@oxyhq/services 29.0.0 → 30.0.0

package/lib/commonjs/ui/session/index.js

@@ -1,78 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-Object.defineProperty(exports, "IdentityBoundSessionError", {
-  enumerable: true,
-  get: function () {
-    return _identityBinding.IdentityBoundSessionError;
-  }
-});
-Object.defineProperty(exports, "accountIdsOf", {
-  enumerable: true,
-  get: function () {
-    return _core.accountIdsOf;
-  }
-});
-Object.defineProperty(exports, "activeSessionIdOf", {
-  enumerable: true,
-  get: function () {
-    return _core.activeSessionIdOf;
-  }
-});
-Object.defineProperty(exports, "activeUserOf", {
-  enumerable: true,
-  get: function () {
-    return _core.activeUserOf;
-  }
-});
-Object.defineProperty(exports, "createIdentitySessionBinding", {
-  enumerable: true,
-  get: function () {
-    return _identityBinding.createIdentitySessionBinding;
-  }
-});
-Object.defineProperty(exports, "createPlatformAuthStateStore", {
-  enumerable: true,
-  get: function () {
-    return _authStore.createPlatformAuthStateStore;
-  }
-});
-Object.defineProperty(exports, "createSessionClient", {
-  enumerable: true,
-  get: function () {
-    return _createSessionClient.createSessionClient;
-  }
-});
-Object.defineProperty(exports, "createSessionClientHost", {
-  enumerable: true,
-  get: function () {
-    return _core.createSessionClientHost;
-  }
-});
-Object.defineProperty(exports, "createTokenTransport", {
-  enumerable: true,
-  get: function () {
-    return _tokenTransport.createTokenTransport;
-  }
-});
-Object.defineProperty(exports, "deviceStateToClientSessions", {
-  enumerable: true,
-  get: function () {
-    return _core.deviceStateToClientSessions;
-  }
-});
-Object.defineProperty(exports, "useBackgroundSessionSync", {
-  enumerable: true,
-  get: function () {
-    return _useBackgroundSessionSync.useBackgroundSessionSync;
-  }
-});
-var _createSessionClient = require("./createSessionClient.js");
-var _tokenTransport = require("./tokenTransport.js");
-var _authStore = require("./authStore.js");
-var _useBackgroundSessionSync = require("./useBackgroundSessionSync.js");
-var _identityBinding = require("./identityBinding.js");
-var _core = require("@oxyhq/core");
-//# sourceMappingURL=index.js.map

package/lib/commonjs/ui/session/index.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_createSessionClient","require","_tokenTransport","_authStore","_useBackgroundSessionSync","_identityBinding","_core"],"sourceRoot":"../../../../src","sources":["ui/session/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,IAAAA,oBAAA,GAAAC,OAAA;AACA,IAAAC,eAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,yBAAA,GAAAH,OAAA;AACA,IAAAI,gBAAA,GAAAJ,OAAA;AAEA,IAAAK,KAAA,GAAAL,OAAA","ignoreList":[]}

package/lib/commonjs/ui/session/nativeSecureStorage.js

@@ -1,90 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createNativeSecureKeyValueStorage = createNativeSecureKeyValueStorage;
-var _storageHelpers = require("../utils/storageHelpers.js");
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
- * The native secure key/value seam every durable `@oxyhq/core` store in this
- * package is built on.
- *
- * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
- * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
- * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
- * module supplies that injection ONCE, so those stores can never drift onto
- * different backings — a device credential in SecureStore and a pin in
- * AsyncStorage would resolve differently after a keystore reset.
- *
- * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
- * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
- * controller), so the web bundle never pulls it and a device without it falls
- * back to AsyncStorage rather than crashing.
- */
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-let secureStorePromise = null;
-
-/**
- * Resolve the `expo-secure-store` module once (memoised), or `null` when it is
- * unavailable — callers then fall back to AsyncStorage. Never throws.
- */
-function loadSecureStore() {
-  if (!secureStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    secureStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod)
-        };
-      }
-      return null;
-    }).catch(() => null);
-  }
-  return secureStorePromise;
-}
-
-/**
- * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
- * at rest) and falls back to AsyncStorage when SecureStore is not installed.
- * The SecureStore module is resolved lazily on first access so construction
- * stays synchronous.
