@oxyhq/services 22.12.4 → 22.13.0

package/lib/typescript/{module/ui/components/oxyAuthChooserStyles.d.ts → commonjs/ui/components/authChooser/styles.d.ts}

@@ -2,6 +2,10 @@
  * Shared styles for `OxyAuthChooser`'s views. Extracted from `OxyAccountDialogScreen`
  * so both the Dialog-wrapped host and any bare host (e.g. a future
  * auth.oxy.so hub page) render identically without duplicating a StyleSheet.
+ *
+ * Only what NativeWind cannot express lives here: the animated collapse, the
+ * fixed-contrast QR plate, per-account accent rings, and the small subordinate
+ * text-link rhythm every view's fallback affordances share.
  */
 export declare const authChooserStyles: {
     rows: {
@@ -187,5 +191,19 @@ export declare const authChooserStyles: {
         borderRadius: number;
         backgroundColor: string;
     };
+    /**
+     * The revealed "Having trouble?" alternatives — a tight stack of subordinate
+     * text links. They share `footerLink`'s rhythm, so the stack itself only has
+     * to stop them drifting apart.
+     */
+    troubleActions: {
+        width: "100%";
+        alignItems: "center";
+    };
+    /** The disclosure trigger, aligned with the subordinate links it reveals. */
+    troubleTrigger: {
+        alignSelf: "center";
+        marginTop: number;
+    };
 };
-//# sourceMappingURL=oxyAuthChooserStyles.d.ts.map
+//# sourceMappingURL=styles.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/styles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/styles.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkC5B;;;;;OAKG;;;;;;;IAOH;;;;;;OAMG;;;;;;;IAOH;;;;;OAKG;;;;;;;;;;IAUH;;;;OAIG;;;;IAIH,0EAA0E;;;;;;;;;;IAU1E;qFACiF;;;;;;;;;;IAUjF,8EAA8E;;;;;IAK9E;;;OAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyEH;;;;OAIG;;;;;IAKH,6EAA6E;;;;;CAK7E,CAAC"}

