@oxyhq/services 22.12.4 → 22.13.0

package/lib/typescript/commonjs/ui/utils/deliveryPlatform.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Classify the surface a "Sign in with Oxy" request is initiated from, for
+ * `AccountDialogController`'s `platform` option (issue #691, Phase 4/5).
+ *
+ * `@oxyhq/core` deliberately refuses to do this itself — it never touches a
+ * platform global — so the consumer that OWNS the environment classifies it and
+ * hands the verdict in. The verdict feeds `selectCommonsDelivery`, where it
+ * decides one thing only: whether this device may take the `'open-commons'`
+ * deep-link route. Getting it wrong in the "mobile" direction is the costly
+ * error (a custom-scheme navigation that does not resolve is a dead end with no
+ * automatic way back), so every ambiguous signal resolves AWAY from `'mobile'`.
+ *
+ * No user-agent string is parsed. The two signals used are declarative and
+ * standardized:
+ *   1. `navigator.userAgentData.mobile` — the User-Agent Client Hints boolean.
+ *      Authoritative where implemented (Chromium), in both directions.
+ *   2. The PRIMARY pointer (`(pointer: coarse)`) plus a touch digitizer.
+ *      A phone/tablet reports a coarse primary pointer; a touchscreen laptop
+ *      still reports its mouse as primary, so it is not misclassified.
+ */
+import type { CommonsDeliveryPlatform } from '@oxyhq/core';
+/**
+ * Which surface this app is running on, as `selectCommonsDelivery` models it.
+ *
+ *  - Native (Expo/RN) is always `'mobile'`: it is an Oxy app installed on a
+ *    phone/tablet, exactly the case where a verified Commons link can resolve
+ *    on this very device.
+ *  - A web browser is classified from the signals above.
+ *  - Anything else — a browser-like environment with neither signal — is
+ *    `'unknown'`, a first-class value that never opts into the deep link.
+ */
+export declare function resolveDeliveryPlatform(): CommonsDeliveryPlatform;
+//# sourceMappingURL=deliveryPlatform.d.ts.map

package/lib/typescript/commonjs/ui/utils/deliveryPlatform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveryPlatform.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/deliveryPlatform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAiB3D;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,uBAAuB,CAgBjE"}

package/lib/typescript/commonjs/ui/utils/oauthReturn.d.ts

@@ -1,27 +1,41 @@
 import type { OxyServices } from '@oxyhq/core';
-export interface OAuthReturnCommitInput {
-    sessionId: string;
-    accessToken?: string;
-    deviceId?: string;
-    deviceSecret?: string;
-    userId: string;
-    expiresAt?: string;
-    user?: {
-        id: string;
-        username?: string;
-        avatar?: string;
-    };
-}
+import type { OAuthSessionCommitInput } from '../oauth/types';
 /**
- * When the RP lands with `?code=` after password sign-in at auth.oxy.so, exchange
- * the code for a device-first session before cold boot runs.
+ * When the RP lands with `?code=` after signing in at auth.oxy.so, exchange the
+ * code for a device-first session before cold boot runs.
+ *
+ * This is the REDIRECT transport's return leg. It owns only what is specific to
+ * a full-page round trip — reading the code off the URL, recovering the
+ * handshake `sessionStorage` carried across the navigation, and cleaning both up
+ * afterwards — and delegates state validation, the PKCE exchange, and the
+ * session commit to `completeOAuthCode`, the same function the popup transport
+ * runs.
  */
 export declare function tryCompleteOAuthReturn(opts: {
     oxyServices: OxyServices;
     clientId?: string | null;
     authRedirectUri?: string;
-    commitSession: (input: OAuthReturnCommitInput) => Promise<void>;
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
 }): Promise<boolean>;
+/**
+ * Rewrite the address bar after an authorize round trip, and tell the router.
+ *
+ * Prefers the page the visit started on (see `persistOAuthReturnPath`) over the
+ * bare origin the IdP redirected to, falling back to `fallbackUrl` when nothing
+ * was recorded.
+ *
+ * The `popstate` dispatch is the load-bearing part. `history.replaceState`
+ * fires no event, and cold boot runs *inside* the mounted app — by the time
+ * this executes, a history-based router (React Router, Vue Router, …) has
+ * already read `location` and rendered the route for `/`. Without a
+ * notification the address bar would show the restored deep link while the page
+ * still displayed the home page. `popstate` is the event the History API
+ * defines for exactly this, and it is what those routers subscribe to.
+ *
+ * Only dispatched when the URL actually changed, so the common no-op case does
+ * not push a spurious event at every listener on the page.
+ */
+export declare function replaceUrlAfterOAuthReturn(fallbackUrl: string): void;
 /**
  * When auth.oxy.so hub-sync redeem fails, the IdP redirects back with
  * `?hub_sync=failed`. Strip the param and log so cold boot can continue

