@oxyhq/services 28.0.0 → 29.0.0

package/lib/typescript/module/ui/runtime/runtimeContext.d.ts

@@ -0,0 +1,43 @@
+import type { DeviceDirectory } from '@oxyhq/contracts';
+import type { DeviceContext, User } from '@oxyhq/core';
+import type { OxyRuntime } from './createOxyRuntime.js';
+import type { OxyRuntimeStatus } from './types.js';
+export declare const OxyRuntimeHandleProvider: import("react").Provider<OxyRuntime | null>;
+export declare class OxyRuntimeMissingError extends Error {
+    readonly code = "oxy_runtime_missing";
+    constructor();
+}
+/** The runtime this provider owns. THROWS when no `<OxyProvider>` is mounted. */
+export declare function useOxyRuntime(): OxyRuntime;
+export interface ActiveAccount {
+    /**
+     * The human whose authentication backs the session — the audit actor. Equal
+     * to {@link ActiveAccount.account} unless a delegated context is active.
+     */
+    principal: User | null;
+    /** The account the session acts AS — what a profile header renders. */
+    account: User | null;
+    /** The resolved `principal acting as account` pair, when a directory is held. */
+    context: DeviceContext | null;
+    /** Whether the actor and the subject are different accounts. */
+    isDelegated: boolean;
+    status: OxyRuntimeStatus;
+}
+/**
+ * Who this app is running as, with the actor and the subject kept apart.
+ *
+ * Unlike `useOxy()`, this re-renders only when one of those five facts moves —
+ * a locale change, a dialog opening or a session-list refresh does not reach it.
+ */
+export declare function useActiveAccount(): ActiveAccount;
+/**
+ * The device directory — every principal on this device and the contexts each
+ * may act as (ADR 0002).
+ *
+ * `null` until something calls `runtime.refreshDirectory()`. A client that
+ * never asks for one never pays for the round trip.
+ */
+export declare function useDeviceDirectory(): DeviceDirectory | null;
+/** The whole runtime snapshot. Prefer a narrower hook where one exists. */
+export declare function useOxySnapshot(): ReturnType<OxyRuntime['getSnapshot']>;
+//# sourceMappingURL=runtimeContext.d.ts.map

package/lib/typescript/module/ui/runtime/runtimeContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/runtimeContext.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAS,CAAC;AAgBhD,eAAO,MAAM,wBAAwB,6CAAmC,CAAC;AAKzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,yBAAyB;;CAMvC;AAED,iFAAiF;AACjF,wBAAgB,aAAa,IAAI,UAAU,CAM1C;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,gEAAgE;IAChE,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AA2BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,GAAG,IAAI,CAE3D;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAEtE"}

