@oxyhq/services 23.0.2 → 23.1.0

package/lib/module/ui/server.js

@@ -0,0 +1,56 @@
+"use strict";
+
+/**
+ * Server-safe UI exports (noops)
+ *
+ * Import from this module for SSR environments where React components
+ * shouldn't be rendered on the server.
+ *
+ * @example
+ * import { OxyProvider, useOxy } from '@oxyhq/services/ui/server';
+ */
+
+// Noop utilities
+const noopComponent = () => null;
+const noopHook = () => ({});
+const noopStorageResult = {
+  storage: null,
+  isReady: false
+};
+
+// Components (all render null)
+export const OxyProvider = noopComponent;
+export const OxySignInButton = noopComponent;
+export const LogoIcon = noopComponent;
+export const LogoText = noopComponent;
+export const FollowButton = noopComponent;
+export const OxyPayButton = noopComponent;
+
+// Context
+export const useOxy = noopHook;
+
+// Hooks (all return empty objects)
+export const useAuth = noopHook;
+export const useFollow = noopHook;
+export const useStorage = () => noopStorageResult;
+
+// Screens (render null)
+export const ProfileScreen = noopComponent;
+
+// Stores (return empty objects)
+export const useAuthStore = noopHook;
+export const useAccountStore = noopHook;
+
+// Toast (noop)
+export const toast = Object.assign(() => {}, {
+  success: () => {},
+  error: () => {},
+  info: () => {},
+  warning: () => {},
+  loading: () => {},
+  dismiss: () => {}
+});
+
+// Error handler utilities (pure functions work everywhere)
+export { handleAuthError, isInvalidSessionError, isTimeoutOrNetworkError, extractErrorMessage } from "./utils/errorHandlers.js";
+//# sourceMappingURL=server.js.map

package/lib/module/ui/server.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["noopComponent","noopHook","noopStorageResult","storage","isReady","OxyProvider","OxySignInButton","LogoIcon","LogoText","FollowButton","OxyPayButton","useOxy","useAuth","useFollow","useStorage","ProfileScreen","useAuthStore","useAccountStore","toast","Object","assign","success","error","info","warning","loading","dismiss","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage"],"sourceRoot":"../../../src","sources":["ui/server.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA,MAAMA,aAAa,GAAGA,CAAA,KAAM,IAAI;AAChC,MAAMC,QAAQ,GAAGA,CAAA,MAAO,CAAC,CAAC,CAAC;AAC3B,MAAMC,iBAAiB,GAAG;EAAEC,OAAO,EAAE,IAAI;EAAEC,OAAO,EAAE;AAAM,CAAC;;AAE3D;AACA,OAAO,MAAMC,WAAW,GAAGL,aAAa;AACxC,OAAO,MAAMM,eAAe,GAAGN,aAAa;AAC5C,OAAO,MAAMO,QAAQ,GAAGP,aAAa;AACrC,OAAO,MAAMQ,QAAQ,GAAGR,aAAa;AACrC,OAAO,MAAMS,YAAY,GAAGT,aAAa;AACzC,OAAO,MAAMU,YAAY,GAAGV,aAAa;;AAEzC;AACA,OAAO,MAAMW,MAAM,GAAGV,QAAQ;;AAE9B;AACA,OAAO,MAAMW,OAAO,GAAGX,QAAQ;AAC/B,OAAO,MAAMY,SAAS,GAAGZ,QAAQ;AACjC,OAAO,MAAMa,UAAU,GAAGA,CAAA,KAAMZ,iBAAiB;;AAEjD;AACA,OAAO,MAAMa,aAAa,GAAGf,aAAa;;AAE1C;AACA,OAAO,MAAMgB,YAAY,GAAGf,QAAQ;AACpC,OAAO,MAAMgB,eAAe,GAAGhB,QAAQ;;AAEvC;AACA,OAAO,MAAMiB,KAAK,GAAGC,MAAM,CAACC,MAAM,CAC9B,MAAM,CAAC,CAAC,EACR;EACIC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,KAAK,EAAEA,CAAA,KAAM,CAAC,CAAC;EACfC,IAAI,EAAEA,CAAA,KAAM,CAAC,CAAC;EACdC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC,CAAC;EACjBC,OAAO,EAAEA,CAAA,KAAM,CAAC;AACpB,CACJ,CAAC;;AAED;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,0BAAuB","ignoreList":[]}

