@oxyhq/services 22.12.5 → 22.12.7

package/lib/commonjs/ui/session/createSessionClient.js

@@ -33,14 +33,22 @@ var _tokenTransport = require("./tokenTransport.js");
  *
  * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
  * when signed out (after the one-shot join redirect).
+ *
+ * `getPinnedAccountId` reports the account an IDENTITY-BOUND provider
+ * (`sessionMode: 'identity'`) is pinned to, and `null` for every account-mode
+ * provider — which is exactly the value `SessionClient` and the transport read
+ * when the option is absent, so account mode is unchanged. While it reports an
+ * account, the client tracks device state truthfully but never re-binds its
+ * bearer to the device's mutable active account.
  */
-function createSessionClient(oxyServices, onUnauthenticated) {
+function createSessionClient(oxyServices, onUnauthenticated, getPinnedAccountId) {
   const host = (0, _core.createSessionClientHost)(oxyServices);
-  const transport = (0, _tokenTransport.createTokenTransport)(oxyServices);
+  const transport = (0, _tokenTransport.createTokenTransport)(oxyServices, getPinnedAccountId);
   const client = new _core.SessionClient(host, {
     transport,
     socketFactory: _socket.io,
-    onUnauthenticated
+    onUnauthenticated,
+    getPinnedAccountId
   });
   return {
     client,

package/lib/commonjs/ui/session/createSessionClient.js.map

@@ -1 +1 @@
-{"version":3,"names":["_socket","require","_core","_tokenTransport","createSessionClient","oxyServices","onUnauthenticated","host","createSessionClientHost","transport","createTokenTransport","client","SessionClient","socketFactory","io"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAMA,IAAAE,eAAA,GAAAF,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EAIxD;EACA,MAAMC,IAAI,GAAG,IAAAC,6BAAuB,EAACH,WAAW,CAAC;EACjD,MAAMI,SAAS,GAAG,IAAAC,oCAAoB,EAACL,WAAW,CAAC;EACnD,MAAMM,MAAM,GAAG,IAAIC,mBAAa,CAACL,IAAI,EAAE;IAAEE,SAAS;IAAEI,aAAa,EAAEC,UAAE;IAAER;EAAkB,CAAC,CAAC;EAC3F,OAAO;IAAEK,MAAM;IAAEJ;EAAK,CAAC;AACzB","ignoreList":[]}
+{"version":3,"names":["_socket","require","_core","_tokenTransport","createSessionClient","oxyServices","onUnauthenticated","getPinnedAccountId","host","createSessionClientHost","transport","createTokenTransport","client","SessionClient","socketFactory","io"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAMA,IAAAE,eAAA,GAAAF,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EACxDC,kBAAwC,EAIxC;EACA,MAAMC,IAAI,GAAG,IAAAC,6BAAuB,EAACJ,WAAW,CAAC;EACjD,MAAMK,SAAS,GAAG,IAAAC,oCAAoB,EAACN,WAAW,EAAEE,kBAAkB,CAAC;EACvE,MAAMK,MAAM,GAAG,IAAIC,mBAAa,CAACL,IAAI,EAAE;IACrCE,SAAS;IACTI,aAAa,EAAEC,UAAE;IACjBT,iBAAiB;IACjBC;EACF,CAAC,CAAC;EACF,OAAO;IAAEK,MAAM;IAAEJ;EAAK,CAAC;AACzB","ignoreList":[]}

package/lib/commonjs/ui/session/identityBinding.js

@@ -0,0 +1,95 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.IdentityBoundSessionError = void 0;
+exports.createIdentitySessionBinding = createIdentitySessionBinding;
+var _core = require("@oxyhq/core");
+var _storageHelpers = require("../utils/storageHelpers.js");
+var _nativeSecureStorage = require("./nativeSecureStorage.js");
+/**
+ * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
+ *
+ * `@oxyhq/core` owns everything platform-agnostic about an identity-bound
+ * session: the pin store shapes, `resolveIdentityPin`,
+ * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
+ * deliberately leaves out is WHICH pin store a given runtime should use, so this
+ * module supplies it — web `localStorage` vs the same native SecureStore adapter
+ * the device credential already persists through — and adds the one piece of
+ * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
+ * account id.
+ *
+ * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
+ * on the socket/apply path, while resolving the pin is asynchronous (a storage
+ * read plus a keychain read, through `resolveIdentityPin`). The provider
+ * resolves it before the cold boot and after every (re-)established identity
+ * session; every read after that is free.
+ */
+
+/**
+ * The provider-scoped identity binding: the core {@link IdentityBinding} handed
+ * to the cold boot and the re-mint handler, plus the resolved pin the projection
+ * and `SessionClient` bind to.
+ */
+
+/**
+ * Thrown by every account-graph mutation while the provider runs in
+ * `sessionMode: 'identity'`.
+ *
+ * An identity-bound app's user is the owner of the local identity key — fixed,
+ * for the lifetime of that key. Switching it is not a temporarily-unavailable
+ * operation that could be retried, it is not part of this mode's contract at
+ * all, so the surfaces reject loudly rather than resolving to a no-op that would
+ * read to the caller as a successful switch.
+ */
+class IdentityBoundSessionError extends Error {
+  name = 'IdentityBoundSessionError';
+  code = 'identity_bound_session';
+  constructor(operation) {
+    super(`"${operation}" is unavailable while the session is identity-bound (sessionMode: "identity"): this app authenticates as the owner of the local identity key and cannot switch accounts.`);
+    this.operation = operation;
+  }
+}
+
+/**
+ * Build the identity binding for this runtime. Called ONCE per provider mount,
+ * and ONLY when `sessionMode: 'identity'` — account-mode providers never
+ * construct a pin store.
+ */
+exports.IdentityBoundSessionError = IdentityBoundSessionError;
+function createIdentitySessionBinding() {
+  const pinStore = (0, _storageHelpers.isReactNative)() ? (0, _core.createNativeIdentityPinStore)((0, _nativeSecureStorage.createNativeSecureKeyValueStorage)()) : (0, _core.createWebIdentityPinStore)();
+  const binding = {
+    pinStore
+  };
+
+  // Only a RESOLVED (non-null) pin is memoised. A `null` outcome is either "not
+  // pinned yet" or an indeterminate key read (locked keychain), and caching
+  // either one would leave this client permanently unpinned for the rest of the
+  // process — the exact state in which it would start following the device's
+  // mutable active account.
+  let pinnedAccountId = null;
+  let inFlight = null;
+  const resolve = () => {
+    if (!inFlight) {
+      inFlight = (0, _core.resolveIdentityPin)(binding).then(pin => {
+        pinnedAccountId = pin?.accountId ?? null;
+        return pinnedAccountId;
+      }).finally(() => {
+        inFlight = null;
+      });
+    }
+    return inFlight;
+  };
+  return {
+    binding,
+    getPinnedAccountId: () => pinnedAccountId,
+    ensurePinnedAccountId: () => pinnedAccountId !== null ? Promise.resolve(pinnedAccountId) : resolve(),
+    refreshPinnedAccountId: () => {
+      pinnedAccountId = null;
+      return resolve();
+    }
+  };
+}
+//# sourceMappingURL=identityBinding.js.map