package/lib/typescript/module/ui/runtime/types.d.ts

@@ -0,0 +1,89 @@
+import type { DeviceDirectory, DeviceSessionState } from '@oxyhq/contracts';
+import type { ClientSession, DeviceContext, User } from '@oxyhq/core';
+/**
+ * The runtime's coarse verdict about this device's session.
+ *
+ * `'booting'` is NOT "signed out but we are still looking": it is the honest
+ * "undetermined" that every readiness gate in the SDK exists to express, and it
+ * ends exactly once at the first cold-boot resolution. `'error'` is reserved for
+ * a resolved boot that produced no account AND recorded a failure — a failed
+ * sign-in against a signed-out device is `'signed_out'` with an `error`, because
+ * the device really is signed out.
+ */
+export type OxyRuntimeStatus = 'booting' | 'authenticated' | 'signed_out' | 'error';
+/**
+ * Whether a bearer usable for private calls is planted right now.
+ *
+ * `'refreshing'` covers both halves of the gap the SDK already tracked with two
+ * separate booleans: a bearer that is present but whose readiness gate is shut
+ * (a commit in flight), and an authenticated account whose bearer has been
+ * invalidated and is being re-minted. Both mean the same thing to a caller —
+ * wait, do not treat this as signed out.
+ */
+export type OxyTokenStatus = 'missing' | 'refreshing' | 'ready' | 'error';
+export interface OxyRuntimeError {
+    message: string;
+    code: string;
+}
+/**
+ * The ONE observable state of an `OxyRuntime` (ADR 0004).
+ *
+ * Frozen and referentially stable: a new object is published only when
+ * something actually changed, so `useSyncExternalStore` can compare by identity
+ * and a selector over an unchanged field never re-renders.
+ *
+ * Every field is either a fact the runtime owns or a pure derivation of one.
+ * There is no second writable store: `sessions`, `activeSessionId`, `status`
+ * and `tokenStatus` are computed by the one snapshot builder, so two of them can
+ * never disagree about the same device.
+ */
+export interface OxyRuntimeSnapshot {
+    status: OxyRuntimeStatus;
+    /**
+     * The device DIRECTORY (ADR 0002) — principals and the contexts each may act
+     * as. `null` until something asks for one; the flat lane never pays for it.
+     */
+    device: DeviceDirectory | null;
+    /**
+     * The flat, server-authoritative device state. Kept beside {@link device}
+     * because it is what the compatibility projections below are derived from,
+     * and because the two describe the same device at the same `revision`.
+     */
+    deviceState: DeviceSessionState | null;
+    /** The active `principal acting as account` pair, when a directory is held. */
+    activeContext: DeviceContext | null;
+    /**
+     * The human whose authentication backs the session — the audit actor.
+     *
+     * Equal to {@link account} on a device with no directory and on any
+     * non-delegated context: the flat lane cannot tell the two apart, and saying
+     * so by making them the same object is more honest than leaving this `null`.
+     */
+    principal: User | null;
+    /** The account the session acts AS — what a profile header renders. */
+    account: User | null;
+    tokenStatus: OxyTokenStatus;
+    /**
+     * Whether the first cold boot has concluded. Monotonic: once `true` it never
+     * reverts, so a later transient signed-out state is never mistaken for
+     * "still booting".
+     */
+    authResolved: boolean;
+    /** A context activation / account switch is in flight. */
+    switching: boolean;
+    error: OxyRuntimeError | null;
+    sessions: ClientSession[];
+    activeSessionId: string | null;
+    /** A sign-in / sign-out operation is in flight. */
+    isLoading: boolean;
+    /** The local display/bookkeeping storage has resolved. */
+    storageReady: boolean;
+    /** A bearer is planted on the client instance right now. */
+    hasAccessToken: boolean;
+    /**
+     * The commit gate. Shut while a session commit is mid-flight so a consumer
+     * cannot fire a private call between the token landing and the projection.
+     */
+    tokenReady: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/typescript/module/ui/runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,eAAe,GAAG,YAAY,GAAG,OAAO,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAC;IAEzB;;;OAGG;IACH,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAE/B;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAEvC,+EAA+E;IAC/E,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAEpC;;;;;;OAMG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAEvB,uEAAuE;IACvE,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAErB,WAAW,EAAE,cAAc,CAAC;IAE5B;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IAEnB,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAM9B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IAEnB,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;IAEtB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB"}

package/lib/typescript/module/ui/runtime/useRuntimeSnapshot.d.ts

@@ -0,0 +1,23 @@
+import type { OxyRuntime } from './createOxyRuntime.js';
+import type { OxyRuntimeSnapshot } from './types.js';
+/**
+ * Subscribe to the whole runtime snapshot.
+ *
+ * The runtime publishes a frozen object only when a fact actually changed, so
+ * identity comparison is exact: a locale change, a dialog opening or an
+ * unrelated query settling does not wake anything subscribed here.
+ */
+export declare function useRuntimeSnapshot(runtime: OxyRuntime): OxyRuntimeSnapshot;
+/**
+ * Subscribe to one derived value of the runtime snapshot.
+ *
+ * The selection is cached against the snapshot it was computed from, which is
+ * what makes a selector returning a fresh object (`{user, isAuthenticated}`)
+ * safe here: `useSyncExternalStore` calls `getSnapshot` several times per
+ * commit and would otherwise see a new object every call and loop.
+ *
+ * `selector` must be stable — hoist it to module scope or wrap it in
+ * `useCallback`. An inline arrow re-subscribes on every render.
+ */
+export declare function useRuntimeSelector<T>(runtime: OxyRuntime, selector: (snapshot: OxyRuntimeSnapshot) => T, isEqual?: (a: T, b: T) => boolean): T;
+//# sourceMappingURL=useRuntimeSnapshot.d.ts.map

package/lib/typescript/module/ui/runtime/useRuntimeSnapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRuntimeSnapshot.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/useRuntimeSnapshot.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,kBAAkB,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,CAAC,EAC7C,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,OAAO,GAChC,CAAC,CAqBH"}

