@oxyhq/services 25.0.1 → 26.0.1

package/README.md

@@ -455,7 +455,7 @@ function LoginScreen() {
 ```
 
 - **Official Oxy apps** (`isOfficial` / first-party types): opens the in-app account dialog.
-- **Third-party apps** (`type: 'third_party'`): starts the standard OAuth 2.0 Authorization Code + PKCE flow against `auth.oxy.so` (the SDK generates `state` + PKCE via `@oxyhq/core`). On web the transport is `OxyProvider` prop `webAuthMode: 'popup' | 'redirect'` (default `'popup'`; issue #691 Phases 2/7b) — `'popup'` opens a small window and relays the result via `postMessage` without navigating your app's tab, falling back to a redirect if the browser blocks it. Pass `oauthRedirectUri`; on native handle `onOAuthResult` to complete the token exchange.
+- **Third-party apps** (`type: 'third_party'`): starts the standard OAuth 2.0 Authorization Code + PKCE flow against `auth.oxy.so` (the SDK generates `state` + PKCE via `@oxyhq/core`). On web the transport is `OxyProvider` prop `webAuthMode: 'popup' | 'redirect'` (default `'redirect'`; issue #691 Phase 2) — `'popup'` opens a small window and relays the result via `postMessage` without navigating your app's tab, falling back to a redirect if the browser blocks it. Pass `oauthRedirectUri`; on native handle `onOAuthResult` to complete the token exchange.
 
 See the [integration guide](../../docs/auth/integration-guide.md) for Console registration, OAuth endpoints, and backend verification, and [AUTHENTICATION.md](../../docs/AUTHENTICATION.md) for the full model.
 
@@ -694,7 +694,7 @@ Typed returns are defined in `ui/hooks/queries/paymentTypes.ts` (`Subscription`,
 
 ## Sign-In Token Planting
 
-`@oxyhq/core` `OxyServices.verifyChallenge()` plants `setTokens(accessToken)` internally before returning. `useAuthOperations.performSignIn` no longer needs to hand-plant the token or call a session-token fallback — just await `verifyChallenge` and proceed.
+`@oxyhq/core` `OxyServices.verifyChallenge()` plants `setTokens(accessToken, refreshToken ?? '')` internally before returning. `useAuthOperations.performSignIn` no longer needs to hand-plant the token or call a session-token fallback — just await `verifyChallenge` and proceed.
 
 ## Requirements
 

package/android/src/main/java/so/oxy/identity/OxyIdentityStore.kt

@@ -2,8 +2,12 @@ package so.oxy.identity
 
 import android.content.Context
 import android.content.SharedPreferences
-import so.oxy.storage.OxyEncryptedPrefs
-import so.oxy.storage.RecoveryPolicy
+import android.util.Log
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import java.io.IOException
+import java.security.GeneralSecurityException
+import java.security.KeyStore
 
 /**
  * Shared accessor for the hardware-backed EncryptedSharedPreferences that holds
@@ -11,35 +15,137 @@ import so.oxy.storage.RecoveryPolicy
  *
  * Used by BOTH [OxyIdentityModule] (the JS bridge / local read + write) and
  * [OxyIdentityProvider] (the cross-process read surface) so the store name and
- * the encryption scheme can never drift between the two halves.
+ * the AES256 encryption scheme can never drift between the two halves.
  *
- * Opening the file — the single-memoized-instance rule and the two-stage keyset
- * self-heal, both load-bearing and non-obvious — lives in [OxyEncryptedPrefs],
- * which is shared with the background-session store. Read its documentation
- * before changing anything about how this file is opened.
+ * ## Single memoized instance (CRITICAL)
  *
- * One consequence worth restating here: an open can legitimately return an EMPTY
- * file (the self-heal wipes a keyset it cannot read). That is safe for this slot
- * specifically because it is a DERIVED copy — Commons re-populates it from the
- * primary self-custody identity on the next boot (`migrateToSharedIdentity`), and
- * that primary lives in expo-secure-store under a different file and different
- * keystore aliases, untouched by any recovery here.
+ * `EncryptedSharedPreferences.create()` must be called AT MOST ONCE per file per
+ * process. It is NOT safe to re-instantiate: when a second instance is created
+ * for the same file while another is live (e.g. the JS write thread and a Binder
+ * thread serving [OxyIdentityProvider.call] concurrently), Tink's keyset load
+ * races and the next decrypt throws `AEADBadTagException` — which silently turned
+ * every cross-app read into "no shared identity". So the instance is created once,
+ * lazily, under a lock, keyed on the process-global application context, and
+ * reused for all reads/writes/provider calls.
+ *
+ * ## Keyset self-heal (CRITICAL)
+ *
+ * The androidx master key that wraps this file's Tink keyset lives under the
+ * UID-scoped default alias [MasterKey.DEFAULT_MASTER_KEY_ALIAS] — one entry for
+ * the whole `so.oxy.shared` UID. When a NEW package joins that shared UID, that
+ * master key can be rotated/regenerated, leaving the keyset already written into
+ * `oxy_shared_identity.xml` wrapped under the OLD key. `create()` then fails GCM
+ * verification (`AEADBadTag` -> `GeneralSecurityException`, or an unreadable
+ * keyset -> `IOException`) on EVERY read/write, and `EncryptedSharedPreferences`
+ * never self-heals — the slot stays permanently dead and cross-app "Sign in with
+ * Oxy" silently falls back to interactive import.
+ *
+ * [openOrHealPrefs] recovers ONCE, in two bounded stages (no retry loop):
+ *   1. Delete ONLY this slot's prefs file (the stale wrapped keyset) and rebuild
+ *      against the current master key — heals the common rotation case without
+ *      touching the master key, so other shared-UID members keep their keysets.
+ *   2. If a fresh keyset STILL can't be built, the master key itself is unusable:
+ *      delete its keystore alias so a new one is generated, wipe the file again,
+ *      and rebuild. If that final rebuild throws, the exception propagates and the
+ *      existing `runCatching {}` at every call site degrades to null.
+ *
+ * This NEVER touches the primary self-custody identity: that lives in
+ * expo-secure-store under a DISTINCT prefs file ("SecureStore") and DISTINCT
+ * keystore aliases ("key_v1"/extended), not the androidx master key wiped here.
+ * The shared slot is a derived copy that Commons re-populates from the primary on
+ * the next boot (`migrateToSharedIdentity`), so wiping it is non-destructive.
  */
 internal object OxyIdentityStore {
   const val PREFS_NAME = "oxy_shared_identity"
   const val KEY_PRIVATE = "priv"
   const val KEY_PUBLIC = "pub"
 
+  private const val TAG = "OxyIdentityStore"
+  private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+
+  @Volatile private var cachedPrefs: SharedPreferences? = null
+
+  private fun prefs(context: Context): SharedPreferences {
+    cachedPrefs?.let { return it }
+    return synchronized(this) {
+      cachedPrefs ?: openOrHealPrefs(context.applicationContext).also { cachedPrefs = it }
+    }
+  }
+
   /**
-   * [RecoveryPolicy.RegenerateSharedMasterKey] preserves this store's original
-   * behaviour: when its keyset cannot be rebuilt, the master key is regenerated.
