@oxyhq/services 21.0.0 → 22.0.0

package/lib/typescript/module/ui/context/passkeyFlow.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Pure passkey (WebAuthn) sign-in / registration orchestration.
+ *
+ * Extracted from `OxyContext` so the fixed `options → ceremony → verify → commit`
+ * ordering is unit-testable with injected deps — the exact pattern
+ * `commitSessionFlow.ts` (`commitDeviceSetAndResolve`) uses. The context methods
+ * (`signInWithPasskey` / `registerWithPasskey` / `addPasskey`) are thin wrappers
+ * that supply the real deps: the core `webauthn*` methods, the platform ceremony
+ * client (`webauthn/passkeyClient`), and the internal `commitSession` funnel.
+ *
+ * All three GATE on `isSupported()` first (the platform client returns `false`
+ * off the web) so an unsupported surface fails loudly before touching a ceremony.
+ */
+import type { LoginResult } from '@oxyhq/contracts';
+import type { CommitInput } from './oxyContextTypes.js';
+/**
+ * The result of `OxyServices.webauthnRegisterVerify` — either the LINK branch
+ * (`{ success, message }`, bearer present, no session) or the SIGNUP branch (a
+ * full {@link LoginResult}, which carries a `sessionId` on its session arm).
+ */
+export type PasskeyRegisterVerifyResult = {
+    success: true;
+    message: string;
+} | LoginResult;
+/** Thrown when a passkey flow is attempted on a surface that cannot run WebAuthn. */
+export declare const PASSKEY_UNSUPPORTED_MESSAGE = "Passkeys are not available in this environment. Use another sign-in method.";
+/** Injected dependencies for {@link runPasskeyLogin}. */
+export interface RunPasskeyLoginDeps {
+    isSupported: () => boolean;
+    getLoginOptions: (username?: string) => Promise<unknown>;
+    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+    loginVerify: (response: unknown, envelope: {
+        deviceName?: string;
+        deviceFingerprint?: string;
+        deviceId?: string;
+    }) => Promise<LoginResult>;
+    commit: (input: CommitInput) => Promise<void>;
+    /**
+     * When present, scopes login options to that user's registered passkeys
+     * (username-first) — the path a NON-discoverable hardware key (e.g. a U2F
+     * security key) needs, since it can't be found by a usernameless ceremony.
+     * Omit for the discoverable / resident-credential path.
+     */
+    username?: string;
+    deviceId?: string;
+    deviceName?: string;
+    deviceFingerprint?: string;
+}
+/**
+ * Passkey SIGN-IN. With no `username` this is the usernameless
+ * (discoverable-credential) flow; with a `username` it is username-first —
+ * the server scopes `allowCredentials` to that user's passkeys so a
+ * non-discoverable hardware key (U2F/security key) can be selected. Either way:
+ * request login options, run the authentication ceremony, verify, then commit
+ * the session. A passkey assertion is itself the strong factor — sign-in always
+ * resolves to a completed session.
+ */
+export declare function runPasskeyLogin(deps: RunPasskeyLoginDeps): Promise<void>;
+/** Injected dependencies for {@link runPasskeyRegister}. */
+export interface RunPasskeyRegisterDeps {
+    isSupported: () => boolean;
+    getRegisterOptions: (username: string) => Promise<unknown>;
+    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+    registerVerify: (response: unknown, envelope: {
+        username: string;
+        deviceName?: string;
+    }) => Promise<PasskeyRegisterVerifyResult>;
+    commit: (input: CommitInput) => Promise<void>;
+    username: string;
+    deviceName?: string;
+}
+/**
+ * Passkey SIGNUP: create a brand-new account whose first auth method is a
+ * passkey. The verify signup branch mints a session (a {@link LoginSessionResult}
+ * carrying `sessionId`), which is committed exactly like a password signup.
+ */
+export declare function runPasskeyRegister(deps: RunPasskeyRegisterDeps): Promise<void>;
+/** Injected dependencies for {@link runPasskeyAdd}. */
+export interface RunPasskeyAddDeps {
+    isSupported: () => boolean;
+    getRegisterOptions: () => Promise<unknown>;
+    runCeremony: (optionsJSON: unknown) => Promise<unknown>;
+    registerVerify: (response: unknown, envelope: {
+        deviceName?: string;
+    }) => Promise<PasskeyRegisterVerifyResult>;
+    onLinked: () => void;
+    deviceName?: string;
+}
+/**
+ * ADD a passkey to the already-signed-in account (bearer present). The verify
+ * link branch returns `{ success, message }` with NO session — so this never
+ * commits a session; it just fires `onLinked` (which invalidates the
+ * auth-methods query). A session arm here would be a server contract violation.
+ */
+export declare function runPasskeyAdd(deps: RunPasskeyAddDeps): Promise<void>;
+//# sourceMappingURL=passkeyFlow.d.ts.map

