@oxyhq/services 22.12.4 → 22.13.0

package/lib/typescript/module/ui/session/index.d.ts

@@ -4,12 +4,16 @@
  * `@oxyhq/core` owns the platform-agnostic `SessionClient`, its host adapter,
  * and the pure `DeviceSessionState → services` projection helpers; those are
  * re-exported straight from core here so `OxyContext` has one import site.
- * `@oxyhq/services` supplies only the two platform pieces: the thin
+ * `@oxyhq/services` supplies only the platform pieces: the thin
  * `createSessionClient` factory (injects socket.io-client `io` + the
- * device-first token transport) and the `AuthStateStore` factory.
+ * device-first token transport), the `AuthStateStore` factory, and — for
+ * `sessionMode: 'identity'` — the identity binding (platform pin store + the
+ * memoised pinned account id).
  */
 export { createSessionClient } from './createSessionClient.js';
 export { createTokenTransport } from './tokenTransport.js';
 export { createPlatformAuthStateStore } from './authStore.js';
+export { createIdentitySessionBinding, IdentityBoundSessionError } from './identityBinding.js';
+export type { IdentitySessionBinding } from './identityBinding.js';
 export { createSessionClientHost, accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions, } from '@oxyhq/core';
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/ui/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAkB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAa,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAkB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAa,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,sBAAmB,CAAC;AAC5F,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAmB,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,aAAa,CAAC"}

package/lib/typescript/module/ui/session/nativeSecureStorage.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The native secure key/value seam every durable `@oxyhq/core` store in this
+ * package is built on.
+ *
+ * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
+ * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
+ * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
+ * module supplies that injection ONCE, so those stores can never drift onto
+ * different backings — a device credential in SecureStore and a pin in
+ * AsyncStorage would resolve differently after a keystore reset.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+import type { NativeKeyValueStorage } from '@oxyhq/core';
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+export declare function createNativeSecureKeyValueStorage(): NativeKeyValueStorage;
+//# sourceMappingURL=nativeSecureStorage.d.ts.map

package/lib/typescript/module/ui/session/nativeSecureStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeSecureStorage.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/nativeSecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0CzD;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,CAiCzE"}

package/lib/typescript/module/ui/session/tokenTransport.d.ts

@@ -21,6 +21,13 @@ import { type OxyServices, type TokenTransport } from '@oxyhq/core';
  *
  * A failure is logged and swallowed: this method must never throw out (it runs
  * inside the socket state handler).
+ *
+ * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
+ * on `state.activeAccountId` is precisely what an identity-bound client must
+ * never do — its token is minted for the PINNED account by the cold boot /
+ * re-mint lane. `SessionClient` already bypasses the transport entirely while
+ * pinned; this guard is the services-side half of that contract, so no future
+ * wiring can reintroduce the convergence from this end.
  */
-export declare function createTokenTransport(oxyServices: OxyServices): TokenTransport;
+export declare function createTokenTransport(oxyServices: OxyServices, getPinnedAccountId?: () => string | null): TokenTransport;
 //# sourceMappingURL=tokenTransport.d.ts.map

package/lib/typescript/module/ui/session/tokenTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG5E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,cAAc,CA8B7E"}
+{"version":3,"file":"tokenTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,WAAW,EACxB,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GACvC,cAAc,CAiChB"}