package/lib/typescript/commonjs/ui/components/authChooser/types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Shared types + per-account color resolution for the auth chooser's views.
+ *
+ * One responsibility: the vocabulary every view module in this folder speaks
+ * (theme/translate aliases, the container-supplied action bundles, and the
+ * account accent). No JSX, no state, no I/O — so a view can import it without
+ * dragging any other view in.
+ */
+import { type AppColorName, type useTheme } from '@oxyhq/bloom/theme';
+import type { useI18n } from '../../hooks/useI18n';
+export type Theme = ReturnType<typeof useTheme>;
+export type Translate = ReturnType<typeof useI18n>['t'];
+/** The account-row actions the container wires for the switcher + menu views. */
+export interface OxyAuthChooserHandlers {
+    onSwitch: (accountId: string) => void;
+    onAdd: () => void;
+    onManage: () => void;
+    /**
+     * Change the current account's photo — opens the avatar-change flow. Because
+     * the account menu lives in the AccountDialog surface, this MORPHS that surface
+     * into `ChangeAvatar` (via `openAvatarPicker` → `openWithinOrPresent`), the same
+     * flow ManageAccount's avatar uses; it never stacks a new dialog.
+     */
+    onEditAvatar: () => void;
+}
+/** Used/total storage bytes for the "Oxy storage" block, or `null` when unknown. */
+export interface AccountStorageModel {
+    usedBytes: number;
+    limitBytes: number;
+}
+/** The account-menu row actions the container wires (deep-links / sheets / sign-out). */
+export interface AccountsMenuActions {
+    onOpenSettings: () => void;
+    onOpenData: () => void;
+    onManageStorage: () => void;
+    onUpgradeStorage: () => void;
+    onHelp: () => void;
+    onPrivacy: () => void;
+    onTerms: () => void;
+    onSignOut: () => void;
+}
+/**
+ * Where a WebAuthn ceremony can run from the current origin.
+ *
+ * A credential minted for `oxy.so` can only be ASSERTED there (or a loopback
+ * dev host) — a hard, browser-enforced RP-ID boundary, not feature detection.
+ * `'direct'` = a first-party Oxy web origin, the ceremony runs here.
+ * `'hub'`    = any other web origin; it runs in the auth.oxy.so popup instead.
+ * `'none'`   = native, where Commons owns identity.
+ */
+export type PasskeyMode = 'direct' | 'hub' | 'none';
+/**
+ * Everything that is NOT the sign-in surface's one primary action.
+ *
+ * The container wires these once; each view decides which of them are genuine
+ * alternatives to ITS primary surface and hands those to `TroubleDisclosure`
+ * (issue #691: fallbacks stay hidden until the user asks or the primary route
+ * fails). A view never renders one of these as a button.
+ */
+export interface SignInAlternatives {
+    /** Whether a WebAuthn ceremony is reachable from this origin at all. */
+    passkeyAvailable: boolean;
+    /**
+     * `true` while a DIRECT ceremony is in flight. The hub-popup variant reports
+     * its progress through `snapshot.signIn` instead, so it never sets this.
+     */
+    passkeyPending: boolean;
+    onSignInWithPasskey: () => void;
+    /** Fall back to the cross-device QR handoff (restarts the request). */
+    onShowQr: () => void;
+    /** Open the Commons store listing / landing page for this platform. */
+    onGetCommons: () => void;
+    /** Enter the account-creation view. */
+    onCreateAccount: () => void;
+}
+/**
+ * Resolve an account's stored color (a named Bloom preset, e.g. `'purple'`) to
+ * a concrete brand hex for the row accent. Falls back to the theme primary when
+ * the account has no color or the value is not a recognized preset, so the accent
+ * renders in EVERY consumer regardless of NativeWind availability.
+ */
+export declare function resolveAccentHex(color: string | null, fallback: string): string;
+/** Narrow a stored color string to a known `AppColorName`, or `undefined`. */
+export declare function toPreset(color: string | null): AppColorName | undefined;
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAsC,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;AAExD,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,IAAI,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,mBAAmB,EAAE,MAAM,IAAI,CAAC;IAChC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,IAAI,CAAC;IACrB,uEAAuE;IACvE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,uCAAuC;IACvC,eAAe,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,8EAA8E;AAC9E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,GAAG,SAAS,CAKvE"}

package/lib/typescript/commonjs/ui/components/authChooser/useUsernameAvailability.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Debounced username-availability check over the existing SDK method.
+ *
+ * One responsibility: turn keystrokes into an `idle | checking | available |
+ * taken` verdict without racing. A sequence guard drops superseded responses,
+ * and a NETWORK failure resets the (now stale) verdict and toasts — it never
+ * paints an inline error inside the dialog (owner mandate).
+ */
+import type { OxyServices } from '@oxyhq/core';
+import type { Translate } from './types';
+export type UsernameStatus = 'idle' | 'checking' | 'available' | 'taken';
+export declare function useUsernameAvailability(oxyServices: OxyServices, t: Translate): {
+    status: UsernameStatus;
+    check: (value: string) => void;
+};
+//# sourceMappingURL=useUsernameAvailability.d.ts.map

package/lib/typescript/commonjs/ui/components/authChooser/useUsernameAvailability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUsernameAvailability.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/useUsernameAvailability.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC;AAOzE,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,EACxB,CAAC,EAAE,SAAS,GACX;IACD,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,CAgCA"}

package/lib/typescript/commonjs/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAiE/B,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EAExB,MAAM,mBAAmB,CAAC;AAY3B,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIlF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAqiCzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAmE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA2E/B,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EAExB,MAAM,mBAAmB,CAAC;AAY3B,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAIlF,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAkuCzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAsE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC"}

