@oxyhq/services 28.0.0 → 30.0.0

package/plugins/withSharedDeviceSessionReader.js

@@ -0,0 +1,57 @@
+/**
+ * Config plugin: withSharedDeviceSessionReader (every other official Oxy app).
+ *
+ * A reader app JOINS the device's existing session — it adopts the shared
+ * `deviceId` + `deviceSecret` a hub app published, so it lands signed in with no
+ * QR and, crucially, without ever asking for Commons's private identity key.
+ * This plugin wires the minimal Android side of `@oxyhq/services`:
+ *
+ *  - Requests the `signature`-level permission
+ *    `so.oxy.shared.permission.READ_DEVICE_SESSION` (defined by the hub apps).
+ *    Because it is `signature`, it is granted only when this app is signed with
+ *    the SAME certificate as the hub — that is the entire trust boundary, and it
+ *    is what makes an incorrectly-signed app unable to read the slot.
+ *  - Adds `<queries>` entries for the hub authorities so package-visibility
+ *    filtering (Android 11+) never hides them from `ContentResolver.call`.
+ *
+ * The provider itself is declared only by the hub apps
+ * (`withSharedDeviceSessionProvider`) — see the note there about why hosting is
+ * restricted to apps inside the `so.oxy.shared` UID.
+ *
+ * Keep this list identical to `PROVIDER_AUTHORITIES` in
+ * `android/src/main/java/so/oxy/devicesession/OxyDeviceSessionModule.kt`.
+ */
+const { withAndroidManifest } = require('@expo/config-plugins');
+
+const READ_DEVICE_SESSION_PERMISSION = 'so.oxy.shared.permission.READ_DEVICE_SESSION';
+const PROVIDER_AUTHORITIES = [
+  'so.oxy.accounts.devicesession',
+  'so.oxy.accounts.dev.devicesession',
+  'so.oxy.commons.devicesession',
+  'so.oxy.commons.dev.devicesession',
+];
+
+module.exports = function withSharedDeviceSessionReader(config) {
+  return withAndroidManifest(config, (modConfig) => {
+    const manifest = modConfig.modResults.manifest;
+
+    manifest['uses-permission'] = manifest['uses-permission'] ?? [];
+    if (!manifest['uses-permission'].some((p) => p.$['android:name'] === READ_DEVICE_SESSION_PERMISSION)) {
+      manifest['uses-permission'].push({ $: { 'android:name': READ_DEVICE_SESSION_PERMISSION } });
+    }
+
+    manifest['queries'] = manifest['queries'] ?? [];
+    if (manifest['queries'].length === 0) {
+      manifest['queries'].push({});
+    }
+    const queries = manifest['queries'][0];
+    queries.provider = queries.provider ?? [];
+    for (const authority of PROVIDER_AUTHORITIES) {
+      if (!queries.provider.some((p) => p.$['android:authorities'] === authority)) {
+        queries.provider.push({ $: { 'android:authorities': authority } });
+      }
+    }
+
+    return modConfig;
+  });
+};

package/src/__tests__/esmSourcePurity.test.ts

@@ -0,0 +1,61 @@
+/**
+ * `@oxyhq/services` ships an ESM build, and ESM has no `require`.
+ *
+ * This is not a style rule: a surviving `require()` puts web bundlers into
+ * CommonJS interop, which hands consumers `undefined` bindings with no build
+ * error and no warning. It blanked auth.oxy.so/authorize once — see the note on
+ * `screenComponents` in `../ui/navigation/routes` for the mechanism, and
+ * `README.md` for the incident.
+ *
+ * Deferring is still legitimate: a thunk over a static import defers a READ,
+ * `import()` defers a LOAD. Neither needs `require()`.
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+const SRC_ROOT = join(__dirname, '..');
+
+/** Source extensions that end up in the published ESM build. */
+const SOURCE_EXTENSIONS = ['.ts', '.tsx'];
+
+/** Tests are compiled to CommonJS by ts-jest and never ship, so they are exempt. */
+const EXEMPT_SEGMENTS = ['__tests__'];
+
+function collectSourceFiles(dir: string): string[] {
+  const found: string[] = [];
+  for (const entry of readdirSync(dir)) {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) {
+      if (EXEMPT_SEGMENTS.includes(entry)) continue;
+      found.push(...collectSourceFiles(path));
+      continue;
+    }
+    if (SOURCE_EXTENSIONS.some((ext) => path.endsWith(ext)) && !path.endsWith('.d.ts')) {
+      found.push(path);
+    }
+  }
+  return found;
+}
+
+/**
+ * Drop comments and string/template literals so prose about `require()` — such
+ * as the notes explaining this very rule — is not mistaken for a call.
+ */
+function stripCommentsAndStrings(code: string): string {
+  return code
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/(^|[^:])\/\/.*$/gm, '$1')
+    .replace(/'(?:[^'\\\n]|\\.)*'/g, "''")
+    .replace(/"(?:[^"\\\n]|\\.)*"/g, '""')
+    .replace(/`(?:[^`\\]|\\.)*`/g, '``');
+}
+
+describe('ESM source purity', () => {
+  it('never calls require() anywhere in the shipped source', () => {
+    const offenders = collectSourceFiles(SRC_ROOT)
+      .filter((file) => /\brequire\s*\(/.test(stripCommentsAndStrings(readFileSync(file, 'utf8'))))
+      .map((file) => relative(SRC_ROOT, file));
+
+    expect(offenders).toEqual([]);
+  });
+});