package/lib/typescript/module/ui/types/navigation.d.ts

@@ -1,6 +1,8 @@
 import type { ReactNode, RefObject } from 'react';
 import type { QueryClient } from '@tanstack/react-query';
 import type { RouteName } from '../navigation/routes.js';
+import type { SessionMode } from '@oxyhq/core';
+import type { WebAuthMode } from '../oauth/types.js';
 export interface StepController {
     canGoBack: () => boolean;
     goBack: () => void;
@@ -59,6 +61,48 @@ export interface OxyProviderProps {
      * so a local/staging deployment targets its own IdP instead of production.
      */
     authorizeBaseUrl?: string;
+    /**
+     * Who owns this app's session.
+     *
+     * - `'account'` (default) — the device's ACTIVE account. Every ordinary Oxy
+     *   app: any app sharing the device's `DeviceSession` can switch the active
+     *   account and this one follows, sign-in surfaces and the account switcher
+     *   are available, and `accounts` lists the account graph.
+     * - `'identity'` — the owner of this device's PRIMARY identity key, for as
+     *   long as that key exists. The provider pins its authenticated user AND
+     *   its bearer to the account that key authenticates as, so an account
+     *   switch made by any sibling app changes the shared device state but never
+     *   this app's user or token. Built for the identity vault (Commons).
+     *
+     * In `'identity'` mode the account-graph surfaces are disabled at the source
+     * rather than hidden in the UI: `accounts` stays empty and is never fetched,
+     * `switchToAccount` / `switchSession` reject with `IdentityBoundSessionError`,
+     * `accountDialogController` is `null` and `openAccountDialog()` does nothing,
+     * and the two web OAuth cold-boot lanes (authorization-code return + silent
+     * cross-origin restore) are skipped — all of them commit whichever account
+     * the IdP resolves, which is not necessarily the local key's owner.
+     *
+     * Read once at mount, like `baseURL` / `oxyServices`: changing it on a
+     * mounted provider does not re-bind the session.
+     * @default 'account'
+     */
+    sessionMode?: SessionMode;
+    /**
+     * How a WEB third-party "Sign in with Oxy" hands the user to the IdP.
+     *
+     * - `'redirect'` (default) — a full-page navigation to `auth.oxy.so`, which
+     *   returns to the registered `redirect_uri` with `?code=`. The tab unmounts
+     *   and remounts, so route and unsaved state are lost.
+     * - `'popup'` — a small `auth.oxy.so` window opened from the user's click.
+     *   The app stays MOUNTED and becomes authenticated without a reload; the
+     *   IdP delivers only the authorization code + `state` back to the opener
+     *   via `postMessage` (never a token, device secret, or PKCE verifier). A
+     *   blocked popup falls back to the redirect automatically.
+     *
+     * Native is unaffected — it always uses an in-app auth session.
+     * @default 'redirect'
+     */
+    webAuthMode?: WebAuthMode;
     queryClient?: QueryClient;
     /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
     hubSync?: boolean;

package/lib/typescript/module/ui/types/navigation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAItD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGrC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACzC"}
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAgB,CAAC;AAElD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGrC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;CACzC"}

package/lib/typescript/module/ui/utils/crossOriginRestore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAiDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CA8BtF"}
+{"version":3,"file":"crossOriginRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/crossOriginRestore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuB/C,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,OAAO,CAOrD;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAKtD;AAED,qEAAqE;AACrE,wBAAgB,6BAA6B,IAAI,IAAI,CAMpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,GAAG,kBAAkB,GAAG,IAAI,CA0BtF"}

package/lib/typescript/module/ui/utils/deliveryPlatform.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Classify the surface a "Sign in with Oxy" request is initiated from, for
+ * `AccountDialogController`'s `platform` option (issue #691, Phase 4/5).
+ *
+ * `@oxyhq/core` deliberately refuses to do this itself — it never touches a
+ * platform global — so the consumer that OWNS the environment classifies it and
+ * hands the verdict in. The verdict feeds `selectCommonsDelivery`, where it
+ * decides one thing only: whether this device may take the `'open-commons'`
+ * deep-link route. Getting it wrong in the "mobile" direction is the costly
+ * error (a custom-scheme navigation that does not resolve is a dead end with no
+ * automatic way back), so every ambiguous signal resolves AWAY from `'mobile'`.
+ *
+ * No user-agent string is parsed. The two signals used are declarative and
+ * standardized:
+ *   1. `navigator.userAgentData.mobile` — the User-Agent Client Hints boolean.
+ *      Authoritative where implemented (Chromium), in both directions.
+ *   2. The PRIMARY pointer (`(pointer: coarse)`) plus a touch digitizer.
+ *      A phone/tablet reports a coarse primary pointer; a touchscreen laptop
+ *      still reports its mouse as primary, so it is not misclassified.
+ */
+import type { CommonsDeliveryPlatform } from '@oxyhq/core';
+/**
+ * Which surface this app is running on, as `selectCommonsDelivery` models it.
+ *
+ *  - Native (Expo/RN) is always `'mobile'`: it is an Oxy app installed on a
+ *    phone/tablet, exactly the case where a verified Commons link can resolve
+ *    on this very device.
+ *  - A web browser is classified from the signals above.
+ *  - Anything else — a browser-like environment with neither signal — is
+ *    `'unknown'`, a first-class value that never opts into the deep link.
+ */
+export declare function resolveDeliveryPlatform(): CommonsDeliveryPlatform;
+//# sourceMappingURL=deliveryPlatform.d.ts.map