package/lib/typescript/commonjs/ui/utils/oauthReturn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthReturn.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/oauthReturn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAU/C,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE,GAAG,OAAO,CAAC,OAAO,CAAC,CA8DnB;AAuBD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAmB/C"}
+{"version":3,"file":"oauthReturn.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/oauthReturn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE,GAAG,OAAO,CAAC,OAAO,CAAC,CA6CnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAuBpE;AAeD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAgB/C"}

package/lib/typescript/module/index.d.ts

@@ -25,7 +25,7 @@ export { useOxy } from './ui/context/OxyContext.js';
 export type { OxyContextState } from './ui/context/OxyContext.js';
 export { useAuth } from './ui/hooks/useAuth.js';
 export type { AuthState, AuthActions, UseAuthReturn } from './ui/hooks/useAuth.js';
-export { FontLoader, setupFonts } from './ui/components/FontLoader';
+export { IdentityBoundSessionError } from './ui/session/identityBinding.js';
 export { useAuthStore } from './ui/stores/authStore.js';
 export { useAccountStore } from './ui/stores/accountStore.js';
 export { useAssetStore, useAssets as useAssetsStore, useAsset, useUploadProgress, useAssetLoading, useAssetErrors, useAssetsByApp, useAssetsByEntity, useAssetUsageCount, useIsAssetLinked, } from './ui/stores/assetStore.js';
@@ -59,6 +59,9 @@ export type { ViewMode, SortBy, SortOrder } from './ui/hooks/useFileFiltering.js
 export { OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, } from '@oxyhq/core';
 export { default as OxySignInButton } from './ui/components/OxySignInButton.js';
 export type { OxySignInButtonProps, OxyOAuthResult } from './ui/components/OxySignInButton.js';
+export { openOAuthPopup } from './ui/oauth/oauthPopup.js';
+export type { StartWebOAuthSignInOptions } from './ui/oauth/browserAuthTransport.js';
+export type { WebAuthMode, WebOAuthSignInResult, WebOAuthRedirectReason, WebOAuthFailureReason, WebOAuthUnsupportedReason, OAuthPopupHandle, } from './ui/oauth/types.js';
 export { OxyAuthPrompt } from './ui/components/OxyAuthPrompt.js';
 export type { OxyAuthPromptProps } from './ui/components/OxyAuthPrompt.js';
 export { OxyOAuthCallback } from './ui/components/OxyOAuthCallback.js';