-   * That is defensible HERE and nowhere else so far, because this slot going dead
-   * already breaks cross-app "Sign in with Oxy" for every Oxy app on the device —
-   * the collateral is not worse than the failure it recovers from — and because
-   * this slot is itself re-populated from the primary identity on the next boot.
+   * Opens the EncryptedSharedPreferences, self-healing a corrupted/unreadable
+   * keyset once (see the "Keyset self-heal" note above). Both exception types the
+   * androidx `create()` declares — `GeneralSecurityException` (AEAD/GCM tag
+   * mismatch) and `IOException` (unparseable keyset) — route into recovery.
    */
-  private fun prefs(context: Context): SharedPreferences =
-    OxyEncryptedPrefs.open(context, PREFS_NAME, RecoveryPolicy.RegenerateSharedMasterKey)
+  private fun openOrHealPrefs(appContext: Context): SharedPreferences {
+    return try {
+      buildEncryptedPrefs(appContext)
+    } catch (corrupt: GeneralSecurityException) {
+      healCorruptedKeyset(appContext, corrupt)
+    } catch (corrupt: IOException) {
+      healCorruptedKeyset(appContext, corrupt)
+    }
+  }
+
+  /**
+   * Stage 1: wipe ONLY this slot's prefs file (which holds the stale wrapped
+   * keyset) and rebuild against the current master key. Escalates to stage 2 if a
+   * fresh keyset still can't be built.
+   */
+  private fun healCorruptedKeyset(appContext: Context, cause: Exception): SharedPreferences {
+    Log.w(
+      TAG,
+      "shared-identity keyset unreadable (rotated master key); cleared and regenerated: ${cause.message}",
+      cause
+    )
+    appContext.deleteSharedPreferences(PREFS_NAME)
+    return try {
+      buildEncryptedPrefs(appContext)
+    } catch (stillCorrupt: GeneralSecurityException) {
+      regenerateMasterKeyAndRebuild(appContext, stillCorrupt)
+    } catch (stillCorrupt: IOException) {
+      regenerateMasterKeyAndRebuild(appContext, stillCorrupt)
+    }
+  }
+
+  /**
+   * Stage 2 (belt-and-suspenders): the androidx master key itself is unusable, so
+   * delete its keystore alias to force a fresh one, wipe the now-stale file again,
+   * and rebuild. The alias is used ONLY by androidx EncryptedSharedPreferences —
+   * expo-secure-store (the primary identity) uses its own distinct aliases — so
+   * this never touches the self-custody key. A throw here propagates to the
+   * call-site `runCatching {}`, which degrades to null.
+   */
+  private fun regenerateMasterKeyAndRebuild(appContext: Context, cause: Exception): SharedPreferences {
+    Log.w(
+      TAG,
+      "shared-identity keyset still unreadable after prefs reset; deleting master key " +
+        "'${MasterKey.DEFAULT_MASTER_KEY_ALIAS}' and regenerating: ${cause.message}",
+      cause
+    )
+    KeyStore.getInstance(ANDROID_KEYSTORE).apply {
+      load(null)
+      if (containsAlias(MasterKey.DEFAULT_MASTER_KEY_ALIAS)) {
+        deleteEntry(MasterKey.DEFAULT_MASTER_KEY_ALIAS)
+      }
+    }
+    appContext.deleteSharedPreferences(PREFS_NAME)
+    return buildEncryptedPrefs(appContext)
+  }
+
+  private fun buildEncryptedPrefs(appContext: Context): SharedPreferences {
+    val masterKey = MasterKey.Builder(appContext)
+      .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+      .build()
+    return EncryptedSharedPreferences.create(
+      appContext,
+      PREFS_NAME,
+      masterKey,
+      EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+      EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+    )
+  }
 
   /** Read the stored keypair as (privateKey, publicKey), or null when absent/blank. */
   fun read(context: Context): Pair<String, String>? {

package/expo-module.config.json

@@ -4,9 +4,6 @@
     "modules": ["OxyIdentityModule"]
   },
   "android": {
-    "modules": [
-      "so.oxy.identity.OxyIdentityModule",
-      "so.oxy.session.OxyBackgroundSessionModule"
-    ]
+    "modules": ["so.oxy.identity.OxyIdentityModule"]
   }
 }

package/lib/commonjs/index.js

@@ -183,12 +183,30 @@ Object.defineProperty(exports, "extractErrorMessage", {
     return _errorHandlers.extractErrorMessage;
   }
 });
+Object.defineProperty(exports, "getExpoPushToken", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.getExpoPushToken;
+  }
+});
 Object.defineProperty(exports, "handleAuthError", {
   enumerable: true,
   get: function () {
     return _errorHandlers.handleAuthError;
   }
 });
+Object.defineProperty(exports, "hasNotificationPermission", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.hasNotificationPermission;
+  }
+});
+Object.defineProperty(exports, "installForegroundNotificationHandler", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.installForegroundNotificationHandler;
+  }
+});
 Object.defineProperty(exports, "invalidateAccountQueries", {
   enumerable: true,
   get: function () {
@@ -279,12 +297,24 @@ Object.defineProperty(exports, "openOAuthPopup", {
     return _oauthPopup.openOAuthPopup;
   }
 });
+Object.defineProperty(exports, "pushTokenPlatform", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.pushTokenPlatform;
+  }
+});
 Object.defineProperty(exports, "queryKeys", {
   enumerable: true,
   get: function () {
     return _queryKeys.queryKeys;
   }
 });
+Object.defineProperty(exports, "requestNotificationPermission", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.requestNotificationPermission;
+  }
+});
 Object.defineProperty(exports, "setOxyAssetInstance", {
   enumerable: true,
   get: function () {
@@ -303,6 +333,18 @@ Object.defineProperty(exports, "subscribeToAccountDialog", {
     return _accountDialogManager.subscribeToAccountDialog;
   }
 });
+Object.defineProperty(exports, "subscribeToNotificationResponses", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.subscribeToNotificationResponses;
+  }
+});
+Object.defineProperty(exports, "takeLaunchNotificationData", {
+  enumerable: true,
+  get: function () {
+    return _deviceNotifications.takeLaunchNotificationData;
+  }
+});
 Object.defineProperty(exports, "upsertCachedUser", {
   enumerable: true,
   get: function () {
@@ -710,6 +752,7 @@ var _useOnlineStatus = require("./ui/hooks/useOnlineStatus.js");
 var _useOxyEvent = require("./ui/hooks/useOxyEvent.js");
 var _errorHandlers = require("./ui/utils/errorHandlers.js");
 var _useFileFiltering = require("./ui/hooks/useFileFiltering.js");
+var _deviceNotifications = require("./notifications/deviceNotifications.js");
 var _OxySignInButton = _interopRequireDefault(require("./ui/components/OxySignInButton.js"));
 var _oauthPopup = require("./ui/oauth/oauthPopup.js");
 var _OxyAuthPrompt = require("./ui/components/OxyAuthPrompt.js");
@@ -817,25 +860,13 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
 // ---------------------------------------------------------------------------
 
 // ---------------------------------------------------------------------------
-// Device notifications — DELIBERATELY NOT EXPORTED HERE
+// Device notifications (the ONE `expo-notifications` adapter)
 // ---------------------------------------------------------------------------
-// The `expo-notifications` adapter lives behind its own entry point:
-//
-//     import { getExpoPushToken } from '@oxyhq/services/notifications';
-//
-// It is the one module in this package whose dependencies (`expo-notifications`
-// and `expo-constants`) are optional peers that an app which does not use push
-// genuinely never installs. Re-exporting it from THIS barrel is what made that
-// optionality a lie: a barrel export puts the module in the import graph of
-// every consumer, and `tsc` must resolve the specifier of an `import()` even
-// when the call is lazy and wrapped in try/catch — so every consumer without
-// `expo-notifications` failed with TS2307 (plus TS7006 cascades) whether or not
-// it had ever heard of push. Behind a subpath the module is only ever pulled in
-// by an app that asked for it, which is what "optional peer" is supposed to
-// mean.