package/src/index.ts

@@ -33,6 +33,29 @@ setPlatformOS(Platform.OS as PlatformOS);
 // ---------------------------------------------------------------------------
 export { default as OxyProvider } from './ui/components/OxyProvider';
 export { useOxy } from './ui/context/OxyContext';
+// `useOxy()` THROWS when no provider is mounted. `useOptionalOxy()` returns
+// `null` instead, for the rare component that renders on both sides of the
+// provider boundary; there is no fabricated forever-loading runtime.
+export { useOptionalOxy, OxyProviderMissingError } from './ui/context/OxyContext';
+
+// The runtime surface (ADR 0004). These subscribe to the ONE runtime with a
+// selector, so — unlike `useOxy()`, whose value is rebuilt by any of its fifty
+// members moving — a locale change or a dialog opening does not re-render them.
+export {
+  useOxyRuntime,
+  useOxySnapshot,
+  useActiveAccount,
+  useDeviceDirectory,
+  OxyRuntimeMissingError,
+} from './ui/runtime';
+export type {
+  ActiveAccount,
+  OxyRuntime,
+  OxyRuntimeError,
+  OxyRuntimeSnapshot,
+  OxyRuntimeStatus,
+  OxyTokenStatus,
+} from './ui/runtime';
 export type { OxyContextState } from './ui/context/OxyContext';
 export { useAuth } from './ui/hooks/useAuth';
 export type { AuthState, AuthActions, UseAuthReturn } from './ui/hooks/useAuth';
@@ -45,7 +68,6 @@ export { IdentityBoundSessionError } from './ui/session/identityBinding';
 // Zustand stores
 // ---------------------------------------------------------------------------
 export { useAuthStore } from './ui/stores/authStore';
-export { useAccountStore } from './ui/stores/accountStore';
 export {
     useAssetStore,
     useAssets as useAssetsStore,
@@ -343,14 +365,14 @@ export { OxySignInRequestSurface } from './ui/components/OxySignInRequestSurface
 export type { OxySignInRequestSurfaceProps } from './ui/components/OxySignInRequestSurface';
 export type { OxySignInSurfaceAction } from './ui/components/authChooser/types';
 
-// Unified switchable-accounts hook — the single source of everything the user
-// can switch into: device sign-ins AND linked graph accounts (owned orgs +
-// shared-with-you), deduped by account id and hydrated with real
-// name/email/avatar/color. Backed by the shared `AccountDialogController` in
-// `@oxyhq/core`. Every switch routes through `useOxy().switchToAccount`.
-// The `SwitchableAccount` type lives in `@oxyhq/core` — import it from there.
-export { useSwitchableAccounts } from './ui/hooks/useSwitchableAccounts';
-export type { UseSwitchableAccountsResult } from './ui/hooks/useSwitchableAccounts';
+// The device switcher — the server's own directory (ADR 0002) of who is signed
+// in here and what each of them may act as, grouped by PERSON, with the two
+// removals an account id cannot name. Backed by the shared
+// `AccountDialogController` in `@oxyhq/core`; selecting a row activates a
+// `contextId`. `DevicePrincipalGroup` and `DeviceContext` live in `@oxyhq/core`
+// — import them from there.
+export { useDeviceSwitcher } from './ui/hooks/useDeviceSwitcher';
+export type { UseDeviceSwitcherResult } from './ui/hooks/useDeviceSwitcher';
 