package/lib/commonjs/ui/session/identityBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","_storageHelpers","_nativeSecureStorage","IdentityBoundSessionError","Error","name","code","constructor","operation","exports","createIdentitySessionBinding","pinStore","isReactNative","createNativeIdentityPinStore","createNativeSecureKeyValueStorage","createWebIdentityPinStore","binding","pinnedAccountId","inFlight","resolve","resolveIdentityPin","then","pin","accountId","finally","getPinnedAccountId","ensurePinnedAccountId","Promise","refreshPinnedAccountId"],"sourceRoot":"../../../../src","sources":["ui/session/identityBinding.ts"],"mappings":";;;;;;;AAkBA,IAAAA,KAAA,GAAAC,OAAA;AAMA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,oBAAA,GAAAF,OAAA;AAzBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;AACA;AACA;;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,yBAAyB,SAASC,KAAK,CAAC;EACjCC,IAAI,GAAG,2BAA2B;EAC3CC,IAAI,GAAG,wBAAwB;EACxCC,WAAWA,CAAUC,SAAiB,EAAE;IACtC,KAAK,CACH,IAAIA,SAAS,2KACf,CAAC;IAAC,KAHiBA,SAAiB,GAAjBA,SAAiB;EAItC;AACF;;AAEA;AACA;AACA;AACA;AACA;AAJAC,OAAA,CAAAN,yBAAA,GAAAA,yBAAA;AAKO,SAASO,4BAA4BA,CAAA,EAA2B;EACrE,MAAMC,QAAQ,GAAG,IAAAC,6BAAa,EAAC,CAAC,GAC5B,IAAAC,kCAA4B,EAAC,IAAAC,sDAAiC,EAAC,CAAC,CAAC,GACjE,IAAAC,+BAAyB,EAAC,CAAC;EAC/B,MAAMC,OAAwB,GAAG;IAAEL;EAAS,CAAC;;EAE7C;EACA;EACA;EACA;EACA;EACA,IAAIM,eAA8B,GAAG,IAAI;EACzC,IAAIC,QAAuC,GAAG,IAAI;EAElD,MAAMC,OAAO,GAAGA,CAAA,KAA8B;IAC5C,IAAI,CAACD,QAAQ,EAAE;MACbA,QAAQ,GAAG,IAAAE,wBAAkB,EAACJ,OAAO,CAAC,CACnCK,IAAI,CAAEC,GAAG,IAAK;QACbL,eAAe,GAAGK,GAAG,EAAEC,SAAS,IAAI,IAAI;QACxC,OAAON,eAAe;MACxB,CAAC,CAAC,CACDO,OAAO,CAAC,MAAM;QACbN,QAAQ,GAAG,IAAI;MACjB,CAAC,CAAC;IACN;IACA,OAAOA,QAAQ;EACjB,CAAC;EAED,OAAO;IACLF,OAAO;IACPS,kBAAkB,EAAEA,CAAA,KAAMR,eAAe;IACzCS,qBAAqB,EAAEA,CAAA,KACrBT,eAAe,KAAK,IAAI,GAAGU,OAAO,CAACR,OAAO,CAACF,eAAe,CAAC,GAAGE,OAAO,CAAC,CAAC;IACzES,sBAAsB,EAAEA,CAAA,KAAM;MAC5BX,eAAe,GAAG,IAAI;MACtB,OAAOE,OAAO,CAAC,CAAC;IAClB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/index.js

@@ -3,6 +3,12 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+Object.defineProperty(exports, "IdentityBoundSessionError", {
+  enumerable: true,
+  get: function () {
+    return _identityBinding.IdentityBoundSessionError;
+  }
+});
 Object.defineProperty(exports, "accountIdsOf", {
   enumerable: true,
   get: function () {
@@ -21,6 +27,12 @@ Object.defineProperty(exports, "activeUserOf", {
     return _core.activeUserOf;
   }
 });
+Object.defineProperty(exports, "createIdentitySessionBinding", {
+  enumerable: true,
+  get: function () {
+    return _identityBinding.createIdentitySessionBinding;
+  }
+});
 Object.defineProperty(exports, "createPlatformAuthStateStore", {
   enumerable: true,
   get: function () {
@@ -54,5 +66,6 @@ Object.defineProperty(exports, "deviceStateToClientSessions", {
 var _createSessionClient = require("./createSessionClient.js");
 var _tokenTransport = require("./tokenTransport.js");
 var _authStore = require("./authStore.js");
+var _identityBinding = require("./identityBinding.js");
 var _core = require("@oxyhq/core");
 //# sourceMappingURL=index.js.map

package/lib/commonjs/ui/session/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_createSessionClient","require","_tokenTransport","_authStore","_core"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,IAAAA,oBAAA,GAAAC,OAAA;AACA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA","ignoreList":[]}
+{"version":3,"names":["_createSessionClient","require","_tokenTransport","_authStore","_identityBinding","_core"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAAA,oBAAA,GAAAC,OAAA;AACA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA","ignoreList":[]}

package/lib/commonjs/ui/session/nativeSecureStorage.js

@@ -0,0 +1,90 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createNativeSecureKeyValueStorage = createNativeSecureKeyValueStorage;
+var _storageHelpers = require("../utils/storageHelpers.js");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
+ * The native secure key/value seam every durable `@oxyhq/core` store in this
+ * package is built on.
+ *
+ * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
+ * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
+ * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
+ * module supplies that injection ONCE, so those stores can never drift onto
+ * different backings — a device credential in SecureStore and a pin in
+ * AsyncStorage would resolve differently after a keystore reset.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+// Variable indirection so Metro's static analyzer never traces expo-secure-store
+// into the web bundle; the module is native-only and optional.
+const SECURE_STORE_MODULE = 'expo-secure-store';
+let secureStorePromise = null;
+
+/**
+ * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
+ * unavailable — callers then fall back to AsyncStorage. Never throws.
+ */
+function loadSecureStore() {
+  if (!secureStorePromise) {
+    const moduleName = SECURE_STORE_MODULE;
+    secureStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
+      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
+        return {
+          getItemAsync: mod.getItemAsync.bind(mod),
+          setItemAsync: mod.setItemAsync.bind(mod),
+          deleteItemAsync: mod.deleteItemAsync.bind(mod)
+        };
+      }
+      return null;
+    }).catch(() => null);
+  }
+  return secureStorePromise;
+}
+
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+function createNativeSecureKeyValueStorage() {
+  let asyncStorage = null;
+  const getAsyncStorage = async () => {
+    if (!asyncStorage) {
+      asyncStorage = await (0, _storageHelpers.createPlatformStorage)();
+    }
+    return asyncStorage;
+  };
+  return {
+    getItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        return secure.getItemAsync(key);
+      }
+      return (await getAsyncStorage()).getItem(key);
+    },
+    setItem: async (key, value) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.setItemAsync(key, value);
+        return;
+      }
+      await (await getAsyncStorage()).setItem(key, value);
+    },
+    removeItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.deleteItemAsync(key);
+        return;
+      }
+      await (await getAsyncStorage()).removeItem(key);
+    }
+  };
+}
+//# sourceMappingURL=nativeSecureStorage.js.map

package/lib/commonjs/ui/session/nativeSecureStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_storageHelpers","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","createPlatformStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;;;;;AAiBA,IAAAA,eAAA,GAAAC,OAAA;AAAgE,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAjBhE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA;AACA;AACA,MAAMkB,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAArB,CAAA,IAAAA,CAAA,IAAAoB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA3B,uBAAA,CAAAD,OAAA,CAAA4B,CAAA,KAAOJ,UAAU,EACnCG,IAAI,CAAEE,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOZ,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASa,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAM,IAAAE,qCAAqB,EAAC,CAAC;IAC9C;IACA,OAAOF,YAAY;EACrB,CAAC;EACD,OAAO;IACLG,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,OAAOA,MAAM,CAACX,YAAY,CAACU,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEE,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACV,YAAY,CAACS,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAMN,eAAe,CAAC,CAAC,EAAEK,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,eAAe,CAACQ,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEO,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/tokenTransport.js

