@oxyhq/services 19.1.2 → 19.2.0

package/android/build.gradle

@@ -0,0 +1,21 @@
+plugins {
+  id 'com.android.library'
+  id 'expo-module-gradle-plugin'
+}
+
+group = 'so.oxy.identity'
+version = '0.1.0'
+
+android {
+  namespace "so.oxy.identity"
+  defaultConfig {
+    versionCode 1
+    versionName "0.1.0"
+  }
+}
+
+dependencies {
+  // Hardware-backed EncryptedSharedPreferences (MasterKey AES256_GCM) for the
+  // cross-app shared identity keypair.
+  implementation "androidx.security:security-crypto:1.1.0-alpha06"
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,10 @@
+<manifest>
+  <!--
+    Intentionally empty. The signature-protected <permission> and the
+    <provider> that hosts the shared identity are declared per-app by the
+    Commons config plugin (`withSharedIdentityProvider.js`), NOT here — only
+    Commons (the identity vault) should host the provider, and its authority is
+    the app's own ${applicationId}.identity. Reader apps add only the matching
+    <uses-permission> via `withSharedIdentityReader.js`.
+  -->
+</manifest>

package/android/src/main/java/so/oxy/identity/OxyIdentityModule.kt

@@ -0,0 +1,84 @@
+package so.oxy.identity
+
+import android.content.Context
+import android.net.Uri
+import android.os.Bundle
+import expo.modules.kotlin.exception.Exceptions
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+/**
+ * JS bridge for the cross-app shared Oxy identity.
+ *
+ * - `putShared` persists the keypair into THIS app's own hardware-backed
+ *   EncryptedSharedPreferences (only Commons calls this).
+ * - `getShared` resolves the keypair from the LOCAL store first (Commons reading
+ *   itself), then from the Commons ContentProvider — prod authority, then the
+ *   dev-variant authority. The `signature` permission on the provider means only
+ *   apps signed with the shared Oxy release key can resolve it.
+ * - `hasShared` / `clearShared` are the check + local teardown helpers.
+ *
+ * Every failure resolves to null / no-op so the JS layer degrades to the app's
+ * normal interactive sign-in path.
+ */
+class OxyIdentityModule : Module() {
+  private val context: Context
+    get() = appContext.reactContext ?: throw Exceptions.ReactContextLost()
+
+  override fun definition() = ModuleDefinition {
+    Name("OxyIdentity")
+
+    AsyncFunction("getShared") {
+      readShared()
+    }
+
+    AsyncFunction("putShared") { privateKey: String, publicKey: String ->
+      OxyIdentityStore.write(context, privateKey, publicKey)
+    }
+
+    AsyncFunction("hasShared") {
+      readShared() != null
+    }
+
+    AsyncFunction("clearShared") {
+      OxyIdentityStore.clear(context)
+    }
+  }
+
+  /**
+   * Local EncryptedSharedPreferences first, then the Commons provider (prod
+   * authority, then dev). Returns null on any failure.
+   */
+  private fun readShared(): Map<String, String>? {
+    runCatching { OxyIdentityStore.read(context) }.getOrNull()?.let { (priv, pub) ->
+      return mapOf("privateKey" to priv, "publicKey" to pub)
+    }
+
+    for (authority in PROVIDER_AUTHORITIES) {
+      val result = runCatching { callProvider(authority) }.getOrNull()
+      if (result != null) return result
+    }
+    return null
+  }
+
+  private fun callProvider(authority: String): Map<String, String>? {
+    val uri = Uri.parse("content://$authority")
+    val bundle: Bundle = context.contentResolver.call(uri, METHOD_GET_SHARED, null, null)
+      ?: return null
+    val priv = bundle.getString(OxyIdentityStore.KEY_PRIVATE) ?: return null
+    val pub = bundle.getString(OxyIdentityStore.KEY_PUBLIC) ?: return null
+    if (priv.isEmpty() || pub.isEmpty()) return null
+    return mapOf("privateKey" to priv, "publicKey" to pub)
+  }
+
+  companion object {
+    private const val METHOD_GET_SHARED = "getShared"
+
+    // Commons hosts the provider at "${applicationId}.identity". Try the prod
+    // app id first, then the dev variant ("so.oxy.commons.dev").
+    private val PROVIDER_AUTHORITIES = listOf(
+      "so.oxy.commons.identity",
+      "so.oxy.commons.dev.identity"
+    )
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityProvider.kt