-//
-// Do NOT re-add these exports here. `__tests__/notifications/barrelIsolation.test.ts`
-// fails if you do.
+// The Expo-side half of push: permission, platform tag, and the EXPO push token
+// `@oxyhq/core`'s `registerPushToken` accepts (never a raw APNs/FCM token).
+// Native-only by construction — every entry point resolves its null/no-op result
+// from `Platform.OS` before `expo-notifications` is ever imported, and both
+// `expo-notifications` and `expo-constants` are OPTIONAL peers.
 
 // ---------------------------------------------------------------------------
 // UI components

package/lib/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_reactNative","_OxyProvider","_interopRequireDefault","_OxyContext","_useAuth","_identityBinding","_authStore","_accountStore","_assetStore","_useAssets","_useFileDownloadUrl","_useFollow","_useStorage","_useAccountQueries","_useServicesQueries","_useSecurityQueries","_useAuthMethods","_usePaymentQueries","_useAccountMutations","_useServicesMutations","_mutationFactory","_mutationKeys","_queryKeys","_userCache","_useMutationStatus","_useOnlineStatus","_useOxyEvent","_errorHandlers","_useFileFiltering","_OxySignInButton","_oauthPopup","_OxyAuthPrompt","_OxyOAuthCallback","_OxyConsentScreen","_RequireOxyAuth","_FollowButton","_OxyPayButton","_LogoIcon","_LogoText","_ProfileButton","_OxyAuthChooser","_OxySignInRequestSurface","_useSwitchableAccounts","_ProfileScreen","_ManageAccountScreen","_NotificationsScreen","_PreferencesScreen","_ConnectedAppsScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_bottomSheetManager","_useSurfaceHeader","_SurfaceHeaderAction","_accountDialogManager","e","__esModule","default","setPlatformOS","Platform","OS"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAMA,IAAAE,YAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAEA,IAAAK,QAAA,GAAAL,OAAA;AAKA,IAAAM,gBAAA,GAAAN,OAAA;AAKA,IAAAO,UAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AAgBA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAMA,IAAAc,kBAAA,GAAAd,OAAA;AAUA,IAAAe,mBAAA,GAAAf,OAAA;AAQA,IAAAgB,mBAAA,GAAAhB,OAAA;AAKA,IAAAiB,eAAA,GAAAjB,OAAA;AACA,IAAAkB,kBAAA,GAAAlB,OAAA;AAyBA,IAAAmB,oBAAA,GAAAnB,OAAA;AAUA,IAAAoB,qBAAA,GAAApB,OAAA;AAOA,IAAAqB,gBAAA,GAAArB,OAAA;AAUA,IAAAsB,aAAA,GAAAtB,OAAA;AAQA,IAAAuB,UAAA,GAAAvB,OAAA;AAmBA,IAAAwB,UAAA,GAAAxB,OAAA;AAIA,IAAAyB,kBAAA,GAAAzB,OAAA;AAEA,IAAA0B,gBAAA,GAAA1B,OAAA;AACA,IAAA2B,YAAA,GAAA3B,OAAA;AAKA,IAAA4B,cAAA,GAAA5B,OAAA;AAWA,IAAA6B,iBAAA,GAAA7B,OAAA;AA+BA,IAAA8B,gBAAA,GAAA3B,sBAAA,CAAAH,OAAA;AAOA,IAAA+B,WAAA,GAAA/B,OAAA;AAUA,IAAAgC,cAAA,GAAAhC,OAAA;AAEA,IAAAiC,iBAAA,GAAAjC,OAAA;AAEA,IAAAkC,iBAAA,GAAAlC,OAAA;AAYA,IAAAmC,eAAA,GAAAnC,OAAA;AAGA,IAAAoC,aAAA,GAAAjC,sBAAA,CAAAH,OAAA;AAEA,IAAAqC,aAAA,GAAAlC,sBAAA,CAAAH,OAAA;AACA,IAAAsC,SAAA,GAAAtC,OAAA;AACA,IAAAuC,SAAA,GAAAvC,OAAA;AAKA,IAAAwC,cAAA,GAAArC,sBAAA,CAAAH,OAAA;AAQA,IAAAyC,eAAA,GAAAtC,sBAAA,CAAAH,OAAA;AAWA,IAAA0C,wBAAA,GAAA1C,OAAA;AAUA,IAAA2C,sBAAA,GAAA3C,OAAA;AAIA,IAAA4C,cAAA,GAAAzC,sBAAA,CAAAH,OAAA;AACA,IAAA6C,oBAAA,GAAA1C,sBAAA,CAAAH,OAAA;AACA,IAAA8C,oBAAA,GAAA3C,sBAAA,CAAAH,OAAA;AACA,IAAA+C,kBAAA,GAAA5C,sBAAA,CAAAH,OAAA;AACA,IAAAgD,oBAAA,GAAA7C,sBAAA,CAAAH,OAAA;AAGA,IAAAiD,oBAAA,GAAA9C,sBAAA,CAAAH,OAAA;AACA,IAAAkD,qBAAA,GAAA/C,sBAAA,CAAAH,OAAA;AACA,IAAAmD,sBAAA,GAAAhD,sBAAA,CAAAH,OAAA;AAKA,IAAAoD,mBAAA,GAAApD,OAAA;AAMA,IAAAqD,iBAAA,GAAArD,OAAA;AACA,IAAAsD,oBAAA,GAAAtD,OAAA;AAMA,IAAAuD,qBAAA,GAAAvD,OAAA;AAI8C,SAAAG,uBAAAqD,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAnV9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAIA,IAAAG,mBAAa,EAACC,qBAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;;AAMA;AACA;AACA;;AAGA;AACA;AACA;;AAgBA;AACA;AACA;;AAOA;AACA;AACA;;AAgCA;;AAeA;AACA;AACA;;AA2BA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAeA;AACA;AACA;AACA;AACA;;AAIA;;AAMA;AACA;AACA;;AASA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;;AAQA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;;AAIA;;AAOA;;AAKA;AACA;AACA;;AAIA;AACA;AACA;;AAIA;AACA;AACA;AACA","ignoreList":[]}
+{"version":3,"names":["_core","require","_reactNative","_OxyProvider","_interopRequireDefault","_OxyContext","_useAuth","_identityBinding","_authStore","_accountStore","_assetStore","_useAssets","_useFileDownloadUrl","_useFollow","_useStorage","_useAccountQueries","_useServicesQueries","_useSecurityQueries","_useAuthMethods","_usePaymentQueries","_useAccountMutations","_useServicesMutations","_mutationFactory","_mutationKeys","_queryKeys","_userCache","_useMutationStatus","_useOnlineStatus","_useOxyEvent","_errorHandlers","_useFileFiltering","_deviceNotifications","_OxySignInButton","_oauthPopup","_OxyAuthPrompt","_OxyOAuthCallback","_OxyConsentScreen","_RequireOxyAuth","_FollowButton","_OxyPayButton","_LogoIcon","_LogoText","_ProfileButton","_OxyAuthChooser","_OxySignInRequestSurface","_useSwitchableAccounts","_ProfileScreen","_ManageAccountScreen","_NotificationsScreen","_PreferencesScreen","_ConnectedAppsScreen","_CreateAccountScreen","_AccountMembersScreen","_AccountSettingsScreen","_bottomSheetManager","_useSurfaceHeader","_SurfaceHeaderAction","_accountDialogManager","e","__esModule","default","setPlatformOS","Platform","OS"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAMA,IAAAE,YAAA,GAAAC,sBAAA,CAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAEA,IAAAK,QAAA,GAAAL,OAAA;AAKA,IAAAM,gBAAA,GAAAN,OAAA;AAKA,IAAAO,UAAA,GAAAP,OAAA;AACA,IAAAQ,aAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AAgBA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,WAAA,GAAAb,OAAA;AAMA,IAAAc,kBAAA,GAAAd,OAAA;AAUA,IAAAe,mBAAA,GAAAf,OAAA;AAQA,IAAAgB,mBAAA,GAAAhB,OAAA;AAKA,IAAAiB,eAAA,GAAAjB,OAAA;AACA,IAAAkB,kBAAA,GAAAlB,OAAA;AAyBA,IAAAmB,oBAAA,GAAAnB,OAAA;AAUA,IAAAoB,qBAAA,GAAApB,OAAA;AAOA,IAAAqB,gBAAA,GAAArB,OAAA;AAUA,IAAAsB,aAAA,GAAAtB,OAAA;AAQA,IAAAuB,UAAA,GAAAvB,OAAA;AAmBA,IAAAwB,UAAA,GAAAxB,OAAA;AAIA,IAAAyB,kBAAA,GAAAzB,OAAA;AAEA,IAAA0B,gBAAA,GAAA1B,OAAA;AACA,IAAA2B,YAAA,GAAA3B,OAAA;AAKA,IAAA4B,cAAA,GAAA5B,OAAA;AAWA,IAAA6B,iBAAA,GAAA7B,OAAA;AAWA,IAAA8B,oBAAA,GAAA9B,OAAA;AAkBA,IAAA+B,gBAAA,GAAA5B,sBAAA,CAAAH,OAAA;AAOA,IAAAgC,WAAA,GAAAhC,OAAA;AAUA,IAAAiC,cAAA,GAAAjC,OAAA;AAEA,IAAAkC,iBAAA,GAAAlC,OAAA;AAEA,IAAAmC,iBAAA,GAAAnC,OAAA;AAYA,IAAAoC,eAAA,GAAApC,OAAA;AAGA,IAAAqC,aAAA,GAAAlC,sBAAA,CAAAH,OAAA;AAEA,IAAAsC,aAAA,GAAAnC,sBAAA,CAAAH,OAAA;AACA,IAAAuC,SAAA,GAAAvC,OAAA;AACA,IAAAwC,SAAA,GAAAxC,OAAA;AAKA,IAAAyC,cAAA,GAAAtC,sBAAA,CAAAH,OAAA;AAQA,IAAA0C,eAAA,GAAAvC,sBAAA,CAAAH,OAAA;AAWA,IAAA2C,wBAAA,GAAA3C,OAAA;AAUA,IAAA4C,sBAAA,GAAA5C,OAAA;AAIA,IAAA6C,cAAA,GAAA1C,sBAAA,CAAAH,OAAA;AACA,IAAA8C,oBAAA,GAAA3C,sBAAA,CAAAH,OAAA;AACA,IAAA+C,oBAAA,GAAA5C,sBAAA,CAAAH,OAAA;AACA,IAAAgD,kBAAA,GAAA7C,sBAAA,CAAAH,OAAA;AACA,IAAAiD,oBAAA,GAAA9C,sBAAA,CAAAH,OAAA;AAGA,IAAAkD,oBAAA,GAAA/C,sBAAA,CAAAH,OAAA;AACA,IAAAmD,qBAAA,GAAAhD,sBAAA,CAAAH,OAAA;AACA,IAAAoD,sBAAA,GAAAjD,sBAAA,CAAAH,OAAA;AAKA,IAAAqD,mBAAA,GAAArD,OAAA;AAMA,IAAAsD,iBAAA,GAAAtD,OAAA;AACA,IAAAuD,oBAAA,GAAAvD,OAAA;AAMA,IAAAwD,qBAAA,GAAAxD,OAAA;AAI8C,SAAAG,uBAAAsD,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAjV9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAIA,IAAAG,mBAAa,EAACC,qBAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;;AAMA;AACA;AACA;;AAGA;AACA;AACA;;AAgBA;AACA;AACA;;AAOA;AACA;AACA;;AAgCA;;AAeA;AACA;AACA;;AA2BA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AAeA;AACA;AACA;AACA;AACA;;AAIA;;AAMA;AACA;AACA;;AASA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;AACA;AACA;;AAQA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;;AAIA;;AAOA;;AAKA;AACA;AACA;;AAIA;AACA;AACA;;AAIA;AACA;AACA;AACA","ignoreList":[]}

package/lib/commonjs/notifications/deviceNotifications.js

@@ -3,7 +3,6 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.ensureNotificationChannel = ensureNotificationChannel;
 exports.getExpoPushToken = getExpoPushToken;
 exports.hasNotificationPermission = hasNotificationPermission;
 exports.installForegroundNotificationHandler = installForegroundNotificationHandler;
@@ -23,25 +22,6 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
  * already lives in `@oxyhq/core`; core may never import an `expo-*` module, and
  * this adapter is the Expo-side half that closes that gap.
  *
- * ## Reached through its OWN entry point, never the root barrel
- *
- * ```ts
- * import { getExpoPushToken } from '@oxyhq/services/notifications';
- * ```
- *
- * This is the only module in the package that depends on peers an app which
- * does not use push genuinely never installs, and a barrel export would put it
- * in EVERY consumer's import graph. `tsc` resolves the specifier of an
- * `import()` even when the call is lazy and inside a try/catch, so a barrel
- * export turned "optional peer" into a hard requirement: consumers with no
- * interest in push failed to type-check with TS2307. The subpath is what keeps
- * the optionality honest — see the note in `src/index.ts`.
- *
- * Metro is the resolver that behaves differently here, and in the useful
- * direction: an unresolvable DYNAMIC `import()` bundles fine (the `catch` below
- * takes over at runtime), where a static import fails the build outright. That
- * is why the runtime shape below must stay dynamic-and-guarded.
- *
  * ## Native-only by construction
  *
  * Every entry point resolves its null/no-op result from `Platform.OS` BEFORE the
@@ -310,49 +290,6 @@ async function takeLaunchNotificationData() {
  */
 let foregroundHandlerAttempted = false;
 
-/** How prominently Android surfaces a channel's notifications. */
-
-/** An Android notification channel this app delivers on. */
-
-/**
- * Create (or update) an Android notification channel.
