current = true;
-    setIsSubmitting(true);
-    try {
-      const result = await signInWithPassword(identifier.trim(), password);
-      if (result.status === '2fa_required') {
-        setLoginToken(result.loginToken);
-        setCode('');
-        setUseBackupCode(false);
-        setStep('twoFactor');
-        return;
-      }
-      onSignedIn?.();
-    } catch (err) {
-      surfaceError(err, 'Sign in failed');
-    } finally {
-      submittingRef.current = false;
-      setIsSubmitting(false);
-    }
-  }, [identifier, password, signInWithPassword, onSignedIn, surfaceError]);
-  const submitTwoFactor = useCallback(async () => {
-    // A second call while one is already in flight is a no-op (double-tap guard).
-    if (submittingRef.current) {
-      return;
-    }
-    if (!loginToken) {
-      setError('Your sign-in session expired. Start again.');
-      setStep('password');
-      return;
-    }
-    if (!code.trim()) {
-      setError(useBackupCode ? 'Enter a backup code' : 'Enter your 6-digit code');
-      return;
-    }
-    setError(null);
-    submittingRef.current = true;
-    setIsSubmitting(true);
-    try {
-      await completeTwoFactorSignIn({
-        loginToken,
-        ...(useBackupCode ? {
-          backupCode: code.trim()
-        } : {
-          token: code.trim()
-        })
-      });
-      onSignedIn?.();
-    } catch (err) {
-      surfaceError(err, 'Verification failed');
-    } finally {
-      submittingRef.current = false;
-      setIsSubmitting(false);
-    }
-  }, [loginToken, code, useBackupCode, completeTwoFactorSignIn, onSignedIn, surfaceError]);
-  const back = useCallback(() => {
-    setError(null);
-    setStep(current => {
-      if (current === 'twoFactor') {
-        setLoginToken(null);
-        setCode('');
-        return 'password';
-      }
-      if (current === 'password') {
-        setPassword('');
-        return 'identifier';
-      }
-      return current;
-    });
-  }, []);
-  const reset = useCallback(() => {
-    setStep('identifier');
-    setIdentifier('');
-    setPassword('');
-    setCode('');
-    setUseBackupCode(false);
-    setLoginToken(null);
-    setError(null);
-    submittingRef.current = false;
-    setIsSubmitting(false);
-  }, []);
-  return useMemo(() => ({
-    step,
-    identifier,
-    setIdentifier,
-    password,
-    setPassword,
-    code,
-    setCode,
-    useBackupCode,
-    setUseBackupCode,
-    error,
-    isSubmitting,
-    submitIdentifier,
-    submitPassword,
-    submitTwoFactor,
-    back,
-    reset
-  }), [step, identifier, password, code, useBackupCode, error, isSubmitting, submitIdentifier, submitPassword, submitTwoFactor, back, reset]);
-}
-//# sourceMappingURL=usePasswordSignIn.js.map