package/lib/typescript/module/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gCAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAAyB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,4BAAyB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAoB,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAoB,CAAC;AAKhF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAKpE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA0B,CAAC;AAC3D,OAAO,EACH,aAAa,EACb,SAAS,IAAI,cAAc,EAC3B,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,2BAAwB,CAAC;AAKhC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,yBAAsB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAA+B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yBAAsB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,0BAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAKjF,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,yCAAsC,CAAC;AAC9C,OAAO,EACH,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,sBAAsB,GACzB,MAAM,0CAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,0CAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAmC,CAAC;AACnE,OAAO,EACH,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,yBAAyB,GAC5B,MAAM,yCAAsC,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,GAC7B,MAAM,oCAAiC,CAAC;AAKzC,OAAO,EACH,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,GAChB,MAAM,6CAA0C,CAAC;AAClD,OAAO,EACH,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAClB,MAAM,8CAA2C,CAAC;AACnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,yCAAsC,CAAC;AAC9C,YAAY,EACR,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,yCAAsC,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAmC,CAAC;AAQjE,OAAO,EACH,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC/B,MAAM,iCAA8B,CAAC;AAOtC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAA8B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,iCAA8B,CAAC;AAGlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAAwB,CAAC;AAKrD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,6BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA0B,CAAC;AAKvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAA6B,CAAC;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAA6B,CAAC;AAK/E,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oCAAiC,CAAC;AAC7E,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,oCAAiC,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,kCAA+B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAA+B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAkC,CAAC;AACpE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qCAAkC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAkC,CAAC;AACpE,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,GACf,MAAM,qCAAkC,CAAC;AAO1C,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAgC,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mCAAgC,CAAC;AAEhG,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iCAA8B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAA8B,CAAC;AACvH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iCAA8B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAA+B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAA+B,CAAC;AAKzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,kCAA+B,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAA+B,CAAC;AAOxE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAgC,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAgC,CAAC;AAQ1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAkC,CAAC;AACzE,YAAY,EAAE,2BAA2B,EAAE,MAAM,qCAAkC,CAAC;AAGpF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA4B,CAAC;AACtE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,mCAAgC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAGlF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,sCAAmC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,uCAAoC,CAAC;AAKtF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uCAAoC,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,MAAM,2BAAwB,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,wCAAqC,CAAC;AAMzG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,yCAAsC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gCAA6B,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAAyB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,4BAAyB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAoB,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAoB,CAAC;AAIhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAA8B,CAAC;AAKzE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA0B,CAAC;AAC3D,OAAO,EACH,aAAa,EACb,SAAS,IAAI,cAAc,EAC3B,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,2BAAwB,CAAC;AAKhC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,yBAAsB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAA+B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yBAAsB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,0BAAuB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAKjF,OAAO,EACH,cAAc,EACd,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,GACnB,MAAM,yCAAsC,CAAC;AAC9C,OAAO,EACH,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,sBAAsB,GACzB,MAAM,0CAAuC,CAAC;AAC/C,OAAO,EACH,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,0CAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAmC,CAAC;AACnE,OAAO,EACH,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,yBAAyB,GAC5B,MAAM,yCAAsC,CAAC;AAG9C,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,GAC7B,MAAM,oCAAiC,CAAC;AAKzC,OAAO,EACH,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,GAChB,MAAM,6CAA0C,CAAC;AAClD,OAAO,EACH,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,eAAe,GAClB,MAAM,8CAA2C,CAAC;AACnD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,yCAAsC,CAAC;AAC9C,YAAY,EACR,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,yCAAsC,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAmC,CAAC;AAQjE,OAAO,EACH,SAAS,EACT,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC/B,MAAM,iCAA8B,CAAC;AAOtC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iCAA8B,CAAC;AACnF,YAAY,EAAE,aAAa,EAAE,MAAM,iCAA8B,CAAC;AAGlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAA8B,CAAC;AACjE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAAwB,CAAC;AAKrD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,6BAA0B,CAAC;AAClC,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA0B,CAAC;AAKvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAA6B,CAAC;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAA6B,CAAC;AAK/E,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,oCAAiC,CAAC;AAC7E,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,oCAAiC,CAAC;AAM5F,OAAO,EAAE,cAAc,EAAE,MAAM,0BAAuB,CAAC;AACvD,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAiC,CAAC;AAClF,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,GACjB,MAAM,qBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,kCAA+B,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAA+B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAkC,CAAC;AACpE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qCAAkC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAkC,CAAC;AACpE,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,GACf,MAAM,qCAAkC,CAAC;AAO1C,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAgC,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mCAAgC,CAAC;AAEhG,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iCAA8B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAA8B,CAAC;AACvH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,iCAA8B,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAA+B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAA+B,CAAC;AAKzD,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,kCAA+B,CAAC;AACzE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAA+B,CAAC;AAOxE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,mCAAgC,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAgC,CAAC;AAQ1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAkC,CAAC;AACzE,YAAY,EAAE,2BAA2B,EAAE,MAAM,qCAAkC,CAAC;AAGpF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA4B,CAAC;AACtE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,mCAAgC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAGlF,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,qCAAkC,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,sCAAmC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,uCAAoC,CAAC;AAKtF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uCAAoC,CAAC;AACvF,YAAY,EAAE,SAAS,EAAE,MAAM,2BAAwB,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,wCAAqC,CAAC;AAMzG,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,yCAAsC,CAAC"}

package/lib/typescript/module/ui/boot/runProviderColdBoot.d.ts

@@ -1,5 +1,6 @@
-import { type AuthStateStore, type OxyServices } from '@oxyhq/core';
+import { type AuthStateStore, type IdentityBinding, type OxyServices, type SessionMode } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
+import type { WebAuthMode } from '../oauth/types.js';
 import type { CommitInput } from '../context/oxyContextTypes.js';
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
 export declare const SESSION_HANDOFF_DEADLINE_MS = 6000;
@@ -26,6 +27,27 @@ export interface RunProviderColdBootOptions {
      * silent-restore redirect targets its own IdP, never production.
      */
     authorizeBaseUrl?: string;
+    /**
+     * Who owns the session this boot resolves. `'account'` (the default) is the
+     * device's active account — every ordinary Oxy app. `'identity'` binds the
+     * boot to the owner of this device's PRIMARY identity key and REQUIRES
+     * {@link identity}; it also disables the two web OAuth lanes below, which
+     * commit whatever account the IdP hands back.
+     */
+    sessionMode?: SessionMode;
+    /** The identity binding required by `sessionMode: 'identity'`. */
+    identity?: IdentityBinding;
+    /**
+     * How this provider's WEB sign-in reaches the IdP
+     * (`OxyProviderProps.webAuthMode`).
+     *
+     * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
+     * the automatic full-page `prompt=none` restore in step 3, so a domain with no
+     * local credential resolves SIGNED OUT instead of bouncing the top-level
+     * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
+     * @default 'redirect'
+     */
+    webAuthMode?: WebAuthMode;
     sessionClient: SessionClient;
     syncDeviceCredentialToHost: () => Promise<void>;
     commitSession: (input: CommitInput, options: {
@@ -40,8 +62,18 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete OAuth authorization-code return (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key)
+ * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
+ *    primary-identity-key lane in `sessionMode: 'identity'`)
  * 3. Silent OAuth for all web apps when mint finds no session
+ *
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
+ *
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 export declare function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void>;
 //# sourceMappingURL=runProviderColdBoot.d.ts.map