@@ -0,0 +1,77 @@
+package so.oxy.identity
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.Context
+import android.content.pm.PackageManager
+import android.database.Cursor
+import android.net.Uri
+import android.os.Bundle
+
+/**
+ * Cross-process read surface for the shared Oxy identity, hosted ONLY by Commons
+ * (declared per-app by the `withSharedIdentityProvider` config plugin with a
+ * `signature`-level permission, authority `${applicationId}.identity`).
+ *
+ * `call("getShared")` returns the keypair from Commons's own
+ * EncryptedSharedPreferences — but ONLY after verifying the caller is signed
+ * with the SAME certificate. That signature check is belt-and-suspenders on top
+ * of the manifest's `signature` permission: even if the permission gate were
+ * ever misconfigured, a differently-signed caller still gets null.
+ *
+ * All standard CRUD operations are no-ops; this provider exists solely for the
+ * `call()` channel.
+ */
+class OxyIdentityProvider : ContentProvider() {
+  override fun onCreate(): Boolean = true
+
+  override fun call(method: String, arg: String?, extras: Bundle?): Bundle? {
+    if (method != METHOD_GET_SHARED) return null
+    val ctx = context ?: return null
+    if (!callerSignatureMatches(ctx)) return null
+
+    val pair = runCatching { OxyIdentityStore.read(ctx) }.getOrNull() ?: return null
+    return Bundle().apply {
+      putString(OxyIdentityStore.KEY_PRIVATE, pair.first)
+      putString(OxyIdentityStore.KEY_PUBLIC, pair.second)
+    }
+  }
+
+  /**
+   * True when the calling package shares this app's signing certificate. Uses
+   * `checkSignatures` (deprecated but still the simplest correct cross-package
+   * signature comparison; returns SIGNATURE_MATCH only for same-cert apps).
+   */
+  private fun callerSignatureMatches(ctx: Context): Boolean {
+    val caller = callingPackage ?: return false
+    return runCatching {
+      @Suppress("DEPRECATION")
+      ctx.packageManager.checkSignatures(caller, ctx.packageName) == PackageManager.SIGNATURE_MATCH
+    }.getOrDefault(false)
+  }
+
+  override fun query(
+    uri: Uri,
+    projection: Array<out String>?,
+    selection: String?,
+    selectionArgs: Array<out String>?,
+    sortOrder: String?
+  ): Cursor? = null
+
+  override fun getType(uri: Uri): String? = null
+
+  override fun insert(uri: Uri, values: ContentValues?): Uri? = null
+
+  override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int = 0
+
+  override fun update(
+    uri: Uri,
+    values: ContentValues?,
+    selection: String?,
+    selectionArgs: Array<out String>?
+  ): Int = 0
+
+  companion object {
+    private const val METHOD_GET_SHARED = "getShared"
+  }
+}