package/lib/module/ui/session/authStore.js

@@ -0,0 +1,35 @@
+"use strict";
+
+/**
+ * Platform `AuthStateStore` for `@oxyhq/services`.
+ *
+ * The zero-cookie device model persists the durable device credential
+ * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
+ * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
+ * owns the store shape + logic (`createWebAuthStateStore` /
+ * `createNativeAuthStateStore`); this module only selects the platform storage
+ * seam:
+ *
+ *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
+ *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
+ *    the shared `createNativeSecureKeyValueStorage()` adapter
+ *    (`expo-secure-store`, AsyncStorage fallback).
+ */
+import { createWebAuthStateStore, createNativeAuthStateStore } from '@oxyhq/core';
+import { isReactNative } from "../utils/storageHelpers.js";
+import { createNativeSecureKeyValueStorage } from "./nativeSecureStorage.js";
+
+/**
+ * Build the platform {@link AuthStateStore} for this runtime.
+ *
+ * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
+ * token) per-app in SecureStore; the SDK re-mints the access token from the
+ * device credential on the next cold boot.
+ */
+export function createPlatformAuthStateStore() {
+  if (!isReactNative()) {
+    return createWebAuthStateStore();
+  }
+  return createNativeAuthStateStore(createNativeSecureKeyValueStorage());
+}
+//# sourceMappingURL=authStore.js.map

package/lib/module/ui/session/authStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createWebAuthStateStore","createNativeAuthStateStore","isReactNative","createNativeSecureKeyValueStorage","createPlatformAuthStateStore"],"sourceRoot":"../../../../src","sources":["ui/session/authStore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEA,uBAAuB,EACvBC,0BAA0B,QAErB,aAAa;AACpB,SAASC,aAAa,QAAQ,4BAAyB;AACvD,SAASC,iCAAiC,QAAQ,0BAAuB;;AAEzE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,4BAA4BA,CAAA,EAAmB;EAC7D,IAAI,CAACF,aAAa,CAAC,CAAC,EAAE;IACpB,OAAOF,uBAAuB,CAAC,CAAC;EAClC;EAEA,OAAOC,0BAA0B,CAACE,iCAAiC,CAAC,CAAC,CAAC;AACxE","ignoreList":[]}

package/lib/module/ui/session/createSessionClient.js

@@ -0,0 +1,55 @@
+"use strict";
+
+import { io } from 'socket.io-client';
+import { SessionClient, createSessionClientHost } from '@oxyhq/core';
+import { createTokenTransport } from "./tokenTransport.js";
+
+/**
+ * Wire a `SessionClient` for `@oxyhq/services`.
+ *
+ * The platform-agnostic parts (host adapter, client, projection helpers) live
+ * ONCE in `@oxyhq/core`; this thin factory only injects the pieces specific to
+ * the RN/Expo SDK:
+ *
+ *  - `socket.io-client`'s `io`, STATICALLY imported (socket.io-client is a real
+ *    dependency of `@oxyhq/services`) so realtime session sync never relies on
+ *    core's lazy dynamic import of a bare specifier — bundler-fragile in
+ *    Metro/Expo-web against the published core dist.
+ *  - the device-first {@link createTokenTransport}, which mints a fallback token
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
+ *
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
+ *
+ * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
+ * when signed out (after the one-shot join redirect).
+ *
+ * `getPinnedAccountId` reports the account an IDENTITY-BOUND provider
+ * (`sessionMode: 'identity'`) is pinned to, and `null` for every account-mode
+ * provider — which is exactly the value `SessionClient` and the transport read
+ * when the option is absent, so account mode is unchanged. While it reports an
+ * account, the client tracks device state truthfully but never re-binds its
+ * bearer to the device's mutable active account.
+ */
+export function createSessionClient(oxyServices, onUnauthenticated, getPinnedAccountId) {
+  const host = createSessionClientHost(oxyServices);
+  const transport = createTokenTransport(oxyServices, getPinnedAccountId);
+  const client = new SessionClient(host, {
+    transport,
+    socketFactory: io,
+    onUnauthenticated,
+    getPinnedAccountId
+  });
+  return {
+    client,
+    host
+  };
+}
+//# sourceMappingURL=createSessionClient.js.map

