@oxyhq/services 23.0.1 → 23.0.2

package/lib/commonjs/ui/screens/trust/trustTier.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["TRUST_TIER_FALLBACK","new","trusted","high_trust","verified","restricted","getTrustTierLabel","tier","t"],"sourceRoot":"../../../../../src","sources":["ui/screens/trust/trustTier.ts"],"mappings":";;;;;;AAIA;AACA,MAAMA,mBAA8C,GAAG;EACnDC,GAAG,EAAE,KAAK;EACVC,OAAO,EAAE,SAAS;EAClBC,UAAU,EAAE,YAAY;EACxBC,QAAQ,EAAE,UAAU;EACpBC,UAAU,EAAE;AAChB,CAAC;;AAED;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACC,IAAe,EAAEC,CAAY,EAAU;EACrE,OAAOA,CAAC,CAAC,eAAeD,IAAI,EAAE,CAAC,IAAIP,mBAAmB,CAACO,IAAI,CAAC;AAChE","ignoreList":[]}

package/lib/commonjs/ui/server.js

@@ -1,86 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.ProfileScreen = exports.OxySignInButton = exports.OxyProvider = exports.OxyPayButton = exports.LogoText = exports.LogoIcon = exports.FollowButton = void 0;
-Object.defineProperty(exports, "extractErrorMessage", {
-  enumerable: true,
-  get: function () {
-    return _errorHandlers.extractErrorMessage;
-  }
-});
-Object.defineProperty(exports, "handleAuthError", {
-  enumerable: true,
-  get: function () {
-    return _errorHandlers.handleAuthError;
-  }
-});
-Object.defineProperty(exports, "isInvalidSessionError", {
-  enumerable: true,
-  get: function () {
-    return _errorHandlers.isInvalidSessionError;
-  }
-});
-Object.defineProperty(exports, "isTimeoutOrNetworkError", {
-  enumerable: true,
-  get: function () {
-    return _errorHandlers.isTimeoutOrNetworkError;
-  }
-});
-exports.useStorage = exports.useOxy = exports.useFollow = exports.useAuthStore = exports.useAuth = exports.useAccountStore = exports.toast = void 0;
-var _errorHandlers = require("./utils/errorHandlers.js");
-/**
- * Server-safe UI exports (noops)
- *
- * Import from this module for SSR environments where React components
- * shouldn't be rendered on the server.
- *
- * @example
- * import { OxyProvider, useOxy } from '@oxyhq/services/ui/server';
- */
-
-// Noop utilities
-const noopComponent = () => null;
-const noopHook = () => ({});
-const noopStorageResult = {
-  storage: null,
-  isReady: false
-};
-
-// Components (all render null)
-const OxyProvider = exports.OxyProvider = noopComponent;
-const OxySignInButton = exports.OxySignInButton = noopComponent;
-const LogoIcon = exports.LogoIcon = noopComponent;
-const LogoText = exports.LogoText = noopComponent;
-const FollowButton = exports.FollowButton = noopComponent;
-const OxyPayButton = exports.OxyPayButton = noopComponent;
-
-// Context
-const useOxy = exports.useOxy = noopHook;
-
-// Hooks (all return empty objects)
-const useAuth = exports.useAuth = noopHook;
-const useFollow = exports.useFollow = noopHook;
-const useStorage = () => noopStorageResult;
-
-// Screens (render null)
-exports.useStorage = useStorage;
-const ProfileScreen = exports.ProfileScreen = noopComponent;
-
-// Stores (return empty objects)
-const useAuthStore = exports.useAuthStore = noopHook;
-const useAccountStore = exports.useAccountStore = noopHook;
-
-// Toast (noop)
-const toast = exports.toast = Object.assign(() => {}, {
-  success: () => {},
-  error: () => {},
-  info: () => {},
-  warning: () => {},
-  loading: () => {},
-  dismiss: () => {}
-});
-
-// Error handler utilities (pure functions work everywhere)
-//# sourceMappingURL=server.js.map

