@oxyhq/services 22.12.4 → 22.13.0

package/lib/typescript/commonjs/ui/boot/runProviderColdBoot.d.ts

@@ -1,5 +1,6 @@
-import { type AuthStateStore, type OxyServices } from '@oxyhq/core';
+import { type AuthStateStore, type IdentityBinding, type OxyServices, type SessionMode } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
+import type { WebAuthMode } from '../oauth/types';
 import type { CommitInput } from '../context/oxyContextTypes';
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
 export declare const SESSION_HANDOFF_DEADLINE_MS = 6000;
@@ -26,6 +27,27 @@ export interface RunProviderColdBootOptions {
      * silent-restore redirect targets its own IdP, never production.
      */
     authorizeBaseUrl?: string;
+    /**
+     * Who owns the session this boot resolves. `'account'` (the default) is the
+     * device's active account — every ordinary Oxy app. `'identity'` binds the
+     * boot to the owner of this device's PRIMARY identity key and REQUIRES
+     * {@link identity}; it also disables the two web OAuth lanes below, which
+     * commit whatever account the IdP hands back.
+     */
+    sessionMode?: SessionMode;
+    /** The identity binding required by `sessionMode: 'identity'`. */
+    identity?: IdentityBinding;
+    /**
+     * How this provider's WEB sign-in reaches the IdP
+     * (`OxyProviderProps.webAuthMode`).
+     *
+     * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
+     * the automatic full-page `prompt=none` restore in step 3, so a domain with no
+     * local credential resolves SIGNED OUT instead of bouncing the top-level
+     * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
+     * @default 'redirect'
+     */
+    webAuthMode?: WebAuthMode;
     sessionClient: SessionClient;
     syncDeviceCredentialToHost: () => Promise<void>;
     commitSession: (input: CommitInput, options: {
@@ -40,8 +62,18 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete OAuth authorization-code return (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key)
+ * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
+ *    primary-identity-key lane in `sessionMode: 'identity'`)
  * 3. Silent OAuth for all web apps when mint finds no session
+ *
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
+ *
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 export declare function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void>;
 //# sourceMappingURL=runProviderColdBoot.d.ts.map

package/lib/typescript/commonjs/ui/boot/runProviderColdBoot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IzF"}
+{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+KzF"}

package/lib/typescript/commonjs/ui/client.d.ts

@@ -15,7 +15,6 @@ export { LogoIcon } from './components/logo/LogoIcon';
 export { LogoText } from './components/logo/LogoText';
 export { default as FollowButton } from './components/FollowButton';
 export { default as OxyPayButton } from './components/OxyPayButton';
-export { FontLoader, setupFonts } from './components/FontLoader';
 export { useOxy } from './context/OxyContext';
 export { useAuth } from './hooks/useAuth';
 export type { AuthState, AuthActions, UseAuthReturn } from './hooks/useAuth';

package/lib/typescript/commonjs/ui/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/ui/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/ui/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAG9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}

package/lib/typescript/commonjs/ui/components/OxyAccountDialogScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAccountDialogScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAccountDialogScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAc3D;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAmDrD,CAAC;AA8DF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"OxyAccountDialogScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAccountDialogScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAc3D;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CA+DrD,CAAC;AA+EF,eAAe,sBAAsB,CAAC"}