package/lib/typescript/commonjs/ui/context/commitSessionFlow.d.ts

@@ -1,4 +1,5 @@
 import type { User } from '@oxyhq/core';
+import type { WebAuthMode } from '../oauth/types';
 export interface CommitDeviceSetAndResolveDeps {
     /**
      * Whether this commit is a deliberate sign-in on THIS device (activates the
@@ -36,4 +37,43 @@ export interface CommitDeviceSetAndResolveDeps {
  * a DETACHED background task a moment later.
  */
 export declare function commitDeviceSetAndResolve(deps: CommitDeviceSetAndResolveDeps): Promise<void>;
+export interface MaybeSyncHubAfterCommitDeps {
+    /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
+    activate: boolean;
+    /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
+    hubSyncRequested: boolean;
+    /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
+    hubSyncEnabled: boolean;
+    /**
+     * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
+     * A first-class input: `'popup'` forbids the redirect outright.
+     */
+    webAuthMode: WebAuthMode;
+    /**
+     * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
+     * navigation was actually started.
+     */
+    syncHub: () => Promise<boolean>;
+}
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+export declare function maybeSyncHubAfterCommit(deps: MaybeSyncHubAfterCommitDeps): Promise<boolean>;
 //# sourceMappingURL=commitSessionFlow.d.ts.map

package/lib/typescript/commonjs/ui/context/commitSessionFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commitSessionFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/commitSessionFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAMxC,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,sCAAsC;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,yEAAyE;IACzE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,gBAAgB,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CA+Ef"}
+{"version":3,"file":"commitSessionFlow.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/commitSessionFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,mBAAmB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,sCAAsC;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,yEAAyE;IACzE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,6EAA6E;IAC7E,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,gBAAgB,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CAkFf;AAED,MAAM,WAAW,2BAA2B;IAC1C,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/lib/typescript/commonjs/ui/context/hooks/useAuthOperations.d.ts

@@ -1,4 +1,4 @@
-import type { ApiError, AuthStateStore, SessionClient, User } from '@oxyhq/core';
+import type { ApiError, AuthStateStore, IdentityBinding, SessionClient, User } from '@oxyhq/core';
 import type { AuthState } from '../../stores/authStore';
 import type { ClientSession } from '@oxyhq/core';
 import type { StorageInterface } from '../../utils/storageHelpers';
@@ -39,6 +39,15 @@ export interface UseAuthOperationsOptions {
     logoutStore: () => void;
     setAuthState: (state: Partial<AuthState>) => void;
     logger?: (message: string, error?: unknown) => void;
+    /**
+     * Identity-bound session (`sessionMode: 'identity'`). When set, a successful
+     * key sign-in writes the durable `{publicKey, accountId}` pin so pinned
+     * re-mints and projections bind immediately instead of waiting for a second
+     * `establishIdentitySession` round-trip.
+     */
+    identityBinding?: IdentityBinding;
+    /** Refreshes the provider's memoised pinned account id after the pin lands. */
+    refreshPinnedAccountId?: () => Promise<string | null>;
 }
 export interface UseAuthOperationsResult {
     /** Sign in with existing public key */
@@ -61,5 +70,5 @@ export declare function clearPersistedAuthSafe(store: AuthStateStore, logger?: (
  * Authentication operations using public key cryptography.
  * Accepts public key as parameter - identity management is handled by the app layer.
  */
-export declare const useAuthOperations: ({ oxyServices, store, activeSessionId, setActiveSessionId, updateSessions, saveActiveSessionId, clearSessionState, switchSession, sessionClient, syncFromClient, onAuthStateChange, onError, loginSuccess, loginFailure, logoutStore, setAuthState, logger, }: UseAuthOperationsOptions) => UseAuthOperationsResult;
+export declare const useAuthOperations: ({ oxyServices, store, activeSessionId, setActiveSessionId, updateSessions, saveActiveSessionId, clearSessionState, switchSession, sessionClient, syncFromClient, onAuthStateChange, onError, loginSuccess, loginFailure, logoutStore, setAuthState, logger, identityBinding, refreshPinnedAccountId, }: UseAuthOperationsOptions) => UseAuthOperationsResult;
 //# sourceMappingURL=useAuthOperations.d.ts.map