- */
-function createNativeSecureKeyValueStorage() {
-  let asyncStorage = null;
-  const getAsyncStorage = async () => {
-    if (!asyncStorage) {
-      asyncStorage = await (0, _storageHelpers.createPlatformStorage)();
-    }
-    return asyncStorage;
-  };
-  return {
-    getItem: async key => {
-      const secure = await loadSecureStore();
-      if (secure) {
-        return secure.getItemAsync(key);
-      }
-      return (await getAsyncStorage()).getItem(key);
-    },
-    setItem: async (key, value) => {
-      const secure = await loadSecureStore();
-      if (secure) {
-        await secure.setItemAsync(key, value);
-        return;
-      }
-      await (await getAsyncStorage()).setItem(key, value);
-    },
-    removeItem: async key => {
-      const secure = await loadSecureStore();
-      if (secure) {
-        await secure.deleteItemAsync(key);
-        return;
-      }
-      await (await getAsyncStorage()).removeItem(key);
-    }
-  };
-}
-//# sourceMappingURL=nativeSecureStorage.js.map

package/lib/commonjs/ui/session/nativeSecureStorage.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_storageHelpers","require","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","SECURE_STORE_MODULE","secureStorePromise","loadSecureStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","bind","catch","createNativeSecureKeyValueStorage","asyncStorage","getAsyncStorage","createPlatformStorage","getItem","key","secure","setItem","value","removeItem"],"sourceRoot":"../../../../src","sources":["ui/session/nativeSecureStorage.ts"],"mappings":";;;;;;AAiBA,IAAAA,eAAA,GAAAC,OAAA;AAAgE,SAAAC,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KAjBhE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAIA;AACA;AACA,MAAMkB,mBAAmB,GAAG,mBAAmB;AAQ/C,IAAIC,kBAA0D,GAAG,IAAI;;AAErE;AACA;AACA;AACA;AACA,SAASC,eAAeA,CAAA,EAAoC;EAC1D,IAAI,CAACD,kBAAkB,EAAE;IACvB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,kBAAkB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAArB,CAAA,IAAAA,CAAA,IAAAoB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA3B,uBAAA,CAAAD,OAAA,CAAA4B,CAAA,KAAOJ,UAAU,EACnCG,IAAI,CAAEE,GAA6B,IAAK;MACvC,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,EACzC;QACA,OAAO;UACLF,YAAY,EAAED,GAAG,CAACC,YAAY,CAACG,IAAI,CAACJ,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACE,IAAI,CAACJ,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACC,IAAI,CAACJ,GAAG;QAC/C,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDK,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOZ,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASa,iCAAiCA,CAAA,EAA0B;EACzE,IAAIC,YAAsE,GAAG,IAAI;EACjF,MAAMC,eAAe,GAAG,MAAAA,CAAA,KAAY;IAClC,IAAI,CAACD,YAAY,EAAE;MACjBA,YAAY,GAAG,MAAM,IAAAE,qCAAqB,EAAC,CAAC;IAC9C;IACA,OAAOF,YAAY;EACrB,CAAC;EACD,OAAO;IACLG,OAAO,EAAE,MAAOC,GAAG,IAAK;MACtB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,OAAOA,MAAM,CAACX,YAAY,CAACU,GAAG,CAAC;MACjC;MACA,OAAO,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEE,OAAO,CAACC,GAAG,CAAC;IAC/C,CAAC;IACDE,OAAO,EAAE,MAAAA,CAAOF,GAAG,EAAEG,KAAK,KAAK;MAC7B,MAAMF,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACV,YAAY,CAACS,GAAG,EAAEG,KAAK,CAAC;QACrC;MACF;MACA,MAAM,CAAC,MAAMN,eAAe,CAAC,CAAC,EAAEK,OAAO,CAACF,GAAG,EAAEG,KAAK,CAAC;IACrD,CAAC;IACDC,UAAU,EAAE,MAAOJ,GAAG,IAAK;MACzB,MAAMC,MAAM,GAAG,MAAMlB,eAAe,CAAC,CAAC;MACtC,IAAIkB,MAAM,EAAE;QACV,MAAMA,MAAM,CAACT,eAAe,CAACQ,GAAG,CAAC;QACjC;MACF;MACA,MAAM,CAAC,MAAMH,eAAe,CAAC,CAAC,EAAEO,UAAU,CAACJ,GAAG,CAAC;IACjD;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/sharedDeviceCredentialStore.js

@@ -1,306 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.SHARED_DEVICE_SESSION_STORAGE_KEY = exports.IOS_KEYCHAIN_ACCESS_GROUP = exports.IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = void 0;
-exports.createPlatformSharedDeviceCredentialStore = createPlatformSharedDeviceCredentialStore;
-var _reactNative = require("react-native");
-var _expoModulesCore = require("expo-modules-core");
-var _core = require("@oxyhq/core");
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
- * The platform half of the shared native DeviceSession credential.