package/lib/commonjs/ui/server.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_errorHandlers","require","noopComponent","noopHook","noopStorageResult","storage","isReady","OxyProvider","exports","OxySignInButton","LogoIcon","LogoText","FollowButton","OxyPayButton","useOxy","useAuth","useFollow","useStorage","ProfileScreen","useAuthStore","useAccountStore","toast","Object","assign","success","error","info","warning","loading","dismiss"],"sourceRoot":"../../../src","sources":["ui/server.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,IAAAA,cAAA,GAAAC,OAAA;AApDA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA,MAAMC,aAAa,GAAGA,CAAA,KAAM,IAAI;AAChC,MAAMC,QAAQ,GAAGA,CAAA,MAAO,CAAC,CAAC,CAAC;AAC3B,MAAMC,iBAAiB,GAAG;EAAEC,OAAO,EAAE,IAAI;EAAEC,OAAO,EAAE;AAAM,CAAC;;AAE3D;AACO,MAAMC,WAAW,GAAAC,OAAA,CAAAD,WAAA,GAAGL,aAAa;AACjC,MAAMO,eAAe,GAAAD,OAAA,CAAAC,eAAA,GAAGP,aAAa;AACrC,MAAMQ,QAAQ,GAAAF,OAAA,CAAAE,QAAA,GAAGR,aAAa;AAC9B,MAAMS,QAAQ,GAAAH,OAAA,CAAAG,QAAA,GAAGT,aAAa;AAC9B,MAAMU,YAAY,GAAAJ,OAAA,CAAAI,YAAA,GAAGV,aAAa;AAClC,MAAMW,YAAY,GAAAL,OAAA,CAAAK,YAAA,GAAGX,aAAa;;AAEzC;AACO,MAAMY,MAAM,GAAAN,OAAA,CAAAM,MAAA,GAAGX,QAAQ;;AAE9B;AACO,MAAMY,OAAO,GAAAP,OAAA,CAAAO,OAAA,GAAGZ,QAAQ;AACxB,MAAMa,SAAS,GAAAR,OAAA,CAAAQ,SAAA,GAAGb,QAAQ;AAC1B,MAAMc,UAAU,GAAGA,CAAA,KAAMb,iBAAiB;;AAEjD;AAAAI,OAAA,CAAAS,UAAA,GAAAA,UAAA;AACO,MAAMC,aAAa,GAAAV,OAAA,CAAAU,aAAA,GAAGhB,aAAa;;AAE1C;AACO,MAAMiB,YAAY,GAAAX,OAAA,CAAAW,YAAA,GAAGhB,QAAQ;AAC7B,MAAMiB,eAAe,GAAAZ,OAAA,CAAAY,eAAA,GAAGjB,QAAQ;;AAEvC;AACO,MAAMkB,KAAK,GAAAb,OAAA,CAAAa,KAAA,GAAGC,MAAM,CAACC,MAAM,CAC9B,MAAM,CAAC,CAAC,EACR;EACIC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,KAAK,EAAEA,CAAA,KAAM,CAAC,CAAC;EACfC,IAAI,EAAEA,CAAA,KAAM,CAAC,CAAC;EACdC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC;AACpB,CACJ,CAAC;;AAED","ignoreList":[]}

package/lib/commonjs/ui/session/authStore.js

@@ -1,39 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createPlatformAuthStateStore = createPlatformAuthStateStore;
-var _core = require("@oxyhq/core");
-var _storageHelpers = require("../utils/storageHelpers.js");
-var _nativeSecureStorage = require("./nativeSecureStorage.js");
-/**
- * Platform `AuthStateStore` for `@oxyhq/services`.
- *
- * The zero-cookie device model persists the durable device credential
- * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
- * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
- * owns the store shape + logic (`createWebAuthStateStore` /
- * `createNativeAuthStateStore`); this module only selects the platform storage
- * seam:
- *
- *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
- *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
- *    the shared `createNativeSecureKeyValueStorage()` adapter
- *    (`expo-secure-store`, AsyncStorage fallback).
- */
-
-/**
- * Build the platform {@link AuthStateStore} for this runtime.
- *
- * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
- * token) per-app in SecureStore; the SDK re-mints the access token from the
- * device credential on the next cold boot.
- */
-function createPlatformAuthStateStore() {
-  if (!(0, _storageHelpers.isReactNative)()) {
-    return (0, _core.createWebAuthStateStore)();
-  }
-  return (0, _core.createNativeAuthStateStore)((0, _nativeSecureStorage.createNativeSecureKeyValueStorage)());
-}
-//# sourceMappingURL=authStore.js.map