package/lib/typescript/module/ui/server.d.ts

@@ -22,7 +22,6 @@ export declare const useStorage: () => {
 };
 export declare const ProfileScreen: () => null;
 export declare const useAuthStore: () => {};
-export declare const useAccountStore: () => {};
 export declare const toast: (() => void) & {
     success: () => void;
     error: () => void;

package/lib/typescript/module/ui/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/ui/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,eAAO,MAAM,WAAW,YAAgB,CAAC;AACzC,eAAO,MAAM,eAAe,YAAgB,CAAC;AAC7C,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,YAAY,YAAgB,CAAC;AAC1C,eAAO,MAAM,YAAY,YAAgB,CAAC;AAG1C,eAAO,MAAM,MAAM,UAAW,CAAC;AAG/B,eAAO,MAAM,OAAO,UAAW,CAAC;AAChC,eAAO,MAAM,SAAS,UAAW,CAAC;AAClC,eAAO,MAAM,UAAU;;;CAA0B,CAAC;AAGlD,eAAO,MAAM,aAAa,YAAgB,CAAC;AAG3C,eAAO,MAAM,YAAY,UAAW,CAAC;AACrC,eAAO,MAAM,eAAe,UAAW,CAAC;AAGxC,eAAO,MAAM,KAAK;;;;;;;CAUjB,CAAC;AAGF,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/ui/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,eAAO,MAAM,WAAW,YAAgB,CAAC;AACzC,eAAO,MAAM,eAAe,YAAgB,CAAC;AAC7C,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,YAAY,YAAgB,CAAC;AAC1C,eAAO,MAAM,YAAY,YAAgB,CAAC;AAG1C,eAAO,MAAM,MAAM,UAAW,CAAC;AAG/B,eAAO,MAAM,OAAO,UAAW,CAAC;AAChC,eAAO,MAAM,SAAS,UAAW,CAAC;AAClC,eAAO,MAAM,UAAU;;;CAA0B,CAAC;AAGlD,eAAO,MAAM,aAAa,YAAgB,CAAC;AAG3C,eAAO,MAAM,YAAY,UAAW,CAAC;AAGrC,eAAO,MAAM,KAAK;;;;;;;CAUjB,CAAC;AAGF,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}