package/lib/typescript/commonjs/ui/components/OxyAuthChooser.d.ts

@@ -10,35 +10,20 @@
  * cross-origin passkey popup (b2) — same chooser, two hosts, two completion
  * strategies via the `onComplete` prop. Neither host duplicates view logic.
  *
- * Views (from `snapshot.view`):
- *  - `accounts` — the unified `SwitchableAccount[]` list. Tapping a row
- *    switches through `controller.switchTo(accountId)`, the active row is
- *    flagged, and a "+ Add account" row opens the sign-in entry.
- *  - `add` / `signin` — the sign-in entry. On WEB this auto-starts "Sign in
- *    with Oxy" (native shared-keychain silently, else the QR handoff) the
- *    instant the view is entered — the QR is the PRIMARY web surface, not a
- *    button behind a click. On NATIVE it stays button-driven (unchanged):
- *    primary "Sign in with Oxy", secondary "Scan a QR from another device".
- *    Both platforms get a footer entry into `signup`.
- *  - `signup` — account creation. Commons is ALWAYS the priority path (owner
- *    mandate) and leads everywhere it appears: native shows only "Create your
- *    identity in Commons" (or "Get Commons" first, if not installed); web on
- *    a first-party Oxy origin leads with the SAME "Get Commons" CTA, with
- *    inline passkey creation (username + `registerWithPasskey`) offered
- *    UNDERNEATH as the de-emphasized "don't want to install anything"
- *    alternative — never co-equal, never a competing button. Anywhere else (a
- *    non-Oxy web origin, before the b2 hub-relay ships) shows an honest "not
- *    available here yet" message instead of a broken button.
- *  - `qr` — the cross-device Commons handoff, and the PRIMARY web sign-in
- *    surface. On a first-party Oxy origin this ALSO carries a "No Commons?"
- *    passkey link — identity is ONE thing (Commons key or browser passkey,
- *    same Oxy ID), so there is no separate "sign in with a passkey" button
- *    anywhere in this file, but passkey is explicitly the LIGHTWEIGHT
- *    ALTERNATIVE for someone who doesn't want to install Commons, never
- *    co-equal: same small-text-link subordination, same framing, wherever it
- *    appears. Native additionally branches on `commonsAvailability`: when
- *    Commons isn't installed, this leads with a "Get Commons" CTA instead of
- *    a same-device dead-end QR.
+ * This file owns WIRING only: the controller binding, the action handlers, and
+ * which view module renders. Every view lives in `./authChooser/`, one
+ * responsibility each:
+ *
+ *  - `accounts` → `AccountsMenuView` — the signed-in Oxy account menu.
+ *  - `add` / `signin` → `SignInEntryView` — ONE primary action, "Continue with
+ *    Oxy" (issue #691, Phase 5). On WEB this view is transient: the flow
+ *    auto-starts the instant the view is reached, because the request surface
+ *    (a QR on an unknown desktop, "Check Commons on your phone" where Oxy could
+ *    deliver) IS the primary route there, never something behind a second tap.
+ *  - `qr` → `SignInRequestView` — the ACTIVE REQUEST: the route Oxy chose plus
+ *    honest progress derived only from `snapshot.signIn`. Alternatives stay
+ *    behind "Having trouble?" until the chosen route reports `routeFailed`.
+ *  - `signup` → `SignUpView` — account creation, Commons-first.
  *
  * Per-account color re-theming uses Bloom's `APP_COLOR_PRESETS` + `BloomColorScope`
  * (same visual language auth.oxy.so uses). Base theming is `useTheme()` + a
@@ -49,6 +34,13 @@ import type React from 'react';
 export interface OxyAuthChooserProps {
     /** Called after a completed switch, sign-in, or sign-up. */
     onComplete?: () => void;
+    /**
+     * When false, the web sign-in entry does not auto-start a device-flow
+     * session on mount. Use for hosts (e.g. the cross-origin passkey hub) that
+     * already have a pending `authorizeCode` and must not spawn a second one.
+     * @default true
+     */
+    autoStartSignIn?: boolean;
 }
 /**
  * The account switcher + sign-in/sign-up chooser. Mounted by `OxyAccountDialogScreen`

package/lib/typescript/commonjs/ui/components/OxyAuthChooser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAsE/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAqCD;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CA4TjD,CAAC;AAwkCF,eAAe,cAAc,CAAC"}
+{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoC/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CA2UjD,CAAC;AA4BF,eAAe,cAAc,CAAC"}