package/lib/typescript/module/ui/utils/deliveryPlatform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveryPlatform.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/deliveryPlatform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAiB3D;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,uBAAuB,CAgBjE"}

package/lib/typescript/module/ui/utils/oauthReturn.d.ts

@@ -1,27 +1,41 @@
 import type { OxyServices } from '@oxyhq/core';
-export interface OAuthReturnCommitInput {
-    sessionId: string;
-    accessToken?: string;
-    deviceId?: string;
-    deviceSecret?: string;
-    userId: string;
-    expiresAt?: string;
-    user?: {
-        id: string;
-        username?: string;
-        avatar?: string;
-    };
-}
+import type { OAuthSessionCommitInput } from '../oauth/types.js';
 /**
- * When the RP lands with `?code=` after password sign-in at auth.oxy.so, exchange
- * the code for a device-first session before cold boot runs.
+ * When the RP lands with `?code=` after signing in at auth.oxy.so, exchange the
+ * code for a device-first session before cold boot runs.
+ *
+ * This is the REDIRECT transport's return leg. It owns only what is specific to
+ * a full-page round trip — reading the code off the URL, recovering the
+ * handshake `sessionStorage` carried across the navigation, and cleaning both up
+ * afterwards — and delegates state validation, the PKCE exchange, and the
+ * session commit to `completeOAuthCode`, the same function the popup transport
+ * runs.
  */
 export declare function tryCompleteOAuthReturn(opts: {
     oxyServices: OxyServices;
     clientId?: string | null;
     authRedirectUri?: string;
-    commitSession: (input: OAuthReturnCommitInput) => Promise<void>;
+    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
 }): Promise<boolean>;
+/**
+ * Rewrite the address bar after an authorize round trip, and tell the router.
+ *
+ * Prefers the page the visit started on (see `persistOAuthReturnPath`) over the
+ * bare origin the IdP redirected to, falling back to `fallbackUrl` when nothing
+ * was recorded.
+ *
+ * The `popstate` dispatch is the load-bearing part. `history.replaceState`
+ * fires no event, and cold boot runs *inside* the mounted app — by the time
+ * this executes, a history-based router (React Router, Vue Router, …) has
+ * already read `location` and rendered the route for `/`. Without a
+ * notification the address bar would show the restored deep link while the page
+ * still displayed the home page. `popstate` is the event the History API
+ * defines for exactly this, and it is what those routers subscribe to.
+ *
+ * Only dispatched when the URL actually changed, so the common no-op case does
+ * not push a spurious event at every listener on the page.
+ */
+export declare function replaceUrlAfterOAuthReturn(fallbackUrl: string): void;
 /**
  * When auth.oxy.so hub-sync redeem fails, the IdP redirects back with
  * `?hub_sync=failed`. Strip the param and log so cold boot can continue

package/lib/typescript/module/ui/utils/oauthReturn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthReturn.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/oauthReturn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAU/C,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE,GAAG,OAAO,CAAC,OAAO,CAAC,CA8DnB;AAuBD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAmB/C"}
+{"version":3,"file":"oauthReturn.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/oauthReturn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAgB,CAAC;AAG9D;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE,GAAG,OAAO,CAAC,OAAO,CAAC,CA6CnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAuBpE;AAeD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAgB/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "22.12.4",
+  "version": "22.13.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -126,8 +126,8 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "0.17.0",
-    "@oxyhq/core": "^12.10.5",
+    "@oxyhq/contracts": "0.18.0",
+    "@oxyhq/core": "^12.11.0",
     "@simplewebauthn/browser": "^13.3.0",
     "color": "^4.2.3"
   },
@@ -136,7 +136,7 @@
     "@commitlint/cli": "^17.6.5",
     "@commitlint/config-conventional": "^17.6.5",
     "@expo/vector-icons": "^15.0.3",
-    "@oxyhq/core": "12.10.4",
+    "@oxyhq/core": "12.11.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@react-native/babel-preset": "^0.86.0",
@@ -152,7 +152,6 @@
     "@types/react": "*",
     "copyfiles": "^2.4.1",
     "expo-file-system": "~57.0.1",
-    "expo-font": "~57.0.1",
     "expo-haptics": "~57.0.1",
     "expo-image": "~57.0.1",
     "expo-linear-gradient": "~57.0.1",
@@ -176,8 +175,8 @@
   },
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
-    "@oxyhq/bloom": "^0.50.2",
-    "@oxyhq/core": "^12.10.0",
+    "@oxyhq/bloom": "^0.54.1",
+    "@oxyhq/core": "^12.11.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",
@@ -189,7 +188,6 @@
     "expo": ">=56.0.0",
     "expo-document-picker": ">=56.0.0",
     "expo-file-system": ">=56.0.0",
-    "expo-font": ">=13.0.0",
     "expo-haptics": ">=56.0.0",
     "expo-image": ">=2.0.0",
     "expo-image-manipulator": ">=56.0.0",