- *
- * A no-op everywhere but Android: iOS has no channels, and web never loads the
- * native module. Call it BEFORE registering a push token, so the very first
- * notification the server sends already has a channel to land on.
- *
- * Failure is non-fatal and logged: a missing channel costs visibility, and
- * refusing to register a token over it would cost the feature entirely.
- *
- * @returns Whether the channel was actually created (`false` off Android, or
- *   when the native module is unavailable, or when creation failed).
- */
-async function ensureNotificationChannel(spec) {
-  if (_reactNative.Platform.OS !== 'android') {
-    return false;
-  }
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return false;
-  }
-  try {
-    await notifications.setNotificationChannelAsync(spec.id, {
-      name: spec.name,
-      importance: spec.importance === 'high' ? notifications.AndroidImportance.HIGH : notifications.AndroidImportance.DEFAULT,
-      ...(spec.description ? {
-        description: spec.description
-      } : {})
-    });
-    return true;
-  } catch (error) {
-    log.warn('could not create the notification channel', {
-      method: 'ensureNotificationChannel',
-      channelId: spec.id
-    }, error);
-    return false;
-  }
-}
-
 /**
  * Install the ONE process-wide handler that decides whether an incoming
  * notification is shown while the app is in the FOREGROUND.

package/lib/commonjs/notifications/deviceNotifications.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","_reactNative","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","log","createLogger","isRecord","value","loadNotifications","Platform","OS","Promise","resolve","then","error","warn","method","easProjectId","constants","debug","fromEasConfig","easConfig","projectId","length","extra","expoConfig","eas","undefined","pushTokenPlatform","hasNotificationPermission","notifications","permissions","getPermissionsAsync","granted","requestNotificationPermission","existing","canAskAgain","requested","requestPermissionsAsync","getExpoPushToken","token","getExpoPushTokenAsync","data","takeLaunchNotificationData","response","getLastNotificationResponse","notification","request","content","clearLastNotificationResponse","clearError","foregroundHandlerAttempted","ensureNotificationChannel","spec","setNotificationChannelAsync","id","name","importance","AndroidImportance","HIGH","DEFAULT","description","channelId","installForegroundNotificationHandler","decide","setNotificationHandler","handleNotification","show","shouldShowBanner","shouldShowList","shouldPlaySound","shouldSetBadge","subscribeToNotificationResponses","listener","subscription","addNotificationResponseReceivedListener","remove"],"sourceRoot":"../../../src","sources":["notifications/deviceNotifications.ts"],"mappings":";;;;;;;;;;;;;AAyDA,IAAAA,KAAA,GAAAC,OAAA;AAEA,IAAAC,YAAA,GAAAD,OAAA;AAAwC,SAAAE,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KA3DxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAMA,MAAMkB,GAAG,GAAG,IAAAC,kBAAY,EAAC,qBAAqB,CAAC;AAK/C,SAASC,QAAQA,CAACC,KAAc,EAAoC;EAClE,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,KAAK,IAAI;AACpD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAwC;EACtE,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,IAAI;IACF,OAAO,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7B,uBAAA,CAAAF,OAAA,CAAa,oBAAoB,GAAC;EAC3C,CAAC,CAAC,OAAOgC,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,oEAAoE,EACpE;MAAEC,MAAM,EAAE;IAAoB,CAAC,EAC/BF,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeG,YAAYA,CAAA,EAA2B;EACpD,IAAIC,SAAqC;EACzC,IAAI;IACFA,SAAS,GAAG,CAAC,MAAAP,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7B,uBAAA,CAAAF,OAAA,CAAa,gBAAgB,GAAC,EAAEa,OAAO;EACtD,CAAC,CAAC,OAAOmB,KAAK,EAAE;IACdV,GAAG,CAACe,KAAK,CACP,iFAAiF,EACjF;MAAEH,MAAM,EAAE;IAAe,CAAC,EAC1BF,KACF,CAAC;IACD,OAAO,IAAI;EACb;EAEA,MAAMM,aAAa,GAAGF,SAAS,CAACG,SAAS,EAAEC,SAAS;EACpD,IAAI,OAAOF,aAAa,KAAK,QAAQ,IAAIA,aAAa,CAACG,MAAM,GAAG,CAAC,EAAE;IACjE,OAAOH,aAAa;EACtB;EAEA,MAAMI,KAAc,GAAGN,SAAS,CAACO,UAAU,EAAED,KAAK;EAClD,MAAME,GAAG,GAAGpB,QAAQ,CAACkB,KAAK,CAAC,GAAGA,KAAK,CAACE,GAAG,GAAGC,SAAS;EACnD,MAAML,SAAS,GAAGhB,QAAQ,CAACoB,GAAG,CAAC,GAAGA,GAAG,CAACJ,SAAS,GAAGK,SAAS;EAC3D,OAAO,OAAOL,SAAS,KAAK,QAAQ,IAAIA,SAAS,CAACC,MAAM,GAAG,CAAC,GAAGD,SAAS,GAAG,IAAI;AACjF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASM,iBAAiBA,CAAA,EAA6B;EAC5D,OAAOnB,qBAAQ,CAACC,EAAE,KAAK,KAAK,IAAID,qBAAQ,CAACC,EAAE,KAAK,SAAS,GAAGD,qBAAQ,CAACC,EAAE,GAAG,IAAI;AAChF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAemB,yBAAyBA,CAAA,EAAqB;EAClE,MAAMC,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMC,WAAW,GAAG,MAAMD,aAAa,CAACE,mBAAmB,CAAC,CAAC;IAC7D,OAAOD,WAAW,CAACE,OAAO,KAAK,IAAI;EACrC,CAAC,CAAC,OAAOnB,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,4CAA4C,EAC5C;MAAEC,MAAM,EAAE;IAA4B,CAAC,EACvCF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeoB,6BAA6BA,CAAA,EAAqB;EACtE,MAAMJ,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMK,QAAQ,GAAG,MAAML,aAAa,CAACE,mBAAmB,CAAC,CAAC;IAC1D,IAAIG,QAAQ,CAACF,OAAO,KAAK,IAAI,EAAE;MAC7B,OAAO,IAAI;IACb;IACA,IAAIE,QAAQ,CAACC,WAAW,KAAK,KAAK,EAAE;MAClC,OAAO,KAAK;IACd;IACA,MAAMC,SAAS,GAAG,MAAMP,aAAa,CAACQ,uBAAuB,CAAC,CAAC;IAC/D,OAAOD,SAAS,CAACJ,OAAO,KAAK,IAAI;EACnC,CAAC,CAAC,OAAOnB,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,mDAAmD,EACnD;MAAEC,MAAM,EAAE;IAAgC,CAAC,EAC3CF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeyB,gBAAgBA,CAAA,EAA2B;EAC/D,MAAMT,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,IAAI;EACb;EAEA,MAAMR,SAAS,GAAG,MAAML,YAAY,CAAC,CAAC;EACtC,IAAI,CAACK,SAAS,EAAE;IACdlB,GAAG,CAACW,IAAI,CACN,0IAA0I,EAC1I;MAAEC,MAAM,EAAE;IAAmB,CAC/B,CAAC;IACD,OAAO,IAAI;EACb;EAEA,IAAI;IACF,MAAMwB,KAAK,GAAG,MAAMV,aAAa,CAACW,qBAAqB,CAAC;MAAEnB;IAAU,CAAC,CAAC;IACtE,IAAIkB,KAAK,CAACE,IAAI,CAACnB,MAAM,KAAK,CAAC,EAAE;MAC3BnB,GAAG,CAACW,IAAI,CAAC,+CAA+C,EAAE;QAAEC,MAAM,EAAE;MAAmB,CAAC,CAAC;MACzF,OAAO,IAAI;IACb;IACA,OAAOwB,KAAK,CAACE,IAAI;EACnB,CAAC,CAAC,OAAO5B,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CAAC,mCAAmC,EAAE;MAAEC,MAAM,EAAE;IAAmB,CAAC,EAAEF,KAAK,CAAC;IACpF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe6B,0BAA0BA,CAAA,EAAqB;EACnE,MAAMb,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMc,QAAQ,GAAGd,aAAa,CAACe,2BAA2B,CAAC,CAAC;IAC5D,IAAI,CAACD,QAAQ,EAAE;MACb,OAAO,IAAI;IACb;IACA,MAAMF,IAAa,GAAGE,QAAQ,CAACE,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI;IAChE,IAAI;MACFZ,aAAa,CAACmB,6BAA6B,CAAC,CAAC;IAC/C,CAAC,CAAC,OAAOC,UAAU,EAAE;MACnB9C,GAAG,CAACW,IAAI,CACN,qDAAqD,EACrD;QAAEC,MAAM,EAAE;MAA6B,CAAC,EACxCkC,UACF,CAAC;IACH;IACA,OAAOR,IAAI;EACb,CAAC,CAAC,OAAO5B,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,2CAA2C,EAC3C;MAAEC,MAAM,EAAE;IAA6B,CAAC,EACxCF,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAIqC,0BAA0B,GAAG,KAAK;;AAEtC;;AAGA;;AAiBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,yBAAyBA,CAC7CC,IAA6B,EACX;EAClB,IAAI5C,qBAAQ,CAACC,EAAE,KAAK,SAAS,EAAE;IAC7B,OAAO,KAAK;EACd;EACA,MAAMoB,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMA,aAAa,CAACwB,2BAA2B,CAACD,IAAI,CAACE,EAAE,EAAE;MACvDC,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfC,UAAU,EACRJ,IAAI,CAACI,UAAU,KAAK,MAAM,GACtB3B,aAAa,CAAC4B,iBAAiB,CAACC,IAAI,GACpC7B,aAAa,CAAC4B,iBAAiB,CAACE,OAAO;MAC7C,IAAIP,IAAI,CAACQ,WAAW,GAAG;QAAEA,WAAW,EAAER,IAAI,CAACQ;MAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAO/C,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,2CAA2C,EAC3C;MAAEC,MAAM,EAAE,2BAA2B;MAAE8C,SAAS,EAAET,IAAI,CAACE;IAAG,CAAC,EAC3DzC,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeiD,oCAAoCA,CACxDC,MAAiD,EAC/B;EAClB,IAAIb,0BAA0B,EAAE;IAC9B,OAAO,KAAK;EACd;EACAA,0BAA0B,GAAG,IAAI;EAEjC,MAAMrB,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACFA,aAAa,CAACmC,sBAAsB,CAAC;MACnCC,kBAAkB,EAAE,MAAOpB,YAAY,IAAK;QAC1C,MAAMJ,IAAa,GAAGI,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI;QACvD,MAAMyB,IAAI,GAAGH,MAAM,CAACtB,IAAI,CAAC,KAAK,MAAM;QACpC,OAAO;UACL;UACA0B,gBAAgB,EAAED,IAAI;UACtB;UACA;UACAE,cAAc,EAAEF,IAAI;UACpB;UACA;UACAG,eAAe,EAAE,KAAK;UACtB;UACAC,cAAc,EAAE;QAClB,CAAC;MACH;IACF,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAOzD,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,uDAAuD,EACvD;MAAEC,MAAM,EAAE;IAAuC,CAAC,EAClDF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe0D,gCAAgCA,CACpDC,QAAiC,EACZ;EACrB,MAAM3C,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,MAAMH,SAAS;EACxB;EACA,IAAI;IACF,MAAM+C,YAAY,GAAG5C,aAAa,CAAC6C,uCAAuC,CAAE/B,QAAQ,IAAK;MACvF6B,QAAQ,CAAC7B,QAAQ,CAACE,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI,CAAC;IACtD,CAAC,CAAC;IACF,OAAO,MAAMgC,YAAY,CAACE,MAAM,CAAC,CAAC;EACpC,CAAC,CAAC,OAAO9D,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,0CAA0C,EAC1C;MAAEC,MAAM,EAAE;IAAmC,CAAC,EAC9CF,KACF,CAAC;IACD,OAAO,MAAMa,SAAS;EACxB;AACF","ignoreList":[]}
+{"version":3,"names":["_core","require","_reactNative","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","log","createLogger","isRecord","value","loadNotifications","Platform","OS","Promise","resolve","then","error","warn","method","easProjectId","constants","debug","fromEasConfig","easConfig","projectId","length","extra","expoConfig","eas","undefined","pushTokenPlatform","hasNotificationPermission","notifications","permissions","getPermissionsAsync","granted","requestNotificationPermission","existing","canAskAgain","requested","requestPermissionsAsync","getExpoPushToken","token","getExpoPushTokenAsync","data","takeLaunchNotificationData","response","getLastNotificationResponse","notification","request","content","clearLastNotificationResponse","clearError","foregroundHandlerAttempted","installForegroundNotificationHandler","decide","setNotificationHandler","handleNotification","show","shouldShowBanner","shouldShowList","shouldPlaySound","shouldSetBadge","subscribeToNotificationResponses","listener","subscription","addNotificationResponseReceivedListener","remove"],"sourceRoot":"../../../src","sources":["notifications/deviceNotifications.ts"],"mappings":";;;;;;;;;;;;AAsCA,IAAAA,KAAA,GAAAC,OAAA;AAEA,IAAAC,YAAA,GAAAD,OAAA;AAAwC,SAAAE,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAxCxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAMA,MAAMkB,GAAG,GAAG,IAAAC,kBAAY,EAAC,qBAAqB,CAAC;AAK/C,SAASC,QAAQA,CAACC,KAAc,EAAoC;EAClE,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,KAAK,IAAI;AACpD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAwC;EACtE,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,IAAI;IACF,OAAO,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7B,uBAAA,CAAAF,OAAA,CAAa,oBAAoB,GAAC;EAC3C,CAAC,CAAC,OAAOgC,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,oEAAoE,EACpE;MAAEC,MAAM,EAAE;IAAoB,CAAC,EAC/BF,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeG,YAAYA,CAAA,EAA2B;EACpD,IAAIC,SAAqC;EACzC,IAAI;IACFA,SAAS,GAAG,CAAC,MAAAP,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7B,uBAAA,CAAAF,OAAA,CAAa