package/lib/commonjs/ui/session/authStore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","_storageHelpers","_nativeSecureStorage","createPlatformAuthStateStore","isReactNative","createWebAuthStateStore","createNativeAuthStateStore","createNativeSecureKeyValueStorage"],"sourceRoot":"../../../../src","sources":["ui/session/authStore.ts"],"mappings":";;;;;;AAeA,IAAAA,KAAA,GAAAC,OAAA;AAKA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,oBAAA,GAAAF,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,4BAA4BA,CAAA,EAAmB;EAC7D,IAAI,CAAC,IAAAC,6BAAa,EAAC,CAAC,EAAE;IACpB,OAAO,IAAAC,6BAAuB,EAAC,CAAC;EAClC;EAEA,OAAO,IAAAC,gCAA0B,EAAC,IAAAC,sDAAiC,EAAC,CAAC,CAAC;AACxE","ignoreList":[]}

package/lib/commonjs/ui/session/createSessionClient.js

@@ -1,58 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createSessionClient = createSessionClient;
-var _socket = require("socket.io-client");
-var _core = require("@oxyhq/core");
-var _tokenTransport = require("./tokenTransport.js");
-/**
- * Wire a `SessionClient` for `@oxyhq/services`.
- *
- * The platform-agnostic parts (host adapter, client, projection helpers) live
- * ONCE in `@oxyhq/core`; this thin factory only injects the pieces specific to
- * the RN/Expo SDK:
- *
- *  - `socket.io-client`'s `io`, STATICALLY imported (socket.io-client is a real
- *    dependency of `@oxyhq/services`) so realtime session sync never relies on
- *    core's lazy dynamic import of a bare specifier — bundler-fragile in
- *    Metro/Expo-web against the published core dist.
- *  - the device-first {@link createTokenTransport}, which mints a fallback token
- *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
- *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
- *    so it takes no `store` of its own).
- *
- * `onUnauthenticated` fires when an applied device state has zero accounts. It
- * receives the {@link SessionStateOrigin} so the provider can gate the
- * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
- * revocation) clears the persisted store; a `push`-origin verdict (a possibly
- * transient socket broadcast) clears only the local UI session and KEEPS the
- * durable device credential. The host is returned alongside the client so the
- * caller can call `host.setCurrentAccountId(...)` as the active account changes.
- *
- * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
- * when signed out (after the one-shot join redirect).
- *
- * `getPinnedAccountId` reports the account an IDENTITY-BOUND provider
- * (`sessionMode: 'identity'`) is pinned to, and `null` for every account-mode
- * provider — which is exactly the value `SessionClient` and the transport read
- * when the option is absent, so account mode is unchanged. While it reports an
- * account, the client tracks device state truthfully but never re-binds its
- * bearer to the device's mutable active account.
- */
-function createSessionClient(oxyServices, onUnauthenticated, getPinnedAccountId) {
-  const host = (0, _core.createSessionClientHost)(oxyServices);
-  const transport = (0, _tokenTransport.createTokenTransport)(oxyServices, getPinnedAccountId);
-  const client = new _core.SessionClient(host, {
-    transport,
-    socketFactory: _socket.io,
-    onUnauthenticated,
-    getPinnedAccountId
-  });
-  return {
-    client,
-    host
-  };
-}
-//# sourceMappingURL=createSessionClient.js.map

package/lib/commonjs/ui/session/createSessionClient.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_socket","require","_core","_tokenTransport","createSessionClient","oxyServices","onUnauthenticated","getPinnedAccountId","host","createSessionClientHost","transport","createTokenTransport","client","SessionClient","socketFactory","io"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAMA,IAAAE,eAAA,GAAAF,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EACxDC,kBAAwC,EAIxC;EACA,MAAMC,IAAI,GAAG,IAAAC,6BAAuB,EAACJ,WAAW,CAAC;EACjD,MAAMK,SAAS,GAAG,IAAAC,oCAAoB,EAACN,WAAW,EAAEE,kBAAkB,CAAC;EACvE,MAAMK,MAAM,GAAG,IAAIC,mBAAa,CAACL,IAAI,EAAE;IACrCE,SAAS;IACTI,aAAa,EAAEC,UAAE;IACjBT,iBAAiB;IACjBC;EACF,CAAC,CAAC;EACF,OAAO;IAAEK,MAAM;IAAEJ;EAAK,CAAC;AACzB","ignoreList":[]}