- *
- * `@oxyhq/core` owns the rules (`sharedDeviceCredential.ts`: when to adopt, when
- * to publish, and above all that an unreadable slot is never an empty one). This
- * module owns only where the bytes live, which is genuinely different per
- * platform:
- *
- *  - **iOS** — one `expo-secure-store` item in the approved Keychain Access Group
- *    `group.so.oxy.shared`, under its OWN `keychainService`
- *    ({@link IOS_DEVICE_SESSION_KEYCHAIN_SERVICE}). Every identity slot uses a
- *    different service (`oxy_identity`, `oxy_identity_backup`,
- *    `oxy_identity_mnemonic`) and the legacy cross-app identity keypair uses the
- *    same group with NO service at all — so this item cannot alias any of them.
- *    That separation is the point of the whole phase: the group-shared identity
- *    key and the group-shared device-session credential are different secrets
- *    with different blast radii and must not be conflated.
- *  - **Android** — the signature-protected `OxyDeviceSession` broker (its own
- *    EncryptedSharedPreferences file, its own ContentProvider, its own
- *    `signature`-level permission). It carries a session credential; it can NOT
- *    reach the identity keypair, which lives in a different file behind a
- *    different provider.
- *  - **web / anything else** — no shared slot. Each origin is its own device by
- *    design, so the factory returns `null` and the cold boot simply omits the
- *    lane.
- *
- * ## What is written here, and what is not
- *
- * Only `{deviceId, deviceSecret}`. No access token, no account id, no user id,
- * and never any identity key material.
- *
- * ## Accessibility
- *
- * `WHEN_UNLOCKED_THIS_DEVICE_ONLY`: a device credential must not travel to
- * another handset in an iCloud/encrypted backup restore — the restored device is
- * a different device and has to establish its own session. It also keeps the item
- * out of reach while the phone is locked, which is why a read can legitimately
- * fail and why the `unavailable` verdict exists at all.
- */
-/**
- * The iOS Keychain Access Group every official Oxy app declares in its
- * entitlements. Shared with the identity slots — the group is the app-group
- * boundary, not the secret's identity.
- */
-const IOS_KEYCHAIN_ACCESS_GROUP = exports.IOS_KEYCHAIN_ACCESS_GROUP = 'group.so.oxy.shared';
-
-/**
- * The iOS `keychainService` for the DEVICE SESSION credential. Deliberately
- * distinct from every identity and recovery service; do not reuse one of those
- * here, and do not drop it (an item written with no service shares the legacy
- * identity slot's namespace inside the group).
- */
-const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = exports.IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = 'oxy_device_session';
-
-/** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
-const SHARED_DEVICE_SESSION_STORAGE_KEY = exports.SHARED_DEVICE_SESSION_STORAGE_KEY = 'oxy_shared_device_session_v1';
-
-// Variable indirection so Metro's static analyzer never traces expo-secure-store
-// into the web bundle; the module is native-only and optional.
-const SECURE_STORE_MODULE = 'expo-secure-store';
-
-/**
- * The subset of `expo-secure-store` this module needs. Unlike the adapter in
- * `nativeSecureStorage.ts` it must pass OPTIONS — the access group and the
- * dedicated service are the entire mechanism here, so an options-less wrapper
- * would silently write a package-private item that no sibling app can see.