package/lib/typescript/module/ui/boot/runProviderColdBoot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IzF"}
+{"version":3,"file":"runProviderColdBoot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/boot/runProviderColdBoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA4B,CAAC;AAE9D,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AA0CpD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,0BAA0B,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,EAAE,CACb,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+KzF"}

package/lib/typescript/module/ui/client.d.ts

@@ -15,7 +15,6 @@ export { LogoIcon } from './components/logo/LogoIcon.js';
 export { LogoText } from './components/logo/LogoText.js';
 export { default as FollowButton } from './components/FollowButton.js';
 export { default as OxyPayButton } from './components/OxyPayButton.js';
-export { FontLoader, setupFonts } from './components/FontLoader';
 export { useOxy } from './context/OxyContext.js';
 export { useAuth } from './hooks/useAuth.js';
 export type { AuthState, AuthActions, UseAuthReturn } from './hooks/useAuth.js';

package/lib/typescript/module/ui/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/ui/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA0B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,iCAA8B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA4B,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA4B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA4B,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGjE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAsB,CAAC;AAG9C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAiB,CAAC;AAC1C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAoB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAoB,CAAC;AAG9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAA+B,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAAuB,CAAC;AAGxD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/ui/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,6BAA0B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,iCAA8B,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,+BAA4B,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA4B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA4B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA4B,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA2B,CAAC;AACpE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,8BAA2B,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAsB,CAAC;AAG9C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAiB,CAAC;AAC1C,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAoB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAoB,CAAC;AAG9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,4BAAyB,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,kCAA+B,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAAuB,CAAC;AAGxD,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}

package/lib/typescript/module/ui/components/OxyAccountDialogScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAccountDialogScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAccountDialogScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAc3D;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAmDrD,CAAC;AA8DF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"OxyAccountDialogScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAccountDialogScreen.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAqB,CAAC;AAc3D;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CA+DrD,CAAC;AA+EF,eAAe,sBAAsB,CAAC"}

