@oxyhq/services 21.0.0 → 21.0.1

package/lib/commonjs/ui/context/passkeyFlow.js

@@ -0,0 +1,117 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.PASSKEY_UNSUPPORTED_MESSAGE = void 0;
+exports.runPasskeyAdd = runPasskeyAdd;
+exports.runPasskeyLogin = runPasskeyLogin;
+exports.runPasskeyRegister = runPasskeyRegister;
+/**
+ * Pure passkey (WebAuthn) sign-in / registration orchestration.
+ *
+ * Extracted from `OxyContext` so the fixed `options → ceremony → verify → commit`
+ * ordering is unit-testable with injected deps — the exact pattern
+ * `commitSessionFlow.ts` (`commitDeviceSetAndResolve`) uses. The context methods
+ * (`signInWithPasskey` / `registerWithPasskey` / `addPasskey`) are thin wrappers
+ * that supply the real deps: the core `webauthn*` methods, the platform ceremony
+ * client (`webauthn/passkeyClient`), and the internal `commitSession` funnel.
+ *
+ * All three GATE on `isSupported()` first (the platform client returns `false`
+ * off the web) so an unsupported surface fails loudly before touching a ceremony.
+ */
+
+/**
+ * The result of `OxyServices.webauthnRegisterVerify` — either the LINK branch
+ * (`{ success, message }`, bearer present, no session) or the SIGNUP branch (a
+ * full {@link LoginResult}, which carries a `sessionId` on its session arm).
+ */
+
+/** Thrown when a passkey flow is attempted on a surface that cannot run WebAuthn. */
+const PASSKEY_UNSUPPORTED_MESSAGE = exports.PASSKEY_UNSUPPORTED_MESSAGE = 'Passkeys are not available in this environment. Use another sign-in method.';
+
+/** Project a session-arm login result onto the internal `commitSession` input. */
+function toCommitInput(result) {
+  return {
+    sessionId: result.sessionId,
+    accessToken: result.accessToken,
+    deviceSecret: result.deviceSecret,
+    deviceId: result.deviceId,
+    expiresAt: result.expiresAt,
+    userId: result.user.id,
+    user: result.user
+  };
+}
+
+/** Injected dependencies for {@link runPasskeyLogin}. */
+
+/**
+ * Usernameless (discoverable-credential) passkey SIGN-IN: request login options,
+ * run the authentication ceremony, verify, then commit the session. A passkey
+ * assertion is itself the strong factor, so a 2FA arm here is a protocol error.
+ */
+async function runPasskeyLogin(deps) {
+  if (!deps.isSupported()) {
+    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
+  }
+  const options = await deps.getLoginOptions();
+  const response = await deps.runCeremony(options);
+  const result = await deps.loginVerify(response, {
+    deviceName: deps.deviceName,
+    deviceFingerprint: deps.deviceFingerprint,
+    deviceId: deps.deviceId
+  });
+  if ('twoFactorRequired' in result) {
+    throw new Error('Passkey sign-in unexpectedly required a second factor.');
+  }
+  await deps.commit(toCommitInput(result));
+}
+
+/** Injected dependencies for {@link runPasskeyRegister}. */
+
+/**
+ * Passkey SIGNUP: create a brand-new account whose first auth method is a
+ * passkey. The verify signup branch mints a session (a {@link LoginSessionResult}
+ * carrying `sessionId`), which is committed exactly like a password signup.
+ */
+async function runPasskeyRegister(deps) {
+  if (!deps.isSupported()) {
+    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
+  }
+  const options = await deps.getRegisterOptions(deps.username);
+  const response = await deps.runCeremony(options);
+  const result = await deps.registerVerify(response, {
+    username: deps.username,
+    deviceName: deps.deviceName
+  });
+  // Only the signup session arm carries `sessionId`; the link branch
+  // (`{ success, message }`) and any 2FA arm do not.
+  if (!('sessionId' in result)) {
+    throw new Error('Passkey registration did not establish a session.');
+  }
+  await deps.commit(toCommitInput(result));
+}
+
+/** Injected dependencies for {@link runPasskeyAdd}. */
+
+/**
+ * ADD a passkey to the already-signed-in account (bearer present). The verify
+ * link branch returns `{ success, message }` with NO session — so this never
+ * commits a session; it just fires `onLinked` (which invalidates the
+ * auth-methods query). A session arm here would be a server contract violation.
+ */
+async function runPasskeyAdd(deps) {
+  if (!deps.isSupported()) {
+    throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
+  }
+  const options = await deps.getRegisterOptions();
+  const response = await deps.runCeremony(options);
+  const result = await deps.registerVerify(response, {
+    deviceName: deps.deviceName
+  });
+  if ('sessionId' in result) {
+    throw new Error('addPasskey unexpectedly minted a new session instead of linking.');
+  }
+  deps.onLinked();
+}
+//# sourceMappingURL=passkeyFlow.js.map

package/lib/commonjs/ui/context/passkeyFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["PASSKEY_UNSUPPORTED_MESSAGE","exports","toCommitInput","result","sessionId","accessToken","deviceSecret","deviceId","expiresAt","userId","user","id","runPasskeyLogin","deps","isSupported","Error","options","getLoginOptions","response","runCeremony","loginVerify","deviceName","deviceFingerprint","commit","runPasskeyRegister","getRegisterOptions","username","registerVerify","runPasskeyAdd","onLinked"],"sourceRoot":"../../../../src","sources":["ui/context/passkeyFlow.ts"],"mappings":";;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;;AAGA;AACO,MAAMA,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GACtC,6EAA6E;;AAE/E;AACA,SAASE,aAAaA,CAACC,MAA0B,EAAe;EAC9D,OAAO;IACLC,SAAS,EAAED,MAAM,CAACC,SAAS;IAC3BC,WAAW,EAAEF,MAAM,CAACE,WAAW;IAC/BC,YAAY,EAAEH,MAAM,CAACG,YAAY;IACjCC,QAAQ,EAAEJ,MAAM,CAACI,QAAQ;IACzBC,SAAS,EAAEL,MAAM,CAACK,SAAS;IAC3BC,MAAM,EAAEN,MAAM,CAACO,IAAI,CAACC,EAAE;IACtBD,IAAI,EAAEP,MAAM,CAACO;EACf,CAAC;AACH;;AAEA;;AAeA;AACA;AACA;AACA;AACA;AACO,eAAeE,eAAeA,CAACC,IAAyB,EAAiB;EAC9E,IAAI,CAACA,IAAI,CAACC,WAAW,CAAC,CAAC,EAAE;IACvB,MAAM,IAAIC,KAAK,CAACf,2BAA2B,CAAC;EAC9C;EACA,MAAMgB,OAAO,GAAG,MAAMH,IAAI,CAACI,eAAe,CAAC,CAAC;EAC5C,MAAMC,QAAQ,GAAG,MAAML,IAAI,CAACM,WAAW,CAACH,OAAO,CAAC;EAChD,MAAMb,MAAM,GAAG,MAAMU,IAAI,CAACO,WAAW,CAACF,QAAQ,EAAE;IAC9CG,UAAU,EAAER,IAAI,CAACQ,UAAU;IAC3BC,iBAAiB,EAAET,IAAI,CAACS,iBAAiB;IACzCf,QAAQ,EAAEM,IAAI,CAACN;EACjB,CAAC,CAAC;EACF,IAAI,mBAAmB,IAAIJ,MAAM,EAAE;IACjC,MAAM,IAAIY,KAAK,CAAC,wDAAwD,CAAC;EAC3E;EACA,MAAMF,IAAI,CAACU,MAAM,CAACrB,aAAa,CAACC,MAAM,CAAC,CAAC;AAC1C;;AAEA;;AAcA;AACA;AACA;AACA;AACA;AACO,eAAeqB,kBAAkBA,CAACX,IAA4B,EAAiB;EACpF,IAAI,CAACA,IAAI,CAACC,WAAW,CAAC,CAAC,EAAE;IACvB,MAAM,IAAIC,KAAK,CAACf,2BAA2B,CAAC;EAC9C;EACA,MAAMgB,OAAO,GAAG,MAAMH,IAAI,CAACY,kBAAkB,CAACZ,IAAI,CAACa,QAAQ,CAAC;EAC5D,MAAMR,QAAQ,GAAG,MAAML,IAAI,CAACM,WAAW,CAACH,OAAO,CAAC;EAChD,MAAMb,MAAM,GAAG,MAAMU,IAAI,CAACc,cAAc,CAACT,QAAQ,EAAE;IACjDQ,QAAQ,EAAEb,IAAI,CAACa,QAAQ;IACvBL,UAAU,EAAER,IAAI,CAACQ;EACnB,CAAC,CAAC;EACF;EACA;EACA,IAAI,EAAE,WAAW,IAAIlB,MAAM,CAAC,EAAE;IAC5B,MAAM,IAAIY,KAAK,CAAC,mDAAmD,CAAC;EACtE;EACA,MAAMF,IAAI,CAACU,MAAM,CAACrB,aAAa,CAACC,MAAM,CAAC,CAAC;AAC1C;;AAEA;;AAaA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeyB,aAAaA,CAACf,IAAuB,EAAiB;EAC1E,IAAI,CAACA,IAAI,CAACC,WAAW,CAAC,CAAC,EAAE;IACvB,MAAM,IAAIC,KAAK,CAACf,2BAA2B,CAAC;EAC9C;EACA,MAAMgB,OAAO,GAAG,MAAMH,IAAI,CAACY,kBAAkB,CAAC,CAAC;EAC/C,MAAMP,QAAQ,GAAG,MAAML,IAAI,CAACM,WAAW,CAACH,OAAO,CAAC;EAChD,MAAMb,MAAM,GAAG,MAAMU,IAAI,CAACc,cAAc,CAACT,QAAQ,EAAE;IAAEG,UAAU,EAAER,IAAI,CAACQ;EAAW,CAAC,CAAC;EACnF,IAAI,WAAW,IAAIlB,MAAM,EAAE;IACzB,MAAM,IAAIY,KAAK,CAAC,kEAAkE,CAAC;EACrF;EACAF,IAAI,CAACgB,QAAQ,CAAC,CAAC;AACjB","ignoreList":[]}