package/lib/typescript/commonjs/ui/components/OxyConsentScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyConsentScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyConsentScreen.tsx"],"names":[],"mappings":"AA8BA,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAmED,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,IAAI,EACJ,OAAO,EACP,MAAM,EACN,IAAY,EACZ,KAAY,GACb,EAAE,qBAAqB,+BA+KvB;AAoID,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"OxyConsentScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyConsentScreen.tsx"],"names":[],"mappings":"AA8BA,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAgHD,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,IAAI,EACJ,OAAO,EACP,MAAM,EACN,IAAY,EACZ,KAAY,GACb,EAAE,qBAAqB,+BA6KvB;AAoID,eAAe,gBAAgB,CAAC"}

package/lib/typescript/commonjs/ui/components/OxyProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyProvider.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,EAAE,EAAkB,MAAM,OAAO,CAAC;AAI7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgD5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAyOrC,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"OxyProvider.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,EAAE,EAAkB,MAAM,OAAO,CAAC;AAI7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA4C5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CA6OrC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/lib/typescript/commonjs/ui/components/OxySignInButton.d.ts

@@ -3,8 +3,8 @@ import { type ViewStyle, type TextStyle, type StyleProp } from 'react-native';
 /**
  * The OAuth handshake surfaced to a NATIVE third-party RP via
  * {@link OxySignInButtonProps.onOAuthResult} so it can finish the code exchange
- * (`POST /auth/oauth/token`). Web RPs read the same `state` / `code_verifier`
- * back from `sessionStorage` across the redirect and do not need this callback.
+ * (`POST /auth/oauth/token`). Web sign-in is handled entirely by the SDK's web
+ * transport (`useOxy().startWebOAuthSignIn`) and never uses this callback.
  */
 export interface OxyOAuthResult {
     /** Deep-link URL the native auth session returned to (`?code=…&state=…`), or `null` if unobserved. */
@@ -34,8 +34,12 @@ export interface OxySignInButtonProps {
      */
     textStyle?: StyleProp<TextStyle>;
     /**
-     * Custom button text
-     * @default 'Sign in with Oxy'
+     * Overrides the button label. When omitted the button renders the ONE
+     * primary relying-party action, localized: `accountSwitcher.continueWithOxy`
+     * ("Continue with Oxy" in English). "Sign in with Oxy" remains the name of
+     * the MECHANISM — only this surface's label is "Continue with Oxy".
+     *
+     * @default localized `accountSwitcher.continueWithOxy`
      */
     text?: string;
     /**
@@ -51,18 +55,19 @@ export interface OxySignInButtonProps {
     /**
      * Exact registered redirect URI the OAuth authorization code is returned to.
      * REQUIRED only for third-party (`type: 'third_party'`) applications, which
-     * sign in via an OAuth + PKCE redirect to `auth.oxy.so`. First-party /
-     * official apps open the in-app dialog and ignore this prop. If a third-party
-     * app resolves without it, the button logs an error and does nothing (it will
-     * not invent a redirect URI).
+     * sign in via OAuth + PKCE against `auth.oxy.so`. First-party / official apps
+     * open the in-app dialog and ignore this prop. If a third-party app resolves
+     * without it, the button logs an error and does nothing (it will not invent a
+     * redirect URI).
      */
     oauthRedirectUri?: string;
     /**
      * Native only: receives the OAuth handshake after a third-party auth session
-     * so the RP can finish the token exchange. On web the handshake is read back
-     * from `sessionStorage` across the full-page redirect, so this is not used
-     * there. A native third-party sign-in with NO `onOAuthResult` handler cannot
-     * complete (the `state` + `code_verifier` are lost) and logs a warning.
+     * so the RP can finish the token exchange. On web the SDK completes the flow
+     * itself — the popup transport keeps the handshake in memory, and the
+     * redirect transport reads it back from `sessionStorage` — so this is never
+     * called there. A native third-party sign-in with NO `onOAuthResult` handler
+     * cannot complete (the `state` + `code_verifier` are lost) and logs a warning.
      *
      * @example
      * ```tsx