package/lib/commonjs/ui/session/identityBinding.js

@@ -1,95 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.IdentityBoundSessionError = void 0;
-exports.createIdentitySessionBinding = createIdentitySessionBinding;
-var _core = require("@oxyhq/core");
-var _storageHelpers = require("../utils/storageHelpers.js");
-var _nativeSecureStorage = require("./nativeSecureStorage.js");
-/**
- * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
- *
- * `@oxyhq/core` owns everything platform-agnostic about an identity-bound
- * session: the pin store shapes, `resolveIdentityPin`,
- * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
- * deliberately leaves out is WHICH pin store a given runtime should use, so this
- * module supplies it — web `localStorage` vs the same native SecureStore adapter
- * the device credential already persists through — and adds the one piece of
- * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
- * account id.
- *
- * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
- * on the socket/apply path, while resolving the pin is asynchronous (a storage
- * read plus a keychain read, through `resolveIdentityPin`). The provider
- * resolves it before the cold boot and after every (re-)established identity
- * session; every read after that is free.
- */
-
-/**
- * The provider-scoped identity binding: the core {@link IdentityBinding} handed
- * to the cold boot and the re-mint handler, plus the resolved pin the projection
- * and `SessionClient` bind to.
- */
-
-/**
- * Thrown by every account-graph mutation while the provider runs in
- * `sessionMode: 'identity'`.
- *
- * An identity-bound app's user is the owner of the local identity key — fixed,
- * for the lifetime of that key. Switching it is not a temporarily-unavailable
- * operation that could be retried, it is not part of this mode's contract at
- * all, so the surfaces reject loudly rather than resolving to a no-op that would
- * read to the caller as a successful switch.
- */
-class IdentityBoundSessionError extends Error {
-  name = 'IdentityBoundSessionError';
-  code = 'identity_bound_session';
-  constructor(operation) {
-    super(`"${operation}" is unavailable while the session is identity-bound (sessionMode: "identity"): this app authenticates as the owner of the local identity key and cannot switch accounts.`);
-    this.operation = operation;
-  }
-}
-
-/**
- * Build the identity binding for this runtime. Called ONCE per provider mount,
- * and ONLY when `sessionMode: 'identity'` — account-mode providers never
- * construct a pin store.
- */
-exports.IdentityBoundSessionError = IdentityBoundSessionError;
-function createIdentitySessionBinding() {
-  const pinStore = (0, _storageHelpers.isReactNative)() ? (0, _core.createNativeIdentityPinStore)((0, _nativeSecureStorage.createNativeSecureKeyValueStorage)()) : (0, _core.createWebIdentityPinStore)();
-  const binding = {
-    pinStore
-  };
-
-  // Only a RESOLVED (non-null) pin is memoised. A `null` outcome is either "not
-  // pinned yet" or an indeterminate key read (locked keychain), and caching
-  // either one would leave this client permanently unpinned for the rest of the
-  // process — the exact state in which it would start following the device's
-  // mutable active account.
-  let pinnedAccountId = null;
-  let inFlight = null;
-  const resolve = () => {
-    if (!inFlight) {
-      inFlight = (0, _core.resolveIdentityPin)(binding).then(pin => {
-        pinnedAccountId = pin?.accountId ?? null;
-        return pinnedAccountId;
-      }).finally(() => {
-        inFlight = null;
-      });
-    }
-    return inFlight;
-  };
-  return {
-    binding,
-    getPinnedAccountId: () => pinnedAccountId,
-    ensurePinnedAccountId: () => pinnedAccountId !== null ? Promise.resolve(pinnedAccountId) : resolve(),
-    refreshPinnedAccountId: () => {
-      pinnedAccountId = null;
-      return resolve();
-    }
-  };
-}
-//# sourceMappingURL=identityBinding.js.map