 // Unified "Manage your Oxy Account" screen (the caller's own personal account)
 export { default as ProfileScreen } from './ui/screens/ProfileScreen';

package/src/ui/boot/runProviderColdBoot.ts

@@ -8,6 +8,7 @@ import {
 } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
 import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
+import { createPlatformSharedDeviceCredentialStore } from '../session/sharedDeviceCredentialStore';
 import { tryCompleteOAuthReturn } from '../utils/oauthReturn';
 import { isWebBrowser } from '../utils/isWebBrowser';
 import { isNetConnectivityExplicitlyOffline } from '../utils/netConnectivity';
@@ -161,6 +162,12 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       platform: { isWeb: isWebBrowser(), isNative: !isWebBrowser() },
       sessionMode,
       identity,
+      // The device-wide shared credential slot, enabling the `shared-device-adopt`
+      // lane: a newly installed official app joins this device's existing session
+      // instead of falling back to signing a challenge with the Commons identity
+      // key. `null` on web, where each origin is its own device by design; the
+      // core lane is also skipped outright in `sessionMode: 'identity'`.
+      sharedDeviceCredential: createPlatformSharedDeviceCredentialStore() ?? undefined,
       overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
       isOffline: () => offline,
       onStepDeadline: (stepId) => {

package/src/ui/client.ts

@@ -19,7 +19,7 @@ export { default as FollowButton } from './components/FollowButton';
 export { default as OxyPayButton } from './components/OxyPayButton';
 
 // Context
-export { useOxy } from './context/OxyContext';
+export { useOxy, useOptionalOxy, OxyProviderMissingError } from './context/OxyContext';
 
 // Hooks
 export { useAuth } from './hooks/useAuth';
@@ -34,7 +34,6 @@ export { default as ManageAccountScreen } from './screens/ManageAccountScreen';
 
 // Stores
 export { useAuthStore } from './stores/authStore';
-export { useAccountStore } from './stores/accountStore';
 
 // Error handler utilities
 export {

package/src/ui/components/FollowTargetButton.tsx

@@ -12,8 +12,8 @@
  * choices that a single press cannot express — follow for a while, stop showing
  * this here without giving it up everywhere — and those belong behind a
  * disclosure precisely because they are not what most people want most of the
- * time. Bloom's `Menu` renders as a bottom sheet on native and a dropdown on
- * web, so this is one component and not a platform fork.
+ * time. Bloom's `DropdownMenu` is platform-forked inside Bloom, so this is one
+ * component and not a platform fork here.
  *
  * ## Verbs
  *
@@ -37,7 +37,12 @@ import type { StyleProp, ViewStyle } from 'react-native';
 import { View } from 'react-native';
 import { Button } from '@oxyhq/bloom/button';
 import { ChevronBottom_Stroke2_Corner0_Rounded as ChevronDown } from '@oxyhq/bloom/icons';
-import { Menu, MenuContent, MenuItem, MenuItemText, MenuTrigger } from '@oxyhq/bloom/menu';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from '@oxyhq/bloom/dropdown-menu';
 import { toast } from '@oxyhq/bloom/toast';
 import { useFollowTarget } from '../hooks/useFollowTarget';
 import { useFollowTargetStore } from '../stores/followTargetStore';
@@ -392,32 +397,31 @@ export const FollowTargetButton = memo(function FollowTargetButton({
   return (
     <View style={[{ flexDirection: 'row', alignItems: 'center', gap: 4 }, style]}>
       {primary}
-      <Menu>
-        <MenuTrigger label={`${label} options`} hint="Opens follow options">
-          {({ props }) => (
-            // The trigger's props are mapped rather than spread: `MenuTrigger`
-            // hands back a DOM-ish bag (focus handlers, an accessibility role)
-            // and `Button` accepts a different set, so a spread would pass
-            // props it silently drops.
-            <Button
-              variant="secondary"
-              size={size === 'large' ? 'large' : 'small'}
-              icon={<ChevronDown width={16} />}
-              disabled={disabled || isUnknown}
-              onPress={props.onPress}
-              accessibilityLabel={props.accessibilityLabel}
-              accessibilityHint={props.accessibilityHint}
-            />
-          )}
-        </MenuTrigger>
-        <MenuContent showCancel>
+      <DropdownMenu>
+        {/*
+          `asChild` renders the Button ITSELF as the trigger, merging the open
+          handler into it. Bloom ignores the trigger's own `label` when the
+          child carries an accessible name, so the name and hint stay on the
+          Button, where they were.
+        */}
+        <DropdownMenuTrigger asChild disabled={disabled || isUnknown}>
+          <Button
+            variant="secondary"
+            size={size === 'large' ? 'large' : 'small'}
+            icon={<ChevronDown width={16} />}
+            disabled={disabled || isUnknown}
+            accessibilityLabel={`${label} options`}
+            accessibilityHint="Opens follow options"
+          />
+        </DropdownMenuTrigger>
+        <DropdownMenuContent label={`${label} options`}>
           {menuItems.map((item) => (
-            <MenuItem key={item.key} label={item.label} onPress={() => runItem(item)}>
-              <MenuItemText>{item.label}</MenuItemText>
-            </MenuItem>
+            <DropdownMenuItem key={item.key} onPress={() => runItem(item)}>
+              {item.label}
+            </DropdownMenuItem>
           ))}
-        </MenuContent>
-      </Menu>
+        </DropdownMenuContent>
+      </DropdownMenu>
     </View>
   );
 });