@@ -27,10 +27,20 @@ var _core = require("@oxyhq/core");
  *
  * A failure is logged and swallowed: this method must never throw out (it runs
  * inside the socket state handler).
+ *
+ * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
+ * on `state.activeAccountId` is precisely what an identity-bound client must
+ * never do — its token is minted for the PINNED account by the cold boot /
+ * re-mint lane. `SessionClient` already bypasses the transport entirely while
+ * pinned; this guard is the services-side half of that contract, so no future
+ * wiring can reintroduce the convergence from this end.
  */
-function createTokenTransport(oxyServices) {
+function createTokenTransport(oxyServices, getPinnedAccountId) {
   return {
     async ensureActiveToken(state) {
+      if ((getPinnedAccountId?.() ?? null) !== null) {
+        return;
+      }
       try {
         // Skip the mint ONLY when the planted bearer already identifies the
         // active account. `getCurrentUserId()` decodes the bearer's `userId`/`id`

package/lib/commonjs/ui/session/tokenTransport.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","createTokenTransport","oxyServices","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","logger","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,WAAwB,EAAkB;EAC7E,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI;QACF;QACA;QACA;QACA,MAAMC,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIH,WAAW,CAACI,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMI,KAAK,GAAG,MAAMT,WAAW,CAACU,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVH,YAAM,CAACM,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEX,KAAK,CAACW;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOR,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_core","require","createTokenTransport","oxyServices","getPinnedAccountId","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","logger","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAClCC,WAAwB,EACxBC,kBAAwC,EACxB;EAChB,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI,CAACF,kBAAkB,GAAG,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE;QAC7C;MACF;MACA,IAAI;QACF;QACA;QACA;QACA,MAAMG,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIJ,WAAW,CAACK,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMI,KAAK,GAAG,MAAMV,WAAW,CAACW,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVH,YAAM,CAACM,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEX,KAAK,CAACW;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOR,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/utils/crossOriginRestore.js

@@ -134,6 +134,7 @@ function consumeSilentOAuthError() {
     // redirected to.
     (0, _oauthReturn.replaceUrlAfterOAuthReturn)(`${url.pathname}${url.search}${url.hash}`);
   }
+  (0, _core.clearOAuthHandshake)();
   return error;
 }
 //# sourceMappingURL=crossOriginRestore.js.map