package/lib/commonjs/ui/hooks/queries/queryKeys.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.queryKeys = exports.invalidateUserQueries = exports.invalidateStorageQueries = exports.invalidateSessionQueries = exports.invalidateSecurityQueries = exports.invalidatePrivacyQueries = exports.invalidatePaymentsQueries = exports.invalidateDeviceQueries = exports.invalidateConnectedAppsQueries = exports.invalidateAccountQueries = void 0;
+exports.queryKeys = exports.invalidateUserQueries = exports.invalidateStorageQueries = exports.invalidateSessionQueries = exports.invalidateSecurityQueries = exports.invalidatePrivacyQueries = exports.invalidatePaymentsQueries = exports.invalidateDeviceQueries = exports.invalidateConnectedAppsQueries = exports.invalidateAuthMethodsQueries = exports.invalidateAccountQueries = void 0;
 /**
  * Centralized query keys for TanStack Query
  *
@@ -63,6 +63,11 @@ const queryKeys = exports.queryKeys = {
     recent: limit => [...queryKeys.security.all, 'recent', limit],
     infinite: (limit, eventType) => [...queryKeys.security.all, 'infinite', limit, eventType]
   },
+  // Linked authentication methods (passwords, identity keys, passkeys, social)
+  authMethods: {
+    all: ['authMethods'],
+    list: userId => [...queryKeys.authMethods.all, 'list', userId || 'current']
+  },
   // Storage usage queries
   storage: {
     all: ['storage'],
@@ -158,9 +163,20 @@ const invalidateStorageQueries = queryClient => {
 };
 
 /**
- * Helper to invalidate all payments / wallet / subscription queries
+ * Helper to invalidate the user's linked auth-methods list (call after linking
+ * or removing a passkey / password / identity key).
  */
 exports.invalidateStorageQueries = invalidateStorageQueries;
+const invalidateAuthMethodsQueries = queryClient => {
+  queryClient.invalidateQueries({
+    queryKey: queryKeys.authMethods.all
+  });
+};
+
+/**
+ * Helper to invalidate all payments / wallet / subscription queries
+ */
+exports.invalidateAuthMethodsQueries = invalidateAuthMethodsQueries;
 const invalidatePaymentsQueries = queryClient => {
   queryClient.invalidateQueries({
     queryKey: queryKeys.payments.all