package/lib/typescript/module/ui/context/passkeyFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/passkeyFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAmB,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAAC;AAE3F,qFAAqF;AACrF,eAAO,MAAM,2BAA2B,gFACuC,CAAC;AAehF,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,WAAW,EAAE,CACX,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY9E;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,cAAc,EAAE,CACd,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBpF;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,cAAc,EAAE,CACd,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC9B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1E"}

package/lib/typescript/module/ui/hooks/mutations/useAccountMutations.d.ts

@@ -32,14 +32,14 @@ export declare const useUpdateProfile: () => import("@tanstack/react-query").Use
         id: import("zod").ZodOptional<import("zod").ZodString>;
     }, "strip", import("zod").ZodTypeAny, {
         url: string;
-        id?: string | undefined;
         description?: string | undefined;
+        id?: string | undefined;
         title?: string | undefined;
         image?: string | undefined;
     }, {
         url: string;
-        id?: string | undefined;
         description?: string | undefined;
+        id?: string | undefined;
         title?: string | undefined;
         image?: string | undefined;
     }>, "many">>;

package/lib/typescript/module/ui/hooks/mutations/useAccountMutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAccountMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useAccountMutations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,eAAe,EAChB,MAAM,aAAa,CAAC;AAerB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;aAqS4B,CAAC;YAEvD,CAAC;;aAEqC,CAAC;YAIxC,CAHA;;;;;;;;;;;;;;;;;;;;;UAkBI,CAAJ;mBAAyC,CAAC;aAK1C,CAAC;aAC+B,CAAC;;;UAErB,CAAC;mBACP,CAAC;aAAoC,CAAA;aACvB,CAAA;;;;;;;;;EAxOrB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe;SAMQ,MAAM;WAAS,MAAM;WAAS,MAAM;WAAS,MAAM;;;EA4EtF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,UAAU,8BAA8B;IACtC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;sBAoFf,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;iBAhOxD,CAAC;uBAA6B,CAAC;iBAAwB,CAAA;cACzD,CAAC;;;qBAAkD,CAAC;qBAChD,CAAC;;;;;;;;;;oBAeD,CAAC;kBAAwB,CAAC;mBAChC,CAAC;;;mBAAoD,CAAA;;;;;;;;;;;;;;;;;;;;;;;;CAsNjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB;cAMoB,OAAO,CAAC,eAAe,CAAC;aAAW,MAAM;;;;cAgJjG,CAAC;AAEF,4CAA4C;AAC5C,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CACxI;AAED,4EAA4E;AAC5E,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;EAmD5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;EA+CpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,uFAoBjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa;UAWd,gBAAgB;iBACT,SAAS,GAAG,QAAQ,GAAG,UAAU;eACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI;WAS5C,CAAC"}
+{"version":3,"file":"useAccountMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useAccountMutations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,eAAe,EAChB,MAAM,aAAa,CAAC;AAerB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;aAqS4B,CAAC;YAEvD,CAAC;;aAEqC,CAAC;YAIxC,CAHA;;;;;;;;;;;;;;;;;;;;;mBAkBQ,CAAC;UAAgC,CAAC;aAK1C,CAAC;aAC+B,CAAC;;;mBAEZ,CAAC;UAChB,CAAC;aAAoC,CAAA;aACvB,CAAA;;;;;;;;;EAxOrB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe;SAMQ,MAAM;WAAS,MAAM;WAAS,MAAM;WAAS,MAAM;;;EA4EtF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,UAAU,8BAA8B;IACtC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;sBAoFf,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;iBAhOxD,CAAC;uBAA6B,CAAC;iBAAwB,CAAA;cACzD,CAAC;;;qBAAkD,CAAC;qBAChD,CAAC;;;;;;;;;;oBAeD,CAAC;kBAAwB,CAAC;mBAChC,CAAC;;;mBAAoD,CAAA;;;;;;;;;;;;;;;;;;;;;;;;CAsNjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB;cAMoB,OAAO,CAAC,eAAe,CAAC;aAAW,MAAM;;;;cAgJjG,CAAC;AAEF,4CAA4C;AAC5C,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CACxI;AAED,4EAA4E;AAC5E,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;EAmD5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;EA+CpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,uFAoBjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa;UAWd,gBAAgB;iBACT,SAAS,GAAG,QAAQ,GAAG,UAAU;eACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI;WAS5C,CAAC"}