package/lib/typescript/commonjs/ui/components/OxySignInButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxySignInButton.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxySignInButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAY,MAAM,cAAc,CAAC;AAoBxF;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC3B,sGAAsG;IACtG,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;CACxB;AAaD,MAAM,WAAW,oBAAoB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAE9C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAE7B;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAEjC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA8L1D,CAAC;AAEF,eAAe,eAAe,CAAC"}
+{"version":3,"file":"OxySignInButton.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxySignInButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAY,MAAM,cAAc,CAAC;AAoBxF;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC3B,sGAAsG;IACtG,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAE9C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAE7B;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA6O1D,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/AccountsMenuView.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The signed-in Oxy account MENU (`accounts` view) — a Google-account-menu-style
+ * full menu built entirely with NativeWind `className` (the dynamic per-account
+ * accent hex is the one inline style NativeWind cannot express). Structure:
+ *
+ *  - HERO on its own chrome-free block: the current account's large pressable
+ *    avatar (with a camera badge to change the photo), the greeting, the account
+ *    address, and a "Manage your Oxy account" pill.
+ *  - SWITCH ACCOUNT: a disclosure row whose corner animates from pill to card as
+ *    the other switchable accounts + "Add another account" + "Manage accounts on
+ *    this device" reveal beneath it.
+ *  - OXY STORAGE: cloud + used/total + a composition meter + Upgrade / Manage chips.
+ *  - MENU rows: Your data in Oxy · Oxy settings · Help & feedback · Sign out —
+ *    Bloom's grouped section, the same component every other SDK settings surface
+ *    uses, not a local row copy.
+ *  - FOOTER: Privacy Policy · Terms of Service.
+ *
+ * All three blocks share ONE rhythm taken from that grouped section: a 12px
+ * content inset, a 12px gap after the leading element, 16px between blocks, and
+ * a 16px trailing chevron column.
+ *
+ * Collapse state is a plain `useState` toggled in the row's press handler — no
+ * effect hook, no derived-from-props sync.
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot } from '@oxyhq/core';
+import { type AccountStorageModel, type AccountsMenuActions, type OxyAuthChooserHandlers, type Theme, type Translate } from './types';
+interface AccountsMenuViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    handlers: OxyAuthChooserHandlers;
+    storage: AccountStorageModel | null;
+    menu: AccountsMenuActions;
+}
+declare const AccountsMenuView: React.FC<AccountsMenuViewProps>;
+export default AccountsMenuView;
+//# sourceMappingURL=AccountsMenuView.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/AccountsMenuView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountsMenuView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/AccountsMenuView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAkB/B,OAAO,KAAK,EAAE,qBAAqB,EAAqB,MAAM,aAAa,CAAC;AAK5E,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,KAAK,EACV,KAAK,SAAS,EACf,MAAM,SAAS,CAAC;AAsEjB,UAAU,qBAAqB;IAC7B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED,QAAA,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAoXrD,CAAC;AA8DF,eAAe,gBAAgB,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/SignInEntryView.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The sign-in ENTRY (`signin` / `add` views) — ONE primary action.
+ *
+ * Issue #691, Phase 5: the normal experience presents no menu of authentication
+ * methods. The user sees "Continue with Oxy"; Oxy — not the user — then picks
+ * how the request reaches their Commons identity, and the request surface shows
+ * honest progress. Everything else (a QR from another device, a passkey on this
+ * device, getting Commons, creating an account) lives behind "Having trouble?".
+ *
+ * Existing accounts still render ABOVE the CTA: "continue as one of these" is a
+ * choice of WHO, not of HOW, so it is not one of the competing method buttons
+ * the issue removes.
+ *
+ * On web this view is transient — the container auto-starts the flow the instant
+ * the view is reached, because the request surface (QR, or "Check Commons on
+ * your phone") IS the primary route there, never something behind a tap.
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot } from '@oxyhq/core';
+import type { OxyAuthChooserHandlers, SignInAlternatives, Theme, Translate } from './types';
+interface SignInEntryViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    handlers: OxyAuthChooserHandlers;