package/android/src/main/java/so/oxy/identity/OxyIdentityStore.kt

@@ -0,0 +1,76 @@
+package so.oxy.identity
+
+import android.content.Context
+import android.content.SharedPreferences
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+
+/**
+ * Shared accessor for the hardware-backed EncryptedSharedPreferences that holds
+ * the cross-app Oxy identity keypair.
+ *
+ * Used by BOTH [OxyIdentityModule] (the JS bridge / local read + write) and
+ * [OxyIdentityProvider] (the cross-process read surface) so the store name and
+ * the AES256 encryption scheme can never drift between the two halves.
+ *
+ * ## Single memoized instance (CRITICAL)
+ *
+ * `EncryptedSharedPreferences.create()` must be called AT MOST ONCE per file per
+ * process. It is NOT safe to re-instantiate: when a second instance is created
+ * for the same file while another is live (e.g. the JS write thread and a Binder
+ * thread serving [OxyIdentityProvider.call] concurrently), Tink's keyset load
+ * races and the next decrypt throws `AEADBadTagException` — which silently turned
+ * every cross-app read into "no shared identity". So the instance is created once,
+ * lazily, under a lock, keyed on the process-global application context, and
+ * reused for all reads/writes/provider calls.
+ */
+internal object OxyIdentityStore {
+  const val PREFS_NAME = "oxy_shared_identity"
+  const val KEY_PRIVATE = "priv"
+  const val KEY_PUBLIC = "pub"
+
+  @Volatile private var cachedPrefs: SharedPreferences? = null
+
+  private fun prefs(context: Context): SharedPreferences {
+    cachedPrefs?.let { return it }
+    return synchronized(this) {
+      cachedPrefs ?: run {
+        val appContext = context.applicationContext
+        val masterKey = MasterKey.Builder(appContext)
+          .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+          .build()
+        val created = EncryptedSharedPreferences.create(
+          appContext,
+          PREFS_NAME,
+          masterKey,
+          EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+          EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+        )
+        cachedPrefs = created
+        created
+      }
+    }
+  }
+
+  /** Read the stored keypair as (privateKey, publicKey), or null when absent/blank. */
+  fun read(context: Context): Pair<String, String>? {
+    val p = prefs(context)
+    val priv = p.getString(KEY_PRIVATE, null) ?: return null
+    val pub = p.getString(KEY_PUBLIC, null) ?: return null
+    if (priv.isEmpty() || pub.isEmpty()) return null
+    return priv to pub
+  }
+
+  fun write(context: Context, priv: String, pub: String) {
+    // commit() (synchronous) so a cross-process reader that fires immediately
+    // after the write is guaranteed to see the flushed value.
+    prefs(context).edit()
+      .putString(KEY_PRIVATE, priv)
+      .putString(KEY_PUBLIC, pub)
+      .commit()
+  }
+
+  fun clear(context: Context) {
+    prefs(context).edit().clear().commit()
+  }
+}

package/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["apple", "android"],
+  "apple": {
+    "modules": ["OxyIdentityModule"]
+  },
+  "android": {
+    "modules": ["so.oxy.identity.OxyIdentityModule"]
+  }
+}

package/ios/OxyIdentity.podspec

@@ -0,0 +1,28 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name           = 'OxyIdentity'
+  s.version        = package['version']
+  s.summary        = package['description']
+  s.description    = package['description']
+  s.license        = package['license']
+  s.author         = package['author']
+  s.homepage       = package['homepage']
+  s.platforms      = {
+    :ios => '16.4',
+    :tvos => '16.4'
+  }
+  s.swift_version  = '5.9'
+  s.source         = { git: 'https://github.com/oxyhq/sdk.git' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+
+  s.source_files = "**/*.{h,m,mm,swift}"
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+end

package/ios/OxyIdentityModule.swift

@@ -0,0 +1,33 @@
+import ExpoModulesCore
+
+/**
+ * iOS no-op implementation of the shared Oxy identity bridge.
+ *
+ * On Apple platforms the cross-app identity share is handled directly by
+ * `@oxyhq/core`'s `KeyManager` via the Keychain Access Group
+ * (`group.so.oxy.shared`) — there is no ContentProvider equivalent to wrap. So
+ * every function here resolves to `nil` / no-op, which makes the JS
+ * `loadSharedIdentityBridge()` seam a pass-through on iOS: `KeyManager`'s iOS
+ * branches keep using `expo-secure-store` with the keychain group untouched.
+ */
+public class OxyIdentityModule: Module {
+  public func definition() -> ModuleDefinition {
+    Name("OxyIdentity")
+
+    AsyncFunction("getShared") { () -> [String: String]? in
+      return nil
+    }
+
+    AsyncFunction("putShared") { (_ privateKey: String, _ publicKey: String) in
+      // No-op on iOS: the keychain-access-group path in KeyManager owns writes.
+    }
+
+    AsyncFunction("hasShared") { () -> Bool in
+      return false
+    }
+
+    AsyncFunction("clearShared") { () in
+      // No-op on iOS.
+    }
+  }
+}