package/src/ui/components/OxyAccountDialogScreen.tsx

@@ -31,6 +31,7 @@ import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
 import type { BaseScreenProps } from '../types/navigation';
 import LogoText from './logo/LogoText';
 import OxyAuthChooser from './OxyAuthChooser';
+import { EMPTY_ACCOUNT_DIALOG_SNAPSHOT } from '../hooks/accountDialogSnapshot';
 
 type Translate = ReturnType<typeof useI18n>['t'];
 
@@ -61,20 +62,22 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
 
   // A lightweight, header-only binding to the same controller `OxyAuthChooser`
   // binds independently — cheap, and the established pattern here (
-  // `useSwitchableAccounts` also binds to this controller on its own).
+  // `useDeviceSwitcher` also binds to this controller on its own).
   const subscribe = useCallback(
     (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
     [controller],
   );
   const getSnapshot = useCallback(
-    () => (controller ? controller.getSnapshot() : EMPTY_SNAPSHOT),
+    () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
     [controller],
   );
   const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
 
   const { view } = snapshot;
-  const showBack =
-    view === 'qr' || view === 'signup' || (view === 'add' && snapshot.accounts.length > 0);
+  // "Add another account" only makes sense as a back destination when there IS
+  // another — i.e. somebody is already signed in on this device.
+  const hasSignedInAccounts = (snapshot.directory?.principals.length ?? 0) > 0;
+  const showBack = view === 'qr' || view === 'signup' || (view === 'add' && hasSignedInAccounts);
   const goToAccounts = useCallback(() => {
     if (!controller) return;
     const { view: currentView, signIn } = controller.getSnapshot();
@@ -100,7 +103,7 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
   // by the bar. Every OTHER view keeps the SHARED Dialog nav header the rest of
   // the SDK uses — a large in-content title/subtitle that collapses into the bar
   // on scroll — because their copy is informative.
-  const copy = view === 'accounts' ? null : headerCopy(view, snapshot.accounts.length, t);
+  const copy = view === 'accounts' ? null : headerCopy(view, hasSignedInAccounts, t);
 
   useSurfaceHeader({
     titleContent: copy ? undefined : NAV_LOGO,
@@ -126,7 +129,7 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
 
 function headerCopy(
   view: Exclude<AccountDialogSnapshot['view'], 'accounts'>,
-  accountCount: number,
+  hasSignedInAccounts: boolean,
   t: Translate,
 ): { title: string; subtitle: string | null } {
   switch (view) {
@@ -147,7 +150,7 @@ function headerCopy(
         subtitle: t('signup.subtitle') || 'One identity for the whole ecosystem.',
       };
     default:
-      return accountCount > 0
+      return hasSignedInAccounts
         ? {
             title: t('signin.addAccountTitle') || 'Add another account',
             subtitle: t('signin.addAccountSubtitle') || 'Sign in with another account.',
@@ -159,28 +162,6 @@ function headerCopy(
   }
 }
 
-const EMPTY_SNAPSHOT: AccountDialogSnapshot = {
-  view: 'accounts',
-  accounts: [],
-  activeAccountId: null,
-  loading: false,
-  error: null,
-  switchingAccountId: null,
-  signIn: {
-    phase: 'idle',
-    authorizeCode: null,
-    qrPayload: null,
-    expiresAt: null,
-    error: null,
-    route: null,
-    routeFailed: false,
-    pushSentAt: null,
-    openedAt: null,
-    progress: 'idle',
-  },
-  commonsAvailability: 'unknown',
-};
-
 /**
  * The screen gutter. In the Dialog's nav-header mode the surface adds NO content
  * padding of its own — the large title and each screen own theirs — so this must