+    /** The ONE primary action. Starts the flow; Oxy chooses the route from there. */
+    onContinueWithOxy: () => void;
+    alternatives: SignInAlternatives;
+}
+declare const SignInEntryView: React.FC<SignInEntryViewProps>;
+export default SignInEntryView;
+//# sourceMappingURL=SignInEntryView.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/SignInEntryView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInEntryView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/SignInEntryView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE5F,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,QAAA,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA2EnD,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/SignInRequestView.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The ACTIVE REQUEST surface (`qr` view) — the route Oxy chose, plus honest
+ * progress (issue #691, Phase 5).
+ *
+ * The user already performed their one action. From here the surface only
+ * REPORTS: the route-appropriate primary visual (`RequestPrimarySurface`), the
+ * status line derived from the controller's real signals
+ * (`signInProgressLabel`), and nothing else at the same weight. Alternatives
+ * stay behind "Having trouble?" until `signIn.routeFailed` says the chosen route
+ * could not be carried out — the controller never silently cascades, so
+ * revealing them is this view's decision and this view's alone.
+ *
+ * Two surfaces take over when there is no working primary route to report on:
+ *  - a FAILED request, whose reason is toasted by the container (never inline),
+ *    leaves "Try again" as the primary action with the alternatives revealed;
+ *  - a native device with NO Commons installed, where a same-device QR would be
+ *    a dead end. There, "Get Commons" is the genuine primary route — not a
+ *    fallback — so it renders as the one primary action and the QR handoff moves
+ *    behind the disclosure ("I have Commons on another device").
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot } from '@oxyhq/core';
+import type { SignInAlternatives, Theme, Translate } from './types';
+interface SignInRequestViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    /** Restart the request after a failure. */
+    onRetry: () => void;
+    alternatives: SignInAlternatives;
+}
+declare const SignInRequestView: React.FC<SignInRequestViewProps>;
+export default SignInRequestView;
+//# sourceMappingURL=SignInRequestView.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/SignInRequestView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInRequestView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/SignInRequestView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpE,UAAU,sBAAsB;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,QAAA,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAqHvD,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/SignUpView.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Account creation (`signup` view).
+ *
+ * Commons is ALWAYS the priority path (owner mandate) and leads everywhere it
+ * appears: native shows only "Create your identity in Commons" (or "Get Commons"
+ * first, when it is not installed); web on a first-party Oxy origin leads with
+ * the SAME "Get Commons" CTA, with inline passkey creation offered UNDERNEATH as
+ * the de-emphasized "don't want to install anything" alternative — never
+ * co-equal, never a competing button. Anywhere else (a non-Oxy web origin,
+ * before the b2 hub-relay ships) shows an honest "not available here yet"
+ * handoff instead of a broken button.
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot, OxyServices } from '@oxyhq/core';
+import type { PasskeyMode, Theme, Translate } from './types';
+interface SignUpViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    oxyServices: OxyServices;
+    passkeyMode: PasskeyMode;
+    onCreateWithPasskey: (username: string) => void;
+    createPending: boolean;
+    /** Open the auth.oxy.so hub popup (b2) — the 'hub' mode's only path. */
+    onOpenHub: () => void;
+    /** Deep-link into Commons' own identity-creation screen (installed only). */
+    onCreateIdentityInCommons: () => void;
+    /** Open the Commons store listing / landing page for this platform. */
+    onGetCommons: () => void;
+    onBackToSignIn: () => void;
+}
+declare const SignUpView: React.FC<SignUpViewProps>;
+export default SignUpView;
+//# sourceMappingURL=SignUpView.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/SignUpView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignUpView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/SignUpView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItE,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAG7D,UAAU,eAAe;IACvB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,aAAa,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,6EAA6E;IAC7E,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,uEAAuE;IACvE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,QAAA,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAqGzC,CAAC;AA8BF,eAAe,UAAU,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/TroubleDisclosure.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The "Having trouble?" progressive disclosure (issue #691, Phase 5).