package/lib/typescript/commonjs/ui/context/hooks/useAuthOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthOperations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/context/hooks/useAuthOperations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAIvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;;;;OAMG;IACH,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0JAA0J;IAC1J,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,+MAA+M;IAC/M,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAClD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kCAAkC;IAClC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,+BAA+B;IAC/B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAMD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAClD,IAAI,CAIN;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,+PAkB/B,wBAAwB,KAAG,uBAqR7B,CAAC"}
+{"version":3,"file":"useAuthOperations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/context/hooks/useAuthOperations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAIvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;;;;OAMG;IACH,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0JAA0J;IAC1J,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,+MAA+M;IAC/M,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAClD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,+EAA+E;IAC/E,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kCAAkC;IAClC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,+BAA+B;IAC/B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAMD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAClD,IAAI,CAIN;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,wSAoB/B,wBAAwB,KAAG,uBAmS7B,CAAC"}

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts

@@ -1,8 +1,10 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient } from '@oxyhq/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode } from '@oxyhq/core';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
+import type { StartWebOAuthSignInOptions } from '../oauth/browserAuthTransport';
+import type { WebAuthMode, WebOAuthSignInResult } from '../oauth/types';
 export interface OxyContextState {
     user: User | null;
     sessions: ClientSession[];
@@ -25,6 +27,19 @@ export interface OxyContextState {
      */
     isAuthResolved: boolean;
     isStorageReady: boolean;
+    /**
+     * Who owns this provider's session (see `OxyProviderProps.sessionMode`).
+     *
+     * `'account'` — the device's active account; any app on the device can switch
+     * it and this client follows. `'identity'` — the owner of the local primary
+     * identity key, permanently: a sibling app's account switch never changes this
+     * client's user or bearer, and every account-graph mutation
+     * (`switchToAccount` / `switchSession`) rejects with `IdentityBoundSessionError`
+     * while `accounts` stays empty and the account dialog never opens.
+     */
+    sessionMode: SessionMode;
+    /** How web third-party sign-in reaches the IdP (see `OxyProviderProps.webAuthMode`). */
+    webAuthMode: WebAuthMode;
     error: string | null;
     /** Active UI locale (`language-REGION`): the account's primary locale when signed in, else the guest/device locale. */
     currentLanguage: string;
@@ -75,6 +90,23 @@ export interface OxyContextState {
     removePasskey: (credentialId: string) => Promise<void>;
     revokeSuspiciousSignIn: () => Promise<void>;
     handleWebSession: (session: SessionLoginResponse) => Promise<void>;
+    /**
+     * Run a WEB third-party OAuth sign-in (authorization code + PKCE) end to end
+     * using this provider's `webAuthMode`, and commit the resulting session.
+     *
+     * This is the shared operation `OxySignInButton` delegates to; RPs that ship
+     * their own button call it directly and never implement popup listeners, a
+     * token exchange, or `state` validation themselves. Returns a typed result —
+     * closing the popup and running out of time are values, not exceptions.
+     *
+     * In popup mode the window MUST be opened during the user's click: either
+     * call this synchronously from the press handler (it opens one itself), or
+     * call `openOAuthPopup()` there and pass the handle as `popup`.
+     *
+     * No-op outside a browser and in `sessionMode: 'identity'`, both of which
+     * resolve to `{ status: 'unsupported' }`.
+     */
+    startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
     logout: (targetSessionId?: string) => Promise<void>;
     logoutAll: () => Promise<void>;
     switchSession: (sessionId: string) => Promise<User>;
@@ -127,6 +159,17 @@ export interface OxyContextProviderProps {
     authorizeBaseUrl?: string;
     storageKeyPrefix?: string;
     clientId?: string;
+    /**
+     * Who owns this provider's session. See `OxyProviderProps.sessionMode` for the
+     * full contract.
+     * @default 'account'
+     */
+    sessionMode?: SessionMode;
+    /**
+     * Transport for WEB third-party sign-in. See `OxyProviderProps.webAuthMode`.
+     * @default 'redirect'
+     */
+    webAuthMode?: WebAuthMode;
     /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
     hubSync?: boolean;
     onAuthStateChange?: (user: User | null) => void;