- */
-
-let keychainStorePromise = null;
-function loadKeychainGroupStore() {
-  if (!keychainStorePromise) {
-    const moduleName = SECURE_STORE_MODULE;
-    keychainStorePromise = (specifier => new Promise(r => r(`${specifier}`)).then(s => _interopRequireWildcard(require(s))))(moduleName).then(mod => {
-      if (typeof mod.getItemAsync === 'function' && typeof mod.setItemAsync === 'function' && typeof mod.deleteItemAsync === 'function' && typeof mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY === 'number') {
-        return {
-          getItemAsync: mod.getItemAsync.bind(mod),
-          setItemAsync: mod.setItemAsync.bind(mod),
-          deleteItemAsync: mod.deleteItemAsync.bind(mod),
-          WHEN_UNLOCKED_THIS_DEVICE_ONLY: mod.WHEN_UNLOCKED_THIS_DEVICE_ONLY
-        };
-      }
-      return null;
-    }).catch(() => null);
-  }
-  return keychainStorePromise;
-}
-
-/** Parse the stored JSON into a credential, or `null` for anything malformed. */
-function parseStoredCredential(raw) {
-  if (!raw) {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== 'object') {
-    return null;
-  }
-  const candidate = parsed;
-  if (typeof candidate.deviceId !== 'string' || candidate.deviceId.length === 0 || typeof candidate.deviceSecret !== 'string' || candidate.deviceSecret.length === 0) {
-    return null;
-  }
-  return {
-    deviceId: candidate.deviceId,
-    deviceSecret: candidate.deviceSecret
-  };
-}
-
-/**
- * The iOS store: one keychain item in the shared access group.
- *
- * A THROWN read is `unavailable`, a `null` read is `absent`. That mapping is the
- * whole safety contract — `expo-secure-store` returns `null` for a genuinely
- * missing item and throws when the keychain itself refuses, and collapsing the
- * two is what would let a locked phone look like a device that never had a
- * session.
- */
-function createKeychainGroupCredentialStore() {
-  const readOptions = {
-    keychainService: IOS_DEVICE_SESSION_KEYCHAIN_SERVICE,
-    keychainAccessGroup: IOS_KEYCHAIN_ACCESS_GROUP
-  };
-  return {
-    read: async () => {
-      const store = await loadKeychainGroupStore();
-      if (!store) {
-        return {
-          state: 'unsupported'
-        };
-      }
-      let raw;
-      try {
-        raw = await store.getItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, readOptions);
-      } catch (error) {
-        return {
-          state: 'unavailable',
-          cause: error
-        };
-      }
-      if (raw === null) {
-        return {
-          state: 'absent'
-        };
-      }
-      const credential = parseStoredCredential(raw);
-      if (!credential) {
-        // Something IS stored and we cannot read it. Reporting `absent` would
-        // authorise overwriting whatever a newer build put there.
-        return {
-          state: 'unavailable',
-          cause: new Error('shared device session item is present but not parseable')
-        };
-      }
-      return {
-        state: 'present',
-        credential
-      };
-    },
-    publish: async credential => {
-      const store = await loadKeychainGroupStore();
-      if (!store) {
-        return false;
-      }
-      const value = JSON.stringify(credential);
-      try {
-        await store.setItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, value, {
-          ...readOptions,
-          keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY
-        });
-        // Read-back verify. A keychain write can resolve without the item having
-        // landed under the access group (a missing entitlement is the usual
-        // cause), and a phantom credential would send a fresh install into a mint
-        // that can never succeed.
-        return (await store.getItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, readOptions)) === value;
-      } catch {
-        return false;
-      }
-    },
-    clear: async () => {
-      const store = await loadKeychainGroupStore();
-      if (!store) {
-        return;
-      }
-      try {
-        await store.deleteItemAsync(SHARED_DEVICE_SESSION_STORAGE_KEY, readOptions);
-      } catch {
-        // Best-effort: the slot is a join point, not a source of truth.
-      }
-    }
-  };
-}
-
-/**
- * The Android broker's JS surface. `read` returns an UNTRUSTED payload that
- * {@link normalizeSharedDeviceSessionRead} narrows; `write` reports whether the
- * native read-back confirmed the bytes.
- */
-
-let brokerModule;
-
-/**
- * Resolve the `OxyDeviceSession` broker, or `null` when it is not autolinked.
- *
- * `requireOptionalNativeModule` (a static import Metro always resolves) rather
- * than a dynamic `import(moduleName)`: the latter compiles to `require(variable)`
- * in the CJS build, which Metro cannot resolve inside a consuming app — it
- * silently returns `null` there, which is exactly how the cross-app identity
- * bridge broke once. Same reasoning as `backgroundSession.ts` next door.