package/lib/typescript/module/ui/components/OxyAuthChooser.d.ts

@@ -10,35 +10,20 @@
  * cross-origin passkey popup (b2) — same chooser, two hosts, two completion
  * strategies via the `onComplete` prop. Neither host duplicates view logic.
  *
- * Views (from `snapshot.view`):
- *  - `accounts` — the unified `SwitchableAccount[]` list. Tapping a row
- *    switches through `controller.switchTo(accountId)`, the active row is
- *    flagged, and a "+ Add account" row opens the sign-in entry.
- *  - `add` / `signin` — the sign-in entry. On WEB this auto-starts "Sign in
- *    with Oxy" (native shared-keychain silently, else the QR handoff) the
- *    instant the view is entered — the QR is the PRIMARY web surface, not a
- *    button behind a click. On NATIVE it stays button-driven (unchanged):
- *    primary "Sign in with Oxy", secondary "Scan a QR from another device".
- *    Both platforms get a footer entry into `signup`.
- *  - `signup` — account creation. Commons is ALWAYS the priority path (owner
- *    mandate) and leads everywhere it appears: native shows only "Create your
- *    identity in Commons" (or "Get Commons" first, if not installed); web on
- *    a first-party Oxy origin leads with the SAME "Get Commons" CTA, with
- *    inline passkey creation (username + `registerWithPasskey`) offered
- *    UNDERNEATH as the de-emphasized "don't want to install anything"
- *    alternative — never co-equal, never a competing button. Anywhere else (a
- *    non-Oxy web origin, before the b2 hub-relay ships) shows an honest "not
- *    available here yet" message instead of a broken button.
- *  - `qr` — the cross-device Commons handoff, and the PRIMARY web sign-in
- *    surface. On a first-party Oxy origin this ALSO carries a "No Commons?"
- *    passkey link — identity is ONE thing (Commons key or browser passkey,
- *    same Oxy ID), so there is no separate "sign in with a passkey" button
- *    anywhere in this file, but passkey is explicitly the LIGHTWEIGHT
- *    ALTERNATIVE for someone who doesn't want to install Commons, never
- *    co-equal: same small-text-link subordination, same framing, wherever it
- *    appears. Native additionally branches on `commonsAvailability`: when
- *    Commons isn't installed, this leads with a "Get Commons" CTA instead of
- *    a same-device dead-end QR.
+ * This file owns WIRING only: the controller binding, the action handlers, and
+ * which view module renders. Every view lives in `./authChooser/`, one
+ * responsibility each:
+ *
+ *  - `accounts` → `AccountsMenuView` — the signed-in Oxy account menu.
+ *  - `add` / `signin` → `SignInEntryView` — ONE primary action, "Continue with
+ *    Oxy" (issue #691, Phase 5). On WEB this view is transient: the flow
+ *    auto-starts the instant the view is reached, because the request surface
+ *    (a QR on an unknown desktop, "Check Commons on your phone" where Oxy could
+ *    deliver) IS the primary route there, never something behind a second tap.
+ *  - `qr` → `SignInRequestView` — the ACTIVE REQUEST: the route Oxy chose plus
+ *    honest progress derived only from `snapshot.signIn`. Alternatives stay
+ *    behind "Having trouble?" until the chosen route reports `routeFailed`.
+ *  - `signup` → `SignUpView` — account creation, Commons-first.
  *
  * Per-account color re-theming uses Bloom's `APP_COLOR_PRESETS` + `BloomColorScope`
  * (same visual language auth.oxy.so uses). Base theming is `useTheme()` + a
@@ -49,6 +34,13 @@ import type React from 'react';
 export interface OxyAuthChooserProps {
     /** Called after a completed switch, sign-in, or sign-up. */
     onComplete?: () => void;
+    /**
+     * When false, the web sign-in entry does not auto-start a device-flow
+     * session on mount. Use for hosts (e.g. the cross-origin passkey hub) that
+     * already have a pending `authorizeCode` and must not spawn a second one.
+     * @default true
+     */
+    autoStartSignIn?: boolean;
 }
 /**
  * The account switcher + sign-in/sign-up chooser. Mounted by `OxyAccountDialogScreen`

package/lib/typescript/module/ui/components/OxyAuthChooser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAsE/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB;AAqCD;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CA4TjD,CAAC;AAwkCF,eAAe,cAAc,CAAC"}
+{"version":3,"file":"OxyAuthChooser.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyAuthChooser.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAoC/B,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,QAAA,MAAM,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CA2UjD,CAAC;AA4BF,eAAe,cAAc,CAAC"}

package/lib/typescript/module/ui/components/OxyConsentScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyConsentScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyConsentScreen.tsx"],"names":[],"mappings":"AA8BA,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAmED,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,IAAI,EACJ,OAAO,EACP,MAAM,EACN,IAAY,EACZ,KAAY,GACb,EAAE,qBAAqB,+BA+KvB;AAoID,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"OxyConsentScreen.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyConsentScreen.tsx"],"names":[],"mappings":"AA8BA,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,kDAAkD;IAClD,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,iFAAiF;IACjF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAgHD,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,IAAI,EACJ,OAAO,EACP,MAAM,EACN,IAAY,EACZ,KAAY,GACb,EAAE,qBAAqB,+BA6KvB;AAoID,eAAe,gBAAgB,CAAC"}

package/lib/typescript/module/ui/components/OxyProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyProvider.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,EAAE,EAAkB,MAAM,OAAO,CAAC;AAI7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAqB,CAAC;AAgD5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAyOrC,CAAC;AAEF,eAAe,WAAW,CAAC"}
+{"version":3,"file":"OxyProvider.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxyProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,EAAE,EAAkB,MAAM,OAAO,CAAC;AAI7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAqB,CAAC;AA4C5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,QAAA,MAAM,WAAW,EAAE,EAAE,CAAC,gBAAgB,CA6OrC,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/lib/typescript/module/ui/components/OxySignInButton.d.ts