package/lib/commonjs/ui/utils/crossOriginRestore.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_isWebBrowser","_oauthReturn","_oauthNavigation","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","isLoopbackOrigin","isIdpHubOrigin","isOfficialWebOrigin","maybeStartSilentOAuthRestore","opts","isWebBrowser","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","generatePkcePair","state","generateOAuthState","persistOAuthHandshake","redirectUri","normalizeOAuthRedirectUri","authorizeUrl","buildOAuthAuthorizeUrl","authorizeBaseUrl","clientId","scope","prompt","redirectToAuthorize","error","logger","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","replaceUrlAfterOAuthReturn","pathname","hash"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;;;;;;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AAaA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,YAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AAEA,SAASI,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACC,4CAAsC,CAAC,IACnDH,KAAK,CAACE,OAAO,CAACE,oCAA8B,CAChD,CAAC;AACH;;AAEA;AACO,SAASC,+BAA+BA,CAAA,EAAS;EACtD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACM,OAAO,CAACH,4CAAsC,EAAE,GAAG,CAAC;EAC1DH,KAAK,CAACM,OAAO,CAACF,oCAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACO,SAASG,6BAA6BA,CAAA,EAAS;EACpD,MAAMP,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMQ,GAAG,IAAI,CAACL,4CAAsC,EAAEC,oCAA8B,CAAC,EAAE;IAC1FJ,KAAK,CAACS,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAI,IAAAC,sBAAgB,EAACD,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAI,IAAAE,oBAAc,EAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAO,IAAAC,yBAAmB,EAACH,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACO,eAAeI,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMC,QAAQ,GAAIrB,UAAU,CAA6BqB,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACR,6BAA6B,CAACQ,QAAQ,CAACP,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIZ,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMoB,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAM,IAAAC,sBAAgB,EAAC,CAAC;IAChE,MAAMC,KAAK,GAAG,MAAM,IAAAC,wBAAkB,EAAC,CAAC;IACxC,IAAI,CAAC,IAAAC,2BAAqB,EAACF,KAAK,EAAEH,YAAY,CAAC,EAAE;MAC/C,OAAO,KAAK;IACd;IAEA,MAAMM,WAAW,GAAG,IAAAC,+BAAyB,EAC3Cd,IAAI,CAACa,WAAW,IAAIX,QAAQ,CAACP,MAC/B,CAAC;IAED,MAAMoB,YAAY,GAAG,IAAAC,4BAAsB,EAAC;MAC1CC,gBAAgB,EAAEjB,IAAI,CAACiB,gBAAgB;MACvCC,QAAQ,EAAElB,IAAI,CAACkB,QAAQ;MACvBL,WAAW;MACXH,KAAK;MACLF,aAAa;MACbW,KAAK,EAAEnB,IAAI,CAACmB,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEF/B,+BAA+B,CAAC,CAAC;IACjC,IAAAgC,oCAAmB,EAACN,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOO,KAAK,EAAE;IACdC,YAAM,CAACC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEH,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASI,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAAC,IAAAzB,0BAAY,EAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMC,QAAQ,GAAIrB,UAAU,CAAgDqB,QAAQ;EACpF,MAAMyB,OAAO,GAAI9C,UAAU,CAA2B8C,OAAO;EAC7D,IAAI,CAACzB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMiB,KAAK,GAAGnB,MAAM,CAACyB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIN,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAjC,+BAA+B,CAAC,CAAC;EAEjC,IAAIsC,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAC7B,QAAQ,CAAC8B,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA,IAAAC,uCAA0B,EAAC,GAAGL,GAAG,CAACM,QAAQ,GAAGN,GAAG,CAACzB,MAAM,GAAGyB,GAAG,CAACO,IAAI,EAAE,CAAC;EACvE;EACA,OAAOf,KAAK;AACd","ignoreList":[]}
+{"version":3,"names":["_core","require","_isWebBrowser","_oauthReturn","_oauthNavigation","sessionStore","globalThis","sessionStorage","isCrossOriginRestoreBlocked","store","Boolean","getItem","OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY","OXY_SILENT_OAUTH_ATTEMPTED_KEY","markCrossOriginRestoreAttempted","setItem","clearCrossOriginRestoreGuards","key","removeItem","isSilentRestoreEligibleOrigin","origin","isLoopbackOrigin","isIdpHubOrigin","isOfficialWebOrigin","maybeStartSilentOAuthRestore","opts","isWebBrowser","location","params","URLSearchParams","search","has","codeVerifier","codeChallenge","generatePkcePair","state","generateOAuthState","persistOAuthHandshake","redirectUri","normalizeOAuthRedirectUri","authorizeUrl","buildOAuthAuthorizeUrl","authorizeBaseUrl","clientId","scope","prompt","redirectToAuthorize","error","logger","warn","component","consumeSilentOAuthError","history","get","replaceState","url","URL","href","searchParams","delete","replaceUrlAfterOAuthReturn","pathname","hash","clearOAuthHandshake"],"sourceRoot":"../../../../src","sources":["ui/utils/crossOriginRestore.ts"],"mappings":";;;;;;;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AAcA,IAAAC,aAAA,GAAAD,OAAA;AACA,IAAAE,YAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AAEA,SAASI,YAAYA,CAAA,EAAwB;EAC3C,OAAQC,UAAU,CAAkCC,cAAc;AACpE;;AAEA;AACO,SAASC,2BAA2BA,CAAA,EAAY;EACrD,MAAMC,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE,OAAO,KAAK;EACxB,OAAOC,OAAO,CACZD,KAAK,CAACE,OAAO,CAACC,4CAAsC,CAAC,IACnDH,KAAK,CAACE,OAAO,CAACE,oCAA8B,CAChD,CAAC;AACH;;AAEA;AACO,SAASC,+BAA+BA,CAAA,EAAS;EACtD,MAAML,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZA,KAAK,CAACM,OAAO,CAACH,4CAAsC,EAAE,GAAG,CAAC;EAC1DH,KAAK,CAACM,OAAO,CAACF,oCAA8B,EAAE,GAAG,CAAC;AACpD;;AAEA;AACO,SAASG,6BAA6BA,CAAA,EAAS;EACpD,MAAMP,KAAK,GAAGJ,YAAY,CAAC,CAAC;EAC5B,IAAI,CAACI,KAAK,EAAE;EACZ,KAAK,MAAMQ,GAAG,IAAI,CAACL,4CAAsC,EAAEC,oCAA8B,CAAC,EAAE;IAC1FJ,KAAK,CAACS,UAAU,CAACD,GAAG,CAAC;EACvB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,6BAA6BA,CAACC,MAAc,EAAW;EACrE,IAAI,IAAAC,sBAAgB,EAACD,MAAM,CAAC,EAAE,OAAO,KAAK;EAC1C,IAAI,IAAAE,oBAAc,EAAC,CAAC,EAAE,OAAO,KAAK;EAClC,OAAO,IAAAC,yBAAmB,EAACH,MAAM,CAAC;AACpC;AAeA;AACA;AACA;AACA;AACO,eAAeI,4BAA4BA,CAChDC,IAA+B,EACb;EAClB,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EAEjC,MAAMC,QAAQ,GAAIrB,UAAU,CAA6BqB,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;;EAE3B;EACA;EACA,IAAI,CAACR,6BAA6B,CAACQ,QAAQ,CAACP,MAAM,CAAC,EAAE;IACnD,OAAO,KAAK;EACd;EAEA,IAAIZ,2BAA2B,CAAC,CAAC,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMoB,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACG,GAAG,CAAC,MAAM,CAAC,IAAIH,MAAM,CAACG,GAAG,CAAC,OAAO,CAAC,EAAE;IAC7C,OAAO,KAAK;EACd;EAEA,IAAI;IACF,MAAM;MAAEC,YAAY;MAAEC;IAAc,CAAC,GAAG,MAAM,IAAAC,sBAAgB,EAAC,CAAC;IAChE,MAAMC,KAAK,GAAG,MAAM,IAAAC,wBAAkB,EAAC,CAAC;IACxC,IAAI,CAAC,IAAAC,2BAAqB,EAACF,KAAK,EAAEH,YAAY,CAAC,EAAE;MAC/C,OAAO,KAAK;IACd;IAEA,MAAMM,WAAW,GAAG,IAAAC,+BAAyB,EAC3Cd,IAAI,CAACa,WAAW,IAAIX,QAAQ,CAACP,MAC/B,CAAC;IAED,MAAMoB,YAAY,GAAG,IAAAC,4BAAsB,EAAC;MAC1CC,gBAAgB,EAAEjB,IAAI,CAACiB,gBAAgB;MACvCC,QAAQ,EAAElB,IAAI,CAACkB,QAAQ;MACvBL,WAAW;MACXH,KAAK;MACLF,aAAa;MACbW,KAAK,EAAEnB,IAAI,CAACmB,KAAK;MACjBC,MAAM,EAAE;IACV,CAAC,CAAC;IAEF/B,+BAA+B,CAAC,CAAC;IACjC,IAAAgC,oCAAmB,EAACN,YAAY,CAAC;IACjC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOO,KAAK,EAAE;IACdC,YAAM,CAACC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAqB,CAAC,EAAEH,KAAK,CAAC;IACvF,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASI,uBAAuBA,CAAA,EAAiD;EACtF,IAAI,CAAC,IAAAzB,0BAAY,EAAC,CAAC,EAAE,OAAO,IAAI;EAChC,MAAMC,QAAQ,GAAIrB,UAAU,CAAgDqB,QAAQ;EACpF,MAAMyB,OAAO,GAAI9C,UAAU,CAA2B8C,OAAO;EAC7D,IAAI,CAACzB,QAAQ,EAAE,OAAO,IAAI;EAE1B,MAAMC,MAAM,GAAG,IAAIC,eAAe,CAACF,QAAQ,CAACG,MAAM,CAAC;EACnD,MAAMiB,KAAK,GAAGnB,MAAM,CAACyB,GAAG,CAAC,OAAO,CAAC;EACjC,IAAIN,KAAK,KAAK,gBAAgB,IAAIA,KAAK,KAAK,kBAAkB,EAAE;IAC9D,OAAO,IAAI;EACb;EAEAjC,+BAA+B,CAAC,CAAC;EAEjC,IAAIsC,OAAO,EAAEE,YAAY,EAAE;IACzB,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAC7B,QAAQ,CAAC8B,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;IAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;IAChC;IACA;IACA;IACA,IAAAC,uCAA0B,EAAC,GAAGL,GAAG,CAACM,QAAQ,GAAGN,GAAG,CAACzB,MAAM,GAAGyB,GAAG,CAACO,IAAI,EAAE,CAAC;EACvE;EACA,IAAAC,yBAAmB,EAAC,CAAC;EACrB,OAAOhB,KAAK;AACd","ignoreList":[]}