package/src/index.ts

@@ -36,11 +36,10 @@ export { useOxy } from './ui/context/OxyContext';
 export type { OxyContextState } from './ui/context/OxyContext';
 export { useAuth } from './ui/hooks/useAuth';
 export type { AuthState, AuthActions, UseAuthReturn } from './ui/hooks/useAuth';
-
-// ---------------------------------------------------------------------------
-// Font loading
-// ---------------------------------------------------------------------------
-export { FontLoader, setupFonts } from './ui/components/FontLoader';
+// Thrown by `switchToAccount` / `switchSession` while `OxyProvider` runs with
+// `sessionMode="identity"` — an identity-bound app authenticates as the owner of
+// the local identity key and cannot switch accounts.
+export { IdentityBoundSessionError } from './ui/session/identityBinding';
 
 // ---------------------------------------------------------------------------
 // Zustand stores
@@ -210,6 +209,21 @@ export {
 } from '@oxyhq/core';
 export { default as OxySignInButton } from './ui/components/OxySignInButton';
 export type { OxySignInButtonProps, OxyOAuthResult } from './ui/components/OxySignInButton';
+
+// Web OAuth transport (popup / redirect). RPs that ship their own sign-in
+// button call `useOxy().startWebOAuthSignIn(...)`; only the popup opener is
+// exported, because it MUST run synchronously inside the press handler to keep
+// the browser's user-gesture attribution.
+export { openOAuthPopup } from './ui/oauth/oauthPopup';
+export type { StartWebOAuthSignInOptions } from './ui/oauth/browserAuthTransport';
+export type {
+  WebAuthMode,
+  WebOAuthSignInResult,
+  WebOAuthRedirectReason,
+  WebOAuthFailureReason,
+  WebOAuthUnsupportedReason,
+  OAuthPopupHandle,
+} from './ui/oauth/types';
 export { OxyAuthPrompt } from './ui/components/OxyAuthPrompt';
 export type { OxyAuthPromptProps } from './ui/components/OxyAuthPrompt';
 export { OxyOAuthCallback } from './ui/components/OxyOAuthCallback';