package/lib/typescript/commonjs/ui/context/oxyContextTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oxyContextTypes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/oxyContextTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChM,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uHAAuH;IACvH,eAAe,EAAE,MAAM,CAAC;IACxB,4GAA4G;IAC5G,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAElC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;OAGG;IACH,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;OAIG;IACH,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,6FAA6F;IAC7F,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAE7B,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAE/B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D"}
+{"version":3,"file":"oxyContextTypes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/oxyContextTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7M,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,wFAAwF;IACxF,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uHAAuH;IACvH,eAAe,EAAE,MAAM,CAAC;IACxB,4GAA4G;IAC5G,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAElC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;OAGG;IACH,mBAAmB,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;OAIG;IACH,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE5F,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,6FAA6F;IAC7F,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAE7B,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAE/B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D"}

package/lib/typescript/commonjs/ui/context/useOxyAccountGraph.d.ts

@@ -6,6 +6,12 @@ interface UseOxyAccountGraphParams {
     isAuthenticated: boolean;
     tokenReady: boolean;
     initialized: boolean;
+    /**
+     * `sessionMode: 'identity'`. The account graph is a switcher surface, and an
+     * identity-bound client authenticates as the owner of the local identity key —
+     * permanently. The graph is therefore never fetched and every switch rejects.
+     */
+    identityBound: boolean;
     oxyServices: OxyServices;
     sessionClient: SessionClient;
     syncFromClient: () => Promise<void>;
@@ -17,7 +23,7 @@ interface UseOxyAccountGraphParams {
     accountDialogControllerRef: RefObject<AccountDialogController | null>;
     clearSessionStateRef: RefObject<() => Promise<void>>;
 }
-export declare function useOxyAccountGraph({ isAuthenticated, tokenReady, initialized, oxyServices, sessionClient, syncFromClient, commitSession, queryClient, accountDialogControllerRef, clearSessionStateRef, }: UseOxyAccountGraphParams): {
+export declare function useOxyAccountGraph({ isAuthenticated, tokenReady, initialized, identityBound, oxyServices, sessionClient, syncFromClient, commitSession, queryClient, accountDialogControllerRef, clearSessionStateRef, }: UseOxyAccountGraphParams): {
     accounts: AccountNode[];
     refreshAccounts: () => Promise<void>;
     switchToAccount: (accountId: string) => Promise<void>;

package/lib/typescript/commonjs/ui/context/useOxyAccountGraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useOxyAccountGraph.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/useOxyAccountGraph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMxH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,UAAU,wBAAwB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxG,WAAW,EAAE,WAAW,CAAC;IACzB,0BAA0B,EAAE,SAAS,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACtE,oBAAoB,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtD;AAED,wBAAgB,kBAAkB,CAAC,EACjC,eAAe,EACf,UAAU,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,EACX,0BAA0B,EAC1B,oBAAoB,GACrB,EAAE,wBAAwB;;2BAGqB,OAAO,CAAC,IAAI,CAAC;iCAsCvC,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;0BAiC3B,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;EAczD"}
+{"version":3,"file":"useOxyAccountGraph.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/useOxyAccountGraph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAOxH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,UAAU,wBAAwB;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxG,WAAW,EAAE,WAAW,CAAC;IACzB,0BAA0B,EAAE,SAAS,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACtE,oBAAoB,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtD;AAED,wBAAgB,kBAAkB,CAAC,EACjC,eAAe,EACf,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,EACX,0BAA0B,EAC1B,oBAAoB,GACrB,EAAE,wBAAwB;;2BAGqB,OAAO,CAAC,IAAI,CAAC;iCAsCvC,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;0BAuC3B,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;EAczD"}