package/lib/commonjs/ui/utils/deliveryPlatform.js

@@ -0,0 +1,58 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.resolveDeliveryPlatform = resolveDeliveryPlatform;
+var _isWebBrowser = require("./isWebBrowser.js");
+/**
+ * Classify the surface a "Sign in with Oxy" request is initiated from, for
+ * `AccountDialogController`'s `platform` option (issue #691, Phase 4/5).
+ *
+ * `@oxyhq/core` deliberately refuses to do this itself — it never touches a
+ * platform global — so the consumer that OWNS the environment classifies it and
+ * hands the verdict in. The verdict feeds `selectCommonsDelivery`, where it
+ * decides one thing only: whether this device may take the `'open-commons'`
+ * deep-link route. Getting it wrong in the "mobile" direction is the costly
+ * error (a custom-scheme navigation that does not resolve is a dead end with no
+ * automatic way back), so every ambiguous signal resolves AWAY from `'mobile'`.
+ *
+ * No user-agent string is parsed. The two signals used are declarative and
+ * standardized:
+ *   1. `navigator.userAgentData.mobile` — the User-Agent Client Hints boolean.
+ *      Authoritative where implemented (Chromium), in both directions.
+ *   2. The PRIMARY pointer (`(pointer: coarse)`) plus a touch digitizer.
+ *      A phone/tablet reports a coarse primary pointer; a touchscreen laptop
+ *      still reports its mouse as primary, so it is not misclassified.
+ */
+
+/**
+ * The `navigator.userAgentData` slice this module reads. Declared locally
+ * because `NavigatorUAData` is not in TypeScript's DOM lib yet; only the one
+ * field consumed here is modelled, and it stays optional so an implementation
+ * without it is simply "no answer" rather than a type lie.
+ */
+
+/**
+ * Which surface this app is running on, as `selectCommonsDelivery` models it.
+ *
+ *  - Native (Expo/RN) is always `'mobile'`: it is an Oxy app installed on a
+ *    phone/tablet, exactly the case where a verified Commons link can resolve
+ *    on this very device.
+ *  - A web browser is classified from the signals above.
+ *  - Anything else — a browser-like environment with neither signal — is
+ *    `'unknown'`, a first-class value that never opts into the deep link.
+ */
+function resolveDeliveryPlatform() {
+  if (!(0, _isWebBrowser.isWebBrowser)()) return 'mobile';
+  const nav = typeof navigator === 'undefined' ? undefined : navigator;
+  const uaMobile = nav?.userAgentData?.mobile;
+  if (typeof uaMobile === 'boolean') return uaMobile ? 'mobile' : 'desktop';
+  if (typeof window !== 'undefined' && typeof window.matchMedia === 'function') {
+    const coarsePrimaryPointer = window.matchMedia('(pointer: coarse)').matches;
+    const hasTouchDigitizer = (nav?.maxTouchPoints ?? 0) > 0;
+    return coarsePrimaryPointer && hasTouchDigitizer ? 'mobile' : 'desktop';
+  }
+  return 'unknown';
+}
+//# sourceMappingURL=deliveryPlatform.js.map

package/lib/commonjs/ui/utils/deliveryPlatform.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_isWebBrowser","require","resolveDeliveryPlatform","isWebBrowser","nav","navigator","undefined","uaMobile","userAgentData","mobile","window","matchMedia","coarsePrimaryPointer","matches","hasTouchDigitizer","maxTouchPoints"],"sourceRoot":"../../../../src","sources":["ui/utils/deliveryPlatform.ts"],"mappings":";;;;;;AAsBA,IAAAA,aAAA,GAAAC,OAAA;AAtBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,uBAAuBA,CAAA,EAA4B;EACjE,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE,OAAO,QAAQ;EAEpC,MAAMC,GAA2C,GAC/C,OAAOC,SAAS,KAAK,WAAW,GAAGC,SAAS,GAAGD,SAAS;EAE1D,MAAME,QAAQ,GAAGH,GAAG,EAAEI,aAAa,EAAEC,MAAM;EAC3C,IAAI,OAAOF,QAAQ,KAAK,SAAS,EAAE,OAAOA,QAAQ,GAAG,QAAQ,GAAG,SAAS;EAEzE,IAAI,OAAOG,MAAM,KAAK,WAAW,IAAI,OAAOA,MAAM,CAACC,UAAU,KAAK,UAAU,EAAE;IAC5E,MAAMC,oBAAoB,GAAGF,MAAM,CAACC,UAAU,CAAC,mBAAmB,CAAC,CAACE,OAAO;IAC3E,MAAMC,iBAAiB,GAAG,CAACV,GAAG,EAAEW,cAAc,IAAI,CAAC,IAAI,CAAC;IACxD,OAAOH,oBAAoB,IAAIE,iBAAiB,GAAG,QAAQ,GAAG,SAAS;EACzE;EAEA,OAAO,SAAS;AAClB","ignoreList":[]}

package/lib/commonjs/ui/utils/oauthReturn.js

@@ -7,10 +7,18 @@ exports.consumeHubSyncFailure = consumeHubSyncFailure;
 exports.replaceUrlAfterOAuthReturn = replaceUrlAfterOAuthReturn;
 exports.tryCompleteOAuthReturn = tryCompleteOAuthReturn;
 var _core = require("@oxyhq/core");
+var _completeOAuthCode = require("../oauth/completeOAuthCode.js");
 var _isWebBrowser = require("./isWebBrowser.js");
 /**
- * When the RP lands with `?code=` after password sign-in at auth.oxy.so, exchange
- * the code for a device-first session before cold boot runs.
+ * When the RP lands with `?code=` after signing in at auth.oxy.so, exchange the
+ * code for a device-first session before cold boot runs.
+ *
+ * This is the REDIRECT transport's return leg. It owns only what is specific to
+ * a full-page round trip — reading the code off the URL, recovering the
+ * handshake `sessionStorage` carried across the navigation, and cleaning both up
+ * afterwards — and delegates state validation, the PKCE exchange, and the
+ * session commit to `completeOAuthCode`, the same function the popup transport
+ * runs.
  */
 async function tryCompleteOAuthReturn(opts) {
   if (!(0, _isWebBrowser.isWebBrowser)()) return false;
@@ -21,6 +29,7 @@ async function tryCompleteOAuthReturn(opts) {
   const oauthError = params.get('error');
   if (oauthError) {
     stripOAuthParamsFromUrl();
+    (0, _core.clearOAuthHandshake)();
     return false;
   }
   if (!code) return false;
@@ -30,50 +39,26 @@ async function tryCompleteOAuthReturn(opts) {
       component: 'oauthReturn'
     });
     stripOAuthParamsFromUrl();
-    return false;
-  }
-  const returnedState = params.get('state');
-  const handshake = (0, _core.readOAuthHandshake)();
-  if (!handshake || !returnedState || handshake.state !== returnedState) {
-    _core.logger.warn('OAuth return ignored: missing or mismatched handshake', {
-      component: 'oauthReturn'
-    });
-    // Consume the return path before clearing the handshake — clearOAuthHandshake
-    // drops the persisted path along with the PKCE keys.
-    stripOAuthParamsFromUrl();
-    (0, _core.clearOAuthHandshake)();
-    return false;
-  }
-  const redirectUri = (0, _core.normalizeOAuthRedirectUri)(opts.authRedirectUri ?? location.origin);
-  try {
-    const result = await opts.oxyServices.exchangeOAuthCode({
-      code,
-      clientId,
-      redirectUri,
-      codeVerifier: handshake.codeVerifier
-    });
-    // Strip OAuth params before commit so a stale `?code=` cannot re-enter the exchange loop.
-    // Read the return path first — clearOAuthHandshake drops it with the PKCE keys.
-    stripOAuthParamsFromUrl();
-    (0, _core.clearOAuthHandshake)();
-    await opts.commitSession({
-      sessionId: result.sessionId,
-      accessToken: result.accessToken,
-      deviceId: result.deviceId,
-      deviceSecret: result.deviceSecret,
-      userId: result.user.id,
-      expiresAt: result.expiresAt,
-      user: result.user
-    });
-    return true;
-  } catch (error) {
-    _core.logger.warn('OAuth return exchange failed', {
-      component: 'oauthReturn'
-    }, error);
-    stripOAuthParamsFromUrl();
     (0, _core.clearOAuthHandshake)();
     return false;
   }
+  const result = await (0, _completeOAuthCode.completeOAuthCode)({
+    oxyServices: opts.oxyServices,
+    clientId,
+    code,
+    returnedState: params.get('state'),
+    handshake: (0, _core.readOAuthHandshake)(),
+    redirectUri: (0, _core.normalizeOAuthRedirectUri)(opts.authRedirectUri ?? location.origin),
+    commitSession: opts.commitSession,
+    // Strip the params before the commit so a stale `?code=` cannot re-enter the
+    // exchange loop, and read the return path FIRST — clearOAuthHandshake drops
+    // it along with the PKCE keys.
+    cleanup: () => {
+      stripOAuthParamsFromUrl();
+      (0, _core.clearOAuthHandshake)();
+    }
+  });
+  return result.ok;
 }
 