package/lib/module/ui/session/createSessionClient.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["io","SessionClient","createSessionClientHost","createTokenTransport","createSessionClient","oxyServices","onUnauthenticated","getPinnedAccountId","host","transport","client","socketFactory"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;AAAA,SAASA,EAAE,QAAQ,kBAAkB;AACrC,SACEC,aAAa,EACbC,uBAAuB,QAGlB,aAAa;AACpB,SAASC,oBAAoB,QAAQ,qBAAkB;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EACxDC,kBAAwC,EAIxC;EACA,MAAMC,IAAI,GAAGN,uBAAuB,CAACG,WAAW,CAAC;EACjD,MAAMI,SAAS,GAAGN,oBAAoB,CAACE,WAAW,EAAEE,kBAAkB,CAAC;EACvE,MAAMG,MAAM,GAAG,IAAIT,aAAa,CAACO,IAAI,EAAE;IACrCC,SAAS;IACTE,aAAa,EAAEX,EAAE;IACjBM,iBAAiB;IACjBC;EACF,CAAC,CAAC;EACF,OAAO;IAAEG,MAAM;IAAEF;EAAK,CAAC;AACzB","ignoreList":[]}

package/lib/module/ui/session/identityBinding.js

@@ -0,0 +1,89 @@
+"use strict";
+
+/**
+ * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
+ *
+ * `@oxyhq/core` owns everything platform-agnostic about an identity-bound
+ * session: the pin store shapes, `resolveIdentityPin`,
+ * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
+ * deliberately leaves out is WHICH pin store a given runtime should use, so this
+ * module supplies it — web `localStorage` vs the same native SecureStore adapter
+ * the device credential already persists through — and adds the one piece of
+ * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
+ * account id.
+ *
+ * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
+ * on the socket/apply path, while resolving the pin is asynchronous (a storage
+ * read plus a keychain read, through `resolveIdentityPin`). The provider
+ * resolves it before the cold boot and after every (re-)established identity
+ * session; every read after that is free.
+ */
+import { createNativeIdentityPinStore, createWebIdentityPinStore, resolveIdentityPin } from '@oxyhq/core';
+import { isReactNative } from "../utils/storageHelpers.js";
+import { createNativeSecureKeyValueStorage } from "./nativeSecureStorage.js";
+
+/**
+ * The provider-scoped identity binding: the core {@link IdentityBinding} handed
+ * to the cold boot and the re-mint handler, plus the resolved pin the projection
+ * and `SessionClient` bind to.
+ */
+
+/**
+ * Thrown by every account-graph mutation while the provider runs in
+ * `sessionMode: 'identity'`.
+ *
+ * An identity-bound app's user is the owner of the local identity key — fixed,
+ * for the lifetime of that key. Switching it is not a temporarily-unavailable
+ * operation that could be retried, it is not part of this mode's contract at
+ * all, so the surfaces reject loudly rather than resolving to a no-op that would
+ * read to the caller as a successful switch.
+ */
+export class IdentityBoundSessionError extends Error {
+  name = 'IdentityBoundSessionError';
+  code = 'identity_bound_session';
+  constructor(operation) {
+    super(`"${operation}" is unavailable while the session is identity-bound (sessionMode: "identity"): this app authenticates as the owner of the local identity key and cannot switch accounts.`);
+    this.operation = operation;
+  }
+}
+
+/**
+ * Build the identity binding for this runtime. Called ONCE per provider mount,
+ * and ONLY when `sessionMode: 'identity'` — account-mode providers never
+ * construct a pin store.
+ */
+export function createIdentitySessionBinding() {
+  const pinStore = isReactNative() ? createNativeIdentityPinStore(createNativeSecureKeyValueStorage()) : createWebIdentityPinStore();
+  const binding = {
+    pinStore
+  };
+
+  // Only a RESOLVED (non-null) pin is memoised. A `null` outcome is either "not
+  // pinned yet" or an indeterminate key read (locked keychain), and caching
+  // either one would leave this client permanently unpinned for the rest of the
+  // process — the exact state in which it would start following the device's
+  // mutable active account.
+  let pinnedAccountId = null;
+  let inFlight = null;
+  const resolve = () => {
+    if (!inFlight) {
+      inFlight = resolveIdentityPin(binding).then(pin => {
+        pinnedAccountId = pin?.accountId ?? null;
+        return pinnedAccountId;
+      }).finally(() => {
+        inFlight = null;
+      });
+    }
+    return inFlight;
+  };
+  return {
+    binding,
+    getPinnedAccountId: () => pinnedAccountId,
+    ensurePinnedAccountId: () => pinnedAccountId !== null ? Promise.resolve(pinnedAccountId) : resolve(),
+    refreshPinnedAccountId: () => {
+      pinnedAccountId = null;
+      return resolve();
+    }
+  };
+}
+//# sourceMappingURL=identityBinding.js.map