package/lib/commonjs/ui/hooks/queries/queryKeys.js.map

@@ -1 +1 @@
-{"version":3,"names":["queryKeys","exports","accounts","all","lists","list","sessionIds","details","detail","sessionId","current","settings","users","userIds","userId","profile","sessions","active","device","deviceId","devices","accountScope","privacy","security","activity","limit","offset","eventType","recent","infinite","storage","usage","connectedApps","follow","counts","payments","subscription","history","wallet","walletTransactions","invalidateAccountQueries","queryClient","invalidateQueries","queryKey","invalidateUserQueries","invalidateSessionQueries","invalidateDeviceQueries","invalidatePrivacyQueries","invalidateSecurityQueries","invalidateStorageQueries","invalidatePaymentsQueries","invalidateConnectedAppsQueries"],"sourceRoot":"../../../../../src","sources":["ui/hooks/queries/queryKeys.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIO,MAAMA,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG;EACvB;EACAE,QAAQ,EAAE;IACRC,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,MAAM,CAAU;IACzDE,IAAI,EAAGC,UAAoB,IAAK,CAAC,GAAGN,SAAS,CAACE,QAAQ,CAACE,KAAK,CAAC,CAAC,EAAEE,UAAU,CAAU;IACpFC,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,QAAQ,CAAU;IAC7DK,MAAM,EAAGC,SAAiB,IAAK,CAAC,GAAGT,SAAS,CAACE,QAAQ,CAACK,OAAO,CAAC,CAAC,EAAEE,SAAS,CAAU;IACpFC,OAAO,EAAGD,SAAyB,IACjCA,SAAS,GACJ,CAAC,GAAGT,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,SAAS,EAAEM,SAAS,CAAC,GACjD,CAAC,GAAGT,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,SAAS,CAAW;IACvDQ,QAAQ,EAAEA,CAAA,KAAM,CAAC,GAAGX,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,UAAU;EACxD,CAAC;EAED;EACAS,KAAK,EAAE;IACLT,GAAG,EAAE,CAAC,OAAO,CAAU;IACvBC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACY,KAAK,CAACT,GAAG,EAAE,MAAM,CAAU;IACtDE,IAAI,EAAGQ,OAAiB,IAAK,CAAC,GAAGb,SAAS,CAACY,KAAK,CAACR,KAAK,CAAC,CAAC,EAAES,OAAO,CAAU;IAC3EN,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACY,KAAK,CAACT,GAAG,EAAE,QAAQ,CAAU;IAC1DK,MAAM,EAAGM,MAAc,IAAK,CAAC,GAAGd,SAAS,CAACY,KAAK,CAACL,OAAO,CAAC,CAAC,EAAEO,MAAM,CAAU;IAC3EC,OAAO,EAAGN,SAAiB,IAAK,CAAC,GAAGT,SAAS,CAACY,KAAK,CAACL,OAAO,CAAC,CAAC,EAAEE,SAAS,EAAE,SAAS;EACrF,CAAC;EAED;EACAO,QAAQ,EAAE;IACRb,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,MAAM,CAAU;IACzDE,IAAI,EAAGS,MAAe,IAAK,CAAC,GAAGd,SAAS,CAACgB,QAAQ,CAACZ,KAAK,CAAC,CAAC,EAAEU,MAAM,CAAU;IAC3EP,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,QAAQ,CAAU;IAC7DK,MAAM,EAAGC,SAAiB,IAAK,CAAC,GAAGT,SAAS,CAACgB,QAAQ,CAACT,OAAO,CAAC,CAAC,EAAEE,SAAS,CAAU;IACpFQ,MAAM,EAAEA,CAAA,KAAM,CAAC,GAAGjB,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,QAAQ,CAAU;IAC5De,MAAM,EAAGC,QAAgB,IAAK,CAAC,GAAGnB,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,QAAQ,EAAEgB,QAAQ;EAC9E,CAAC;EAED;EACAC,OAAO,EAAE;IACPjB,GAAG,EAAE,CAAC,SAAS,CAAU;IACzBC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACoB,OAAO,CAACjB,GAAG,EAAE,MAAM,CAAU;IACxDE,IAAI,EAAGgB,YAAqB,IAAK,CAAC,GAAGrB,SAAS,CAACoB,OAAO,CAAChB,KAAK,CAAC,CAAC,EAAEiB,YAAY,CAAU;IACtFd,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACoB,OAAO,CAACjB,GAAG,EAAE,QAAQ,CAAU;IAC5DK,MAAM,EAAGW,QAAgB,IAAK,CAAC,GAAGnB,SAAS,CAACoB,OAAO,CAACb,OAAO,CAAC,CAAC,EAAEY,QAAQ;EACzE,CAAC;EAED;EACAG,OAAO,EAAE;IACPnB,GAAG,EAAE,CAAC,SAAS,CAAU;IACzBQ,QAAQ,EAAGG,MAAe,IAAK,CAAC,GAAGd,SAAS,CAACsB,OAAO,CAACnB,GAAG,EAAE,UAAU,EAAEW,MAAM,IAAI,SAAS;EAC3F,CAAC;EAED;EACAS,QAAQ,EAAE;IACRpB,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BqB,QAAQ,EAAEA,CAACC,KAAc,EAAEC,MAAe,EAAEC,SAAkB,KAC5D,CAAC,GAAG3B,SAAS,CAACuB,QAAQ,CAACpB,GAAG,EAAE,UAAU,EAAEsB,KAAK,EAAEC,MAAM,EAAEC,SAAS,CAAU;IAC5EC,MAAM,EAAGH,KAAa,IACpB,CAAC,GAAGzB,SAAS,CAACuB,QAAQ,CAACpB,GAAG,EAAE,QAAQ,EAAEsB,KAAK,CAAU;IACvDI,QAAQ,EAAEA,CAACJ,KAAa,EAAEE,SAAkB,KAC1C,CAAC,GAAG3B,SAAS,CAACuB,QAAQ,CAACpB,GAAG,EAAE,UAAU,EAAEsB,KAAK,EAAEE,SAAS;EAC5D,CAAC;EAED;EACAG,OAAO,EAAE;IACP3B,GAAG,EAAE,CAAC,SAAS,CAAU;IACzB4B,KAAK,EAAGV,YAAqB,IAAK,CAAC,GAAGrB,SAAS,CAAC8B,OAAO,CAAC3B,GAAG,EAAE,OAAO,EAAEkB,YAAY;EACpF,CAAC;EAED;EACAW,aAAa,EAAE;IACb7B,GAAG,EAAE,CAAC,eAAe,CAAU;IAC/BE,IAAI,EAAEA,CAAA,KAAM,CAAC,GAAGL,SAAS,CAACgC,aAAa,CAAC7B,GAAG,EAAE,MAAM;EACrD,CAAC;EAED;EACA8B,MAAM,EAAE;IACN9B,GAAG,EAAE,CAAC,QAAQ,CAAU;IACxB+B,MAAM,EAAGpB,MAAc,IAAK,CAAC,GAAGd,SAAS,CAACiC,MAAM,CAAC9B,GAAG,EAAE,QAAQ,EAAEW,MAAM;EACxE,CAAC;EAED;EACAqB,QAAQ,EAAE;IACRhC,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BiC,YAAY,EAAGtB,MAAe,IAC5B,CAAC,GAAGd,SAAS,CAACmC,QAAQ,CAAChC,GAAG,EAAE,cAAc,EAAEW,MAAM,IAAI,SAAS,CAAU;IAC3EuB,OAAO,EAAGvB,MAAe,IACvB,CAAC,GAAGd,SAAS,CAACmC,QAAQ,CAAChC,GAAG,EAAE,SAAS,EAAEW,MAAM,IAAI,SAAS,CAAU;IACtEwB,MAAM,EAAGxB,MAAe,IACtB,CAAC,GAAGd,SAAS,CAACmC,QAAQ,CAAChC,GAAG,EAAE,QAAQ,EAAEW,MAAM,IAAI,SAAS,CAAU;IACrEyB,kBAAkB,EAAEA,CAACd,KAAc,EAAEC,MAAe,EAAEZ,MAAe,KACnE,CACE,GAAGd,SAAS,CAACmC,QAAQ,CAAChC,GAAG,EACzB,QAAQ,EACRW,MAAM,IAAI,SAAS,EACnB,cAAc,EACdW,KAAK,EACLC,MAAM;EAEZ;AACF,CAAU;;AAEV;AACA;AACA;AACO,MAAMc,wBAAwB,GAAIC,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACE,QAAQ,CAACC;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAuC,wBAAA,GAAAA,wBAAA;AAGO,MAAMI,qBAAqB,GAAIH,WAAwB,IAAW;EACvEA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACY,KAAK,CAACT;EAAI,CAAC,CAAC;AAClE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA2C,qBAAA,GAAAA,qBAAA;AAGO,MAAMC,wBAAwB,GAAIJ,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACgB,QAAQ,CAACb;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA4C,wBAAA,GAAAA,wBAAA;AAGO,MAAMC,uBAAuB,GAAIL,WAAwB,IAAW;EACzEA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACoB,OAAO,CAACjB;EAAI,CAAC,CAAC;AACpE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA6C,uBAAA,GAAAA,uBAAA;AAGO,MAAMC,wBAAwB,GAAIN,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACsB,OAAO,CAACnB;EAAI,CAAC,CAAC;AACpE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA8C,wBAAA,GAAAA,wBAAA;AAGO,MAAMC,yBAAyB,GAAIP,WAAwB,IAAW;EAC3EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACuB,QAAQ,CAACpB;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA+C,yBAAA,GAAAA,yBAAA;AAGO,MAAMC,wBAAwB,GAAIR,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAAC8B,OAAO,CAAC3B;EAAI,CAAC,CAAC;AACpE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAgD,wBAAA,GAAAA,wBAAA;AAGO,MAAMC,yBAAyB,GAAIT,WAAwB,IAAW;EAC3EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACmC,QAAQ,CAAChC;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAiD,yBAAA,GAAAA,yBAAA;AAGO,MAAMC,8BAA8B,GAAIV,WAAwB,IAAW;EAChFA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE3C,SAAS,CAACgC,aAAa,CAAC7B;EAAI,CAAC,CAAC;AAC1E,CAAC;AAACF,OAAA,CAAAkD,8BAAA,GAAAA,8BAAA","ignoreList":[]}
+{"version":3,"names":["queryKeys","exports","accounts","all","lists","list","sessionIds","details","detail","sessionId","current","settings","users","userIds","userId","profile","sessions","active","device","deviceId","devices","accountScope","privacy","security","activity","limit","offset","eventType","recent","infinite","authMethods","storage","usage","connectedApps","follow","counts","payments","subscription","history","wallet","walletTransactions","invalidateAccountQueries","queryClient","invalidateQueries","queryKey","invalidateUserQueries","invalidateSessionQueries","invalidateDeviceQueries","invalidatePrivacyQueries","invalidateSecurityQueries","invalidateStorageQueries","invalidateAuthMethodsQueries","invalidatePaymentsQueries","invalidateConnectedAppsQueries"],"sourceRoot":"../../../../../src","sources":["ui/hooks/queries/queryKeys.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIO,MAAMA,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG;EACvB;EACAE,QAAQ,EAAE;IACRC,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,MAAM,CAAU;IACzDE,IAAI,EAAGC,UAAoB,IAAK,CAAC,GAAGN,SAAS,CAACE,QAAQ,CAACE,KAAK,CAAC,CAAC,EAAEE,UAAU,CAAU;IACpFC,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,QAAQ,CAAU;IAC7DK,MAAM,EAAGC,SAAiB,IAAK,CAAC,GAAGT,SAAS,CAACE,QAAQ,CAACK,OAAO,CAAC,CAAC,EAAEE,SAAS,CAAU;IACpFC,OAAO,EAAGD,SAAyB,IACjCA,SAAS,GACJ,CAAC,GAAGT,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,SAAS,EAAEM,SAAS,CAAC,GACjD,CAAC,GAAGT,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,SAAS,CAAW;IACvDQ,QAAQ,EAAEA,CAAA,KAAM,CAAC,GAAGX,SAAS,CAACE,QAAQ,CAACC,GAAG,EAAE,UAAU;EACxD,CAAC;EAED;EACAS,KAAK,EAAE;IACLT,GAAG,EAAE,CAAC,OAAO,CAAU;IACvBC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACY,KAAK,CAACT,GAAG,EAAE,MAAM,CAAU;IACtDE,IAAI,EAAGQ,OAAiB,IAAK,CAAC,GAAGb,SAAS,CAACY,KAAK,CAACR,KAAK,CAAC,CAAC,EAAES,OAAO,CAAU;IAC3EN,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACY,KAAK,CAACT,GAAG,EAAE,QAAQ,CAAU;IAC1DK,MAAM,EAAGM,MAAc,IAAK,CAAC,GAAGd,SAAS,CAACY,KAAK,CAACL,OAAO,CAAC,CAAC,EAAEO,MAAM,CAAU;IAC3EC,OAAO,EAAGN,SAAiB,IAAK,CAAC,GAAGT,SAAS,CAACY,KAAK,CAACL,OAAO,CAAC,CAAC,EAAEE,SAAS,EAAE,SAAS;EACrF,CAAC;EAED;EACAO,QAAQ,EAAE;IACRb,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,MAAM,CAAU;IACzDE,IAAI,EAAGS,MAAe,IAAK,CAAC,GAAGd,SAAS,CAACgB,QAAQ,CAACZ,KAAK,CAAC,CAAC,EAAEU,MAAM,CAAU;IAC3EP,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,QAAQ,CAAU;IAC7DK,MAAM,EAAGC,SAAiB,IAAK,CAAC,GAAGT,SAAS,CAACgB,QAAQ,CAACT,OAAO,CAAC,CAAC,EAAEE,SAAS,CAAU;IACpFQ,MAAM,EAAEA,CAAA,KAAM,CAAC,GAAGjB,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,QAAQ,CAAU;IAC5De,MAAM,EAAGC,QAAgB,IAAK,CAAC,GAAGnB,SAAS,CAACgB,QAAQ,CAACb,GAAG,EAAE,QAAQ,EAAEgB,QAAQ;EAC9E,CAAC;EAED;EACAC,OAAO,EAAE;IACPjB,GAAG,EAAE,CAAC,SAAS,CAAU;IACzBC,KAAK,EAAEA,CAAA,KAAM,CAAC,GAAGJ,SAAS,CAACoB,OAAO,CAACjB,GAAG,EAAE,MAAM,CAAU;IACxDE,IAAI,EAAGgB,YAAqB,IAAK,CAAC,GAAGrB,SAAS,CAACoB,OAAO,CAAChB,KAAK,CAAC,CAAC,EAAEiB,YAAY,CAAU;IACtFd,OAAO,EAAEA,CAAA,KAAM,CAAC,GAAGP,SAAS,CAACoB,OAAO,CAACjB,GAAG,EAAE,QAAQ,CAAU;IAC5DK,MAAM,EAAGW,QAAgB,IAAK,CAAC,GAAGnB,SAAS,CAACoB,OAAO,CAACb,OAAO,CAAC,CAAC,EAAEY,QAAQ;EACzE,CAAC;EAED;EACAG,OAAO,EAAE;IACPnB,GAAG,EAAE,CAAC,SAAS,CAAU;IACzBQ,QAAQ,EAAGG,MAAe,IAAK,CAAC,GAAGd,SAAS,CAACsB,OAAO,CAACnB,GAAG,EAAE,UAAU,EAAEW,MAAM,IAAI,SAAS;EAC3F,CAAC;EAED;EACAS,QAAQ,EAAE;IACRpB,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BqB,QAAQ,EAAEA,CAACC,KAAc,EAAEC,MAAe,EAAEC,SAAkB,KAC5D,CAAC,GAAG3B,SAAS,CAACuB,QAAQ,CAACpB,GAAG,EAAE,UAAU,EAAEsB,KAAK,EAAEC,MAAM,EAAEC,SAAS,CAAU;IAC5EC,MAAM,EAAGH,KAAa,IACpB,CAAC,GAAGzB,SAAS,CAACuB,QAAQ,CAACpB,GAAG,EAAE,QAAQ,EAAEsB,KAAK,CAAU;IACvDI,QAAQ,EAAEA,CAACJ,KAAa,EAAEE,SAAkB,KAC1C,CAAC,GAAG3B,SAAS,CAACuB,QAAQ,CAACpB,GAAG,EAAE,UAAU,EAAEsB,KAAK,EAAEE,SAAS;EAC5D,CAAC;EAED;EACAG,WAAW,EAAE;IACX3B,GAAG,EAAE,CAAC,aAAa,CAAU;IAC7BE,IAAI,EAAGS,MAAe,IAAK,CAAC,GAAGd,SAAS,CAAC8B,WAAW,CAAC3B,GAAG,EAAE,MAAM,EAAEW,MAAM,IAAI,SAAS;EACvF,CAAC;EAED;EACAiB,OAAO,EAAE;IACP5B,GAAG,EAAE,CAAC,SAAS,CAAU;IACzB6B,KAAK,EAAGX,YAAqB,IAAK,CAAC,GAAGrB,SAAS,CAAC+B,OAAO,CAAC5B,GAAG,EAAE,OAAO,EAAEkB,YAAY;EACpF,CAAC;EAED;EACAY,aAAa,EAAE;IACb9B,GAAG,EAAE,CAAC,eAAe,CAAU;IAC/BE,IAAI,EAAEA,CAAA,KAAM,CAAC,GAAGL,SAAS,CAACiC,aAAa,CAAC9B,GAAG,EAAE,MAAM;EACrD,CAAC;EAED;EACA+B,MAAM,EAAE;IACN/B,GAAG,EAAE,CAAC,QAAQ,CAAU;IACxBgC,MAAM,EAAGrB,MAAc,IAAK,CAAC,GAAGd,SAAS,CAACkC,MAAM,CAAC/B,GAAG,EAAE,QAAQ,EAAEW,MAAM;EACxE,CAAC;EAED;EACAsB,QAAQ,EAAE;IACRjC,GAAG,EAAE,CAAC,UAAU,CAAU;IAC1BkC,YAAY,EAAGvB,MAAe,IAC5B,CAAC,GAAGd,SAAS,CAACoC,QAAQ,CAACjC,GAAG,EAAE,cAAc,EAAEW,MAAM,IAAI,SAAS,CAAU;IAC3EwB,OAAO,EAAGxB,MAAe,IACvB,CAAC,GAAGd,SAAS,CAACoC,QAAQ,CAACjC,GAAG,EAAE,SAAS,EAAEW,MAAM,IAAI,SAAS,CAAU;IACtEyB,MAAM,EAAGzB,MAAe,IACtB,CAAC,GAAGd,SAAS,CAACoC,QAAQ,CAACjC,GAAG,EAAE,QAAQ,EAAEW,MAAM,IAAI,SAAS,CAAU;IACrE0B,kBAAkB,EAAEA,CAACf,KAAc,EAAEC,MAAe,EAAEZ,MAAe,KACnE,CACE,GAAGd,SAAS,CAACoC,QAAQ,CAACjC,GAAG,EACzB,QAAQ,EACRW,MAAM,IAAI,SAAS,EACnB,cAAc,EACdW,KAAK,EACLC,MAAM;EAEZ;AACF,CAAU;;AAEV;AACA;AACA;AACO,MAAMe,wBAAwB,GAAIC,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACE,QAAQ,CAACC;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAwC,wBAAA,GAAAA,wBAAA;AAGO,MAAMI,qBAAqB,GAAIH,WAAwB,IAAW;EACvEA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACY,KAAK,CAACT;EAAI,CAAC,CAAC;AAClE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA4C,qBAAA,GAAAA,qBAAA;AAGO,MAAMC,wBAAwB,GAAIJ,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACgB,QAAQ,CAACb;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA6C,wBAAA,GAAAA,wBAAA;AAGO,MAAMC,uBAAuB,GAAIL,WAAwB,IAAW;EACzEA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACoB,OAAO,CAACjB;EAAI,CAAC,CAAC;AACpE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA8C,uBAAA,GAAAA,uBAAA;AAGO,MAAMC,wBAAwB,GAAIN,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACsB,OAAO,CAACnB;EAAI,CAAC,CAAC;AACpE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAA+C,wBAAA,GAAAA,wBAAA;AAGO,MAAMC,yBAAyB,GAAIP,WAAwB,IAAW;EAC3EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACuB,QAAQ,CAACpB;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAgD,yBAAA,GAAAA,yBAAA;AAGO,MAAMC,wBAAwB,GAAIR,WAAwB,IAAW;EAC1EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAAC+B,OAAO,CAAC5B;EAAI,CAAC,CAAC;AACpE,CAAC;;AAED;AACA;AACA;AACA;AAHAF,OAAA,CAAAiD,wBAAA,GAAAA,wBAAA;AAIO,MAAMC,4BAA4B,GAAIT,WAAwB,IAAW;EAC9EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAAC8B,WAAW,CAAC3B;EAAI,CAAC,CAAC;AACxE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAkD,4BAAA,GAAAA,4BAAA;AAGO,MAAMC,yBAAyB,GAAIV,WAAwB,IAAW;EAC3EA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACoC,QAAQ,CAACjC;EAAI,CAAC,CAAC;AACrE,CAAC;;AAED;AACA;AACA;AAFAF,OAAA,CAAAmD,yBAAA,GAAAA,yBAAA;AAGO,MAAMC,8BAA8B,GAAIX,WAAwB,IAAW;EAChFA,WAAW,CAACC,iBAAiB,CAAC;IAAEC,QAAQ,EAAE5C,SAAS,CAACiC,aAAa,CAAC9B;EAAI,CAAC,CAAC;AAC1E,CAAC;AAACF,OAAA,CAAAoD,8BAAA,GAAAA,8BAAA","ignoreList":[]}