package/lib/typescript/module/ui/hooks/queries/queryKeys.d.ts

@@ -51,6 +51,10 @@ export declare const queryKeys: {
         readonly recent: (limit: number) => readonly ["security", "recent", number];
         readonly infinite: (limit: number, eventType?: string) => readonly ["security", "infinite", number, string | undefined];
     };
+    readonly authMethods: {
+        readonly all: readonly ["authMethods"];
+        readonly list: (userId?: string) => readonly ["authMethods", "list", string];
+    };
     readonly storage: {
         readonly all: readonly ["storage"];
         readonly usage: (accountScope?: string) => readonly ["storage", "usage", string | undefined];
@@ -99,6 +103,11 @@ export declare const invalidateSecurityQueries: (queryClient: QueryClient) => vo
  * Helper to invalidate all storage-usage queries
  */
 export declare const invalidateStorageQueries: (queryClient: QueryClient) => void;
+/**
+ * Helper to invalidate the user's linked auth-methods list (call after linking
+ * or removing a passkey / password / identity key).
+ */
+export declare const invalidateAuthMethodsQueries: (queryClient: QueryClient) => void;
 /**
  * Helper to invalidate all payments / wallet / subscription queries
  */

package/lib/typescript/module/ui/hooks/queries/queryKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queryKeys.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/queryKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,eAAO,MAAM,SAAS;;;;oCAKC,MAAM,EAAE;;qCAEP,MAAM;uCACJ,MAAM,GAAG,IAAI;;;;;;iCAWnB,MAAM,EAAE;;kCAEP,MAAM;sCACF,MAAM;;;;;iCAOX,MAAM;;qCAEF,MAAM;;oCAEP,MAAM;;;;;uCAOH,MAAM;;oCAET,MAAM;;;;qCAML,MAAM;;;;oCAMP,MAAM,WAAW,MAAM,cAAc,MAAM;iCAE9C,MAAM;mCAEJ,MAAM,cAAc,MAAM;;;;wCAOrB,MAAM;;;;;;;;kCAYZ,MAAM;;;;yCAMC,MAAM;oCAEX,MAAM;mCAEP,MAAM;8CAEK,MAAM,WAAW,MAAM,WAAW,MAAM;;CAU/D,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,WAAW,KAAG,IAEhE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,aAAa,WAAW,KAAG,IAElE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,aAAa,WAAW,KAAG,IAEpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,aAAa,WAAW,KAAG,IAEpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,aAAa,WAAW,KAAG,IAEzE,CAAC"}
+{"version":3,"file":"queryKeys.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/queryKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,eAAO,MAAM,SAAS;;;;oCAKC,MAAM,EAAE;;qCAEP,MAAM;uCACJ,MAAM,GAAG,IAAI;;;;;;iCAWnB,MAAM,EAAE;;kCAEP,MAAM;sCACF,MAAM;;;;;iCAOX,MAAM;;qCAEF,MAAM;;oCAEP,MAAM;;;;;uCAOH,MAAM;;oCAET,MAAM;;;;qCAML,MAAM;;;;oCAMP,MAAM,WAAW,MAAM,cAAc,MAAM;iCAE9C,MAAM;mCAEJ,MAAM,cAAc,MAAM;;;;iCAO5B,MAAM;;;;wCAMC,MAAM;;;;;;;;kCAYZ,MAAM;;;;yCAMC,MAAM;oCAEX,MAAM;mCAEP,MAAM;8CAEK,MAAM,WAAW,MAAM,WAAW,MAAM;;CAU/D,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,WAAW,KAAG,IAEhE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,aAAa,WAAW,KAAG,IAElE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,aAAa,WAAW,KAAG,IAEpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,aAAa,WAAW,KAAG,IAEnE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GAAI,aAAa,WAAW,KAAG,IAEvE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,aAAa,WAAW,KAAG,IAEpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,aAAa,WAAW,KAAG,IAEzE,CAAC"}

package/lib/typescript/module/ui/hooks/queries/useAuthMethods.d.ts

@@ -0,0 +1,212 @@
+import type { AuthMethodEntry, AuthMethodsResponse } from '@oxyhq/contracts';
+/**
+ * The current account's linked authentication methods (`GET /auth/methods`),
+ * plus convenience projections. Backs the security / account surfaces that let a
+ * user see and manage their passwords, identity key, social logins, and passkeys.
+ *
+ * `passkeys` is the `type === 'webauthn'` subset — one entry per registered
+ * credential. Invalidate via `queryKeys.authMethods.all` after linking a passkey
+ * (`useOxy().addPasskey()` does this) or removing one.
+ */
+export declare const useAuthMethods: (options?: {
+    enabled?: boolean;
+}) => {
+    /** Every linked auth method. Empty while loading. */
+    methods: readonly AuthMethodEntry[];
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys: AuthMethodEntry[];