@@ -3,8 +3,8 @@ import { type ViewStyle, type TextStyle, type StyleProp } from 'react-native';
 /**
  * The OAuth handshake surfaced to a NATIVE third-party RP via
  * {@link OxySignInButtonProps.onOAuthResult} so it can finish the code exchange
- * (`POST /auth/oauth/token`). Web RPs read the same `state` / `code_verifier`
- * back from `sessionStorage` across the redirect and do not need this callback.
+ * (`POST /auth/oauth/token`). Web sign-in is handled entirely by the SDK's web
+ * transport (`useOxy().startWebOAuthSignIn`) and never uses this callback.
  */
 export interface OxyOAuthResult {
     /** Deep-link URL the native auth session returned to (`?code=…&state=…`), or `null` if unobserved. */
@@ -34,8 +34,12 @@ export interface OxySignInButtonProps {
      */
     textStyle?: StyleProp<TextStyle>;
     /**
-     * Custom button text
-     * @default 'Sign in with Oxy'
+     * Overrides the button label. When omitted the button renders the ONE
+     * primary relying-party action, localized: `accountSwitcher.continueWithOxy`
+     * ("Continue with Oxy" in English). "Sign in with Oxy" remains the name of
+     * the MECHANISM — only this surface's label is "Continue with Oxy".
+     *
+     * @default localized `accountSwitcher.continueWithOxy`
      */
     text?: string;
     /**
@@ -51,18 +55,19 @@ export interface OxySignInButtonProps {
     /**
      * Exact registered redirect URI the OAuth authorization code is returned to.
      * REQUIRED only for third-party (`type: 'third_party'`) applications, which
-     * sign in via an OAuth + PKCE redirect to `auth.oxy.so`. First-party /
-     * official apps open the in-app dialog and ignore this prop. If a third-party
-     * app resolves without it, the button logs an error and does nothing (it will
-     * not invent a redirect URI).
+     * sign in via OAuth + PKCE against `auth.oxy.so`. First-party / official apps
+     * open the in-app dialog and ignore this prop. If a third-party app resolves
+     * without it, the button logs an error and does nothing (it will not invent a
+     * redirect URI).
      */
     oauthRedirectUri?: string;
     /**
      * Native only: receives the OAuth handshake after a third-party auth session
-     * so the RP can finish the token exchange. On web the handshake is read back
-     * from `sessionStorage` across the full-page redirect, so this is not used
-     * there. A native third-party sign-in with NO `onOAuthResult` handler cannot
-     * complete (the `state` + `code_verifier` are lost) and logs a warning.
+     * so the RP can finish the token exchange. On web the SDK completes the flow
+     * itself — the popup transport keeps the handshake in memory, and the
+     * redirect transport reads it back from `sessionStorage` — so this is never
+     * called there. A native third-party sign-in with NO `onOAuthResult` handler
+     * cannot complete (the `state` + `code_verifier` are lost) and logs a warning.
      *
      * @example
      * ```tsx

package/lib/typescript/module/ui/components/OxySignInButton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxySignInButton.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxySignInButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAY,MAAM,cAAc,CAAC;AAoBxF;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC3B,sGAAsG;IACtG,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;CACxB;AAaD,MAAM,WAAW,oBAAoB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAE9C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAE7B;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAEjC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA8L1D,CAAC;AAEF,eAAe,eAAe,CAAC"}
+{"version":3,"file":"OxySignInButton.d.ts","sourceRoot":"","sources":["../../../../../src/ui/components/OxySignInButton.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAY,MAAM,cAAc,CAAC;AAoBxF;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC3B,sGAAsG;IACtG,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAE9C;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAE7B;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAEjC;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA6O1D,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/lib/typescript/module/ui/components/authChooser/AccountsMenuView.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The signed-in Oxy account MENU (`accounts` view) — a Google-account-menu-style
+ * full menu built entirely with NativeWind `className` (the dynamic per-account
+ * accent hex is the one inline style NativeWind cannot express). Structure:
+ *
+ *  - HERO on its own chrome-free block: the current account's large pressable
+ *    avatar (with a camera badge to change the photo), the greeting, the account
+ *    address, and a "Manage your Oxy account" pill.
+ *  - SWITCH ACCOUNT: a disclosure row whose corner animates from pill to card as
+ *    the other switchable accounts + "Add another account" + "Manage accounts on
+ *    this device" reveal beneath it.
+ *  - OXY STORAGE: cloud + used/total + a composition meter + Upgrade / Manage chips.
+ *  - MENU rows: Your data in Oxy · Oxy settings · Help & feedback · Sign out —
+ *    Bloom's grouped section, the same component every other SDK settings surface
+ *    uses, not a local row copy.
+ *  - FOOTER: Privacy Policy · Terms of Service.
+ *
+ * All three blocks share ONE rhythm taken from that grouped section: a 12px
+ * content inset, a 12px gap after the leading element, 16px between blocks, and
+ * a 16px trailing chevron column.
+ *
+ * Collapse state is a plain `useState` toggled in the row's press handler — no
+ * effect hook, no derived-from-props sync.
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot } from '@oxyhq/core';
+import { type AccountStorageModel, type AccountsMenuActions, type OxyAuthChooserHandlers, type Theme, type Translate } from './types.js';
+interface AccountsMenuViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    handlers: OxyAuthChooserHandlers;
+    storage: AccountStorageModel | null;
+    menu: AccountsMenuActions;
+}
+declare const AccountsMenuView: React.FC<AccountsMenuViewProps>;
+export default AccountsMenuView;
+//# sourceMappingURL=AccountsMenuView.d.ts.map