package/lib/commonjs/ui/hooks/queries/useAuthMethods.js

@@ -0,0 +1,49 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.useAuthMethods = void 0;
+var _react = require("react");
+var _reactQuery = require("@tanstack/react-query");
+var _queryKeys = require("./queryKeys.js");
+var _OxyContext = require("../../context/OxyContext.js");
+/** Stable empty list so the derived selectors keep a stable reference while loading. */
+const EMPTY_METHODS = Object.freeze([]);
+
+/**
+ * The current account's linked authentication methods (`GET /auth/methods`),
+ * plus convenience projections. Backs the security / account surfaces that let a
+ * user see and manage their passwords, identity key, social logins, and passkeys.
+ *
+ * `passkeys` is the `type === 'webauthn'` subset — one entry per registered
+ * credential. Invalidate via `queryKeys.authMethods.all` after linking a passkey
+ * (`useOxy().addPasskey()` does this) or removing one.
+ */
+const useAuthMethods = options => {
+  const {
+    oxyServices,
+    activeSessionId
+  } = (0, _OxyContext.useOxy)();
+  const query = (0, _reactQuery.useQuery)({
+    queryKey: _queryKeys.queryKeys.authMethods.list(),
+    queryFn: () => oxyServices.listAuthMethods(),
+    enabled: options?.enabled !== false && !!activeSessionId,
+    staleTime: 5 * 60 * 1000,
+    // 5 minutes
+    gcTime: 10 * 60 * 1000 // 10 minutes
+  });
+  const methods = query.data?.methods ?? EMPTY_METHODS;
+  const passkeys = (0, _react.useMemo)(() => methods.filter(method => method.type === 'webauthn'), [methods]);
+  return {
+    ...query,
+    /** Every linked auth method. Empty while loading. */
+    methods,
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys,
+    /** The account's DID, or `null` while loading. */
+    did: query.data?.did ?? null
+  };
+};
+exports.useAuthMethods = useAuthMethods;
+//# sourceMappingURL=useAuthMethods.js.map