- */
-function loadBrokerModule() {
-  if (brokerModule === undefined) {
-    const native = (0, _expoModulesCore.requireOptionalNativeModule)('OxyDeviceSession');
-    brokerModule = native && typeof native.read === 'function' && typeof native.write === 'function' && typeof native.clear === 'function' ? {
-      read: native.read.bind(native),
-      write: native.write.bind(native),
-      clear: native.clear.bind(native)
-    } : null;
-  }
-  return brokerModule;
-}
-
-/**
- * The Android store: the signature-protected `OxyDeviceSession` broker.
- *
- * The broker already answers with an explicit status, so the only work here is
- * narrowing an UNTRUSTED payload — `normalizeSharedDeviceSessionRead` resolves
- * anything it does not recognise to `unavailable`, never `absent`.
- */
-function createBrokerCredentialStore() {
-  return {
-    read: async () => {
-      const broker = loadBrokerModule();
-      if (!broker) {
-        return {
-          state: 'unsupported'
-        };
-      }
-      try {
-        return (0, _core.normalizeSharedDeviceSessionRead)(await broker.read());
-      } catch (error) {
-        return {
-          state: 'unavailable',
-          cause: error
-        };
-      }
-    },
-    publish: async credential => {
-      const broker = loadBrokerModule();
-      if (!broker) {
-        return false;
-      }
-      try {
-        // The broker read-back-verifies natively and returns the verdict.
-        return await broker.write(credential.deviceId, credential.deviceSecret);
-      } catch {
-        return false;
-      }
-    },
-    clear: async () => {
-      const broker = loadBrokerModule();
-      if (!broker) {
-        return;
-      }
-      try {
-        await broker.clear();
-      } catch {
-        // Best-effort — see the iOS store.
-      }
-    }
-  };
-}
-
-/**
- * The shared DeviceSession credential slot for this runtime, or `null` when
- * there is none.
- *
- * The branch is on the PLATFORM, not on which module happens to load, because
- * `expo-secure-store` loads perfectly well on Android — it would just quietly
- * ignore `keychainAccessGroup` and read a package-private item, which looks
- * exactly like an empty shared slot. This is the same iOS-vs-Android split
- * `KeyManager` makes for the shared identity, for the same reason.
- *
- * Any other native platform gets the broker, which answers `unsupported` when
- * the module is not linked — so the lane is simply off, which is the safe
- * direction.
- */
-function createPlatformSharedDeviceCredentialStore() {
-  if (_reactNative.Platform.OS === 'web') {
-    return null;
-  }
-  return _reactNative.Platform.OS === 'ios' ? createKeychainGroupCredentialStore() : createBrokerCredentialStore();
-}
-//# sourceMappingURL=sharedDeviceCredentialStore.js.map