package/lib/commonjs/index.js

@@ -441,6 +441,12 @@ Object.defineProperty(exports, "useOxy", {
     return _OxyContext.useOxy;
   }
 });
+Object.defineProperty(exports, "useOxyEvent", {
+  enumerable: true,
+  get: function () {
+    return _useOxyEvent.useOxyEvent;
+  }
+});
 Object.defineProperty(exports, "usePrivacySettings", {
   enumerable: true,
   get: function () {
@@ -645,6 +651,7 @@ var _mutationKeys = require("./ui/hooks/mutations/mutationKeys.js");
 var _queryKeys = require("./ui/hooks/queries/queryKeys.js");
 var _useMutationStatus = require("./ui/hooks/useMutationStatus.js");
 var _useOnlineStatus = require("./ui/hooks/useOnlineStatus.js");
+var _useOxyEvent = require("./ui/hooks/useOxyEvent.js");
 var _errorHandlers = require("./ui/utils/errorHandlers.js");
 var _useFileFiltering = require("./ui/hooks/useFileFiltering.js");
 var _OxySignInButton = _interopRequireDefault(require("./ui/components/OxySignInButton.js"));

package/lib/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_reactNative","_OxyProvider","_interopRequireDefault","_OxyContext","_useAuth","_FontLoader","_authStore","_accountStore","_assetStore","_useAssets","_useFileDownloadUrl","_useFollow","_useStorage","_useAccountQueries","_useServicesQueries","_useSecurityQueries","_usePaymentQueries","_useAccountMutations","_useServicesMutations","_mutationFactory","_mutationKeys","_queryKeys","_useMutationStatus","_useOnlineStatus","_errorHandlers","_useFileFiltering","_OxySignInButton","_OxyAuthPrompt","_OxyOAuthCallback","_OxyConsentScreen","_RequireOxyAuth","_FollowButton","_OxyPayButton","_LogoIcon","_LogoText","_ProfileButton","_useSwitchableAccounts","_ProfileScreen","_ManageAccountScreen","_NotificationsScreen","_PreferencesScreen","_ConnectedAppsScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_bottomSheetManager","_accountDialogManager","e","__esModule","default","setPlatformOS","Platform","OS"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAMA,IAAAE,YAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAEA,IAAAK,QAAA,GAAAL,OAAA;AAMA,IAAAM,WAAA,GAAAN,OAAA;AAKA,IAAAO,UAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AAgBA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAMA,IAAAc,kBAAA,GAAAd,OAAA;AAUA,IAAAe,mBAAA,GAAAf,OAAA;AAQA,IAAAgB,mBAAA,GAAAhB,OAAA;AAKA,IAAAiB,kBAAA,GAAAjB,OAAA;AAyBA,IAAAkB,oBAAA,GAAAlB,OAAA;AAUA,IAAAmB,qBAAA,GAAAnB,OAAA;AAOA,IAAAoB,gBAAA,GAAApB,OAAA;AAUA,IAAAqB,aAAA,GAAArB,OAAA;AAQA,IAAAsB,UAAA,GAAAtB,OAAA;AAcA,IAAAuB,kBAAA,GAAAvB,OAAA;AAEA,IAAAwB,gBAAA,GAAAxB,OAAA;AAKA,IAAAyB,cAAA,GAAAzB,OAAA;AAWA,IAAA0B,iBAAA,GAAA1B,OAAA;AAUA,IAAA2B,gBAAA,GAAAxB,sBAAA,CAAAH,OAAA;AAEA,IAAA4B,cAAA,GAAA5B,OAAA;AAEA,IAAA6B,iBAAA,GAAA7B,OAAA;AAEA,IAAA8B,iBAAA,GAAA9B,OAAA;AAYA,IAAA+B,eAAA,GAAA/B,OAAA;AAGA,IAAAgC,aAAA,GAAA7B,sBAAA,CAAAH,OAAA;AAEA,IAAAiC,aAAA,GAAA9B,sBAAA,CAAAH,OAAA;AACA,IAAAkC,SAAA,GAAAlC,OAAA;AACA,IAAAmC,SAAA,GAAAnC,OAAA;AAKA,IAAAoC,cAAA,GAAAjC,sBAAA,CAAAH,OAAA;AASA,IAAAqC,sBAAA,GAAArC,OAAA;AAIA,IAAAsC,cAAA,GAAAnC,sBAAA,CAAAH,OAAA;AACA,IAAAuC,oBAAA,GAAApC,sBAAA,CAAAH,OAAA;AACA,IAAAwC,oBAAA,GAAArC,sBAAA,CAAAH,OAAA;AACA,IAAAyC,kBAAA,GAAAtC,sBAAA,CAAAH,OAAA;AACA,IAAA0C,oBAAA,GAAAvC,sBAAA,CAAAH,OAAA;AAGA,IAAA2C,oBAAA,GAAAxC,sBAAA,CAAAH,OAAA;AACA,IAAA4C,qBAAA,GAAAzC,sBAAA,CAAAH,OAAA;AACA,IAAA6C,sBAAA,GAAA1C,sBAAA,CAAAH,OAAA;AAKA,IAAA8C,mBAAA,GAAA9C,OAAA;AAOA,IAAA+C,qBAAA,GAAA/C,OAAA;AAI8C,SAAAG,uBAAA6C,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AA3Q9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAIA,IAAAG,mBAAa,EAACC,qBAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;;AAOA;AACA;AACA;;AAGA;AACA;AACA;;AAgBA;AACA;AACA;;AAOA;AACA;AACA;;AA+BA;;AAeA;AACA;AACA;;AA2BA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAcA;;AAKA;AACA;AACA;;AASA;AACA;AACA;;AAIA;AACA;AACA;;AAkBA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;;AAIA;;AAOA;;AAKA;AACA;AACA;;AAIA;AACA;AACA;AACA","ignoreList":[]}
+{"version":3,"names":["_core","require","_reactNative","_OxyProvider","_interopRequireDefault","_OxyContext","_useAuth","_FontLoader","_authStore","_accountStore","_assetStore","_useAssets","_useFileDownloadUrl","_useFollow","_useStorage","_useAccountQueries","_useServicesQueries","_useSecurityQueries","_usePaymentQueries","_useAccountMutations","_useServicesMutations","_mutationFactory","_mutationKeys","_queryKeys","_useMutationStatus","_useOnlineStatus","_useOxyEvent","_errorHandlers","_useFileFiltering","_OxySignInButton","_OxyAuthPrompt","_OxyOAuthCallback","_OxyConsentScreen","_RequireOxyAuth","_FollowButton","_OxyPayButton","_LogoIcon","_LogoText","_ProfileButton","_