package/lib/commonjs/ui/session/identityBinding.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","_storageHelpers","_nativeSecureStorage","IdentityBoundSessionError","Error","name","code","constructor","operation","exports","createIdentitySessionBinding","pinStore","isReactNative","createNativeIdentityPinStore","createNativeSecureKeyValueStorage","createWebIdentityPinStore","binding","pinnedAccountId","inFlight","resolve","resolveIdentityPin","then","pin","accountId","finally","getPinnedAccountId","ensurePinnedAccountId","Promise","refreshPinnedAccountId"],"sourceRoot":"../../../../src","sources":["ui/session/identityBinding.ts"],"mappings":";;;;;;;AAkBA,IAAAA,KAAA,GAAAC,OAAA;AAMA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,oBAAA,GAAAF,OAAA;AAzBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;AACA;AACA;;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,yBAAyB,SAASC,KAAK,CAAC;EACjCC,IAAI,GAAG,2BAA2B;EAC3CC,IAAI,GAAG,wBAAwB;EACxCC,WAAWA,CAAUC,SAAiB,EAAE;IACtC,KAAK,CACH,IAAIA,SAAS,2KACf,CAAC;IAAC,KAHiBA,SAAiB,GAAjBA,SAAiB;EAItC;AACF;;AAEA;AACA;AACA;AACA;AACA;AAJAC,OAAA,CAAAN,yBAAA,GAAAA,yBAAA;AAKO,SAASO,4BAA4BA,CAAA,EAA2B;EACrE,MAAMC,QAAQ,GAAG,IAAAC,6BAAa,EAAC,CAAC,GAC5B,IAAAC,kCAA4B,EAAC,IAAAC,sDAAiC,EAAC,CAAC,CAAC,GACjE,IAAAC,+BAAyB,EAAC,CAAC;EAC/B,MAAMC,OAAwB,GAAG;IAAEL;EAAS,CAAC;;EAE7C;EACA;EACA;EACA;EACA;EACA,IAAIM,eAA8B,GAAG,IAAI;EACzC,IAAIC,QAAuC,GAAG,IAAI;EAElD,MAAMC,OAAO,GAAGA,CAAA,KAA8B;IAC5C,IAAI,CAACD,QAAQ,EAAE;MACbA,QAAQ,GAAG,IAAAE,wBAAkB,EAACJ,OAAO,CAAC,CACnCK,IAAI,CAAEC,GAAG,IAAK;QACbL,eAAe,GAAGK,GAAG,EAAEC,SAAS,IAAI,IAAI;QACxC,OAAON,eAAe;MACxB,CAAC,CAAC,CACDO,OAAO,CAAC,MAAM;QACbN,QAAQ,GAAG,IAAI;MACjB,CAAC,CAAC;IACN;IACA,OAAOA,QAAQ;EACjB,CAAC;EAED,OAAO;IACLF,OAAO;IACPS,kBAAkB,EAAEA,CAAA,KAAMR,eAAe;IACzCS,qBAAqB,EAAEA,CAAA,KACrBT,eAAe,KAAK,IAAI,GAAGU,OAAO,CAACR,OAAO,CAACF,eAAe,CAAC,GAAGE,OAAO,CAAC,CAAC;IACzES,sBAAsB,EAAEA,CAAA,KAAM;MAC5BX,eAAe,GAAG,IAAI;MACtB,OAAOE,OAAO,CAAC,CAAC;IAClB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/index.js