+    /** The account's DID, or `null` while loading. */
+    did: string | null;
+    data: NoInfer<AuthMethodsResponse>;
+    error: Error;
+    isError: true;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: false;
+    isRefetchError: true;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "error";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthMethodsResponse>, Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<NoInfer<AuthMethodsResponse>>;
+} | {
+    /** Every linked auth method. Empty while loading. */
+    methods: readonly AuthMethodEntry[];
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys: AuthMethodEntry[];
+    /** The account's DID, or `null` while loading. */
+    did: string | null;
+    data: NoInfer<AuthMethodsResponse>;
+    error: null;
+    isError: false;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: true;
+    isPlaceholderData: false;
+    status: "success";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthMethodsResponse>, Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<NoInfer<AuthMethodsResponse>>;
+} | {
+    /** Every linked auth method. Empty while loading. */
+    methods: readonly AuthMethodEntry[];
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys: AuthMethodEntry[];
+    /** The account's DID, or `null` while loading. */
+    did: string | null;
+    data: undefined;
+    error: Error;
+    isError: true;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: true;
+    isRefetchError: false;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "error";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthMethodsResponse>, Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<NoInfer<AuthMethodsResponse>>;
+} | {
+    /** Every linked auth method. Empty while loading. */
+    methods: readonly AuthMethodEntry[];
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys: AuthMethodEntry[];
+    /** The account's DID, or `null` while loading. */
+    did: string | null;
+    data: undefined;
+    error: null;
+    isError: false;
+    isPending: true;
+    isLoading: true;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "pending";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthMethodsResponse>, Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<NoInfer<AuthMethodsResponse>>;
+} | {
+    /** Every linked auth method. Empty while loading. */
+    methods: readonly AuthMethodEntry[];
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys: AuthMethodEntry[];
+    /** The account's DID, or `null` while loading. */
+    did: string | null;
+    data: undefined;
+    error: null;
+    isError: false;
+    isPending: true;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: false;
+    isPlaceholderData: false;
+    status: "pending";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isLoading: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthMethodsResponse>, Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<NoInfer<AuthMethodsResponse>>;
+} | {
+    /** Every linked auth method. Empty while loading. */
+    methods: readonly AuthMethodEntry[];
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys: AuthMethodEntry[];
+    /** The account's DID, or `null` while loading. */
+    did: string | null;
+    data: NoInfer<AuthMethodsResponse>;
+    isError: false;
+    error: null;
+    isPending: false;
+    isLoading: false;
+    isLoadingError: false;
+    isRefetchError: false;
+    isSuccess: true;
+    isPlaceholderData: true;
+    status: "success";
+    dataUpdatedAt: number;
+    errorUpdatedAt: number;
+    failureCount: number;
+    failureReason: Error | null;
+    errorUpdateCount: number;
+    isFetched: boolean;
+    isFetchedAfterMount: boolean;
+    isFetching: boolean;
+    isInitialLoading: boolean;
+    isPaused: boolean;
+    isRefetching: boolean;
+    isStale: boolean;
+    isEnabled: boolean;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthMethodsResponse>, Error>>;
+    fetchStatus: import("@tanstack/query-core").FetchStatus;
+    promise: Promise<NoInfer<AuthMethodsResponse>>;
+};
+//# sourceMappingURL=useAuthMethods.d.ts.map