package/lib/commonjs/ui/hooks/queries/useAuthMethods.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","require","_reactQuery","_queryKeys","_OxyContext","EMPTY_METHODS","Object","freeze","useAuthMethods","options","oxyServices","activeSessionId","useOxy","query","useQuery","queryKey","queryKeys","authMethods","list","queryFn","listAuthMethods","enabled","staleTime","gcTime","methods","data","passkeys","useMemo","filter","method","type","did","exports"],"sourceRoot":"../../../../../src","sources":["ui/hooks/queries/useAuthMethods.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AAEA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAEA;AACA,MAAMI,aAAyC,GAAGC,MAAM,CAACC,MAAM,CAAC,EAAE,CAAC;;AAEnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,cAAc,GAAIC,OAA+B,IAAK;EACjE,MAAM;IAAEC,WAAW;IAAEC;EAAgB,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EAEjD,MAAMC,KAAK,GAAG,IAAAC,oBAAQ,EAAsB;IAC1CC,QAAQ,EAAEC,oBAAS,CAACC,WAAW,CAACC,IAAI,CAAC,CAAC;IACtCC,OAAO,EAAEA,CAAA,KAAMT,WAAW,CAACU,eAAe,CAAC,CAAC;IAC5CC,OAAO,EAAEZ,OAAO,EAAEY,OAAO,KAAK,KAAK,IAAI,CAAC,CAACV,eAAe;IACxDW,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IAAE;IAC1BC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAE;EAC1B,CAAC,CAAC;EAEF,MAAMC,OAAO,GAAGX,KAAK,CAACY,IAAI,EAAED,OAAO,IAAInB,aAAa;EACpD,MAAMqB,QAAQ,GAAG,IAAAC,cAAO,EACtB,MAAMH,OAAO,CAACI,MAAM,CAAEC,MAAM,IAAKA,MAAM,CAACC,IAAI,KAAK,UAAU,CAAC,EAC5D,CAACN,OAAO,CACV,CAAC;EAED,OAAO;IACL,GAAGX,KAAK;IACR;IACAW,OAAO;IACP;IACAE,QAAQ;IACR;IACAK,GAAG,EAAElB,KAAK,CAACY,IAAI,EAAEM,GAAG,IAAI;EAC1B,CAAC;AACH,CAAC;AAACC,OAAA,CAAAxB,cAAA,GAAAA,cAAA","ignoreList":[]}

package/lib/commonjs/webauthn/passkeyClient.js

@@ -0,0 +1,39 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.isPasskeySupported = isPasskeySupported;
+exports.runAuthenticationCeremony = runAuthenticationCeremony;
+exports.runRegistrationCeremony = runRegistrationCeremony;
+/**
+ * Passkey / WebAuthn ceremony client — clean default (non-web) implementation.
+ *
+ * This is the base module TypeScript resolves for TYPES and any bundler that
+ * does not pick a platform variant. It intentionally imports NOTHING browser-
+ * specific (no `@simplewebauthn/browser`) so it stays safe for Metro, native
+ * builds, and SSR. The real ceremony lives in `passkeyClient.web.ts`; native
+ * passkeys are Commons' job, so there is no WebAuthn ceremony here.
+ *
+ * `isPasskeySupported()` returns `false` (no relying-party origin / no browser
+ * WebAuthn API), and the ceremony helpers throw a clear error so a caller that
+ * skipped the support gate fails loudly instead of silently.
+ */
+
+const WEBAUTHN_WEB_ONLY_MESSAGE = 'WebAuthn is web-only; native uses Commons. Passkeys are not available on this platform.';
+
+/** Always `false` off the web — there is no relying-party origin or WebAuthn API. */
+function isPasskeySupported() {
+  return false;
+}
+
+/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
+async function runRegistrationCeremony(_optionsJSON) {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}
+
+/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
+async function runAuthenticationCeremony(_optionsJSON) {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}
+//# sourceMappingURL=passkeyClient.js.map

package/lib/commonjs/webauthn/passkeyClient.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["WEBAUTHN_WEB_ONLY_MESSAGE","isPasskeySupported","runRegistrationCeremony","_optionsJSON","Error","runAuthenticationCeremony"],"sourceRoot":"../../../src","sources":["webauthn/passkeyClient.ts"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,yBAAyB,GAC7B,yFAAyF;;AAE3F;AACO,SAASC,kBAAkBA,CAAA,EAAY;EAC5C,OAAO,KAAK;AACd;;AAEA;AACO,eAAeC,uBAAuBA,CAACC,YAAqB,EAAoB;EACrF,MAAM,IAAIC,KAAK,CAACJ,yBAAyB,CAAC;AAC5C;;AAEA;AACO,eAAeK,yBAAyBA,CAACF,YAAqB,EAAoB;EACvF,MAAM,IAAIC,KAAK,CAACJ,yBAAyB,CAAC;AAC5C","ignoreList":[]}

package/lib/commonjs/webauthn/passkeyClient.native.js

@@ -0,0 +1,34 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.isPasskeySupported = isPasskeySupported;
+exports.runAuthenticationCeremony = runAuthenticationCeremony;
+exports.runRegistrationCeremony = runRegistrationCeremony;
+/**
+ * Passkey / WebAuthn ceremony client — NATIVE implementation.
+ *
+ * React Native has no browser WebAuthn API, and Oxy's native passkey story is
+ * Commons (shared-keychain / QR handoff), NOT `navigator.credentials`. So this
+ * variant imports NOTHING browser-specific and mirrors the clean default:
+ * unsupported, and the ceremony helpers throw if a caller skipped the gate.
+ */
+
+const WEBAUTHN_WEB_ONLY_MESSAGE = 'WebAuthn is web-only; native uses Commons. Passkeys are not available on this platform.';
+
+/** Always `false` on native — there is no browser WebAuthn API. */
+function isPasskeySupported() {
+  return false;
+}
+
+/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
+async function runRegistrationCeremony(_optionsJSON) {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}
+
+/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
+async function runAuthenticationCeremony(_optionsJSON) {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}
+//# sourceMappingURL=passkeyClient.native.js.map

package/lib/commonjs/webauthn/passkeyClient.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["WEBAUTHN_WEB_ONLY_MESSAGE","isPasskeySupported","runRegistrationCeremony","_optionsJSON","Error","runAuthenticationCeremony"],"sourceRoot":"../../../src","sources":["webauthn/passkeyClient.native.ts"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,yBAAyB,GAC7B,yFAAyF;;AAE3F;AACO,SAASC,kBAAkBA,CAAA,EAAY;EAC5C,OAAO,KAAK;AACd;;AAEA;AACO,eAAeC,uBAAuBA,CAACC,YAAqB,EAAoB;EACrF,MAAM,IAAIC,KAAK,CAACJ,yBAAyB,CAAC;AAC5C;;AAEA;AACO,eAAeK,yBAAyBA,CAACF,YAAqB,EAAoB;EACvF,MAAM,IAAIC,KAAK,CAACJ,yBAAyB,CAAC;AAC5C","ignoreList":[]}