useSwitchableAccounts","_ProfileScreen","_ManageAccountScreen","_NotificationsScreen","_PreferencesScreen","_ConnectedAppsScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_bottomSheetManager","_accountDialogManager","e","__esModule","default","setPlatformOS","Platform","OS"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAMA,IAAAE,YAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAEA,IAAAK,QAAA,GAAAL,OAAA;AAMA,IAAAM,WAAA,GAAAN,OAAA;AAKA,IAAAO,UAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AAgBA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAMA,IAAAc,kBAAA,GAAAd,OAAA;AAUA,IAAAe,mBAAA,GAAAf,OAAA;AAQA,IAAAgB,mBAAA,GAAAhB,OAAA;AAKA,IAAAiB,kBAAA,GAAAjB,OAAA;AAyBA,IAAAkB,oBAAA,GAAAlB,OAAA;AAUA,IAAAmB,qBAAA,GAAAnB,OAAA;AAOA,IAAAoB,gBAAA,GAAApB,OAAA;AAUA,IAAAqB,aAAA,GAAArB,OAAA;AAQA,IAAAsB,UAAA,GAAAtB,OAAA;AAcA,IAAAuB,kBAAA,GAAAvB,OAAA;AAEA,IAAAwB,gBAAA,GAAAxB,OAAA;AACA,IAAAyB,YAAA,GAAAzB,OAAA;AAKA,IAAA0B,cAAA,GAAA1B,OAAA;AAWA,IAAA2B,iBAAA,GAAA3B,OAAA;AAUA,IAAA4B,gBAAA,GAAAzB,sBAAA,CAAAH,OAAA;AAEA,IAAA6B,cAAA,GAAA7B,OAAA;AAEA,IAAA8B,iBAAA,GAAA9B,OAAA;AAEA,IAAA+B,iBAAA,GAAA/B,OAAA;AAYA,IAAAgC,eAAA,GAAAhC,OAAA;AAGA,IAAAiC,aAAA,GAAA9B,sBAAA,CAAAH,OAAA;AAEA,IAAAkC,aAAA,GAAA/B,sBAAA,CAAAH,OAAA;AACA,IAAAmC,SAAA,GAAAnC,OAAA;AACA,IAAAoC,SAAA,GAAApC,OAAA;AAKA,IAAAqC,cAAA,GAAAlC,sBAAA,CAAAH,OAAA;AASA,IAAAsC,sBAAA,GAAAtC,OAAA;AAIA,IAAAuC,cAAA,GAAApC,sBAAA,CAAAH,OAAA;AACA,IAAAwC,oBAAA,GAAArC,sBAAA,CAAAH,OAAA;AACA,IAAAyC,oBAAA,GAAAtC,sBAAA,CAAAH,OAAA;AACA,IAAA0C,kBAAA,GAAAvC,sBAAA,CAAAH,OAAA;AACA,IAAA2C,oBAAA,GAAAxC,sBAAA,CAAAH,OAAA;AAGA,IAAA4C,oBAAA,GAAAzC,sBAAA,CAAAH,OAAA;AACA,IAAA6C,qBAAA,GAAA1C,sBAAA,CAAAH,OAAA;AACA,IAAA8C,sBAAA,GAAA3C,sBAAA,CAAAH,OAAA;AAKA,IAAA+C,mBAAA,GAAA/C,OAAA;AAOA,IAAAgD,qBAAA,GAAAhD,OAAA;AAI8C,SAAAG,uBAAA8C,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AA5Q9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAIA,IAAAG,mBAAa,EAACC,qBAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;;AAOA;AACA;AACA;;AAGA;AACA;AACA;;AAgBA;AACA;AACA;;AAOA;AACA;AACA;;AA+BA;;AAeA;AACA;AACA;;AA2BA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAcA;;AAMA;AACA;AACA;;AASA;AACA;AACA;;AAIA;AACA;AACA;;AAkBA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;;AAIA;;AAOA;;AAKA;AACA;AACA;;AAIA;AACA;AACA;AACA","ignoreList":[]}