package/lib/typescript/commonjs/ui/hooks/useSwitchableAccounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSwitchableAccounts.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSwitchableAccounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAG5E,MAAM,WAAW,2BAA2B;IACxC,0EAA0E;IAC1E,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,2BAA2B,CAuBnE"}
+{"version":3,"file":"useSwitchableAccounts.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSwitchableAccounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAG5E,MAAM,WAAW,2BAA2B;IACxC,0EAA0E;IAC1E,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AA4BD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,2BAA2B,CAuBnE"}

package/lib/typescript/commonjs/ui/index.d.ts

@@ -21,7 +21,6 @@ export { RequireOxyAuth } from './components/RequireOxyAuth';
 export type { RequireOxyAuthProps, RequireOxyAuthPrompt } from './components/RequireOxyAuth';
 export { default as FollowButton } from './components/FollowButton';
 export { default as OxyPayButton } from './components/OxyPayButton';
-export { FontLoader, setupFonts } from './components/FontLoader';
 export { default as ProfileButton } from './components/ProfileButton';
 export { useOxy } from './context/OxyContext';
 export { useAuth } from './hooks/useAuth';

package/lib/typescript/commonjs/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGtE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGtE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}

package/lib/typescript/commonjs/ui/oauth/browserAuthTransport.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The single web entry point for third-party "Sign in with Oxy".
+ *
+ * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
+ * result — so callers (`OxySignInButton`, and any RP with its own button) never
+ * touch `window.open`, `postMessage`, or the token exchange themselves.
+ *
+ * Popup mode keeps the relying party mounted: its route, scroll position, and
+ * unsaved state survive because the tab never navigates. Redirect mode is the
+ * compatibility fallback, and is also where popup mode lands when the browser
+ * blocks the window — a blocked popup must still sign the user in, not dead-end.
+ *
+ * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
+ * remains the native lane and is untouched by this module.
+ */
+import type { OxyServices } from '@oxyhq/core';
+import type { OAuthPopupHandle, OAuthSessionCommitInput, WebAuthMode, WebOAuthSignInResult } from './types';
+/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
+export interface WebOAuthTransportContext {
+    /** The provider's `webAuthMode`. */
+    mode: WebAuthMode;
+    oxyServices: OxyServices;
+    /** The app's registered client id; `null` disables third-party sign-in. */
+    clientId: string | null;
+    /** Authorize endpoint override (local/staging deployments). */
+    authorizeBaseUrl?: string;
+    /** `sessionMode: 'identity'` — no third-party OAuth lane exists by design. */
+    identityBound: boolean;
+    /** The provider's session commit funnel. */
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+}
+/** Per-press inputs for {@link startWebOAuthSignIn}. */
+export interface StartWebOAuthSignInOptions {
+    /** EXACT registered redirect URI for this application. */
+    redirectUri: string;
+    /**
+     * The popup to drive, when the caller already opened one.
+     *
+     * - omitted — this call opens the window itself, which is only valid when it
+     *   was invoked SYNCHRONOUSLY from the user's click (gesture attribution);
+     * - `null` — the caller tried and the browser blocked it: fall back to a
+     *   full-page redirect;
+     * - a handle — use exactly this window.
+     *
+     * Callers that must `await` before signing in (resolving the application, for
+     * instance) have to open the window in their press handler and pass it here;
+     * a window opened after an `await` is silently blocked by every browser.
+     */
+    popup?: OAuthPopupHandle | null;
+    /** Requested scope; defaults to the SDK's standard sign-in scope. */
+    scope?: string;
+    /** Popup timeout override (ms). */
+    timeoutMs?: number;
+}
+export declare function startWebOAuthSignIn(context: WebOAuthTransportContext, options: StartWebOAuthSignInOptions): Promise<WebOAuthSignInResult>;
+//# sourceMappingURL=browserAuthTransport.d.ts.map