package/lib/typescript/module/ui/components/authChooser/AccountsMenuView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountsMenuView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/AccountsMenuView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAkB/B,OAAO,KAAK,EAAE,qBAAqB,EAAqB,MAAM,aAAa,CAAC;AAK5E,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,KAAK,EACV,KAAK,SAAS,EACf,MAAM,YAAS,CAAC;AAsEjB,UAAU,qBAAqB;IAC7B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED,QAAA,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAoXrD,CAAC;AA8DF,eAAe,gBAAgB,CAAC"}

package/lib/typescript/module/ui/components/authChooser/SignInEntryView.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The sign-in ENTRY (`signin` / `add` views) — ONE primary action.
+ *
+ * Issue #691, Phase 5: the normal experience presents no menu of authentication
+ * methods. The user sees "Continue with Oxy"; Oxy — not the user — then picks
+ * how the request reaches their Commons identity, and the request surface shows
+ * honest progress. Everything else (a QR from another device, a passkey on this
+ * device, getting Commons, creating an account) lives behind "Having trouble?".
+ *
+ * Existing accounts still render ABOVE the CTA: "continue as one of these" is a
+ * choice of WHO, not of HOW, so it is not one of the competing method buttons
+ * the issue removes.
+ *
+ * On web this view is transient — the container auto-starts the flow the instant
+ * the view is reached, because the request surface (QR, or "Check Commons on
+ * your phone") IS the primary route there, never something behind a tap.
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot } from '@oxyhq/core';
+import type { OxyAuthChooserHandlers, SignInAlternatives, Theme, Translate } from './types.js';
+interface SignInEntryViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    handlers: OxyAuthChooserHandlers;
+    /** The ONE primary action. Starts the flow; Oxy chooses the route from there. */
+    onContinueWithOxy: () => void;
+    alternatives: SignInAlternatives;
+}
+declare const SignInEntryView: React.FC<SignInEntryViewProps>;
+export default SignInEntryView;
+//# sourceMappingURL=SignInEntryView.d.ts.map

package/lib/typescript/module/ui/components/authChooser/SignInEntryView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInEntryView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/SignInEntryView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAS,CAAC;AAE5F,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,IAAI,CAAC;IAC9B,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,QAAA,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,oBAAoB,CA2EnD,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/lib/typescript/module/ui/components/authChooser/SignInRequestView.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The ACTIVE REQUEST surface (`qr` view) — the route Oxy chose, plus honest
+ * progress (issue #691, Phase 5).
+ *
+ * The user already performed their one action. From here the surface only
+ * REPORTS: the route-appropriate primary visual (`RequestPrimarySurface`), the
+ * status line derived from the controller's real signals
+ * (`signInProgressLabel`), and nothing else at the same weight. Alternatives
+ * stay behind "Having trouble?" until `signIn.routeFailed` says the chosen route
+ * could not be carried out — the controller never silently cascades, so
+ * revealing them is this view's decision and this view's alone.
+ *
+ * Two surfaces take over when there is no working primary route to report on:
+ *  - a FAILED request, whose reason is toasted by the container (never inline),
+ *    leaves "Try again" as the primary action with the alternatives revealed;
+ *  - a native device with NO Commons installed, where a same-device QR would be
+ *    a dead end. There, "Get Commons" is the genuine primary route — not a
+ *    fallback — so it renders as the one primary action and the QR handoff moves
+ *    behind the disclosure ("I have Commons on another device").
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot } from '@oxyhq/core';
+import type { SignInAlternatives, Theme, Translate } from './types.js';
+interface SignInRequestViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    /** Restart the request after a failure. */
+    onRetry: () => void;
+    alternatives: SignInAlternatives;
+}
+declare const SignInRequestView: React.FC<SignInRequestViewProps>;
+export default SignInRequestView;
+//# sourceMappingURL=SignInRequestView.d.ts.map