package/src/ui/boot/__tests__/coldBootWebAuthMode.test.ts

@@ -0,0 +1,281 @@
+/**
+ * `runProviderColdBoot` — the `webAuthMode` transport gate (#691 phase 7).
+ *
+ * `webAuthMode: 'popup'` must never let the boot navigate the RP's top-level
+ * window: no silent `prompt=none` restore, no authorize redirect, a signed-out
+ * domain simply resolves signed out. `'redirect'` — still the default and the
+ * compatibility path — must behave exactly as before.
+ *
+ * Unlike `__tests__/boot/runProviderColdBoot.test.ts` (deadline + connectivity
+ * wiring, with `crossOriginRestore` stubbed out), this suite keeps the restore
+ * lane REAL so the redirect-mode assertions reach the actual navigation
+ * primitive — the thing popup mode has to suppress.
+ */
+
+import type { AuthStateStore, PersistedAuthState, SessionClient } from '@oxyhq/core';
+
+// Only `runSessionColdBoot` and the origin-CLASSIFICATION predicates are faked.
+// jsdom's `location` is non-configurable, so origin eligibility has to be driven
+// through the predicates (their real behaviour is covered by core's own tests);
+// everything else in core (PKCE, authorize-URL builder, handshake store) stays
+// real so the redirect-mode lane is exercised end to end.
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    runSessionColdBoot: jest.fn(),
+    isLoopbackOrigin: jest.fn(() => false),
+    isOfficialWebOrigin: jest.fn(() => true),
+    isIdpHubOrigin: jest.fn(() => false),
+  };
+});
+
+// The ONLY top-level-window navigation primitive either lane can reach.
+jest.mock('../../components/oauthNavigation', () => ({
+  redirectToAuthorize: jest.fn(),
+}));
+
+// Spied but REAL: redirect mode must still perform the actual restore.
+jest.mock('../../utils/crossOriginRestore', () => {
+  const actual = jest.requireActual('../../utils/crossOriginRestore');
+  return {
+    __esModule: true,
+    ...actual,
+    maybeStartSilentOAuthRestore: jest.fn(actual.maybeStartSilentOAuthRestore),
+    consumeSilentOAuthError: jest.fn(actual.consumeSilentOAuthError),
+  };
+});
+
+jest.mock('../../utils/oauthReturn', () => {
+  const actual = jest.requireActual('../../utils/oauthReturn');
+  return {
+    __esModule: true,
+    ...actual,
+    tryCompleteOAuthReturn: jest.fn(async () => false),
+    consumeHubSyncFailure: jest.fn(actual.consumeHubSyncFailure),
+  };
+});
+
+import { runSessionColdBoot } from '@oxyhq/core';
+import { redirectToAuthorize } from '../../components/oauthNavigation';
+import {
+  clearCrossOriginRestoreGuards,
+  consumeSilentOAuthError,
+  maybeStartSilentOAuthRestore,
+} from '../../utils/crossOriginRestore';
+import { consumeHubSyncFailure, tryCompleteOAuthReturn } from '../../utils/oauthReturn';
+import { runProviderColdBoot, type RunProviderColdBootOptions } from '../runProviderColdBoot';
+
+const mockRunSessionColdBoot = runSessionColdBoot as jest.Mock;
+const mockRedirectToAuthorize = redirectToAuthorize as jest.Mock;
+const mockSilentRestore = maybeStartSilentOAuthRestore as jest.Mock;
+const mockConsumeSilentOAuthError = consumeSilentOAuthError as jest.Mock;
+const mockConsumeHubSyncFailure = consumeHubSyncFailure as jest.Mock;
+const mockTryCompleteOAuthReturn = tryCompleteOAuthReturn as jest.Mock;
+
+const CLIENT_ID = 'oxy_dk_test';
+
+/** An auth store holding no device credential — the signed-out domain case. */
+function makeEmptyAuthStore(): AuthStateStore {
+  return {
+    load: jest.fn(async (): Promise<PersistedAuthState | null> => null),
+    save: jest.fn(async () => undefined),
+    clear: jest.fn(async () => undefined),
+  } as unknown as AuthStateStore;
+}
+
+interface Harness {
+  options: RunProviderColdBootOptions;
+  commitSession: jest.Mock;
+  markAuthResolved: jest.Mock;
+  setTokenReady: jest.Mock;
+  sessionClientStart: jest.Mock;
+}
+
+function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harness {
+  const commitSession = jest.fn(async () => undefined);
+  const markAuthResolved = jest.fn();
+  const setTokenReady = jest.fn();
+  const sessionClientStart = jest.fn(async () => undefined);
+
+  const options: RunProviderColdBootOptions = {
+    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
+    authStore: makeEmptyAuthStore(),
+    clientId: CLIENT_ID,
+    sessionClient: { start: sessionClientStart } as unknown as SessionClient,
+    syncDeviceCredentialToHost: jest.fn(async () => undefined),
+    commitSession,
+    markAuthResolved,
+    setTokenReady,
+    ...overrides,
+  };
+
+  return { options, commitSession, markAuthResolved, setTokenReady, sessionClientStart };
+}
+
+/** `runSessionColdBoot` finding no session at all — the signed-out domain. */
+function stubSignedOutBoot(): void {
+  mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+    await opts.onSignedOut?.('no_session');
+    return { kind: 'unauthenticated' } as const;
+  });
+}
+
+describe('runProviderColdBoot — webAuthMode transport gate (#691 phase 7)', () => {
+  beforeEach(() => {
+    mockRunSessionColdBoot.mockReset();
+    mockRedirectToAuthorize.mockClear();
+    mockSilentRestore.mockClear();