package/lib/commonjs/webauthn/passkeyClient.web.js

@@ -0,0 +1,57 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.isPasskeySupported = isPasskeySupported;
+exports.runAuthenticationCeremony = runAuthenticationCeremony;
+exports.runRegistrationCeremony = runRegistrationCeremony;
+var _browser = require("@simplewebauthn/browser");
+/**
+ * Passkey / WebAuthn ceremony client — WEB implementation.
+ *
+ * The browser half of the passkey flow: it drives `navigator.credentials`
+ * through `@simplewebauthn/browser`, turning the OPAQUE options the server
+ * emitted (`OxyServices.webauthn{Register,Login}Options`) into the opaque
+ * response the matching `verify` endpoint consumes. Oxy never owns those wire
+ * shapes — `@simplewebauthn/browser` does — so options flow in as `unknown` and
+ * the single cast at this boundary hands them to the library's own types.
+ *
+ * This file is selected ONLY on web (react-native-web / Vite RNW): the sibling
+ * `passkeyClient.native.ts` + the clean default `passkeyClient.ts` deliberately
+ * do NOT import `@simplewebauthn/browser` (a browser-only dependency), per the
+ * platform-split rule. Native passkeys are Commons' job — there is no WebAuthn
+ * ceremony off the web.
+ */
+
+/**
+ * True iff this browser can run a WebAuthn ceremony (exposes the
+ * `PublicKeyCredential` global). Gate all passkey UI/entrypoints on this so an
+ * unsupported browser fails loudly rather than throwing mid-ceremony.
+ */
+function isPasskeySupported() {
+  return typeof window !== 'undefined' && typeof window.PublicKeyCredential !== 'undefined';
+}
+
+/**
+ * Run the WebAuthn REGISTRATION ceremony (`navigator.credentials.create`) from
+ * the server's opaque creation options, returning the opaque attestation
+ * response for `OxyServices.webauthnRegisterVerify`.
+ */
+async function runRegistrationCeremony(optionsJSON) {
+  return (0, _browser.startRegistration)({
+    optionsJSON: optionsJSON
+  });
+}
+
+/**
+ * Run the WebAuthn AUTHENTICATION ceremony (`navigator.credentials.get`) from
+ * the server's opaque request options, returning the opaque assertion response
+ * for `OxyServices.webauthnLoginVerify`.
+ */
+async function runAuthenticationCeremony(optionsJSON) {
+  return (0, _browser.startAuthentication)({
+    optionsJSON: optionsJSON
+  });
+}
+//# sourceMappingURL=passkeyClient.web.js.map

package/lib/commonjs/webauthn/passkeyClient.web.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_browser","require","isPasskeySupported","window","PublicKeyCredential","runRegistrationCeremony","optionsJSON","startRegistration","runAuthenticationCeremony","startAuthentication"],"sourceRoot":"../../../src","sources":["webauthn/passkeyClient.web.ts"],"mappings":";;;;;;;;AAiBA,IAAAA,QAAA,GAAAC,OAAA;AAjBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAWA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAAA,EAAY;EAC5C,OAAO,OAAOC,MAAM,KAAK,WAAW,IAAI,OAAOA,MAAM,CAACC,mBAAmB,KAAK,WAAW;AAC3F;;AAEA;AACA;AACA;AACA;AACA;AACO,eAAeC,uBAAuBA,CAC3CC,WAAoB,EACe;EACnC,OAAO,IAAAC,0BAAiB,EAAC;IAAED,WAAW,EAAEA;EAAsD,CAAC,CAAC;AAClG;;AAEA;AACA;AACA;AACA;AACA;AACO,eAAeE,yBAAyBA,CAC7CF,WAAoB,EACiB;EACrC,OAAO,IAAAG,4BAAmB,EAAC;IAAEH,WAAW,EAAEA;EAAqD,CAAC,CAAC;AACnG","ignoreList":[]}

package/lib/module/index.js

@@ -61,6 +61,7 @@ export { useStorage } from "./ui/hooks/useStorage.js";
 export { useUserProfile, useUserProfiles, useCurrentUser, useUserById, useUserByUsername, useUsersBySessions, usePrivacySettings, useConnectedApps } from "./ui/hooks/queries/useAccountQueries.js";
 export { useSessions, useSession, useDeviceSessions, useUserDevices, useSecurityInfo, useAccountStorageUsage } from "./ui/hooks/queries/useServicesQueries.js";
 export { useSecurityActivity, useRecentSecurityActivity, useInfiniteSecurityActivity } from "./ui/hooks/queries/useSecurityQueries.js";
+export { useAuthMethods } from "./ui/hooks/queries/useAuthMethods.js";
 export { useUserSubscription, useUserPayments, useUserWallet, useUserWalletTransactions } from "./ui/hooks/queries/usePaymentQueries.js";
 
 // Payment / wallet / subscription domain types
@@ -80,7 +81,7 @@ export { mutationKeys } from "./ui/hooks/mutations/mutationKeys.js";
 // Consumers (Mention, Homiio, Alia, accounts) use these to invalidate cached
 // data after writes that touch shared backend state. Keep nominal — no
 // `export *` — and never drop a public symbol without a major version bump.
-export { queryKeys, invalidateAccountQueries, invalidateUserQueries, invalidateSessionQueries, invalidateDeviceQueries, invalidatePrivacyQueries, invalidateSecurityQueries, invalidateStorageQueries, invalidatePaymentsQueries, invalidateConnectedAppsQueries } from "./ui/hooks/queries/queryKeys.js";
+export { queryKeys, invalidateAccountQueries, invalidateUserQueries, invalidateSessionQueries, invalidateDeviceQueries, invalidatePrivacyQueries, invalidateSecurityQueries, invalidateStorageQueries, invalidatePaymentsQueries, invalidateConnectedAppsQueries, invalidateAuthMethodsQueries } from "./ui/hooks/queries/queryKeys.js";
 
 // Mutation status aggregator (for "Syncing..." indicators)
 export { useMutationStatus } from "./ui/hooks/useMutationStatus.js";