package/lib/typescript/commonjs/ui/oauth/browserAuthTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browserAuthTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/browserAuthTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EAEX,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAEjB,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wDAAwD;AACxD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAsF/B"}

package/lib/typescript/commonjs/ui/oauth/completeOAuthCode.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+import type { OxyServices } from '@oxyhq/core';
+import type { OAuthCompletionResult, OAuthHandshake, OAuthSessionCommitInput } from './types';
+/** Inputs for {@link completeOAuthCode}. */
+export interface CompleteOAuthCodeInput {
+    oxyServices: OxyServices;
+    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
+    clientId: string;
+    /** The single-use authorization code the IdP issued. */
+    code: string;
+    /** The `state` the IdP returned, or `null` when it sent none. */
+    returnedState: string | null;
+    /**
+     * The handshake this RP started the authorize request with, or `null` when it
+     * is gone (never stored, expired, or a different tab's). A missing handshake
+     * is treated exactly like a mismatched `state`: no exchange is attempted.
+     */
+    handshake: OAuthHandshake | null;
+    /** EXACT redirect URI sent on the authorize request — OAuth requires a match. */
+    redirectUri: string;
+    /** The provider's session commit funnel. */
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
+    /**
+     * Transport-specific teardown, invoked once after the exchange settles and
+     * before the commit. The redirect lane strips `?code=` and clears the
+     * persisted handshake; the popup lane has nothing persisted and omits it.
+     */
+    cleanup?: () => void;
+}
+export declare function completeOAuthCode(input: CompleteOAuthCodeInput): Promise<OAuthCompletionResult>;
+//# sourceMappingURL=completeOAuthCode.d.ts.map

package/lib/typescript/commonjs/ui/oauth/completeOAuthCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completeOAuthCode.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/completeOAuthCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAE9F,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+import type { WebAuthMode } from './types';
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+export declare function allowsAutomaticIdpRedirect(webAuthMode: WebAuthMode): boolean;
+//# sourceMappingURL=legacyRedirectLanes.d.ts.map

package/lib/typescript/commonjs/ui/oauth/legacyRedirectLanes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyRedirectLanes.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/legacyRedirectLanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAE5E"}

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+import type { OAuthHandshake } from './types';
+/** Inputs for {@link prepareAuthorizeRequest}. */
+export interface PrepareAuthorizeRequestParams {
+    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
+    clientId: string;
+    /** EXACT registered redirect URI. The token exchange must replay this value. */
+    redirectUri: string;
+    /** Authorize endpoint override; defaults to the production Oxy IdP. */
+    authorizeBaseUrl?: string;
+    /** Requested scope; defaults to the SDK's standard sign-in scope. */
+    scope?: string;
+    /**
+     * Ask the IdP to deliver the result to `window.opener` via `postMessage`
+     * instead of redirecting. Set ONLY by the popup transport. It is a request,
+     * not a guarantee — an IdP with no opener still redirects.
+     */
+    responseMode?: 'web_message';
+}
+/** A ready-to-use authorize request plus the secrets that finish it. */
+export interface PreparedAuthorizeRequest {
+    /** Fully-built `auth.oxy.so/authorize` URL. */
+    authorizeUrl: string;
+    /**
+     * Exact origin of {@link authorizeUrl}. The popup transport accepts
+     * `postMessage` from this origin and no other.
+     */
+    authorizeOrigin: string;
+    /** The `state` + PKCE verifier this request is bound to. */
+    handshake: OAuthHandshake;
+}
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+export declare function prepareAuthorizeRequest(params: PrepareAuthorizeRequestParams): Promise<PreparedAuthorizeRequest>;
+//# sourceMappingURL=oauthHandshake.d.ts.map

package/lib/typescript/commonjs/ui/oauth/oauthHandshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthHandshake.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthHandshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAkBnC"}