package/lib/typescript/module/ui/hooks/queries/useAuthMethods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthMethods.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/useAuthMethods.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAO7E;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;IAmB1D,qDAAqD;;IAErD,6EAA6E;;IAE7E,kDAAkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAJlD,qDAAqD;;IAErD,6EAA6E;;IAE7E,kDAAkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAJlD,qDAAqD;;IAErD,6EAA6E;;IAE7E,kDAAkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAJlD,qDAAqD;;IAErD,6EAA6E;;IAE7E,kDAAkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAJlD,qDAAqD;;IAErD,6EAA6E;;IAE7E,kDAAkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAJlD,qDAAqD;;IAErD,6EAA6E;;IAE7E,kDAAkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGrD,CAAC"}

package/lib/typescript/module/ui/types/navigation.d.ts

@@ -41,6 +41,14 @@ export interface OxyProviderProps {
     baseURL?: string;
     authWebUrl?: string;
     authRedirectUri?: string;
+    /**
+     * Authorize endpoint override for silent cross-origin session restore
+     * (web cross-app SSO on cold boot). Defaults to the production Oxy IdP
+     * (`https://auth.oxy.so/authorize`) when unset. Set this from an env var
+     * (e.g. Vite `VITE_OXY_AUTHORIZE_URL`, Expo `EXPO_PUBLIC_OXY_AUTHORIZE_URL`)
+     * so a local/staging deployment targets its own IdP instead of production.
+     */
+    authorizeBaseUrl?: string;
     queryClient?: QueryClient;
     /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
     hubSync?: boolean;

package/lib/typescript/module/ui/types/navigation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAItD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAG9C,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACzC"}
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAItD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAG9C,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACzC"}