 /**
@@ -138,18 +123,15 @@ function stripOAuthParamsFromUrl() {
 function consumeHubSyncFailure() {
   if (!(0, _isWebBrowser.isWebBrowser)()) return false;
   const location = globalThis.location;
-  const history = globalThis.history;
   if (!location) return false;
   const params = new URLSearchParams(location.search);
   if (params.get('hub_sync') !== 'failed') return false;
   _core.logger.warn('Hub sync failed — IdP device session may be out of sync', {
     component: 'hubSync'
   });
-  if (history?.replaceState) {
-    const url = new URL(location.href);
-    url.searchParams.delete('hub_sync');
-    history.replaceState(history.state, '', `${url.pathname}${url.search}${url.hash}`);
-  }
+  const url = new URL(location.href);
+  url.searchParams.delete('hub_sync');
+  replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
   return true;
 }
 //# sourceMappingURL=oauthReturn.js.map

package/lib/commonjs/ui/utils/oauthReturn.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_isWebBrowser","tryCompleteOAuthReturn","opts","isWebBrowser","location","globalThis","params","URLSearchParams","search","code","get","oauthError","stripOAuthParamsFromUrl","clientId","logger","warn","component","returnedState","handshake","readOAuthHandshake","state","clearOAuthHandshake","redirectUri","normalizeOAuthRedirectUri","authRedirectUri","origin","result","oxyServices","exchangeOAuthCode","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error","replaceUrlAfterOAuthReturn","fallbackUrl","history","replaceState","current","pathname","hash","target","consumeOAuthReturnPath","dispatch","dispatchEvent","event","PopStateEvent","Event","call","url","URL","href","searchParams","delete","consumeHubSyncFailure"],"sourceRoot":"../../../../src","sources":["ui/utils/oauthReturn.ts"],"mappings":";;;;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AAOA,IAAAC,aAAA,GAAAD,OAAA;AAYA;AACA;AACA;AACA;AACO,eAAeE,sBAAsBA,CAACC,IAK5C,EAAoB;EACnB,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMC,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,MAAMC,IAAI,GAAGH,MAAM,CAACI,GAAG,CAAC,MAAM,CAAC;EAC/B,MAAMC,UAAU,GAAGL,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACtC,IAAIC,UAAU,EAAE;IACdC,uBAAuB,CAAC,CAAC;IACzB,OAAO,KAAK;EACd;EACA,IAAI,CAACH,IAAI,EAAE,OAAO,KAAK;EAEvB,MAAMI,QAAQ,GAAGX,IAAI,CAACW,QAAQ;EAC9B,IAAI,CAACA,QAAQ,EAAE;IACbC,YAAM,CAACC,IAAI,CAAC,wCAAwC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,CAAC;IACnFJ,uBAAuB,CAAC,CAAC;IACzB,OAAO,KAAK;EACd;EAEA,MAAMK,aAAa,GAAGX,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACzC,MAAMQ,SAAS,GAAG,IAAAC,wBAAkB,EAAC,CAAC;EACtC,IAAI,CAACD,SAAS,IAAI,CAACD,aAAa,IAAIC,SAAS,CAACE,KAAK,KAAKH,aAAa,EAAE;IACrEH,YAAM,CAACC,IAAI,CAAC,uDAAuD,EAAE;MACnEC,SAAS,EAAE;IACb,CAAC,CAAC;IACF;IACA;IACAJ,uBAAuB,CAAC,CAAC;IACzB,IAAAS,yBAAmB,EAAC,CAAC;IACrB,OAAO,KAAK;EACd;EAEA,MAAMC,WAAW,GAAG,IAAAC,+BAAyB,EAC3CrB,IAAI,CAACsB,eAAe,IAAIpB,QAAQ,CAACqB,MACnC,CAAC;EAED,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMxB,IAAI,CAACyB,WAAW,CAACC,iBAAiB,CAAC;MACtDnB,IAAI;MACJI,QAAQ;MACRS,WAAW;MACXO,YAAY,EAAEX,SAAS,CAACW;IAC1B,CAAC,CAAC;IACF;IACA;IACAjB,uBAAuB,CAAC,CAAC;IACzB,IAAAS,yBAAmB,EAAC,CAAC;IACrB,MAAMnB,IAAI,CAAC4B,aAAa,CAAC;MACvBC,SAAS,EAAEL,MAAM,CAACK,SAAS;MAC3BC,WAAW,EAAEN,MAAM,CAACM,WAAW;MAC/BC,QAAQ,EAAEP,MAAM,CAACO,QAAQ;MACzBC,YAAY,EAAER,MAAM,CAACQ,YAAY;MACjCC,MAAM,EAAET,MAAM,CAACU,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEZ,MAAM,CAACY,SAAS;MAC3BF,IAAI,EAAEV,MAAM,CAACU;IACf,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAOG,KAAK,EAAE;IACdzB,YAAM,CAACC,IAAI,CAAC,8BAA8B,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,EAAEuB,KAAK,CAAC;IAChF3B,uBAAuB,CAAC,CAAC;IACzB,IAAAS,yBAAmB,EAAC,CAAC;IACrB,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASmB,0BAA0BA,CAACC,WAAmB,EAAQ;EACpE,MAAMrC,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,MAAMsC,OAAO,GAAIrC,UAAU,CAA2BqC,OAAO;EAC7D,IAAI,CAACtC,QAAQ,IAAI,CAACsC,OAAO,EAAEC,YAAY,EAAE;EAEzC,MAAMC,OAAO,GAAG,GAAGxC,QAAQ,CAACyC,QAAQ,GAAGzC,QAAQ,CAACI,MAAM,GAAGJ,QAAQ,CAAC0C,IAAI,EAAE;EACxE,MAAMC,MAAM,GAAG,IAAAC,4BAAsB,EAAC,CAAC,IAAIP,WAAW;EACtDC,OAAO,CAACC,YAAY,CAACD,OAAO,CAACtB,KAAK,EAAE,EAAE,EAAE2B,MAAM,CAAC;EAC/C,IAAIA,MAAM,KAAKH,OAAO,EAAE;EAExB,MAAMK,QAAQ,GAAI5C,UAAU,CAAmD6C,aAAa;EAC5F,IAAI,OAAOD,QAAQ,KAAK,UAAU,EAAE;EACpC,IAAI;IACF;IACA;IACA,MAAME,KAAK,GACT,OAAOC,aAAa,KAAK,UAAU,GAC/B,IAAIA,aAAa,CAAC,UAAU,EAAE;MAAEhC,KAAK,EAAEsB,OAAO,CAACtB;IAAM,CAAC,CAAC,GACvD,IAAIiC,KAAK,CAAC,UAAU,CAAC;IAC3BJ,QAAQ,CAACK,IAAI,CAACjD,UAAU,EAAE8C,KAAK,CAAC;EAClC,CAAC,CAAC,OAAOZ,KAAK,EAAE;IACdzB,YAAM,CAACC,IAAI,CAAC,yCAAyC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,EAAEuB,KAAK,CAAC;EAC7F;AACF;AAEA,SAAS3B,uBAAuBA,CAAA,EAAS;EACvC,MAAMR,QAAQ,GAAIC,UAAU,CAAgDD,QAAQ;EACpF,MAAMsC,OAAO,GAAIrC,UAAU,CAA2BqC,OAAO;EAC7D,IAAI,CAACtC,QAAQ,IAAI,CAACsC,OAAO,EAAEC,YAAY,EAAE;EACzC,MAAMY,GAAG,GAAG,IAAIC,GAAG,CAACpD,QAAQ,CAACqD,IAAI,CAAC;EAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,MAAM,CAAC;EAC/BJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;EAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;EACnCnB,0BAA0B,CAAC,GAAGe,GAAG,CAACV,QAAQ,GAAGU