+    mockConsumeSilentOAuthError.mockClear();
+    mockConsumeHubSyncFailure.mockClear();
+    mockTryCompleteOAuthReturn.mockClear();
+    mockTryCompleteOAuthReturn.mockImplementation(async () => false);
+    globalThis.sessionStorage?.clear();
+    clearCrossOriginRestoreGuards();
+  });
+
+  describe("webAuthMode: 'popup'", () => {
+    it('never starts the silent restore and never navigates the top-level window', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('resolves a domain with no local credential SIGNED OUT instead of bouncing', async () => {
+      stubSignedOutBoot();
+      const { options, markAuthResolved, commitSession, sessionClientStart } = makeHarness({
+        webAuthMode: 'popup',
+      });
+
+      await runProviderColdBoot(options);
+
+      // Auth resolution concluded (routing can settle), nothing was committed,
+      // and with no persisted credential the device socket is not started.
+      expect(markAuthResolved).toHaveBeenCalled();
+      expect(commitSession).not.toHaveBeenCalled();
+      expect(sessionClientStart).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('still completes an authorization code already on the URL (blocked-popup fallback)', async () => {
+      // A popup-mode app lands here whenever the browser blocked the popup and
+      // `startWebOAuthSignIn` fell back to a full-page redirect.
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options, markAuthResolved, setTokenReady } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      expect(setTokenReady).toHaveBeenLastCalledWith(true);
+      expect(markAuthResolved).toHaveBeenCalled();
+      // The device mint is short-circuited by the completed return leg.
+      expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('commits the OAuth return WITHOUT hub sync', async () => {
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      const commit = mockTryCompleteOAuthReturn.mock.calls[0][0] as {
+        commitSession: (input: unknown) => Promise<void>;
+      };
+      await commit.commitSession({ sessionId: 's1', userId: 'u1' });
+      expect(options.commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', userId: 'u1' },
+        { activate: true, hubSync: false },
+      );
+    });
+  });
+
+  describe("webAuthMode: 'redirect' (unchanged compatibility path)", () => {
+    it('starts the silent restore and navigates to the IdP with prompt=none', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode: 'redirect' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
+      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
+      const url = new URL(mockRedirectToAuthorize.mock.calls[0][0] as string);
+      expect(url.origin + url.pathname).toBe('https://auth.oxy.so/authorize');
+      expect(url.searchParams.get('client_id')).toBe(CLIENT_ID);
+      expect(url.searchParams.get('prompt')).toBe('none');
+    });
+
+    it('is the DEFAULT when no webAuthMode is supplied', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness();
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
+      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
+    });
+
+    it('does NOT restore when the mint already resolved a session', async () => {
+      mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+        const session = { sessionId: 's1', userId: 'u1', accessToken: 'at', via: 'device-secret-mint' };
+        await opts.onSession?.(session);
+        return { kind: 'session', via: session.via, session } as const;
+      });
+      const { options, commitSession } = makeHarness({ webAuthMode: 'redirect' });
+
+      await runProviderColdBoot(options);
+
+      expect(commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', accessToken: 'at', userId: 'u1' },
+        { activate: false },
+      );
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('URL-cleanup consumers run in BOTH modes', () => {
+    it.each(['popup', 'redirect'] as const)(
+      'consumes the silent-OAuth error and hub-sync failure params (%s)',
+      async (webAuthMode) => {
+        stubSignedOutBoot();
+        const { options } = makeHarness({ webAuthMode });
+
+        await runProviderColdBoot(options);
+
+        expect(mockConsumeSilentOAuthError).toHaveBeenCalledTimes(1);
+        expect(mockConsumeHubSyncFailure).toHaveBeenCalledTimes(1);
+      },
+    );
+
+    it.each(['popup', 'redirect'] as const)(
+      'consumes an authorization code left on the URL (%s)',
+      async (webAuthMode) => {
+        stubSignedOutBoot();
+        const { options } = makeHarness({ webAuthMode });
+
+        await runProviderColdBoot(options);
+
+        expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      },
+    );
+  });
+
+  describe('identity mode still skips both web OAuth lanes in either transport', () => {
+    it.each(['popup', 'redirect'] as const)('skips the return leg and the restore (%s)', async (webAuthMode) => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode, sessionMode: 'identity' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+  });
+});