@@ -1,71 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-Object.defineProperty(exports, "IdentityBoundSessionError", {
-  enumerable: true,
-  get: function () {
-    return _identityBinding.IdentityBoundSessionError;
-  }
-});
-Object.defineProperty(exports, "accountIdsOf", {
-  enumerable: true,
-  get: function () {
-    return _core.accountIdsOf;
-  }
-});
-Object.defineProperty(exports, "activeSessionIdOf", {
-  enumerable: true,
-  get: function () {
-    return _core.activeSessionIdOf;
-  }
-});
-Object.defineProperty(exports, "activeUserOf", {
-  enumerable: true,
-  get: function () {
-    return _core.activeUserOf;
-  }
-});
-Object.defineProperty(exports, "createIdentitySessionBinding", {
-  enumerable: true,
-  get: function () {
-    return _identityBinding.createIdentitySessionBinding;
-  }
-});
-Object.defineProperty(exports, "createPlatformAuthStateStore", {
-  enumerable: true,
-  get: function () {
-    return _authStore.createPlatformAuthStateStore;
-  }
-});
-Object.defineProperty(exports, "createSessionClient", {
-  enumerable: true,
-  get: function () {
-    return _createSessionClient.createSessionClient;
-  }
-});
-Object.defineProperty(exports, "createSessionClientHost", {
-  enumerable: true,
-  get: function () {
-    return _core.createSessionClientHost;
-  }
-});
-Object.defineProperty(exports, "createTokenTransport", {
-  enumerable: true,
-  get: function () {
-    return _tokenTransport.createTokenTransport;
-  }
-});
-Object.defineProperty(exports, "deviceStateToClientSessions", {
-  enumerable: true,
-  get: function () {
-    return _core.deviceStateToClientSessions;
-  }
-});
-var _createSessionClient = require("./createSessionClient.js");
-var _tokenTransport = require("./tokenTransport.js");
-var _authStore = require("./authStore.js");
-var _identityBinding = require("./identityBinding.js");
-var _core = require("@oxyhq/core");
-//# sourceMappingURL=index.js.map

package/lib/commonjs/ui/session/index.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_createSessionClient","require","_tokenTransport","_authStore","_identityBinding","_core"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAAA,oBAAA,GAAAC,OAAA;AACA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA","ignoreList":[]}

package/lib/commonjs/ui/session/nativeSecureStorage.js

@@ -1,90 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createNativeSecureKeyValueStorage = createNativeSecureKeyValueStorage;
-var _storageHelpers = require("../utils/storageHelpers.js");
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
- * The native secure key/value seam every durable `@oxyhq/core` store in this
- * package is built on.
- *
- * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
- * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
- * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
- * module supplies that injection ONCE, so those stores can never drift onto
- * different backings — a device credential in SecureStore and a pin in
- * AsyncStorage would resolve differently after a keystore reset.
- *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
- */
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-let secureStorePromise = null;
-
-/**
- * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
- * unavailable — callers then fall back to AsyncStorage. Never throws.
- */
-function loadSecureStore() {
-  if (!secureStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    secureStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod)
-        };
-      }
-      return null;
-    }).catch(() => null);
-  }
-  return secureStorePromise;
-}
-
-/**
- * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
- * at rest) and falls back to AsyncStorage when SecureStore is not installed.
- * The SecureStore module is resolved lazily on first access so construction
- * stays synchronous.
- */
-function createNativeSecureKeyValueStorage() {
-  let asyncStorage = null;
-  const getAsyncStorage = async () => {
-    if (!asyncStorage) {
-      asyncStorage = await (0, _storageHelpers.createPlatformStorage)();
-    }
-    return asyncStorage;
-  };
-  return {
-    getItem: async key => {
-      const secure = await loadSecureStore();
-      if (secure) {
-        return secure.getItemAsync(key);
-      }
-      return (await getAsyncStorage()).getItem(key);
-    },
-    setItem: async (key, value) => {
-      const secure = await loadSecureStore();
-      if (secure) {
-        await secure.setItemAsync(key, value);
-        return;
-      }
-      await (await getAsyncStorage()).setItem(key, value);
-    },
-    removeItem: async key => {
-      const secure = await loadSecureStore();
-      if (secure) {
-        await secure.deleteItemAsync(key);
-        return;
-      }
-      await (await getAsyncStorage()).removeItem(key);
-    }
-  };
-}
-//# sourceMappingURL=nativeSecureStorage.js.map

package/lib/commonjs/ui/session/nativeSecureStorage.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_storageHelpers","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","createPlatformStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;;;;;AAiBA,IAAAA,eAAA,GAAAC,OAAA;AAAgE,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAjBhE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA;AACA;AACA,MAAMkB,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAArB,CAAA,IAAAA,CAAA,IAAAoB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA3B,uBAAA,CAAAD,OAAA,CAAA4B,CAAA,KAAOJ,UAAU,EACnCG,IAAI,CAAEE,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOZ,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASa,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAM,IAAAE,qCAAqB,EAAC,CAAC;IAC9C;IACA,OAAOF,YAAY;EACrB,CAAC;EACD,OAAO;IACLG,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,OAAOA,MAAM,CAACX,YAAY,CAACU,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEE,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACV,YAAY,CAACS,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAMN,eAAe,CAAC,CAAC,EAAEK,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,eAAe,CAACQ,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEO,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/tokenTransport.js