,GAAG,CAAC/C,MAAM,GAAG+C,GAAG,CAACT,IAAI,EAAE,CAAC;AACvE;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASc,qBAAqBA,CAAA,EAAY;EAC/C,IAAI,CAAC,IAAAzD,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMC,QAAQ,GAAIC,UAAU,CAAgDD,QAAQ;EACpF,MAAMsC,OAAO,GAAIrC,UAAU,CAA2BqC,OAAO;EAC7D,IAAI,CAACtC,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACI,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;EAErDI,YAAM,CAACC,IAAI,CAAC,yDAAyD,EAAE;IACrEC,SAAS,EAAE;EACb,CAAC,CAAC;EAEF,IAAI0B,OAAO,EAAEC,YAAY,EAAE;IACzB,MAAMY,GAAG,GAAG,IAAIC,GAAG,CAACpD,QAAQ,CAACqD,IAAI,CAAC;IAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;IACnCjB,OAAO,CAACC,YAAY,CAACD,OAAO,CAACtB,KAAK,EAAE,EAAE,EAAE,GAAGmC,GAAG,CAACV,QAAQ,GAAGU,GAAG,CAAC/C,MAAM,GAAG+C,GAAG,CAACT,IAAI,EAAE,CAAC;EACpF;EACA,OAAO,IAAI;AACb","ignoreList":[]}
+{"version":3,"names":["_core","require","_completeOAuthCode","_isWebBrowser","tryCompleteOAuthReturn","opts","isWebBrowser","location","globalThis","params","URLSearchParams","search","code","get","oauthError","stripOAuthParamsFromUrl","clearOAuthHandshake","clientId","logger","warn","component","result","completeOAuthCode","oxyServices","returnedState","handshake","readOAuthHandshake","redirectUri","normalizeOAuthRedirectUri","authRedirectUri","origin","commitSession","cleanup","ok","replaceUrlAfterOAuthReturn","fallbackUrl","history","replaceState","current","pathname","hash","target","consumeOAuthReturnPath","state","dispatch","dispatchEvent","event","PopStateEvent","Event","call","error","url","URL","href","searchParams","delete","consumeHubSyncFailure"],"sourceRoot":"../../../../src","sources":["ui/utils/oauthReturn.ts"],"mappings":";;;;;;;;AACA,IAAAA,KAAA,GAAAC,OAAA;AAOA,IAAAC,kBAAA,GAAAD,OAAA;AAEA,IAAAE,aAAA,GAAAF,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeG,sBAAsBA,CAACC,IAK5C,EAAoB;EACnB,IAAI,CAAC,IAAAC,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMC,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,MAAMC,IAAI,GAAGH,MAAM,CAACI,GAAG,CAAC,MAAM,CAAC;EAC/B,MAAMC,UAAU,GAAGL,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;EACtC,IAAIC,UAAU,EAAE;IACdC,uBAAuB,CAAC,CAAC;IACzB,IAAAC,yBAAmB,EAAC,CAAC;IACrB,OAAO,KAAK;EACd;EACA,IAAI,CAACJ,IAAI,EAAE,OAAO,KAAK;EAEvB,MAAMK,QAAQ,GAAGZ,IAAI,CAACY,QAAQ;EAC9B,IAAI,CAACA,QAAQ,EAAE;IACbC,YAAM,CAACC,IAAI,CAAC,wCAAwC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,CAAC;IACnFL,uBAAuB,CAAC,CAAC;IACzB,IAAAC,yBAAmB,EAAC,CAAC;IACrB,OAAO,KAAK;EACd;EAEA,MAAMK,MAAM,GAAG,MAAM,IAAAC,oCAAiB,EAAC;IACrCC,WAAW,EAAElB,IAAI,CAACkB,WAAW;IAC7BN,QAAQ;IACRL,IAAI;IACJY,aAAa,EAAEf,MAAM,CAACI,GAAG,CAAC,OAAO,CAAC;IAClCY,SAAS,EAAE,IAAAC,wBAAkB,EAAC,CAAC;IAC/BC,WAAW,EAAE,IAAAC,+BAAyB,EAACvB,IAAI,CAACwB,eAAe,IAAItB,QAAQ,CAACuB,MAAM,CAAC;IAC/EC,aAAa,EAAE1B,IAAI,CAAC0B,aAAa;IACjC;IACA;IACA;IACAC,OAAO,EAAEA,CAAA,KAAM;MACbjB,uBAAuB,CAAC,CAAC;MACzB,IAAAC,yBAAmB,EAAC,CAAC;IACvB;EACF,CAAC,CAAC;EACF,OAAOK,MAAM,CAACY,EAAE;AAClB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,0BAA0BA,CAACC,WAAmB,EAAQ;EACpE,MAAM5B,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,MAAM6B,OAAO,GAAI5B,UAAU,CAA2B4B,OAAO;EAC7D,IAAI,CAAC7B,QAAQ,IAAI,CAAC6B,OAAO,EAAEC,YAAY,EAAE;EAEzC,MAAMC,OAAO,GAAG,GAAG/B,QAAQ,CAACgC,QAAQ,GAAGhC,QAAQ,CAACI,MAAM,GAAGJ,QAAQ,CAACiC,IAAI,EAAE;EACxE,MAAMC,MAAM,GAAG,IAAAC,4BAAsB,EAAC,CAAC,IAAIP,WAAW;EACtDC,OAAO,CAACC,YAAY,CAACD,OAAO,CAACO,KAAK,EAAE,EAAE,EAAEF,MAAM,CAAC;EAC/C,IAAIA,MAAM,KAAKH,OAAO,EAAE;EAExB,MAAMM,QAAQ,GAAIpC,UAAU,CAAmDqC,aAAa;EAC5F,IAAI,OAAOD,QAAQ,KAAK,UAAU,EAAE;EACpC,IAAI;IACF;IACA;IACA,MAAME,KAAK,GACT,OAAOC,aAAa,KAAK,UAAU,GAC/B,IAAIA,aAAa,CAAC,UAAU,EAAE;MAAEJ,KAAK,EAAEP,OAAO,CAACO;IAAM,CAAC,CAAC,GACvD,IAAIK,KAAK,CAAC,UAAU,CAAC;IAC3BJ,QAAQ,CAACK,IAAI,CAACzC,UAAU,EAAEsC,KAAK,CAAC;EAClC,CAAC,CAAC,OAAOI,KAAK,EAAE;IACdhC,YAAM,CAACC,IAAI,CAAC,yCAAyC,EAAE;MAAEC,SAAS,EAAE;IAAc,CAAC,EAAE8B,KAAK,CAAC;EAC7F;AACF;AAEA,SAASnC,uBAAuBA,CAAA,EAAS;EACvC,MAAMR,QAAQ,GAAIC,UAAU,CAAgDD,QAAQ;EACpF,MAAM6B,OAAO,GAAI5B,UAAU,CAA2B4B,OAAO;EAC7D,IAAI,CAAC7B,QAAQ,IAAI,CAAC6B,OAAO,EAAEC,YAAY,EAAE;EACzC,MAAMc,GAAG,GAAG,IAAIC,GAAG,CAAC7C,QAAQ,CAAC8C,IAAI,CAAC;EAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,MAAM,CAAC;EAC/BJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,OAAO,CAAC;EAChCJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,mBAAmB,CAAC;EAC5CJ,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;EACnCrB,0BAA0B,CAAC,GAAGiB,GAAG,CAACZ,QAAQ,GAAGY,GAAG,CAACxC,MAAM,GAAGwC,GAAG,CAACX,IAAI,EAAE,CAAC;AACvE;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASgB,qBAAqBA,CAAA,EAAY;EAC/C,IAAI,CAAC,IAAAlD,0BAAY,EAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMC,QAAQ,GAAIC,UAAU,CAA6BD,QAAQ;EACjE,IAAI,CAACA,QAAQ,EAAE,OAAO,KAAK;EAE3B,MAAME,MAAM,GAAG,IAAIC,eAAe,CAACH,QAAQ,CAACI,MAAM,CAAC;EACnD,IAAIF,MAAM,CAACI,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;EAErDK,YAAM,CAACC,IAAI,CAAC,yDAAyD,EAAE;IACrEC,SAAS,EAAE;EACb,CAAC,CAAC;EAEF,MAAM+B,GAAG,GAAG,IAAIC,GAAG,CAAC7C,QAAQ,CAAC8C,IAAI,CAAC;EAClCF,GAAG,CAACG,YAAY,CAACC,MAAM,CAAC,UAAU,CAAC;EACnCrB,0BAA0B,CAAC,GAAGiB,GAAG,CAACZ,QAAQ,GAAGY,GAAG,CAACxC,MAAM,GAAGwC,GAAG,CAACX,IAAI,EAAE,CAAC;EACrE,OAAO,IAAI;AACb","ignoreList":[]}