package/lib/module/ui/session/identityBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createNativeIdentityPinStore","createWebIdentityPinStore","resolveIdentityPin","isReactNative","createNativeSecureKeyValueStorage","IdentityBoundSessionError","Error","name","code","constructor","operation","createIdentitySessionBinding","pinStore","binding","pinnedAccountId","inFlight","resolve","then","pin","accountId","finally","getPinnedAccountId","ensurePinnedAccountId","Promise","refreshPinnedAccountId"],"sourceRoot":"../../../../src","sources":["ui/session/identityBinding.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACEA,4BAA4B,EAC5BC,yBAAyB,EACzBC,kBAAkB,QAEb,aAAa;AACpB,SAASC,aAAa,QAAQ,4BAAyB;AACvD,SAASC,iCAAiC,QAAQ,0BAAuB;;AAEzE;AACA;AACA;AACA;AACA;;AAqBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,yBAAyB,SAASC,KAAK,CAAC;EACjCC,IAAI,GAAG,2BAA2B;EAC3CC,IAAI,GAAG,wBAAwB;EACxCC,WAAWA,CAAUC,SAAiB,EAAE;IACtC,KAAK,CACH,IAAIA,SAAS,2KACf,CAAC;IAAC,KAHiBA,SAAiB,GAAjBA,SAAiB;EAItC;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,4BAA4BA,CAAA,EAA2B;EACrE,MAAMC,QAAQ,GAAGT,aAAa,CAAC,CAAC,GAC5BH,4BAA4B,CAACI,iCAAiC,CAAC,CAAC,CAAC,GACjEH,yBAAyB,CAAC,CAAC;EAC/B,MAAMY,OAAwB,GAAG;IAAED;EAAS,CAAC;;EAE7C;EACA;EACA;EACA;EACA;EACA,IAAIE,eAA8B,GAAG,IAAI;EACzC,IAAIC,QAAuC,GAAG,IAAI;EAElD,MAAMC,OAAO,GAAGA,CAAA,KAA8B;IAC5C,IAAI,CAACD,QAAQ,EAAE;MACbA,QAAQ,GAAGb,kBAAkB,CAACW,OAAO,CAAC,CACnCI,IAAI,CAAEC,GAAG,IAAK;QACbJ,eAAe,GAAGI,GAAG,EAAEC,SAAS,IAAI,IAAI;QACxC,OAAOL,eAAe;MACxB,CAAC,CAAC,CACDM,OAAO,CAAC,MAAM;QACbL,QAAQ,GAAG,IAAI;MACjB,CAAC,CAAC;IACN;IACA,OAAOA,QAAQ;EACjB,CAAC;EAED,OAAO;IACLF,OAAO;IACPQ,kBAAkB,EAAEA,CAAA,KAAMP,eAAe;IACzCQ,qBAAqB,EAAEA,CAAA,KACrBR,eAAe,KAAK,IAAI,GAAGS,OAAO,CAACP,OAAO,CAACF,eAAe,CAAC,GAAGE,OAAO,CAAC,CAAC;IACzEQ,sBAAsB,EAAEA,CAAA,KAAM;MAC5BV,eAAe,GAAG,IAAI;MACtB,OAAOE,OAAO,CAAC,CAAC;IAClB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/index.js