@@ -1,75 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createTokenTransport = createTokenTransport;
-var _core = require("@oxyhq/core");
-/**
- * Platform `TokenTransport` for `SessionClient` (device-first model).
- *
- * `ensureActiveToken` is the fallback the client uses when a `session_state`
- * push arrived WITHOUT an embedded `activeToken` and the planted bearer does not
- * already belong to the state's active account. It mints one through the ONE
- * unified single-flight the scheduler, the request-time preflight, and the 401
- * retry all use — `oxyServices.httpService.refreshAccessToken(...)` — which runs
- * the installed refresh handler (present the persisted zero-cookie `deviceId` +
- * `deviceSecret` at `POST /session/device/token`, which mints for the device's
- * CURRENT active account). Routing through the SAME entry point means this lane
- * can never double-rotate the device secret against the others: it has NO
- * private single-flight of its own.
- *
- * The short-circuit compares the planted bearer's ACCOUNT against
- * `state.activeAccountId`, not mere token presence: a bearer for the PREVIOUS
- * account (an account switch) must still mint the new account's token — skipping
- * on presence alone would leave a subscriber observing the new active account
- * under the old account's bearer (the account-switch 404 race).
- *
- * A failure is logged and swallowed: this method must never throw out (it runs
- * inside the socket state handler).
- *
- * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
- * on `state.activeAccountId` is precisely what an identity-bound client must
- * never do — its token is minted for the PINNED account by the cold boot /
- * re-mint lane. `SessionClient` already bypasses the transport entirely while
- * pinned; this guard is the services-side half of that contract, so no future
- * wiring can reintroduce the convergence from this end.
- */
-function createTokenTransport(oxyServices, getPinnedAccountId) {
-  return {
-    async ensureActiveToken(state) {
-      if ((getPinnedAccountId?.() ?? null) !== null) {
-        return;
-      }
-      try {
-        // Skip the mint ONLY when the planted bearer already identifies the
-        // active account. `getCurrentUserId()` decodes the bearer's `userId`/`id`
-        // (null when absent/opaque), directly comparable to the account id.
-        const activeAccountId = state.activeAccountId;
-        if (activeAccountId !== null && oxyServices.getCurrentUserId() === activeAccountId) {
-          return;
-        }
-      } catch (error) {
-        _core.logger.warn('ensureActiveToken: bearer-account check threw', {
-          component: 'TokenTransport'
-        }, error);
-      }
-      try {
-        // The shared HttpService single-flight coalesces concurrent callers onto
-        // one in-flight mint; no local `inFlightMint` guard is needed.
-        const token = await oxyServices.httpService.refreshAccessToken('preflight');
-        if (!token) {
-          _core.logger.debug('ensureActiveToken: refresh produced no session', {
-            component: 'TokenTransport',
-            deviceId: state.deviceId
-          });
-        }
-      } catch (error) {
-        _core.logger.warn('ensureActiveToken: refresh failed', {
-          component: 'TokenTransport'
-        }, error);
-      }
-    }
-  };
-}
-//# sourceMappingURL=tokenTransport.js.map

package/lib/commonjs/ui/session/tokenTransport.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","createTokenTransport","oxyServices","getPinnedAccountId","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","logger","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAClCC,WAAwB,EACxBC,kBAAwC,EACxB;EAChB,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI,CAACF,kBAAkB,GAAG,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE;QAC7C;MACF;MACA,IAAI;QACF;QACA;QACA;QACA,MAAMG,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIJ,WAAW,CAACK,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMI,KAAK,GAAG,MAAMV,WAAW,CAACW,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVH,YAAM,CAACM,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEX,KAAK,CAACW;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOR,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}