+ *
+ * The normal sign-in surface presents ONE primary action. Every alternative —
+ * scanning a QR from another device, a passkey on this device, getting Commons,
+ * creating an account — lives here, hidden until the user asks for it or the
+ * chosen primary route fails.
+ *
+ * Two renderings, deliberately not one controlled component:
+ *  - `revealed` (the primary route failed, or there IS no primary route): the
+ *    alternatives ARE the surface's content now, so they render plainly. There
+ *    is nothing left to hide them behind.
+ *  - otherwise: Bloom's own `Collapsible`, whose trigger is the small
+ *    "Having trouble?" affordance.
+ *
+ * Splitting on `revealed` is what keeps the open state where it belongs — inside
+ * Bloom's uncontrolled disclosure — instead of forcing a hand-rolled controlled
+ * copy of it here.
+ */
+import type React from 'react';
+import type { Theme, Translate } from './types';
+/** One alternative route out of the current surface. Always a subordinate link. */
+export interface TroubleAction {
+    /** Stable identity for the list, and the action's `testID`. */
+    key: string;
+    label: string;
+    onPress: () => void;
+    disabled?: boolean;
+}
+interface TroubleDisclosureProps {
+    actions: TroubleAction[];
+    /**
+     * `true` when the primary route could not be carried out (`signIn.routeFailed`)
+     * or the surface has no working primary at all (a failed request). The
+     * alternatives are shown without asking.
+     */
+    revealed: boolean;
+    theme: Theme;
+    t: Translate;
+}
+declare const TroubleDisclosure: React.FC<TroubleDisclosureProps>;
+export default TroubleDisclosure;
+//# sourceMappingURL=TroubleDisclosure.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/TroubleDisclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TroubleDisclosure.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/TroubleDisclosure.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEhD,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;CACd;AAED,QAAA,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CA8BvD,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/primitives.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The small presentational building blocks shared across the auth chooser's
+ * views. One responsibility each, no controller access, no side effects — they
+ * take props and render.
+ */
+import type React from 'react';
+import { Pressable } from 'react-native';
+import type { SwitchableAccount } from '@oxyhq/core';
+import { type Theme } from './types';
+type HoverPressableProps = Omit<React.ComponentProps<typeof Pressable>, 'className'> & {
+    baseClassName: string;
+    hoverClassName: string;
+};
+/**
+ * A `Pressable` that appends a hover-tint NativeWind token while pointer-hovered.
+ * The Metro web pipeline here does NOT emit NativeWind `hover:` variants, so hover
+ * is driven by RN's cross-platform `onHoverIn`/`onHoverOut` (they fire only on web
+ * via react-native-web; a no-op on native) toggling a plain background token —
+ * the tint stays a NativeWind class, only the trigger is JS.
+ */
+export declare const HoverPressable: React.FC<HoverPressableProps>;
+/**
+ * A SUBORDINATE action: a small centred text link, never a button.
+ *
+ * This is the single visual grammar for everything that is not the surface's one
+ * primary action (issue #691) — the sign-up entry, and every alternative revealed
+ * behind "Having trouble?". Keeping them all on one component is what stops an
+ * alternative from quietly growing into a co-equal button again.
+ */
+export declare const SubtleLink: React.FC<{
+    label: string;
+    theme: Theme;
+    onPress: () => void;
+    disabled?: boolean;
+    testID?: string;
+}>;
+/** A labelled hairline separating two blocks ("or"). */
+export declare const Dividerish: React.FC<{
+    theme: Theme;
+    label: string;
+}>;
+/**
+ * An account row on the sign-in entry — "continue as one of these" rather than a
+ * choice of authentication METHOD, which is why it stays above the primary CTA
+ * instead of behind the trouble disclosure.
+ */
+export declare const AccountRow: React.FC<{
+    account: SwitchableAccount;
+    theme: Theme;
+    switching: boolean;
+    disabled: boolean;
+    onPress: () => void;
+}>;
+export {};