package/lib/typescript/module/ui/session/authStore.d.ts

@@ -1,25 +1,76 @@
 /**
  * Platform `AuthStateStore` for `@oxyhq/services`.
  *
- * The zero-cookie device model persists the durable device credential
- * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
- * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
- * owns the store shape + logic (`createWebAuthStateStore` /
- * `createNativeAuthStateStore`); this module only selects the platform storage
- * seam:
+ * The device model persists the durable device credential (`deviceId` +
+ * `deviceSecret`) per origin (web) / per device (native), and the SDK re-mints
+ * the access token from that credential on cold boot. `@oxyhq/core` owns the
+ * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
+ * `createMemoryAuthStateStore`); this module only selects the seam:
  *
+ *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
  *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
  *    the shared `createNativeSecureKeyValueStorage()` adapter
- *    (`expo-secure-store`, AsyncStorage fallback).
+ *    (`expo-secure-store`, AsyncStorage fallback), WRAPPED so every credential
+ *    it persists is also mirrored into the device-wide shared slot.
+ *
+ * The native wrapper is how several official apps end up on ONE `DeviceSession`
+ * (and therefore one active context): whichever app proves a credential publishes
+ * it, and a later-installed sibling adopts it during cold boot instead of asking
+ * for the Commons identity key. The mirror is additive — it can neither change
+ * nor fail the app's own durable write.
  */
-import { type AuthStateStore } from '@oxyhq/core';
+import { type AuthStateStore, type SessionMode } from '@oxyhq/core';
+export interface PlatformAuthStateStoreOptions {
+    /**
+     * Who owns the session this provider resolves. Only `'account'` mirrors into
+     * the device-wide shared slot.
+     *
+     * `'identity'` (the vault) is deliberately excluded, which keeps its storage
+     * behaviour byte-for-byte what it is today. The vault's credential is a
+     * perfectly valid device credential, so publishing it would arguably be
+     * correct — but it would also let every ordinary app on the device join the
+     * vault's device session as a side effect of the vault persisting a token, and
+     * "a background write changes which session five other apps boot into" is not
+     * a decision a storage seam gets to make.
+     */
+    sessionMode?: SessionMode;
+    /**
+     * Whether this origin/app may persist a durable device credential AT ALL.
+     *
+     * `'ephemeral'` stores nothing durable and mirrors nothing: the session lives
+     * in memory for the lifetime of the page and is gone on reload. Its one caller
+     * is `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
+     * where the durable credential for the browser profile is the server-side
+     * DeviceSession behind the `__Host-oxy-device` handle.
+     *
+     * See `OxyProviderProps.deviceCredentialStorage` for why the answer to "let the
+     * hub be authoritative" is to stop persisting the other credential rather than
+     * to consult it second.
+     */
+    storage?: 'persistent' | 'ephemeral';
+}
 /**
  * Build the platform {@link AuthStateStore} for this runtime.
  *
  * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
  * token) per-app in SecureStore; the SDK re-mints the access token from the
  * device credential on the next cold boot.
+ *
+ * ## The ephemeral check is FIRST, and the order is load-bearing
+ *
+ * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
+ * never reach the native path — and therefore can never reach the shared-slot
+ * mirroring wrapper. Checked after that branch instead, an origin that has
+ * declined to persist a credential would publish one into the device-wide slot
+ * every sibling app adopts on cold boot: it would keep nothing itself while
+ * deciding which session five other apps boot into.
+ *
+ * That is unreachable today because the only ephemeral caller is a web origin, so
+ * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
+ * of guarantee that stops holding when someone adds the second caller, so it is
+ * structural here rather than incidental, and
+ * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
  */
-export declare function createPlatformAuthStateStore(): AuthStateStore;
+export declare function createPlatformAuthStateStore(options?: PlatformAuthStateStoreOptions): AuthStateStore;
 //# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/session/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAIrB;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,cAAc,CAM7D"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,cAAc,CAiBhB"}

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts

@@ -0,0 +1,32 @@
+import { type SharedDeviceCredentialStore } from '@oxyhq/core';
+/**
+ * The iOS Keychain Access Group every official Oxy app declares in its
+ * entitlements. Shared with the identity slots — the group is the app-group
+ * boundary, not the secret's identity.
+ */
+export declare const IOS_KEYCHAIN_ACCESS_GROUP = "group.so.oxy.shared";
+/**
+ * The iOS `keychainService` for the DEVICE SESSION credential. Deliberately
+ * distinct from every identity and recovery service; do not reuse one of those
+ * here, and do not drop it (an item written with no service shares the legacy
+ * identity slot's namespace inside the group).
+ */
+export declare const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = "oxy_device_session";
+/** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
+export declare const SHARED_DEVICE_SESSION_STORAGE_KEY = "oxy_shared_device_session_v1";
+/**
+ * The shared DeviceSession credential slot for this runtime, or `null` when
+ * there is none.
+ *
+ * The branch is on the PLATFORM, not on which module happens to load, because
+ * `expo-secure-store` loads perfectly well on Android — it would just quietly
+ * ignore `keychainAccessGroup` and read a package-private item, which looks
+ * exactly like an empty shared slot. This is the same iOS-vs-Android split
+ * `KeyManager` makes for the shared identity, for the same reason.
+ *
+ * Any other native platform gets the broker, which answers `unsupported` when
+ * the module is not linked — so the lane is simply off, which is the safe
+ * direction.
+ */
+export declare function createPlatformSharedDeviceCredentialStore(): SharedDeviceCredentialStore | null;
+//# sourceMappingURL=sharedDeviceCredentialStore.d.ts.map

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AA0OhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAK9F"}