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts

@@ -5,11 +5,30 @@ export declare function isCrossOriginRestoreBlocked(): boolean;
 export declare function markCrossOriginRestoreAttempted(): void;
 /** Clear all cross-origin restore loop guards (call on sign-out). */
 export declare function clearCrossOriginRestoreGuards(): void;
+/**
+ * Whether cold boot should attempt silent cross-origin OAuth restore for the
+ * given web origin.
+ *
+ * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
+ * origins participate in cross-app SSO — a random third-party / preview origin
+ * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
+ * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
+ * as official: a developer's local app must never be redirected to a hosted IdP
+ * on cold boot (it signs in through the in-app dialog instead). The central IdP
+ * hub's own origin is excluded to avoid a wasteful self-hop.
+ */
+export declare function isSilentRestoreEligibleOrigin(origin: string): boolean;
 export interface SilentOAuthRestoreOptions {
     oxyServices: OxyServices;
     clientId: string;
     redirectUri?: string;
     scope?: string;
+    /**
+     * Authorize endpoint override (env-configurable per deployment). Defaults to
+     * the production Oxy IdP when unset, so a local/staging app points silent
+     * restore at its OWN IdP instead of production `auth.oxy.so`.
+     */
+    authorizeBaseUrl?: string;
 }
 /**
  * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CA0ClB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CAsBtF"}
+{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAiDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CAsBtF"}

package/lib/typescript/module/webauthn/passkeyClient.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Passkey / WebAuthn ceremony client — clean default (non-web) implementation.
+ *
+ * This is the base module TypeScript resolves for TYPES and any bundler that
+ * does not pick a platform variant. It intentionally imports NOTHING browser-
+ * specific (no `@simplewebauthn/browser`) so it stays safe for Metro, native
+ * builds, and SSR. The real ceremony lives in `passkeyClient.web.ts`; native
+ * passkeys are Commons' job, so there is no WebAuthn ceremony here.
+ *
+ * `isPasskeySupported()` returns `false` (no relying-party origin / no browser
+ * WebAuthn API), and the ceremony helpers throw a clear error so a caller that
+ * skipped the support gate fails loudly instead of silently.
+ */
+/** Always `false` off the web — there is no relying-party origin or WebAuthn API. */
+export declare function isPasskeySupported(): boolean;
+/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
+export declare function runRegistrationCeremony(_optionsJSON: unknown): Promise<unknown>;
+/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
+export declare function runAuthenticationCeremony(_optionsJSON: unknown): Promise<unknown>;
+//# sourceMappingURL=passkeyClient.d.ts.map

package/lib/typescript/module/webauthn/passkeyClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyClient.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,qFAAqF;AACrF,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,uFAAuF;AACvF,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAED,uFAAuF;AACvF,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF"}

package/lib/typescript/module/webauthn/passkeyClient.native.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Passkey / WebAuthn ceremony client — NATIVE implementation.
+ *
+ * React Native has no browser WebAuthn API, and Oxy's native passkey story is
+ * Commons (shared-keychain / QR handoff), NOT `navigator.credentials`. So this
+ * variant imports NOTHING browser-specific and mirrors the clean default:
+ * unsupported, and the ceremony helpers throw if a caller skipped the gate.
+ */
+/** Always `false` on native — there is no browser WebAuthn API. */
+export declare function isPasskeySupported(): boolean;
+/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
+export declare function runRegistrationCeremony(_optionsJSON: unknown): Promise<unknown>;
+/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
+export declare function runAuthenticationCeremony(_optionsJSON: unknown): Promise<unknown>;
+//# sourceMappingURL=passkeyClient.native.d.ts.map

package/lib/typescript/module/webauthn/passkeyClient.native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyClient.native.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.native.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,qFAAqF;AACrF,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAED,qFAAqF;AACrF,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF"}