+//# sourceMappingURL=primitives.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/primitives.tsx"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,SAAS,EAAQ,MAAM,cAAc,CAAC;AAK/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAA8B,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAKjE,KAAK,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,SAAS,CAAC,EAAE,WAAW,CAAC,GAAG;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAcxD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAWA,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAMhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;IAChC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAgDA,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/requestSurfaces.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The PRIMARY visual of an active "Sign in with Oxy" request — one surface per
+ * route, chosen by {@link RequestPrimarySurface} from the controller's own facts.
+ *
+ * Each is a leading visual and nothing else: the status sentence underneath is
+ * owned by `signInProgressLabel`, and the alternatives by `TroubleDisclosure`.
+ * That separation is what keeps exactly one primary action on screen (issue
+ * #691) — a surface here can never grow a competing button.
+ *
+ * Anti-phishing: the QR plate encodes `signIn.qrPayload` and renders NOTHING
+ * derived from it. Application identity, origin, and scopes are resolved
+ * server-side by the approver (Commons), never read out of the payload here.
+ */
+import type React from 'react';
+import { MaterialCommunityIcons } from '@expo/vector-icons';
+import type { SignInFlowState } from '@oxyhq/core';
+import type { Theme, Translate } from './types';
+/** The indeterminate leading visual: the request exists but has nothing to show yet. */
+export declare const PreparingSurface: React.FC;
+/** The leading glyph for a route whose surface is elsewhere (the phone, Commons). */
+export declare const RouteGlyph: React.FC<{
+    name: keyof typeof MaterialCommunityIcons.glyphMap;
+    color: string;
+}>;
+/** The cross-device handoff: a headline over the fixed-contrast QR plate. */
+export declare const QrPlate: React.FC<{
+    payload: string;
+    theme: Theme;
+    t: Translate;
+}>;
+/**
+ * The acquisition surface. For someone with no Commons at all this is the
+ * GENUINE primary route, not a fallback — a same-device QR they would have to
+ * scan with the very screen showing it is a dead end — so it renders as the
+ * surface's one primary action.
+ */
+export declare const GetCommonsPrompt: React.FC<{
+    theme: Theme;
+    t: Translate;
+    onGetCommons: () => void;
+}>;
+/**
+ * The one primary visual for the request's current state.
+ *
+ * Ordered most-terminal-first, so a late-arriving route can never pull the
+ * surface back from "confirming" to a QR the user has already scanned. Every
+ * branch reads only controller facts — there is no local timeline.
+ */
+export declare const RequestPrimarySurface: React.FC<{
+    signIn: SignInFlowState;
+    theme: Theme;
+    t: Translate;
+}>;
+//# sourceMappingURL=requestSurfaces.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/requestSurfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestSurfaces.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/requestSurfaces.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAK5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAShD,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAqD,CAAC;AAE3F,qFAAqF;AACrF,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,OAAO,sBAAsB,CAAC,QAAQ,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;CACf,CAEA,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,SAAS,CAAA;CAAE,CAa7E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B,CAcA,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,EAAE,CAAC;IAC3C,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;CACd,CAmBA,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/signInProgress.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The sign-in status line's copy (issue #691, Phase 5).
+ *
+ * One responsibility: map the controller's DERIVED `signIn.progress` — plus the
+ * chosen route, which only disambiguates the generic waiting step — onto a
+ * sentence. Pure and total, with no clock and no state of its own: the line can
+ * therefore only advance when the controller observed a real signal, never on a
+ * timer and never optimistically.
+ *
+ * The ladder the user sees:
+ *
+ *     Preparing request
+ *     Check Commons on your phone
+ *     Opened in Commons
+ *     Confirming identity
+ *     Identity confirmed
+ */
+import type { CommonsDeliveryRoute, SignInProgress } from '@oxyhq/core';
+import type { Translate } from './types';
+/**
+ * The status sentence for the active request, or `null` when there is nothing
+ * honest to say (no live request, or a terminal error — which is toasted, never
+ * rendered inline).
+ */
+export declare function signInProgressLabel(progress: SignInProgress, route: CommonsDeliveryRoute | null, t: Translate): string | null;
+//# sourceMappingURL=signInProgress.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/signInProgress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInProgress.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/signInProgress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,oBAAoB,GAAG,IAAI,EAClC,CAAC,EAAE,SAAS,GACX,MAAM,GAAG,IAAI,CAuBf"}