@@ -0,0 +1,20 @@
+"use strict";
+
+/**
+ * Session-sync integration layer — intra-package use only.
+ *
+ * `@oxyhq/core` owns the platform-agnostic `SessionClient`, its host adapter,
+ * and the pure `DeviceSessionState → services` projection helpers; those are
+ * re-exported straight from core here so `OxyContext` has one import site.
+ * `@oxyhq/services` supplies only the platform pieces: the thin
+ * `createSessionClient` factory (injects socket.io-client `io` + the
+ * device-first token transport), the `AuthStateStore` factory, and — for
+ * `sessionMode: 'identity'` — the identity binding (platform pin store + the
+ * memoised pinned account id).
+ */
+export { createSessionClient } from "./createSessionClient.js";
+export { createTokenTransport } from "./tokenTransport.js";
+export { createPlatformAuthStateStore } from "./authStore.js";
+export { createIdentitySessionBinding, IdentityBoundSessionError } from "./identityBinding.js";
+export { createSessionClientHost, accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions } from '@oxyhq/core';
+//# sourceMappingURL=index.js.map

package/lib/module/ui/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createSessionClient","createTokenTransport","createPlatformAuthStateStore","createIdentitySessionBinding","IdentityBoundSessionError","createSessionClientHost","accountIdsOf","activeSessionIdOf","activeUserOf","deviceStateToClientSessions"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,mBAAmB,QAAQ,0BAAuB;AAC3D,SAASC,oBAAoB,QAAQ,qBAAkB;AACvD,SAASC,4BAA4B,QAAQ,gBAAa;AAC1D,SAASC,4BAA4B,EAAEC,yBAAyB,QAAQ,sBAAmB;AAE3F,SACEC,uBAAuB,EACvBC,YAAY,EACZC,iBAAiB,EACjBC,YAAY,EACZC,2BAA2B,QACtB,aAAa","ignoreList":[]}

package/lib/module/ui/session/nativeSecureStorage.js

@@ -0,0 +1,88 @@
+"use strict";
+
+/**
+ * The native secure key/value seam every durable `@oxyhq/core` store in this
+ * package is built on.
+ *
+ * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
+ * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
+ * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
+ * module supplies that injection ONCE, so those stores can never drift onto
+ * different backings — a device credential in SecureStore and a pin in
+ * AsyncStorage would resolve differently after a keystore reset.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+
+import { createPlatformStorage } from "../utils/storageHelpers.js";
+
+// Variable indirection so Metro's static analyzer never traces expo-secure-store
+// into the web bundle; the module is native-only and optional.
+const SECURE_STORE_MODULE = 'expo-secure-store';
+let secureStorePromise = null;
+
+/**
+ * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
+ * unavailable — callers then fall back to AsyncStorage. Never throws.
+ */
+function loadSecureStore() {
+  if (!secureStorePromise) {
+    const moduleName = SECURE_STORE_MODULE;
+    secureStorePromise = import(moduleName).then(mod => {
+      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
+        return {
+          getItemAsync: mod.getItemAsync.bind(mod),
+          setItemAsync: mod.setItemAsync.bind(mod),
+          deleteItemAsync: mod.deleteItemAsync.bind(mod)
+        };
+      }
+      return null;
+    }).catch(() => null);
+  }
+  return secureStorePromise;
+}
+
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+export function createNativeSecureKeyValueStorage() {
+  let asyncStorage = null;
+  const getAsyncStorage = async () => {
+    if (!asyncStorage) {
+      asyncStorage = await createPlatformStorage();
+    }
+    return asyncStorage;
+  };
+  return {
+    getItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        return secure.getItemAsync(key);
+      }
+      return (await getAsyncStorage()).getItem(key);
+    },
+    setItem: async (key, value) => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.setItemAsync(key, value);
+        return;
+      }
+      await (await getAsyncStorage()).setItem(key, value);
+    },
+    removeItem: async key => {
+      const secure = await loadSecureStore();
+      if (secure) {
+        await secure.deleteItemAsync(key);
+        return;
+      }
+      await (await getAsyncStorage()).removeItem(key);
+    }
+  };
+}
+//# sourceMappingURL=nativeSecureStorage.js.map