package/lib/commonjs/ui/session/sharedDeviceCredentialStore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_reactNative","require","_expoModulesCore","_core","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","IOS_KEYCHAIN_ACCESS_GROUP","exports","IOS_DEVICE_SESSION_KEYCHAIN_SERVICE","SHARED_DEVICE_SESSION_STORAGE_KEY","SECURE_STORE_MODULE","keychainStorePromise","loadKeychainGroupStore","moduleName","specifier","Promise","then","s","mod","getItemAsync","setItemAsync","deleteItemAsync","WHEN_UNLOCKED_THIS_DEVICE_ONLY","bind","catch","parseStoredCredential","raw","parsed","JSON","parse","candidate","deviceId","length","deviceSecret","createKeychainGroupCredentialStore","readOptions","keychainService","keychainAccessGroup","read","store","state","error","cause","credential","Error","publish","value","stringify","keychainAccessible","clear","brokerModule","loadBrokerModule","undefined","native","requireOptionalNativeModule","write","createBrokerCredentialStore","broker","normalizeSharedDeviceSessionRead","createPlatformSharedDeviceCredentialStore","Platform","OS"],"sourceRoot":"../../../../src","sources":["ui/session/sharedDeviceCredentialStore.ts"],"mappings":";;;;;;;AAuCA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AAKqB,SAAAG,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA,KA9CrB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAUA;AACA;AACA;AACA;AACA;AACO,MAAMkB,yBAAyB,GAAAC,OAAA,CAAAD,yBAAA,GAAG,qBAAqB;;AAE9D;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,mCAAmC,GAAAD,OAAA,CAAAC,mCAAA,GAAG,oBAAoB;;AAEvE;AACO,MAAMC,iCAAiC,GAAAF,OAAA,CAAAE,iCAAA,GAAG,8BAA8B;;AAE/E;AACA;AACA,MAAMC,mBAAmB,GAAG,mBAAmB;;AAE/C;AACA;AACA;AACA;AACA;AACA;;AAQA,IAAIC,oBAA+D,GAAG,IAAI;AAE1E,SAASC,sBAAsBA,CAAA,EAAuC;EACpE,IAAI,CAACD,oBAAoB,EAAE;IACzB,MAAME,UAAU,GAAGH,mBAAmB;IACtCC,oBAAoB,GAAG,CAAAG,SAAA,QAAAC,OAAA,CAAAzB,CAAA,IAAAA,CAAA,IAAAwB,SAAA,KAAAE,IAAA,CAAAC,CAAA,IAAA/B,uBAAA,CAAAH,OAAA,CAAAkC,CAAA,KAAOJ,UAAU,EACrCG,IAAI,CAAEE,GAAgC,IAAK;MAC1C,IACE,OAAOA,GAAG,CAACC,YAAY,KAAK,UAAU,IACtC,OAAOD,GAAG,CAACE,YAAY,KAAK,UAAU,IACtC,OAAOF,GAAG,CAACG,eAAe,KAAK,UAAU,IACzC,OAAOH,GAAG,CAACI,8BAA8B,KAAK,QAAQ,EACtD;QACA,OAAO;UACLH,YAAY,EAAED,GAAG,CAACC,YAAY,CAACI,IAAI,CAACL,GAAG,CAAC;UACxCE,YAAY,EAAEF,GAAG,CAACE,YAAY,CAACG,IAAI,CAACL,GAAG,CAAC;UACxCG,eAAe,EAAEH,GAAG,CAACG,eAAe,CAACE,IAAI,CAACL,GAAG,CAAC;UAC9CI,8BAA8B,EAAEJ,GAAG,CAACI;QACtC,CAAC;MACH;MACA,OAAO,IAAI;IACb,CAAC,CAAC,CACDE,KAAK,CAAC,MAAM,IAAI,CAAC;EACtB;EACA,OAAOb,oBAAoB;AAC7B;;AAEA;AACA,SAASc,qBAAqBA,CAACC,GAAkB,EAAiC;EAChF,IAAI,CAACA,GAAG,EAAE;IACR,OAAO,IAAI;EACb;EACA,IAAIC,MAAe;EACnB,IAAI;IACFA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;EACA,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IACzC,OAAO,IAAI;EACb;EACA,MAAMG,SAAS,GAAGH,MAAiC;EACnD,IACE,OAAOG,SAAS,CAACC,QAAQ,KAAK,QAAQ,IACtCD,SAAS,CAACC,QAAQ,CAACC,MAAM,KAAK,CAAC,IAC/B,OAAOF,SAAS,CAACG,YAAY,KAAK,QAAQ,IAC1CH,SAAS,CAACG,YAAY,CAACD,MAAM,KAAK,CAAC,EACnC;IACA,OAAO,IAAI;EACb;EACA,OAAO;IAAED,QAAQ,EAAED,SAAS,CAACC,QAAQ;IAAEE,YAAY,EAAEH,SAAS,CAACG;EAAa,CAAC;AAC/E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,kCAAkCA,CAAA,EAAgC;EACzE,MAAMC,WAAW,GAAG;IAClBC,eAAe,EAAE5B,mCAAmC;IACpD6B,mBAAmB,EAAE/B;EACvB,CAAC;EAED,OAAO;IACLgC,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMC,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV,OAAO;UAAEC,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAId,GAAkB;MACtB,IAAI;QACFA,GAAG,GAAG,MAAMa,KAAK,CAACpB,YAAY,CAACV,iCAAiC,EAAE0B,WAAW,CAAC;MAChF,CAAC,CAAC,OAAOM,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;MACA,IAAIf,GAAG,KAAK,IAAI,EAAE;QAChB,OAAO;UAAEc,KAAK,EAAE;QAAS,CAAC;MAC5B;MACA,MAAMG,UAAU,GAAGlB,qBAAqB,CAACC,GAAG,CAAC;MAC7C,IAAI,CAACiB,UAAU,EAAE;QACf;QACA;QACA,OAAO;UACLH,KAAK,EAAE,aAAa;UACpBE,KAAK,EAAE,IAAIE,KAAK,CAAC,yDAAyD;QAC5E,CAAC;MACH;MACA,OAAO;QAAEJ,KAAK,EAAE,SAAS;QAAEG;MAAW,CAAC;IACzC,CAAC;IAEDE,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMJ,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV,OAAO,KAAK;MACd;MACA,MAAMO,KAAK,GAAGlB,IAAI,CAACmB,SAAS,CAACJ,UAAU,CAAC;MACxC,IAAI;QACF,MAAMJ,KAAK,CAACnB,YAAY,CAACX,iCAAiC,EAAEqC,KAAK,EAAE;UACjE,GAAGX,WAAW;UACda,kBAAkB,EAAET,KAAK,CAACjB;QAC5B,CAAC,CAAC;QACF;QACA;QACA;QACA;QACA,OAAO,CAAC,MAAMiB,KAAK,CAACpB,YAAY,CAACV,iCAAiC,EAAE0B,WAAW,CAAC,MAAMW,KAAK;MAC7F,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDG,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMV,KAAK,GAAG,MAAM3B,sBAAsB,CAAC,CAAC;MAC5C,IAAI,CAAC2B,KAAK,EAAE;QACV;MACF;MACA,IAAI;QACF,MAAMA,KAAK,CAAClB,eAAe,CAACZ,iCAAiC,EAAE0B,WAAW,CAAC;MAC7E,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;;AAOA,IAAIe,YAA6D;;AAEjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAAA,EAAwC;EAC/D,IAAID,YAAY,KAAKE,SAAS,EAAE;IAC9B,MAAMC,MAAM,GAAG,IAAAC,4CAA2B,EAAwC,kBAAkB,CAAC;IACrGJ,YAAY,GACVG,MAAM,IAAI,OAAOA,MAAM,CAACf,IAAI,KAAK,UAAU,IAAI,OAAOe,MAAM,CAACE,KAAK,KAAK,UAAU,IAAI,OAAOF,MAAM,CAACJ,KAAK,KAAK,UAAU,GACnH;MACEX,IAAI,EAAEe,MAAM,CAACf,IAAI,CAACf,IAAI,CAAC8B,MAAM,CAAC;MAC9BE,KAAK,EAAEF,MAAM,CAACE,KAAK,CAAChC,IAAI,CAAC8B,MAAM,CAAC;MAChCJ,KAAK,EAAEI,MAAM,CAACJ,KAAK,CAAC1B,IAAI,CAAC8B,MAAM;IACjC,CAAC,GACD,IAAI;EACZ;EACA,OAAOH,YAAY;AACrB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASM,2BAA2BA,CAAA,EAAgC;EAClE,OAAO;IACLlB,IAAI,EAAE,MAAAA,CAAA,KAAiD;MACrD,MAAMmB,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO;UAAEjB,KAAK,EAAE;QAAc,CAAC;MACjC;MACA,IAAI;QACF,OAAO,IAAAkB,sCAAgC,EAAC,MAAMD,MAAM,CAACnB,IAAI,CAAC,CAAC,CAAC;MAC9D,CAAC,CAAC,OAAOG,KAAK,EAAE;QACd,OAAO;UAAED,KAAK,EAAE,aAAa;UAAEE,KAAK,EAAED;QAAM,CAAC;MAC/C;IACF,CAAC;IAEDI,OAAO,EAAE,MAAOF,UAAU,IAAuB;MAC/C,MAAMc,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX,OAAO,KAAK;MACd;MACA,IAAI;QACF;QACA,OAAO,MAAMA,MAAM,CAACF,KAAK,CAACZ,UAAU,CAACZ,QAAQ,EAAEY,UAAU,CAACV,YAAY,CAAC;MACzE,CAAC,CAAC,MAAM;QACN,OAAO,KAAK;MACd;IACF,CAAC;IAEDgB,KAAK,EAAE,MAAAA,CAAA,KAA2B;MAChC,MAAMQ,MAAM,GAAGN,gBAAgB,CAAC,CAAC;MACjC,IAAI,CAACM,MAAM,EAAE;QACX;MACF;MACA,IAAI;QACF,MAAMA,MAAM,CAACR,KAAK,CAAC,CAAC;MACtB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASU,yCAAyCA,CAAA,EAAuC;EAC9F,IAAIC,qBAAQ,CAACC,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,OAAOD,qBAAQ,CAACC,EAAE,KAAK,KAAK,GAAG3B,kCAAkC,CAAC,CAAC,GAAGsB,2BAA2B,CAAC,CAAC;AACrG","ignoreList":[]}

package/lib/commonjs/ui/session/tokenTransport.js

@@ -1,75 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createTokenTransport = createTokenTransport;
-var _core = require("@oxyhq/core");
-/**
- * Platform `TokenTransport` for `SessionClient` (device-first model).