,gBAAgB,GAAC,EAAEa,OAAO;EACtD,CAAC,CAAC,OAAOmB,KAAK,EAAE;IACdV,GAAG,CAACe,KAAK,CACP,iFAAiF,EACjF;MAAEH,MAAM,EAAE;IAAe,CAAC,EAC1BF,KACF,CAAC;IACD,OAAO,IAAI;EACb;EAEA,MAAMM,aAAa,GAAGF,SAAS,CAACG,SAAS,EAAEC,SAAS;EACpD,IAAI,OAAOF,aAAa,KAAK,QAAQ,IAAIA,aAAa,CAACG,MAAM,GAAG,CAAC,EAAE;IACjE,OAAOH,aAAa;EACtB;EAEA,MAAMI,KAAc,GAAGN,SAAS,CAACO,UAAU,EAAED,KAAK;EAClD,MAAME,GAAG,GAAGpB,QAAQ,CAACkB,KAAK,CAAC,GAAGA,KAAK,CAACE,GAAG,GAAGC,SAAS;EACnD,MAAML,SAAS,GAAGhB,QAAQ,CAACoB,GAAG,CAAC,GAAGA,GAAG,CAACJ,SAAS,GAAGK,SAAS;EAC3D,OAAO,OAAOL,SAAS,KAAK,QAAQ,IAAIA,SAAS,CAACC,MAAM,GAAG,CAAC,GAAGD,SAAS,GAAG,IAAI;AACjF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASM,iBAAiBA,CAAA,EAA6B;EAC5D,OAAOnB,qBAAQ,CAACC,EAAE,KAAK,KAAK,IAAID,qBAAQ,CAACC,EAAE,KAAK,SAAS,GAAGD,qBAAQ,CAACC,EAAE,GAAG,IAAI;AAChF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAemB,yBAAyBA,CAAA,EAAqB;EAClE,MAAMC,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMC,WAAW,GAAG,MAAMD,aAAa,CAACE,mBAAmB,CAAC,CAAC;IAC7D,OAAOD,WAAW,CAACE,OAAO,KAAK,IAAI;EACrC,CAAC,CAAC,OAAOnB,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,4CAA4C,EAC5C;MAAEC,MAAM,EAAE;IAA4B,CAAC,EACvCF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeoB,6BAA6BA,CAAA,EAAqB;EACtE,MAAMJ,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMK,QAAQ,GAAG,MAAML,aAAa,CAACE,mBAAmB,CAAC,CAAC;IAC1D,IAAIG,QAAQ,CAACF,OAAO,KAAK,IAAI,EAAE;MAC7B,OAAO,IAAI;IACb;IACA,IAAIE,QAAQ,CAACC,WAAW,KAAK,KAAK,EAAE;MAClC,OAAO,KAAK;IACd;IACA,MAAMC,SAAS,GAAG,MAAMP,aAAa,CAACQ,uBAAuB,CAAC,CAAC;IAC/D,OAAOD,SAAS,CAACJ,OAAO,KAAK,IAAI;EACnC,CAAC,CAAC,OAAOnB,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,mDAAmD,EACnD;MAAEC,MAAM,EAAE;IAAgC,CAAC,EAC3CF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeyB,gBAAgBA,CAAA,EAA2B;EAC/D,MAAMT,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,IAAI;EACb;EAEA,MAAMR,SAAS,GAAG,MAAML,YAAY,CAAC,CAAC;EACtC,IAAI,CAACK,SAAS,EAAE;IACdlB,GAAG,CAACW,IAAI,CACN,0IAA0I,EAC1I;MAAEC,MAAM,EAAE;IAAmB,CAC/B,CAAC;IACD,OAAO,IAAI;EACb;EAEA,IAAI;IACF,MAAMwB,KAAK,GAAG,MAAMV,aAAa,CAACW,qBAAqB,CAAC;MAAEnB;IAAU,CAAC,CAAC;IACtE,IAAIkB,KAAK,CAACE,IAAI,CAACnB,MAAM,KAAK,CAAC,EAAE;MAC3BnB,GAAG,CAACW,IAAI,CAAC,+CAA+C,EAAE;QAAEC,MAAM,EAAE;MAAmB,CAAC,CAAC;MACzF,OAAO,IAAI;IACb;IACA,OAAOwB,KAAK,CAACE,IAAI;EACnB,CAAC,CAAC,OAAO5B,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CAAC,mCAAmC,EAAE;MAAEC,MAAM,EAAE;IAAmB,CAAC,EAAEF,KAAK,CAAC;IACpF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe6B,0BAA0BA,CAAA,EAAqB;EACnE,MAAMb,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMc,QAAQ,GAAGd,aAAa,CAACe,2BAA2B,CAAC,CAAC;IAC5D,IAAI,CAACD,QAAQ,EAAE;MACb,OAAO,IAAI;IACb;IACA,MAAMF,IAAa,GAAGE,QAAQ,CAACE,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI;IAChE,IAAI;MACFZ,aAAa,CAACmB,6BAA6B,CAAC,CAAC;IAC/C,CAAC,CAAC,OAAOC,UAAU,EAAE;MACnB9C,GAAG,CAACW,IAAI,CACN,qDAAqD,EACrD;QAAEC,MAAM,EAAE;MAA6B,CAAC,EACxCkC,UACF,CAAC;IACH;IACA,OAAOR,IAAI;EACb,CAAC,CAAC,OAAO5B,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,2CAA2C,EAC3C;MAAEC,MAAM,EAAE;IAA6B,CAAC,EACxCF,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAIqC,0BAA0B,GAAG,KAAK;;AAEtC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,oCAAoCA,CACxDC,MAAiD,EAC/B;EAClB,IAAIF,0BAA0B,EAAE;IAC9B,OAAO,KAAK;EACd;EACAA,0BAA0B,GAAG,IAAI;EAEjC,MAAMrB,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACFA,aAAa,CAACwB,sBAAsB,CAAC;MACnCC,kBAAkB,EAAE,MAAOT,YAAY,IAAK;QAC1C,MAAMJ,IAAa,GAAGI,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI;QACvD,MAAMc,IAAI,GAAGH,MAAM,CAACX,IAAI,CAAC,KAAK,MAAM;QACpC,OAAO;UACL;UACAe,gBAAgB,EAAED,IAAI;UACtB;UACA;UACAE,cAAc,EAAEF,IAAI;UACpB;UACA;UACAG,eAAe,EAAE,KAAK;UACtB;UACAC,cAAc,EAAE;QAClB,CAAC;MACH;IACF,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAO9C,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,uDAAuD,EACvD;MAAEC,MAAM,EAAE;IAAuC,CAAC,EAClDF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe+C,gCAAgCA,CACpDC,QAAiC,EACZ;EACrB,MAAMhC,aAAa,GAAG,MAAMtB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACsB,aAAa,EAAE;IAClB,OAAO,MAAMH,SAAS;EACxB;EACA,IAAI;IACF,MAAMoC,YAAY,GAAGjC,aAAa,CAACkC,uCAAuC,CAAEpB,QAAQ,IAAK;MACvFkB,QAAQ,CAAClB,QAAQ,CAACE,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI,CAAC;IACtD,CAAC,CAAC;IACF,OAAO,MAAMqB,YAAY,CAACE,MAAM,CAAC,CAAC;EACpC,CAAC,CAAC,OAAOnD,KAAK,EAAE;IACdV,GAAG,CAACW,IAAI,CACN,0CAA0C,EAC1C;MAAEC,MAAM,EAAE;IAAmC,CAAC,EAC9CF,KACF,CAAC;IACD,OAAO,MAAMa,SAAS;EACxB;AACF","ignoreList":[]}

package/lib/commonjs/ui/boot/runProviderColdBoot.js

@@ -7,9 +7,10 @@ exports.SESSION_HANDOFF_DEADLINE_MS = exports.COLD_BOOT_OVERALL_DEADLINE_MS = vo
 exports.runProviderColdBoot = runProviderColdBoot;
 var _core = require("@oxyhq/core");
 var _deviceCredential = require("../utils/deviceCredential.js");
+var _crossOriginRestore = require("../utils/crossOriginRestore.js");
 var _oauthReturn = require("../utils/oauthReturn.js");
 var _isWebBrowser = require("../utils/isWebBrowser.js");
-var _netConnectivity = require("../utils/netConnectivity.js");
+var _legacyRedirectLanes = require("../oauth/legacyRedirectLanes.js");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
 const SESSION_HANDOFF_DEADLINE_MS = exports.SESSION_HANDOFF_DEADLINE_MS = 6000;
@@ -56,8 +57,8 @@ async function detectOfflineHint() {
       setTimeout(() => resolve(null), OFFLINE_PROBE_TIMEOUT_MS);
     })]);
     // `null` ⇒ the probe timed out (unknown → assume online). Only an explicit
-    // disconnected / unreachable verdict disables the network steps.