package/lib/module/ui/session/nativeSecureStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPlatformStorage","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","then","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,qBAAqB,QAAQ,4BAAyB;;AAE/D;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,MAAM,CAACE,UAAU,CAAC,CACpCC,IAAI,CAAEC,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOT,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASU,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAMb,qBAAqB,CAAC,CAAC;IAC9C;IACA,OAAOa,YAAY;EACrB,CAAC;EACD,OAAO;IACLE,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,OAAOA,MAAM,CAACV,YAAY,CAACS,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEC,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,YAAY,CAACQ,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAML,eAAe,CAAC,CAAC,EAAEI,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMd,eAAe,CAAC,CAAC;MACtC,IAAIc,MAAM,EAAE;QACV,MAAMA,MAAM,CAACR,eAAe,CAACO,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMF,eAAe,CAAC,CAAC,EAAEM,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/session/tokenTransport.js

@@ -0,0 +1,71 @@
+"use strict";
+
+import { logger } from '@oxyhq/core';
+/**
+ * Platform `TokenTransport` for `SessionClient` (device-first model).
+ *
+ * `ensureActiveToken` is the fallback the client uses when a `session_state`
+ * push arrived WITHOUT an embedded `activeToken` and the planted bearer does not
+ * already belong to the state's active account. It mints one through the ONE
+ * unified single-flight the scheduler, the request-time preflight, and the 401
+ * retry all use — `oxyServices.httpService.refreshAccessToken(...)` — which runs
+ * the installed refresh handler (present the persisted zero-cookie `deviceId` +
+ * `deviceSecret` at `POST /session/device/token`, which mints for the device's
+ * CURRENT active account). Routing through the SAME entry point means this lane
+ * can never double-rotate the device secret against the others: it has NO
+ * private single-flight of its own.
+ *
+ * The short-circuit compares the planted bearer's ACCOUNT against
+ * `state.activeAccountId`, not mere token presence: a bearer for the PREVIOUS
+ * account (an account switch) must still mint the new account's token — skipping
+ * on presence alone would leave a subscriber observing the new active account
+ * under the old account's bearer (the account-switch 404 race).
+ *
+ * A failure is logged and swallowed: this method must never throw out (it runs
+ * inside the socket state handler).
+ *
+ * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
+ * on `state.activeAccountId` is precisely what an identity-bound client must
+ * never do — its token is minted for the PINNED account by the cold boot /
+ * re-mint lane. `SessionClient` already bypasses the transport entirely while
+ * pinned; this guard is the services-side half of that contract, so no future
+ * wiring can reintroduce the convergence from this end.
+ */
+export function createTokenTransport(oxyServices, getPinnedAccountId) {
+  return {
+    async ensureActiveToken(state) {
+      if ((getPinnedAccountId?.() ?? null) !== null) {
+        return;
+      }
+      try {
+        // Skip the mint ONLY when the planted bearer already identifies the
+        // active account. `getCurrentUserId()` decodes the bearer's `userId`/`id`
+        // (null when absent/opaque), directly comparable to the account id.
+        const activeAccountId = state.activeAccountId;
+        if (activeAccountId !== null && oxyServices.getCurrentUserId() === activeAccountId) {
+          return;
+        }
+      } catch (error) {
+        logger.warn('ensureActiveToken: bearer-account check threw', {
+          component: 'TokenTransport'
+        }, error);
+      }
+      try {
+        // The shared HttpService single-flight coalesces concurrent callers onto
+        // one in-flight mint; no local `inFlightMint` guard is needed.
+        const token = await oxyServices.httpService.refreshAccessToken('preflight');
+        if (!token) {
+          logger.debug('ensureActiveToken: refresh produced no session', {
+            component: 'TokenTransport',
+            deviceId: state.deviceId
+          });
+        }
+      } catch (error) {
+        logger.warn('ensureActiveToken: refresh failed', {
+          component: 'TokenTransport'
+        }, error);
+      }
+    }
+  };
+}
+//# sourceMappingURL=tokenTransport.js.map