package/lib/typescript/module/ui/stores/authStore.d.ts

@@ -1,17 +1,61 @@
 import type { User } from '@oxyhq/core';
+import type { OxyRuntime } from '../runtime/index.js';
+/**
+ * The signed-in user, as a zustand-shaped read/write surface.
+ *
+ * It used to BE a zustand store, and that made it a second owner of the
+ * session: the provider wrote `user`/`isAuthenticated` here, `SessionClient`
+ * wrote the same facts into its device state, and nothing reconciled them —
+ * when they disagreed, which one was right was not answerable. It is now a
+ * projection of the ONE `OxyRuntime` (ADR 0004): reads come off the runtime
+ * snapshot and writes go into the runtime, so there is nothing left to drift.
+ *
+ * The zustand SHAPE is kept deliberately — `useAuthStore(selector)`,
+ * `.getState()`, `.setState()`, `.subscribe()` — because a dozen call sites
+ * across this package and the Commons app read the user out of band, from
+ * mutation success handlers and cache helpers that are not inside a render.
+ * Rewriting them is Phase 8's cut, not this one's.
+ *
+ * `fetchUser` and `lastUserFetch` are GONE rather than projected: they were a
+ * five-minute profile cache with zero readers anywhere in the monorepo, and the
+ * Query cache has owned that job since long before this change.
+ */
 export interface AuthState {
     user: User | null;
     isAuthenticated: boolean;
     isLoading: boolean;
     error: string | null;
-    lastUserFetch: number | null;
     loginSuccess: (user: User) => void;
     loginFailure: (error: string) => void;
     logout: () => void;
-    fetchUser: (oxyServices: {
-        getCurrentUser: () => Promise<User>;
-    }, forceRefresh?: boolean) => Promise<void>;
+    /** Replace the signed-in profile after a write (a rename, a new avatar). */
     setUser: (user: User) => void;
 }
-export declare const useAuthStore: import("zustand").UseBoundStore<import("zustand").StoreApi<AuthState>>;
+/** The subset of `AuthState` a caller may push back in through `setState`. */
+export type AuthStatePatch = Partial<Pick<AuthState, 'user' | 'isLoading' | 'error'>>;
+/**
+ * Point this surface at the provider's runtime. Called once by
+ * `OxyRuntimeProvider`; the returned function detaches it again on unmount.
+ *
+ * With nothing bound, reads answer signed-out and writes are dropped. That is
+ * the honest answer for the two places it happens — the SSR shim, and a unit
+ * test poking the store with no provider mounted — and it is why binding is an
+ * explicit call rather than a lazily-created default runtime, which is exactly
+ * the fabricated-forever-loading runtime ADR 0004 deleted.
+ */
+export declare function bindAuthStoreToRuntime(runtime: OxyRuntime): () => void;
+declare function useAuthStoreHook<T>(selector: (state: AuthState) => T): T;
+/**
+ * Read the signed-in user. Zustand-shaped, projected from the runtime.
+ *
+ * A selector that builds an object must be wrapped in `useShallow` (as every
+ * call site here already does) — otherwise a structurally-equal result reads as
+ * a change on every publish.
+ */
+export declare const useAuthStore: typeof useAuthStoreHook & {
+    getState: () => AuthState;
+    setState: (patch: AuthStatePatch) => void;
+    subscribe: (listener: () => void) => (() => void);
+};
+export {};
 //# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/stores/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/authStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAIxC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,SAAS,EAAE,CAAC,WAAW,EAAE;QAAE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3G,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC/B;AAED,eAAO,MAAM,YAAY,wEA0CtB,CAAC"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/authStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,4EAA4E;IAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;AAuEtF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,IAAI,CActE;AA6BD,iBAAS,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,CAejE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;oBAnDJ,SAAS;sBAEL,cAAc,KAAG,IAAI;0BAkBjB,MAAM,IAAI,KAAG,CAAC,MAAM,IAAI,CAAC;CAmCpD,CAAC"}

package/lib/typescript/module/ui/types/navigation.d.ts

@@ -123,5 +123,31 @@ export interface OxyProviderProps {
      * @default false
      */
     backgroundSession?: boolean;
+    /**
+     * Whether this origin/app may persist the durable device credential
+     * (`deviceId` + `deviceSecret`) at all.
+     *
+     * `'persistent'` (the default, and every app's behaviour) stores it — web
+     * localStorage per origin, SecureStore per app on native — so the SDK can
+     * re-mint an access token on the next cold boot.
+     *
+     * `'ephemeral'` stores NOTHING durable: the session lives in memory for the
+     * lifetime of the page and is gone on reload. It exists for ONE caller,
+     * `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
+     * where the durable credential for the browser profile is the server-side
+     * DeviceSession behind the `__Host-oxy-device` handle. Two durable
+     * credentials for one origin is the dual authority that phase exists to
+     * remove — revoking the hub while a localStorage secret still mints would
+     * make a sign-out look like it worked — so the way to let the hub be
+     * authoritative is to stop persisting the other one, not to consult it
+     * second.
+     *
+     * Do NOT reach for this to make an app "more private". A relying-party
+     * origin set to `'ephemeral'` simply signs the user out on every reload,
+     * because nothing else on that origin remembers the device.
+     *
+     * @default 'persistent'
+     */
+    deviceCredentialStorage?: 'persistent' | 'ephemeral';
 }
 //# sourceMappingURL=navigation.d.ts.map