-    return (0, _netConnectivity.isNetConnectivityExplicitlyOffline)(state);
+    // `isConnected === false` disables the network steps.
+    return state?.isConnected === false;
   } catch {
     // NetInfo missing / probe threw — never block sign-in on a probe failure.
     return false;
@@ -67,19 +68,19 @@ async function detectOfflineHint() {
  * Device-first cold boot for `@oxyhq/services` providers.
  *
  * Ordered pipeline:
- * 1. Complete an OAuth authorization-code return already on the URL (web)
+ * 1. Complete OAuth authorization-code return (web)
  * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
  *    primary-identity-key lane in `sessionMode: 'identity'`)
+ * 3. Silent OAuth for all web apps when mint finds no session
  *
- * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
- * which for an identity-bound client is somebody else's account by construction.
- * In `'identity'` mode the boot is exactly step 2.
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
  *
- * The boot NEVER navigates the top-level window. There is no automatic
- * `prompt=none` bounce to the IdP: a web origin with no local device credential
- * resolves SIGNED OUT and waits for the user's next explicit "Continue with
- * Oxy", which opens a popup from a real gesture (#691 phase 7b). Step 1 is not a
- * navigation — it only consumes a code that is already in the address bar.
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 async function runProviderColdBoot(opts) {
   const {
@@ -87,8 +88,10 @@ async function runProviderColdBoot(opts) {
     authStore,
     clientId,
     authRedirectUri,
+    authorizeBaseUrl,
     sessionMode = 'account',
     identity,
+    webAuthMode = 'redirect',
     sessionClient,
     syncDeviceCredentialToHost,
     commitSession,
@@ -98,18 +101,28 @@ async function runProviderColdBoot(opts) {
   const identityBound = sessionMode === 'identity';
   setTokenReady(false);
   try {
-    // The redirect transport's RETURN leg. An app reaches it whenever the browser
-    // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
-    // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
-    // load-bearing even though nothing here ever starts a redirect. It consumes a
-    // code (or a stale OAuth `error`) already in the address bar and rewrites the
-    // URL via `history.replaceState`; it never begins a navigation.
+    // MODE-INDEPENDENT URL cleanup, deliberately so: both consume query params a
+    // PREVIOUS redirect-mode session left in the address bar (`?error=login_required`
+    // from a silent authorize, `?hub_sync=failed` from the hub) and restore the
+    // page the visit started on. Flipping an app to popup mode must not strand
+    // those params, so neither is gated on `webAuthMode`. Neither starts a
+    // navigation — they only rewrite the URL via `history.replaceState`.
+    (0, _crossOriginRestore.consumeSilentOAuthError)();
+    (0, _oauthReturn.consumeHubSyncFailure)();
+
+    // The redirect transport's RETURN leg — also NOT gated on `webAuthMode`. A
+    // popup-mode app legitimately lands here with `?code=` whenever the browser
+    // blocked the popup and `startWebOAuthSignIn` fell back to a full-page
+    // redirect (`popup-blocked` / `popup-navigation-failed`), and an app that
+    // switched modes mid-flight must not be stranded with a dead `?code=`
+    // either. It consumes a code already on the URL; it never starts one.
     const oauthCompleted = identityBound ? false : await (0, _oauthReturn.tryCompleteOAuthReturn)({
       oxyServices,
       clientId,
       authRedirectUri,
       commitSession: input => commitSession(input, {
-        activate: true
+        activate: true,
+        hubSync: false
       })
     });
     if (oauthCompleted) {
@@ -123,7 +136,7 @@ async function runProviderColdBoot(opts) {
     // burning the overall deadline on a mint that cannot succeed. Any ambiguity
     // resolves to "online" — the network steps still run.
     const offline = await detectOfflineHint();
-    await (0, _core.runSessionColdBoot)({
+    const outcome = await (0, _core.runSessionColdBoot)({
       oxy: oxyServices,
       store: authStore,
       platform: {
@@ -185,6 +198,37 @@ async function runProviderColdBoot(opts) {
         }
       }
     });
+
+    // Silent cross-origin OAuth restore (web cross-app SSO): a full-page
+    // `prompt=none` bounce to the IdP when the mint found no local session.
+    //
+    // TRANSPORT gate (`allowsAutomaticIdpRedirect`): `webAuthMode: 'popup'`
+    // FORBIDS this lane. It navigates the top-level window with no user gesture
+    // behind it, which is precisely what popup mode exists to eliminate — a
+    // popup-mode domain without a local credential resolves signed out right
+    // here and waits for the user's next explicit "Continue with Oxy" (issue
+    // #691, "Cold boot and cross-domain behavior"). `'redirect'` — still the
+    // default and the compatibility path — reaches this lane unchanged, and this
+    // whole block disappears with the transport in phase 7b.
+    //
+    // ORIGIN gate: same as the hub-sync WRITE side (`syncHubAfterSignIn`) —
+    // official web origins only, never the IdP hub itself, and — unlike the
+    // write side — never a loopback / local-dev origin (which must not be
+    // bounced to a hosted IdP on cold boot). The authorize endpoint is
+    // env-configurable so a local/staging app targets its own IdP instead of
+    // production.
+    const webOrigin = (0, _isWebBrowser.isWebBrowser)() ? globalThis.location?.origin : undefined;
+    if (!identityBound && (0, _legacyRedirectLanes.allowsAutomaticIdpRedirect)(webAuthMode) && clientId && outcome.kind !== 'session' && webOrigin && (0, _crossOriginRestore.isSilentRestoreEligibleOrigin)(webOrigin)) {
+      const redirected = await (0, _crossOriginRestore.maybeStartSilentOAuthRestore)({
+        oxyServices,
+        clientId,
+        redirectUri: authRedirectUri,
+        authorizeBaseUrl
+      });
+      if (redirected) {
+        return;
+      }
+    }
   } catch (error) {
     if (__DEV__) {
       _core.logger.error('Cold boot error', error instanceof Error ? error : new Error(String(error)), {