package/lib/module/ui/session/tokenTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["logger","createTokenTransport","oxyServices","getPinnedAccountId","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;AAAA,SAASA,MAAM,QAA+C,aAAa;AAG3E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAClCC,WAAwB,EACxBC,kBAAwC,EACxB;EAChB,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI,CAACF,kBAAkB,GAAG,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE;QAC7C;MACF;MACA,IAAI;QACF;QACA;QACA;QACA,MAAMG,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIJ,WAAW,CAACK,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdR,MAAM,CAACS,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMG,KAAK,GAAG,MAAMT,WAAW,CAACU,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVX,MAAM,CAACc,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEV,KAAK,CAACU;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOP,KAAK,EAAE;QACdR,MAAM,CAACS,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEF,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/stores/accountStore.js

@@ -0,0 +1,213 @@
+"use strict";
+
+import { create } from 'zustand';
+import { buildAccountsArray, createQuickAccount } from '@oxyhq/core';
+const initialState = {
+  accounts: {},
+  accountOrder: [],
+  accountsArray: [],
+  loading: false,
+  loadingSessionIds: new Set(),
+  error: null
+};
+export const useAccountStore = create((set, get) => ({
+  ...initialState,
+  setAccounts: accounts => set(state => {
+    const accountMap = {};
+    const order = [];
+    const seenSessionIds = new Set();
+    for (const account of accounts) {
+      if (seenSessionIds.has(account.sessionId)) continue;
+      seenSessionIds.add(account.sessionId);
+      accountMap[account.sessionId] = account;
+      order.push(account.sessionId);
+    }
+    const accountsArray = buildAccountsArray(accountMap, order);
+    const sameOrder = order.length === state.accountOrder.length && order.every((id, i) => id === state.accountOrder[i]);
+    const sameAccounts = sameOrder && order.every(id => {
+      const existing = state.accounts[id];
+      const newAccount = accountMap[id];
+      return existing && existing.sessionId === newAccount.sessionId && existing.userId === newAccount.userId && existing.avatar === newAccount.avatar && existing.avatarUrl === newAccount.avatarUrl;
+    });
+    if (sameAccounts) return {};
+    return {
+      accounts: accountMap,
+      accountOrder: order,
+      accountsArray
+    };
+  }),
+  addAccount: account => set(state => {
+    // Check if account with same sessionId exists
+    if (state.accounts[account.sessionId]) {
+      // Update existing
+      const existing = state.accounts[account.sessionId];
+      if (existing.avatar === account.avatar && existing.avatarUrl === account.avatarUrl) {
+        return {}; // No change
+      }
+      const newAccounts = {
+        ...state.accounts,
+        [account.sessionId]: account
+      };
+      return {
+        accounts: newAccounts,
+        accountsArray: buildAccountsArray(newAccounts, state.accountOrder)
+      };
+    }
+    const newAccounts = {
+      ...state.accounts,
+      [account.sessionId]: account
+    };
+    const newOrder = [account.sessionId, ...state.accountOrder];
+    return {
+      accounts: newAccounts,
+      accountOrder: newOrder,
+      accountsArray: buildAccountsArray(newAccounts, newOrder)
+    };
+  }),
+  updateAccount: (sessionId, updates) => set(state => {
+    const existing = state.accounts[sessionId];
+    if (!existing) return {};
+    const updated = {
+      ...existing,
+      ...updates
+    };
+    if (existing.avatar === updated.avatar && existing.avatarUrl === updated.avatarUrl) {
+      return {}; // No change
+    }
+    const newAccounts = {
+      ...state.accounts,
+      [sessionId]: updated
+    };
+    return {
+      accounts: newAccounts,
+      accountsArray: buildAccountsArray(newAccounts, state.accountOrder)
+    };
+  }),
+  removeAccount: sessionId => set(state => {
+    if (!state.accounts[sessionId]) return {};
+    const {
+      [sessionId]: _removed,
+      ...rest
+    } = state.accounts;
+    const newOrder = state.accountOrder.filter(id => id !== sessionId);