package/lib/typescript/module/ui/types/navigation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAgB,CAAC;AAElD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGrC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../../../../src/ui/types/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAgB,CAAC;AAElD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;IACpB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGrC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAGlC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAGjE,aAAa,CAAC,EAAE,SAAS,CAAC;IAG1B,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAGnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IAMtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,uBAAuB,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACxD"}

package/lib/typescript/module/ui/utils/avatarUtils.d.ts

@@ -2,16 +2,8 @@ import type { OxyServices, User } from '@oxyhq/core';
 import type { UserProfileUpdate } from '@oxyhq/contracts';
 import type { QueryClient } from '@tanstack/react-query';
 /**
- * Refreshes avatar in accountStore with cache-busted URL to force image reload.
- *
- * @param sessionId - The session ID for the account to update
- * @param avatarFileId - The new avatar file ID
- * @param oxyServices - OxyServices instance to generate download URL
- */
-export declare function refreshAvatarInStore(sessionId: string, avatarFileId: string, oxyServices: OxyServices): void;
-/**
- * Updates user profile with avatar and handles all side effects (query invalidation, accountStore update).
- * This function can be used from within OxyContext provider without requiring useOxy hook.
+ * Updates user profile with avatar and handles all side effects (cache writes,
+ * query invalidation). Usable from inside the provider without `useOxy`.
  *
  * @param updates - Profile updates including avatar
  * @param oxyServices - OxyServices instance

package/lib/typescript/module/ui/utils/avatarUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"avatarUtils.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/avatarUtils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOzD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,WAAW,GACvB,IAAI,CAON;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,WAAW,EAAE,WAAW,EACxB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAyCf"}
+{"version":3,"file":"avatarUtils.d.ts","sourceRoot":"","sources":["../../../../../src/ui/utils/avatarUtils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAOzD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,WAAW,EAAE,WAAW,EACxB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@oxyhq/services",
-  "version": "28.0.0",
+  "version": "29.0.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
   "types": "lib/typescript/commonjs/index.d.ts",
   "react-native": "src/index.ts",
   "source": "src/index.ts",
-  "sideEffects": false,
   "publishConfig": {
     "access": "public"
   },
@@ -139,7 +138,7 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "0.25.0",
+    "@oxyhq/contracts": "0.26.0",
     "@simplewebauthn/browser": "^13.3.0",
     "color": "^4.2.3"
   },
@@ -148,10 +147,10 @@
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@expo/vector-icons": "^15.0.3",
-    "@oxyhq/core": "20.0.0",
+    "@oxyhq/core": "21.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
-    "@react-native/babel-preset": "^0.86.0",
+    "@react-native/babel-preset": "^0.86.2",
     "@release-it/conventional-changelog": "^10.0.6",
     "@tanstack/query-async-storage-persister": "^5.101",
     "@tanstack/query-sync-storage-persister": "^5.101",
@@ -184,14 +183,14 @@
     "react-native-svg": "15.15.5",
     "release-it": "^19.0.6",
     "socket.io-client": "^4.8.1",
-    "ts-jest": "^29.4.0",
+    "ts-jest": "^29.4.12",
     "typescript": "^5.9.2",
     "zustand": "^5.0.14"
   },
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxyhq/bloom": ">=0.59.0",
-    "@oxyhq/core": "^20.0.0",
+    "@oxyhq/core": "^21.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": ">=11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",