package/lib/commonjs/ui/context/OxyContext.js

@@ -26,6 +26,7 @@ var _useAvatarPicker = require("../hooks/useAvatarPicker.js");
 var _accountStore = require("../stores/accountStore.js");
 var _index = require("../session/index.js");
 var _oxyContextHelpers = require("./oxyContextHelpers.js");
+var _commitSessionFlow = require("./commitSessionFlow.js");
 var _useOxyAccountGraph = require("./useOxyAccountGraph.js");
 var _jsxRuntime = require("react/jsx-runtime");
 const OxyContext = /*#__PURE__*/(0, _react.createContext)(null);
@@ -240,8 +241,16 @@ const OxyProvider = ({
   // the one-shot join redirect.
   const sessionClientPairRef = (0, _react.useRef)(null);
   if (!sessionClientPairRef.current) {
-    sessionClientPairRef.current = (0, _index.createSessionClient)(oxyServices, authStore, () => {
-      (0, _useAuthOperations.clearPersistedAuthSafe)(authStore, logger);
+    sessionClientPairRef.current = (0, _index.createSessionClient)(oxyServices, origin => {
+      // Erase the DURABLE device credential only on a `request`-origin verdict
+      // (a REST sign-out / revocation). A `push`-origin empty state is a socket
+      // broadcast that may be a transient reconnect artifact — clearing the
+      // credential on it would strand the user signed out with no way back, so
+      // we clear only the local UI session and keep the credential (a dead one
+      // re-mints to `no_active_session` and resolves signed-out on next boot).
+      if (origin === 'request') {
+        (0, _useAuthOperations.clearPersistedAuthSafe)(authStore, logger);
+      }
       void clearSessionStateRef.current().catch(clearError => {
         logger('Failed to clear local state on remote sign-out', clearError);
       });
@@ -261,8 +270,12 @@ const OxyProvider = ({
       return;
     }
     if (state.accounts.length === 0) {
+      // Clear the LOCAL UI session on any applied empty state, but NEVER the
+      // durable device credential here: `syncFromClient` runs for socket-pushed
+      // (possibly transient) states too, and wiping the credential on one would
+      // strand the user signed out. The credential wipe is gated on a
+      // `request`-origin verdict in `onUnauthenticated` above.
       sessionClientHost.setCurrentAccountId(null);
-      (0, _useAuthOperations.clearPersistedAuthSafe)(authStore, logger);
       await clearSessionState();
       return;
     }
@@ -289,7 +302,7 @@ const OxyProvider = ({
       loginSuccess(activeUser);
     }
     sessionClientHost.setCurrentAccountId(latest.activeAccountId);
-  }, [oxyServices, sessionClient, sessionClientHost, authStore, updateSessions, setActiveSessionId, loginSuccess, clearSessionState, logger]);
+  }, [oxyServices, sessionClient, sessionClientHost, updateSessions, setActiveSessionId, loginSuccess, clearSessionState, logger]);
   const syncFromClientRef = (0, _react.useRef)(syncFromClient);
   syncFromClientRef.current = syncFromClient;
   const syncDeviceCredentialToHost = (0, _react.useCallback)(async () => {
@@ -476,45 +489,27 @@ const OxyProvider = ({
       setActiveSessionId(input.sessionId);
     }
 