package/lib/module/index.js

@@ -36,10 +36,10 @@ setPlatformOS(Platform.OS);
 export { default as OxyProvider } from "./ui/components/OxyProvider.js";
 export { useOxy } from "./ui/context/OxyContext.js";
 export { useAuth } from "./ui/hooks/useAuth.js";
-// ---------------------------------------------------------------------------
-// Font loading
-// ---------------------------------------------------------------------------
-export { FontLoader, setupFonts } from './ui/components/FontLoader';
+// Thrown by `switchToAccount` / `switchSession` while `OxyProvider` runs with
+// `sessionMode="identity"` — an identity-bound app authenticates as the owner of
+// the local identity key and cannot switch accounts.
+export { IdentityBoundSessionError } from "./ui/session/identityBinding.js";
 
 // ---------------------------------------------------------------------------
 // Zustand stores
@@ -103,10 +103,24 @@ export { handleAuthError, isInvalidSessionError, isTimeoutOrNetworkError, extrac
 // ---------------------------------------------------------------------------
 export { useFileFiltering } from "./ui/hooks/useFileFiltering.js";
 // ---------------------------------------------------------------------------
+// Device notifications (the ONE `expo-notifications` adapter)
+// ---------------------------------------------------------------------------
+// The Expo-side half of push: permission, platform tag, and the EXPO push token
+// `@oxyhq/core`'s `registerPushToken` accepts (never a raw APNs/FCM token).
+// Native-only by construction — every entry point resolves its null/no-op result
+// from `Platform.OS` before `expo-notifications` is ever imported, and both
+// `expo-notifications` and `expo-constants` are OPTIONAL peers.
+export { pushTokenPlatform, hasNotificationPermission, requestNotificationPermission, getExpoPushToken, takeLaunchNotificationData, installForegroundNotificationHandler, subscribeToNotificationResponses } from "./notifications/deviceNotifications.js";
+// ---------------------------------------------------------------------------
 // UI components
 // ---------------------------------------------------------------------------
 export { OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY } from '@oxyhq/core';
 export { default as OxySignInButton } from "./ui/components/OxySignInButton.js";
+// Web OAuth transport (popup / redirect). RPs that ship their own sign-in
+// button call `useOxy().startWebOAuthSignIn(...)`; only the popup opener is
+// exported, because it MUST run synchronously inside the press handler to keep
+// the browser's user-gesture attribution.
+export { openOAuthPopup } from "./ui/oauth/oauthPopup.js";
 export { OxyAuthPrompt } from "./ui/components/OxyAuthPrompt.js";
 export { OxyOAuthCallback } from "./ui/components/OxyOAuthCallback.js";
 export { OxyConsentScreen } from "./ui/components/OxyConsentScreen.js";
@@ -131,6 +145,15 @@ export { default as ProfileButton } from "./ui/components/ProfileButton.js";
 // host (e.g. a future auth.oxy.so hub page) can mount the exact same chooser
 // with its own completion strategy.
 export { default as OxyAuthChooser } from "./ui/components/OxyAuthChooser.js";
+// The in-flight "Sign in with Oxy" REQUEST surface — the route's primary visual,
+// the progress line, and the "Having trouble?" alternatives — as a purely
+// presentational component driven by plain facts. `OxyAuthChooser` renders it
+// from `AccountDialogController`'s device flow; a host with a request of its own
+// (the auth.oxy.so IdP's OAuth-bound lane) renders the SAME component from its
+// own facts, so there is one implementation of this surface, not two. It needs
+// no controller: `route` + `progress` + `qrPayload` + the failure flags are the
+// whole contract, and none of them is a secret credential.
+export { OxySignInRequestSurface } from "./ui/components/OxySignInRequestSurface.js";
 // Unified switchable-accounts hook — the single source of everything the user
 // can switch into: device sign-ins AND linked graph accounts (owned orgs +
 // shared-with-you), deduped by account id and hydrated with real