package/plugins/withSharedDeviceSessionProvider.js

@@ -0,0 +1,102 @@
+/**
+ * Config plugin: withSharedDeviceSessionProvider (UID-member hub apps).
+ *
+ * The shared DeviceSession credential is how several official Oxy apps end up on
+ * ONE `DeviceSession` — and therefore one globally active account context —
+ * WITHOUT any of them reading Commons's private identity key. This plugin wires
+ * the Android side of `@oxyhq/services`:
+ *
+ *  - Defines a `signature`-level permission
+ *    `so.oxy.shared.permission.READ_DEVICE_SESSION`. `signature` means only apps
+ *    signed with the SAME certificate (the shared Oxy release keystore) can hold
+ *    it — the trust boundary is the signing key, not the deprecated `sharedUserId`.
+ *  - Requests that same permission so this app can also read cross-authority.
+ *  - Declares `OxyDeviceSessionProvider` at authority
+ *    `${applicationId}.devicesession` (AGP substitutes `${applicationId}` at
+ *    build), guarded by that permission. The provider is READ-only across the
+ *    process boundary: a sibling may join the device session, never overwrite it.
+ *  - Adds `<queries>` entries so Android 11+ package-visibility filtering never
+ *    hides the sibling providers from the resolver.
+ *
+ * WHICH APPS USE THIS PLUGIN: exactly the apps listed in `PROVIDER_AUTHORITIES`
+ * below, which must be apps inside the `so.oxy.shared` UID. UID members share one
+ * data directory, so they all serve the SAME file and the sweep in
+ * `OxyDeviceSessionModule` is deterministic whichever one answers. An app that is
+ * same-signature but outside that UID must use `withSharedDeviceSessionReader`
+ * instead — hosting from there would publish a second, independent copy of "the
+ * shared credential" and make the winner depend on list order.
+ *
+ * Keep this list identical to `PROVIDER_AUTHORITIES` in
+ * `android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt`.
+ *
+ * This is deliberately a SEPARATE permission and a SEPARATE provider from
+ * `withSharedIdentityProvider`. Two secrets with different blast radii: the
+ * identity key is self-custody and irreplaceable, the device credential is
+ * server-revocable and re-publishable. An app that only needs a session gets only
+ * the second one.
+ */
+const { withAndroidManifest } = require('@expo/config-plugins');
+
+const READ_DEVICE_SESSION_PERMISSION = 'so.oxy.shared.permission.READ_DEVICE_SESSION';
+const PROVIDER_CLASS = 'so.oxy.devicesession.OxyDeviceSessionProvider';
+const PROVIDER_AUTHORITIES = [
+  'so.oxy.accounts.devicesession',
+  'so.oxy.accounts.dev.devicesession',
+  'so.oxy.commons.devicesession',
+  'so.oxy.commons.dev.devicesession',
+];
+
+module.exports = function withSharedDeviceSessionProvider(config) {
+  return withAndroidManifest(config, (modConfig) => {
+    const manifest = modConfig.modResults.manifest;
+
+    // 1. Define the signature-level permission.
+    manifest['permission'] = manifest['permission'] ?? [];
+    if (!manifest['permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
+      manifest['permission'].push({
+        $: {
+          'android:name': READ_DEVICE_SESSION_PERMISSION,
+          'android:protectionLevel': 'signature',
+        },
+      });
+    }
+
+    // 2. Request it (a hub app reads its siblings too — prod ⇆ dev variant).
+    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
+    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
+      manifest['uses-permission'].push({ $: { 'android:name': READ_DEVICE_SESSION_PERMISSION } });
+    }
+
+    // 3. Make the sibling provider authorities visible under package filtering.
+    manifest['queries'] = manifest['queries'] ?? [];
+    if (manifest['queries'].length === 0) {
+      manifest['queries'].push({});
+    }
+    const queries = manifest['queries'][0];
+    queries.provider = queries.provider ?? [];
+    for (const authority of PROVIDER_AUTHORITIES) {
+      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
+        queries.provider.push({ $: { 'android:authorities': authority } });
+      }
+    }
+
+    // 4. Host the provider.
+    const app = manifest.application?.[0];
+    if (!app) {
+      throw new Error('withSharedDeviceSessionProvider: AndroidManifest has no <application>');
+    }
+    app.provider = app.provider ?? [];
+    if (!app.provider.some((p) => p.$['android:name'] === PROVIDER_CLASS)) {
+      app.provider.push({
+        $: {
+          'android:name': PROVIDER_CLASS,
+          'android:authorities': '${applicationId}.devicesession',
+          'android:exported': 'true',
+          'android:permission': READ_DEVICE_SESSION_PERMISSION,
+        },
+      });
+    }
+
+    return modConfig;
+  });
+};