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["setPlatformOS","Platform","OS","default","OxyProvider","useOxy","useAuth","FontLoader","setupFonts","useAuthStore","useAccountStore","useAssetStore","useAssets","useAssetsStore","useAsset","useUploadProgress","useAssetLoading","useAssetErrors","useAssetsByApp","useAssetsByEntity","useAssetUsageCount","useIsAssetLinked","setOxyAssetInstance","useFileDownloadUrl","useFollow","useFollowerCounts","useStorage","useUserProfile","useUserProfiles","useCurrentUser","useUserById","useUserByUsername","useUsersBySessions","usePrivacySettings","useConnectedApps","useSessions","useSession","useDeviceSessions","useUserDevices","useSecurityInfo","useAccountStorageUsage","useSecurityActivity","useRecentSecurityActivity","useInfiniteSecurityActivity","useUserSubscription","useUserPayments","useUserWallet","useUserWalletTransactions","useUpdateProfile","useUploadAvatar","useUpdateAccountSettings","useUpdatePrivacySettings","useUpdateNotificationPreferences","useUpdateUserPreferences","useRevokeConnectedApp","useUploadFile","useSwitchSession","useLogoutSession","useLogoutAll","useUpdateDeviceName","useRemoveDevice","createProfileMutation","createGenericMutation","mutationKeys","queryKeys","invalidateAccountQueries","invalidateUserQueries","invalidateSessionQueries","invalidateDeviceQueries","invalidatePrivacyQueries","invalidateSecurityQueries","invalidateStorageQueries","invalidatePaymentsQueries","invalidateConnectedAppsQueries","useMutationStatus","useOnlineStatus","useOxyEvent","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage","useFileFiltering","OXY_OAUTH_STATE_STORAGE_KEY","OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY","OxySignInButton","OxyAuthPrompt","OxyOAuthCallback","OxyConsentScreen","RequireOxyAuth","FollowButton","OxyPayButton","LogoIcon","LogoText","ProfileButton","useSwitchableAccounts","ProfileScreen","ManageAccountScreen","NotificationsScreen","PreferencesScreen","ConnectedAppsScreen","CreateAccountScreen","AccountMembersScreen","AccountSettingsScreen","showBottomSheet","closeBottomSheet","openAccountDialog","closeAccountDialog","subscribeToAccountDialog"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA,SAASA,aAAa,QAAyB,aAAa;AAC5D,SAASC,QAAQ,QAAQ,cAAc;AACvCD,aAAa,CAACC,QAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;AACA,SAASC,OAAO,IAAIC,WAAW,QAAQ,gCAA6B;AACpE,SAASC,MAAM,QAAQ,4BAAyB;AAEhD,SAASC,OAAO,QAAQ,uBAAoB;AAG5C;AACA;AACA;AACA,SAASC,UAAU,EAAEC,UAAU,QAAQ,+BAA4B;;AAEnE;AACA;AACA;AACA,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,eAAe,QAAQ,6BAA0B;AAC1D,SACIC,aAAa,EACbC,SAAS,IAAIC,cAAc,EAC3BC,QAAQ,EACRC,iBAAiB,EACjBC,eAAe,EACfC,cAAc,EACdC,cAAc,EACdC,iBAAiB,EACjBC,kBAAkB,EAClBC,gBAAgB,QACb,2BAAwB;;AAE/B;AACA;AACA;AACA,SAAST,SAAS,EAAEU,mBAAmB,QAAQ,yBAAsB;AACrE,SAASC,kBAAkB,QAAQ,kCAA+B;AAClE,SAASC,SAAS,EAAEC,iBAAiB,QAAQ,yBAAsB;AACnE,SAASC,UAAU,QAAQ,0BAAuB;AAGlD;AACA;AACA;AACA,SACIC,cAAc,EACdC,eAAe,EACfC,cAAc,EACdC,WAAW,EACXC,iBAAiB,EACjBC,kBAAkB,EAClBC,kBAAkB,EAClBC,gBAAgB,QACb,yCAAsC;AAC7C,SACIC,WAAW,EACXC,UAAU,EACVC,iBAAiB,EACjBC,cAAc,EACdC,eAAe,EACfC,sBAAsB,QACnB,0CAAuC;AAC9C,SACIC,mBAAmB,EACnBC,yBAAyB,EACzBC,2BAA2B,QACxB,0CAAuC;AAC9C,SACIC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,yBAAyB,QACtB,yCAAsC;;AAE7C;;AAeA;AACA;AACA;AACA,SACIC,gBAAgB,EAChBC,eAAe,EACfC,wBAAwB,EACxBC,wBAAwB,EACxBC,gCAAgC,EAChCC,wBAAwB,EACxBC,qBAAqB,EACrBC,aAAa,QACV,6CAA0C;AACjD,SACIC,gBAAgB,EAChBC,gBAAgB,EAChBC,YAAY,EACZC,mBAAmB,EACnBC,eAAe,QACZ,8CAA2C;AAClD,SACIC,qBAAqB,EACrBC,qBAAqB,QAClB,yCAAsC;AAM7C;AACA,SAASC,YAAY,QAAQ,sCAAmC;;AAEhE;AACA;AACA;AACA;AACA;AACA;AACA,SACIC,SAAS,EACTC,wBAAwB,EACxBC,qBAAqB,EACrBC,wBAAwB,EACxBC,uBAAuB,EACvBC,wBAAwB,EACxBC,yBAAyB,EACzBC,wBAAwB,EACxBC,yBAAyB,EACzBC,8BAA8B,QAC3B,iCAA8B;;AAErC;AACA,SAASC,iBAAiB,QAAQ,iCAA8B;AAEhE,SAASC,eAAe,QAAQ,+BAA4B;AAC5D,SAASC,WAAW,QAAQ,2BAAwB;;AAEpD;AACA;AACA;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,6BAA0B;AAGjC;AACA;AACA;AACA,SAASC,gBAAgB,QAAQ,gCAA6B;AAG9D;AACA;AACA;AACA,SACEC,2BAA2B,EAC3BC,mCAAmC,QAC9B,aAAa;AACpB,SAAShF,OAAO,IAAIiF,eAAe,QAAQ,oCAAiC;AAE5E,SAASC,aAAa,QAAQ,kCAA+B;AAE7D,SAASC,gBAAgB,QAAQ,qCAAkC;AAEnE,SAASC,gBAAgB,QAAQ,qCAAkC;AAOnE;AACA;AACA;AACA;AACA;AACA,SAASC,cAAc,QAAQ,mCAAgC;AAG/D,SAASrF,OAAO,IAAIsF,YAAY,QAAQ,iCAA8B;AAEtE,SAAStF,OAAO,IAAIuF,YAAY,QAAQ,iCAA8B;AACtE,SAASC,QAAQ,QAAQ,kCAA+B;AACxD,SAASC,QAAQ,QAAQ,kCAA+B;;AAExD;AACA;AACA;AACA,SAASzF,OAAO,IAAI0F,aAAa,QAAQ,kCAA+B;AAGxE;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,qBAAqB,QAAQ,qCAAkC;AAGxE;AACA,SAAS3F,OAAO,IAAI4F,aAAa,QAAQ,+BAA4B;AACrE,SAAS5F,OAAO,IAAI6F,mBAAmB,QAAQ,qCAAkC;AACjF,SAAS7F,OAAO,IAAI8F,mBAAmB,QAAQ,qCAAkC;AACjF,SAAS9F,OAAO,IAAI+F,iBAAiB,QAAQ,mCAAgC;AAC7E,SAAS/F,OAAO,IAAIgG,mBAAmB,QAAQ,qCAAkC;;AAEjF;AACA,SAAShG,OAAO,IAAIiG,mBAAmB,QAAQ,qCAAkC;AACjF,SAASjG,OAAO,IAAIkG,oBAAoB,QAAQ,sCAAmC;AACnF,SAASlG,OAAO,IAAImG,qBAAqB,QAAQ,uCAAoC;;AAErF;AACA;AACA;AACA,SAASC,eAAe,EAAEC,gBAAgB,QAAQ,uCAAoC;AAGtF;AACA;AACA;AACA;AACA,SACEC,iBAAiB,EACjBC,kBAAkB,EAClBC,wBAAwB,QACnB,yCAAsC","ignoreList":[]}
+{"version":3,"names":["setPlatformOS","Platform","OS","default","OxyProvider","useOxy","useAuth","FontLoader","setupFonts","useAuthStore","useAccountStore","useAssetStore","useAssets","useAssetsStore","useAsset","useUploadProgress","useAssetLoading","useAssetErrors","useAssetsByApp","useAssetsByEntity","useAssetUsageCount","useIsAssetLinked","setOxyAssetInstance","useFileDownloadUrl","useFollow","useFollowerCounts","useStorage","useUserProfile","useUserProfiles","useCurrentUser","useUserById","useUserByUsername","useUsersBySessions","usePrivacySettings","useConnectedApps","useSessions","useSession","useDeviceSessions","useUserDevices","useSecurityInfo","useAccountStorageUsage","useSecurityActivity","useRecentSecurityActivity","useInfiniteSecurityActivity","useAuthMethods","useUserSubscription","useUserPayments","useUserWallet","useUserWalletTransactions","useUpdateProfile","useUploadAvatar","useUpdateAccountSettings","useUpdatePrivacySettings","useUpdateNotificationPreferences","useUpdateUserPreferences","useRevokeConnectedApp","useUploadFile","useSwitchSession","useLogoutSession","useLogoutAll","useUpdateDeviceName","useRemoveDevice","createProfileMutation","createGenericMutation","mutationKeys","queryKeys","invalidateAccountQueries","invalidateUserQueries","invalidateSessionQueries","invalidateDeviceQueries","invalidatePrivacyQueries","invalidateSecurityQueries","invalidateStorageQueries","invalidatePaymentsQueries","invalidateConnectedAppsQueries","invalidateAuthMethodsQueries","useMutationStatus","useOnlineStatus","useOxyEvent","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage","useFileFiltering","OXY_OAUTH_STATE_STORAGE_KEY","OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY","OxySignInButton","OxyAuthPrompt","OxyOAuthCallback","OxyConsentScreen","RequireOxyAuth","FollowButton","OxyPayButton","LogoIcon","LogoText","ProfileButton","useSwitchableAccounts","ProfileScreen","ManageAccountScreen","NotificationsScreen","PreferencesScreen","ConnectedAppsScreen","CreateAccountScreen","AccountMembersScreen","AccountSettingsScreen","showBottomSheet","closeBottomSheet","openAccountDialog","closeAccountDialog","subscribeToAccountDialog"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA,SAASA,aAAa,QAAyB,aAAa;AAC5D,SAASC,QAAQ,QAAQ,cAAc;AACvCD,aAAa,CAACC,QAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;AACA,SAASC,OAAO,IAAIC,WAAW,QAAQ,gCAA6B;AACpE,SAASC,MAAM,QAAQ,4BAAyB;AAEhD,SAASC,OAAO,QAAQ,uBAAoB;AAG5C;AACA;AACA;AACA,SAASC,UAAU,EAAEC,UAAU,QAAQ,+BAA4B;;AAEnE;AACA;AACA;AACA,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,eAAe,QAAQ,6BAA0B;AAC1D,SACIC,aAAa,EACbC,SAAS,IAAIC,cAAc,EAC3BC,QAAQ,EACRC,iBAAiB,EACjBC,eAAe,EACfC,cAAc,EACdC,cAAc,EACdC,iBAAiB,EACjBC,kBAAkB,EAClBC,gBAAgB,QACb,2BAAwB;;AAE/B;AACA;AACA;AACA,SAAST,SAAS,EAAEU,mBAAmB,QAAQ,yBAAsB;AACrE,SAASC,kBAAkB,QAAQ,kCAA+B;AAClE,SAASC,SAAS,EAAEC,iBAAiB,QAAQ,yBAAsB;AACnE,SAASC,UAAU,QAAQ,0BAAuB;AAGlD;AACA;AACA;AACA,SACIC,cAAc,EACdC,eAAe,EACfC,cAAc,EACdC,WAAW,EACXC,iBAAiB,EACjBC,kBAAkB,EAClBC,kBAAkB,EAClBC,gBAAgB,QACb,yCAAsC;AAC7C,SACIC,WAAW,EACXC,UAAU,EACVC,iBAAiB,EACjBC,cAAc,EACdC,eAAe,EACfC,sBAAsB,QACnB,0CAAuC;AAC9C,SACIC,mBAAmB,EACnBC,yBAAyB,EACzBC,2BAA2B,QACxB,0CAAuC;AAC9C,SAASC,cAAc,QAAQ,sCAAmC;AAClE,SACIC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,yBAAyB,QACtB,yCAAsC;;AAE7C;;AAeA;AACA;AACA;AACA,SACIC,gBAAgB,EAChBC,eAAe,EACfC,wBAAwB,EACxBC,wBAAwB,EACxBC,gCAAgC,EAChCC,wBAAwB,EACxBC,qBAAqB,EACrBC,aAAa,QACV,6CAA0C;AACjD,SACIC,gBAAgB,EAChBC,gBAAgB,EAChBC,YAAY,EACZC,mBAAmB,EACnBC,eAAe,QACZ,8CAA2C;AAClD,SACIC,qBAAqB,EACrBC,qBAAqB,QAClB,yCAAsC;AAM7C;AACA,SAASC,YAAY,QAAQ,sCAAmC;;AAEhE;AACA;AACA;AACA;AACA;AACA;AACA,SACIC,SAAS,EACTC,wBAAwB,EACxBC,qBAAqB,EACrBC,wBAAwB,EACxBC,uBAAuB,EACvBC,wBAAwB,EACxBC,yBAAyB,EACzBC,wBAAwB,EACxBC,yBAAyB,EACzBC,8BAA8B,EAC9BC,4BAA4B,QACzB,iCAA8B;;AAErC;AACA,SAASC,iBAAiB,QAAQ,iCAA8B;AAEhE,SAASC,eAAe,QAAQ,+BAA4B;AAC5D,SAASC,WAAW,QAAQ,2BAAwB;;AAEpD;AACA;AACA;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,6BAA0B;AAGjC;AACA;AACA;AACA,SAASC,gBAAgB,QAAQ,gCAA6B;AAG9D;AACA;AACA;AACA,SACEC,2BAA2B,EAC3BC,mCAAmC,QAC9B,aAAa;AACpB,SAASlF,OAAO,IAAImF,eAAe,QAAQ,oCAAiC;AAE5E,SAASC,aAAa,QAAQ,kCAA+B;AAE7D,SAASC,gBAAgB,QAAQ,qCAAkC;AAEnE,SAASC,gBAAgB,QAAQ,qCAAkC;AAOnE;AACA;AACA;AACA;AACA;AACA,SAASC,cAAc,QAAQ,mCAAgC;AAG/D,SAASvF,OAAO,IAAIwF,YAAY,QAAQ,iCAA8B;AAEtE,SAASxF,OAAO,IAAIyF,YAAY,QAAQ,iCAA8B;AACtE,SAASC,QAAQ,QAAQ,kCAA+B;AACxD,SAASC,QAAQ,QAAQ,kCAA+B;;AAExD;AACA;AACA;AACA,SAAS3F,OAAO,IAAI4F,aAAa,QAAQ,kCAA+B;AAGxE;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,qBAAqB,QAAQ,qCAAkC;AAGxE;AACA,SAAS7F,OAAO,IAAI8F,aAAa,QAAQ,+BAA4B;AACrE,SAAS9F,OAAO,IAAI+F,mBAAmB,QAAQ,qCAAkC;AACjF,SAAS/F,OAAO,IAAIgG,mBAAmB,QAAQ,qCAAkC;AACjF,SAAShG,OAAO,IAAIiG,iBAAiB,QAAQ,mCAAgC;AAC7E,SAASjG,OAAO,IAAIkG,mBAAmB,QAAQ,qCAAkC;;AAEjF;AACA,SAASlG,OAAO,IAAImG,mBAAmB,QAAQ,qCAAkC;AACjF,SAASnG,OAAO,IAAIoG,oBAAoB,QAAQ,sCAAmC;AACnF,SAASpG,OAAO,IAAIqG,qBAAqB,QAAQ,uCAAoC;;AAErF;AACA;AACA;AACA,SAASC,eAAe,EAAEC,gBAAgB,QAAQ,uCAAoC;AAGtF;AACA;AACA;AACA;AACA,SACEC,iBAAiB,EACjBC,kBAAkB,EAClBC,wBAAwB,QACnB,yCAAsC","ignoreList":[]}