package/lib/typescript/module/webauthn/passkeyClient.web.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Passkey / WebAuthn ceremony client — WEB implementation.
+ *
+ * The browser half of the passkey flow: it drives `navigator.credentials`
+ * through `@simplewebauthn/browser`, turning the OPAQUE options the server
+ * emitted (`OxyServices.webauthn{Register,Login}Options`) into the opaque
+ * response the matching `verify` endpoint consumes. Oxy never owns those wire
+ * shapes — `@simplewebauthn/browser` does — so options flow in as `unknown` and
+ * the single cast at this boundary hands them to the library's own types.
+ *
+ * This file is selected ONLY on web (react-native-web / Vite RNW): the sibling
+ * `passkeyClient.native.ts` + the clean default `passkeyClient.ts` deliberately
+ * do NOT import `@simplewebauthn/browser` (a browser-only dependency), per the
+ * platform-split rule. Native passkeys are Commons' job — there is no WebAuthn
+ * ceremony off the web.
+ */
+import { type RegistrationResponseJSON, type AuthenticationResponseJSON } from '@simplewebauthn/browser';
+/**
+ * True iff this browser can run a WebAuthn ceremony (exposes the
+ * `PublicKeyCredential` global). Gate all passkey UI/entrypoints on this so an
+ * unsupported browser fails loudly rather than throwing mid-ceremony.
+ */
+export declare function isPasskeySupported(): boolean;
+/**
+ * Run the WebAuthn REGISTRATION ceremony (`navigator.credentials.create`) from
+ * the server's opaque creation options, returning the opaque attestation
+ * response for `OxyServices.webauthnRegisterVerify`.
+ */
+export declare function runRegistrationCeremony(optionsJSON: unknown): Promise<RegistrationResponseJSON>;
+/**
+ * Run the WebAuthn AUTHENTICATION ceremony (`navigator.credentials.get`) from
+ * the server's opaque request options, returning the opaque assertion response
+ * for `OxyServices.webauthnLoginVerify`.
+ */
+export declare function runAuthenticationCeremony(optionsJSON: unknown): Promise<AuthenticationResponseJSON>;
+//# sourceMappingURL=passkeyClient.web.d.ts.map

package/lib/typescript/module/webauthn/passkeyClient.web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeyClient.web.d.ts","sourceRoot":"","sources":["../../../../src/webauthn/passkeyClient.web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAKL,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAEnC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAErC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "21.0.0",
+  "version": "22.0.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -126,15 +126,16 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "0.14.1",
-    "@oxyhq/core": "^11.0.0",
+    "@oxyhq/contracts": "0.15.0",
+    "@oxyhq/core": "^12.0.0",
+    "@simplewebauthn/browser": "^13.3.0",
     "color": "^4.2.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
     "@commitlint/cli": "^17.6.5",
     "@commitlint/config-conventional": "^17.6.5",
-    "@oxyhq/core": "11.0.0",
+    "@oxyhq/core": "12.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@react-native/babel-preset": "^0.86.0",
@@ -175,7 +176,7 @@
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxyhq/bloom": ">=0.16.0",
-    "@oxyhq/core": "^11.0.0",
+    "@oxyhq/core": "^12.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",

package/src/index.ts

@@ -33,7 +33,7 @@ setPlatformOS(Platform.OS as PlatformOS);
 // ---------------------------------------------------------------------------
 export { default as OxyProvider } from './ui/components/OxyProvider';
 export { useOxy } from './ui/context/OxyContext';
-export type { OxyContextState, PasswordSignInResult } from './ui/context/OxyContext';
+export type { OxyContextState } from './ui/context/OxyContext';
 export { useAuth } from './ui/hooks/useAuth';
 export type { AuthState, AuthActions, UseAuthReturn } from './ui/hooks/useAuth';
 
@@ -95,6 +95,7 @@ export {
     useRecentSecurityActivity,
     useInfiniteSecurityActivity,
 } from './ui/hooks/queries/useSecurityQueries';
+export { useAuthMethods } from './ui/hooks/queries/useAuthMethods';
 export {
     useUserSubscription,
     useUserPayments,
@@ -166,6 +167,7 @@ export {
     invalidateStorageQueries,
     invalidatePaymentsQueries,
     invalidateConnectedAppsQueries,
+    invalidateAuthMethodsQueries,
 } from './ui/hooks/queries/queryKeys';
 
 // Mutation status aggregator (for "Syncing..." indicators)