package/lib/typescript/module/ui/components/authChooser/SignInRequestView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInRequestView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/SignInRequestView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAS,CAAC;AAEpE,UAAU,sBAAsB;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,QAAA,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAqHvD,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/lib/typescript/module/ui/components/authChooser/SignUpView.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Account creation (`signup` view).
+ *
+ * Commons is ALWAYS the priority path (owner mandate) and leads everywhere it
+ * appears: native shows only "Create your identity in Commons" (or "Get Commons"
+ * first, when it is not installed); web on a first-party Oxy origin leads with
+ * the SAME "Get Commons" CTA, with inline passkey creation offered UNDERNEATH as
+ * the de-emphasized "don't want to install anything" alternative — never
+ * co-equal, never a competing button. Anywhere else (a non-Oxy web origin,
+ * before the b2 hub-relay ships) shows an honest "not available here yet"
+ * handoff instead of a broken button.
+ */
+import type React from 'react';
+import type { AccountDialogSnapshot, OxyServices } from '@oxyhq/core';
+import type { PasskeyMode, Theme, Translate } from './types.js';
+interface SignUpViewProps {
+    snapshot: AccountDialogSnapshot;
+    theme: Theme;
+    t: Translate;
+    oxyServices: OxyServices;
+    passkeyMode: PasskeyMode;
+    onCreateWithPasskey: (username: string) => void;
+    createPending: boolean;
+    /** Open the auth.oxy.so hub popup (b2) — the 'hub' mode's only path. */
+    onOpenHub: () => void;
+    /** Deep-link into Commons' own identity-creation screen (installed only). */
+    onCreateIdentityInCommons: () => void;
+    /** Open the Commons store listing / landing page for this platform. */
+    onGetCommons: () => void;
+    onBackToSignIn: () => void;
+}
+declare const SignUpView: React.FC<SignUpViewProps>;
+export default SignUpView;
+//# sourceMappingURL=SignUpView.d.ts.map

package/lib/typescript/module/ui/components/authChooser/SignUpView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignUpView.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/SignUpView.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAItE,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAS,CAAC;AAG7D,UAAU,eAAe;IACvB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,aAAa,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,6EAA6E;IAC7E,yBAAyB,EAAE,MAAM,IAAI,CAAC;IACtC,uEAAuE;IACvE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,QAAA,MAAM,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAqGzC,CAAC;AA8BF,eAAe,UAAU,CAAC"}

package/lib/typescript/module/ui/components/authChooser/TroubleDisclosure.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The "Having trouble?" progressive disclosure (issue #691, Phase 5).
+ *
+ * The normal sign-in surface presents ONE primary action. Every alternative —
+ * scanning a QR from another device, a passkey on this device, getting Commons,
+ * creating an account — lives here, hidden until the user asks for it or the
+ * chosen primary route fails.
+ *
+ * Two renderings, deliberately not one controlled component:
+ *  - `revealed` (the primary route failed, or there IS no primary route): the
+ *    alternatives ARE the surface's content now, so they render plainly. There
+ *    is nothing left to hide them behind.
+ *  - otherwise: Bloom's own `Collapsible`, whose trigger is the small
+ *    "Having trouble?" affordance.
+ *
+ * Splitting on `revealed` is what keeps the open state where it belongs — inside
+ * Bloom's uncontrolled disclosure — instead of forcing a hand-rolled controlled
+ * copy of it here.
+ */
+import type React from 'react';
+import type { Theme, Translate } from './types.js';
+/** One alternative route out of the current surface. Always a subordinate link. */
+export interface TroubleAction {
+    /** Stable identity for the list, and the action's `testID`. */
+    key: string;
+    label: string;
+    onPress: () => void;
+    disabled?: boolean;
+}
+interface TroubleDisclosureProps {
+    actions: TroubleAction[];
+    /**
+     * `true` when the primary route could not be carried out (`signIn.routeFailed`)
+     * or the surface has no working primary at all (a failed request). The
+     * alternatives are shown without asking.
+     */
+    revealed: boolean;
+    theme: Theme;
+    t: Translate;
+}
+declare const TroubleDisclosure: React.FC<TroubleDisclosureProps>;
+export default TroubleDisclosure;
+//# sourceMappingURL=TroubleDisclosure.d.ts.map

package/lib/typescript/module/ui/components/authChooser/TroubleDisclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TroubleDisclosure.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/components/authChooser/TroubleDisclosure.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAK/B,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAS,CAAC;AAEhD,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,CAAC,EAAE,SAAS,CAAC;CACd;AAED,QAAA,MAAM,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,sBAAsB,CA8BvD,CAAC;AAEF,eAAe,iBAAiB,CAAC"}