package/lib/module/ui/components/OxyAccountDialog.js

@@ -49,9 +49,11 @@ import { Button } from '@oxyhq/bloom/button';
 import { Dialog } from '@oxyhq/bloom/dialog';
 import { Text } from '@oxyhq/bloom/typography';
 import { useTheme, BloomColorScope, APP_COLOR_NAMES, APP_COLOR_PRESETS } from '@oxyhq/bloom/theme';
+import { isOxyRpOrigin } from '@oxyhq/core';
 import { useQueryClient } from '@tanstack/react-query';
 import { useOxy } from "../context/OxyContext.js";
 import { useI18n } from "../hooks/useI18n.js";
+import { isWebBrowser } from "../utils/isWebBrowser.js";
 import { LogoIcon } from "./logo/LogoIcon.js";
 
 /** Diameter of a row avatar. */
@@ -89,7 +91,8 @@ const OxyAccountDialog = () => {
     closeAccountDialog,
     showBottomSheet,
     logoutAll,
-    refreshAccounts
+    refreshAccounts,
+    signInWithPasskey
   } = useOxy();
   const theme = useTheme();
   const {
@@ -97,6 +100,29 @@ const OxyAccountDialog = () => {
   } = useI18n();
   const queryClient = useQueryClient();
 
+  // Passkey sign-in is offered ONLY on a first-party Oxy web origin (a credential
+  // minted for `oxy.so` can only be asserted there or on a loopback dev host).
+  // Off the web / on a non-Oxy origin the button is hidden entirely (a hub popup
+  // for arbitrary web origins is a later phase). This is environment-static.
+  const passkeyAvailable = useMemo(() => isWebBrowser() && isOxyRpOrigin(), []);
+  const [passkeyPending, setPasskeyPending] = useState(false);
+  const [passkeyError, setPasskeyError] = useState(null);
+  const handleSignInWithPasskey = useCallback(async () => {
+    if (passkeyPending) return;
+    setPasskeyPending(true);
+    setPasskeyError(null);
+    try {
+      await signInWithPasskey();
+      closeAccountDialog();
+    } catch (error) {
+      // A cancelled/failed ceremony keeps the dialog open so the user can retry
+      // or fall back to another method — surface a concise message, never swallow.
+      setPasskeyError(error instanceof Error && error.message ? error.message : 'Passkey sign-in failed.');
+    } finally {
+      setPasskeyPending(false);
+    }
+  }, [passkeyPending, signInWithPasskey, closeAccountDialog]);
+
   // Bind the headless controller. `getSnapshot` returns a stable reference
   // between changes, so it is `useSyncExternalStore`-safe. Guard the no-provider
   // loading state (`controller` is `null`) with an inert store.
@@ -187,7 +213,10 @@ const OxyAccountDialog = () => {
         handlers: handlers,
         onSignInWithOxy: () => void controller.signInWithOxy(),
         onScanQr: () => void controller.showQr(),
-        onUsePassword: () => void controller.openPasswordAtOxyAuth()
+        onUsePassword: () => void controller.openPasswordAtOxyAuth(),
+        onSignInWithPasskey: passkeyAvailable ? () => void handleSignInWithPasskey() : undefined,
+        passkeyPending: passkeyPending,
+        passkeyError: passkeyError
       })
     })]
   });
@@ -407,7 +436,10 @@ const SignInView = ({
   handlers,
   onSignInWithOxy,
   onScanQr,
-  onUsePassword
+  onUsePassword,
+  onSignInWithPasskey,
+  passkeyPending,
+  passkeyError
 }) => /*#__PURE__*/_jsxs(View, {
   style: styles.signInBlock,
   children: [snapshot.accounts.length > 0 ? /*#__PURE__*/_jsxs(View, {
@@ -427,7 +459,19 @@ const SignInView = ({
     onPress: onSignInWithOxy,
     style: styles.primaryButton,
     children: "Sign in with Oxy"
-  }), /*#__PURE__*/_jsx(Button, {
+  }), onSignInWithPasskey ? /*#__PURE__*/_jsx(Button, {
+    variant: "secondary",
+    onPress: onSignInWithPasskey,
+    disabled: passkeyPending,
+    style: styles.secondaryButton,
+    testID: "passkey-signin-button",
+    children: passkeyPending ? t('accountSwitcher.passkeySigningIn') || 'Signing in…' : t('accountSwitcher.signInWithPasskey') || 'Sign in with a passkey'
+  }) : null, passkeyError ? /*#__PURE__*/_jsx(Text, {
+    style: [styles.errorText, {
+      color: theme.colors.error
+    }],
+    children: passkeyError
+  }) : null, /*#__PURE__*/_jsx(Button, {
     variant: "secondary",
     onPress: onScanQr,
     style: styles.secondaryButton,