+    return {
+      accounts: rest,
+      accountOrder: newOrder,
+      accountsArray: buildAccountsArray(rest, newOrder)
+    };
+  }),
+  moveAccountToTop: sessionId => set(state => {
+    if (!state.accounts[sessionId]) return {};
+    const filtered = state.accountOrder.filter(id => id !== sessionId);
+    const newOrder = [sessionId, ...filtered];
+    return {
+      accountOrder: newOrder,
+      accountsArray: buildAccountsArray(state.accounts, newOrder)
+    };
+  }),
+  setLoading: loading => set({
+    loading
+  }),
+  setLoadingSession: (sessionId, loading) => set(state => {
+    const newSet = new Set(state.loadingSessionIds);
+    if (loading) {
+      newSet.add(sessionId);
+    } else {
+      newSet.delete(sessionId);
+    }
+    return {
+      loadingSessionIds: newSet
+    };
+  }),
+  setError: error => set({
+    error
+  }),
+  loadAccounts: async (sessionIds, oxyServices, existingAccounts = [], preserveOrder = true) => {
+    const state = get();
+    const uniqueSessionIds = Array.from(new Set(sessionIds));
+    if (uniqueSessionIds.length === 0) {
+      get().setAccounts([]);
+      return;
+    }
+
+    // Try to get data from TanStack Query cache first
+    try {
+      // This will be called from a component, so we need to access queryClient differently
+      // For now, we'll keep the API call but optimize it
+      const existingMap = new Map(existingAccounts.map(a => [a.sessionId, a]));
+      for (const account of Object.values(state.accounts)) {
+        existingMap.set(account.sessionId, account);
+      }
+      const missingSessionIds = uniqueSessionIds.filter(id => !existingMap.has(id));
+      if (missingSessionIds.length === 0) {
+        const ordered = uniqueSessionIds.map(id => existingMap.get(id)).filter(acc => acc !== undefined);
+        get().setAccounts(ordered);
+        return;
+      }
+      if (state.loading) {
+        return;
+      }
+      set({
+        loading: true,
+        error: null
+      });
+      try {
+        const batchResults = await oxyServices.getUsersBySessions(missingSessionIds);
+        const accountMap = new Map();
+        for (const {
+          sessionId,
+          user: userData
+        } of batchResults) {
+          if (userData && !accountMap.has(sessionId)) {
+            const existing = existingMap.get(sessionId);
+            accountMap.set(sessionId, createQuickAccount(sessionId, userData, existing, (fileId, variant) => oxyServices.getFileDownloadUrl(fileId, variant)));
+          }
+        }
+        for (const [sessionId, account] of accountMap) {
+          existingMap.set(sessionId, account);
+        }
+        const orderToUse = preserveOrder ? uniqueSessionIds : [...uniqueSessionIds, ...state.accountOrder];
+        const seen = new Set();
+        const ordered = [];
+        for (const sessionId of orderToUse) {
+          if (seen.has(sessionId)) continue;
+          seen.add(sessionId);
+          const account = existingMap.get(sessionId);
+          if (account) ordered.push(account);
+        }
+        get().setAccounts(ordered);
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Failed to load accounts';
+        if (__DEV__) {
+          console.error('AccountStore: Failed to load accounts:', error);
+        }
+        set({
+          error: errorMessage
+        });
+      } finally {
+        set({
+          loading: false
+        });
+      }
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : 'Failed to load accounts';
+      if (__DEV__) {
+        console.error('AccountStore: Failed to load accounts:', error);
+      }
+      set({
+        error: errorMessage,
+        loading: false
+      });
+    }
+  },
+  reset: () => set(initialState)
+}));
+
+// Selectors for performance - return cached array to prevent infinite loops
+export const useAccounts = () => {
+  return useAccountStore(state => state.accountsArray);
+};
+export const useAccountLoading = () => useAccountStore(s => s.loading);
+export const useAccountError = () => useAccountStore(s => s.error);
+export const useAccountLoadingSession = sessionId => useAccountStore(s => s.loadingSessionIds.has(sessionId));
+//# sourceMappingURL=accountStore.js.map