-    // Register into the device set. A deliberate sign-in ACTIVATES the account
-    // (`registerAndActivate`); the cold boot only ensures membership and lets
-    // the server's own `activeAccountId` win (`addCurrentAccount`). Both then
-    // start the socket + project. Best-effort — a failure never fails the
-    // sign-in (cold boot re-registers on the next load).
-    try {
-      if (options.activate) {
-        await sessionClient.registerAndActivate(input.userId);
-      } else {
-        await sessionClient.addCurrentAccount();
-      }
-      await sessionClient.start();
-      await syncFromClient();
-    } catch (registrationError) {
-      _core.logger.warn('commitSession: device-set registration failed', {
-        component: 'OxyContext',
-        method: 'commitSession'
-      }, registrationError);
-    }
-
-    // Hydrate the full user (the commit input carries only minimal data). Fall
-    // back to the minimal shape if the profile fetch fails.
-    let fullUser = null;
-    try {
-      fullUser = await oxyServices.getCurrentUser();
-    } catch (profileError) {
-      if (__DEV__) {
-        _core.logger.debug('Failed to fetch full user on commit; using minimal fallback', {
-          component: 'OxyContext',
-          method: 'commitSession'
-        }, profileError);
-      }
-      fullUser = input.user ?? null;
-    }
-    if (fullUser) {
-      loginSuccess(fullUser);
-      onAuthStateChangeRef.current?.(fullUser);
-    }
-    markAuthResolvedRef.current();
+    // Register into the device set, hydrate the full user, and flip the
+    // auth-resolution gate. A deliberate sign-in ACTIVATES the account and
+    // BLOCKS on the reconcile (register + socket + sessions projection) before
+    // resolving — unchanged ordering. The cold boot resolves auth from the
+    // profile fetch FIRST and reconciles the device set in the background, so
+    // first paint is not held behind those extra round-trips. Reconcile is
+    // best-effort — a failure never fails the sign-in (cold boot re-registers
+    // on the next load).
+    await (0, _commitSessionFlow.commitDeviceSetAndResolve)({
+      activate: options.activate,
+      userId: input.userId,
+      fallbackUser: input.user ?? null,
+      registerAndActivate: userId => sessionClient.registerAndActivate(userId),
+      addCurrentAccount: () => sessionClient.addCurrentAccount(),
+      startSocket: () => sessionClient.start(),
+      syncFromClient,
+      getCurrentUser: () => oxyServices.getCurrentUser(),
+      loginSuccess,
+      onAuthStateChange: onAuthStateChangeRef.current,
+      markAuthResolved: markAuthResolvedRef.current
+    });
     if (options.activate && options.hubSync && hubSync && (0, _isWebBrowser.isWebBrowser)()) {
       try {
         await (0, _core.syncHubAfterSignIn)(oxyServices, {
@@ -577,7 +572,13 @@ const OxyProvider = ({
           return;
         }
         void _reactNative.Linking.openURL(url);
-      }
+      },
+      // Native-only probe so the controller can detect an installed Commons and
+      // deep-link straight into its approve screen (keeping the QR/polling live
+      // as fallback). `undefined` on web mirrors the `openUrl` split — the
+      // controller short-circuits, so `redirectToAuthorize` never runs for the
+      // `oxycommons://` payload.
+      canOpenApp: (0, _isWebBrowser.isWebBrowser)() ? undefined : url => _reactNative.Linking.canOpenURL(url)
     });
   }
   const accountDialogController = accountDialogControllerRef.current;
@@ -708,10 +709,10 @@ const OxyProvider = ({
       if (document.visibilityState !== 'visible') return;
       const reconcile = async () => {
         if (!oxyServices.getAccessToken() && sessionClientHost.getDeviceCredential()) {
-          await (0, _core.refreshPersistedSession)({
-            oxy: oxyServices,
-            store: authStore
-          });
+          // Route through the ONE shared single-flight the scheduler/preflight/401
+          // use — never a private mint lane — so a tab-focus reconcile can't
+          // double-rotate the device secret against them.
+          await oxyServices.httpService.refreshAccessToken('preflight');
         }
         if (!oxyServices.getAccessToken() && !sessionClientHost.getDeviceCredential()) {
           return;
@@ -723,7 +724,7 @@ const OxyProvider = ({
     };
     document.addEventListener('visibilitychange', onVisibility);
     return () => document.removeEventListener('visibilitychange', onVisibility);
-  }, [oxyServices, sessionClient, sessionClientHost, authStore, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
@@ -819,6 +820,7 @@ const OxyProvider = ({
     storageKeyPrefix,
     clientId,
     oxyServices,
+    sessionClient,
     useFollow: useFollowHook,
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
@@ -830,7 +832,7 @@ const OxyProvider = ({
     switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, storage, error, currentLanguage, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPassword, completeTwoFactorSignIn, revokeSuspiciousSignIn, handleWebSession, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, useFollowHook, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, storage, error, currentLanguage, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPassword, completeTwoFactorSignIn, revokeSuspiciousSignIn, handleWebSession, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, useFollowHook, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   return /*#__PURE__*/(0, _jsxRuntime.jsx)(OxyContext.Provider, {
     value: contextValue,
     children: children
@@ -886,6 +888,7 @@ const LOADING_STATE = {
   storageKeyPrefix: 'oxy_session',
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
+  sessionClient: null,
   openAvatarPicker: () => {},
   accountDialogController: null,
   isAccountDialogOpen: false,