- *
- * `ensureActiveToken` is the fallback the client uses when a `session_state`
- * push arrived WITHOUT an embedded `activeToken` and the planted bearer does not
- * already belong to the state's active account. It mints one through the ONE
- * unified single-flight the scheduler, the request-time preflight, and the 401
- * retry all use — `oxyServices.httpService.refreshAccessToken(...)` — which runs
- * the installed refresh handler (present the persisted zero-cookie `deviceId` +
- * `deviceSecret` at `POST /session/device/token`, which mints for the device's
- * CURRENT active account). Routing through the SAME entry point means this lane
- * can never double-rotate the device secret against the others: it has NO
- * private single-flight of its own.
- *
- * The short-circuit compares the planted bearer's ACCOUNT against
- * `state.activeAccountId`, not mere token presence: a bearer for the PREVIOUS
- * account (an account switch) must still mint the new account's token — skipping
- * on presence alone would leave a subscriber observing the new active account
- * under the old account's bearer (the account-switch 404 race).
- *
- * A failure is logged and swallowed: this method must never throw out (it runs
- * inside the socket state handler).
- *
- * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
- * on `state.activeAccountId` is precisely what an identity-bound client must
- * never do — its token is minted for the PINNED account by the cold boot /
- * re-mint lane. `SessionClient` already bypasses the transport entirely while
- * pinned; this guard is the services-side half of that contract, so no future
- * wiring can reintroduce the convergence from this end.
- */
-function createTokenTransport(oxyServices, getPinnedAccountId) {
-  return {
-    async ensureActiveToken(state) {
-      if ((getPinnedAccountId?.() ?? null) !== null) {
-        return;
-      }
-      try {
-        // Skip the mint ONLY when the planted bearer already identifies the
-        // active account. `getCurrentUserId()` decodes the bearer's `userId`/`id`
-        // (null when absent/opaque), directly comparable to the account id.
-        const activeAccountId = state.activeAccountId;
-        if (activeAccountId !== null && oxyServices.getCurrentUserId() === activeAccountId) {
-          return;
-        }
-      } catch (error) {
-        _core.logger.warn('ensureActiveToken: bearer-account check threw', {
-          component: 'TokenTransport'
-        }, error);
-      }
-      try {
-        // The shared HttpService single-flight coalesces concurrent callers onto
-        // one in-flight mint; no local `inFlightMint` guard is needed.
-        const token = await oxyServices.httpService.refreshAccessToken('preflight');
-        if (!token) {
-          _core.logger.debug('ensureActiveToken: refresh produced no session', {
-            component: 'TokenTransport',
-            deviceId: state.deviceId
-          });
-        }
-      } catch (error) {
-        _core.logger.warn('ensureActiveToken: refresh failed', {
-          component: 'TokenTransport'
-        }, error);
-      }
-    }
-  };
-}
-//# sourceMappingURL=tokenTransport.js.map

package/lib/commonjs/ui/session/tokenTransport.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","createTokenTransport","oxyServices","getPinnedAccountId","ensureActiveToken","state","activeAccountId","getCurrentUserId","error","logger","warn","component","token","httpService","refreshAccessToken","debug","deviceId"],"sourceRoot":"../../../../src","sources":["ui/session/tokenTransport.ts"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAClCC,WAAwB,EACxBC,kBAAwC,EACxB;EAChB,OAAO;IACL,MAAMC,iBAAiBA,CAACC,KAAyB,EAAiB;MAChE,IAAI,CAACF,kBAAkB,GAAG,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE;QAC7C;MACF;MACA,IAAI;QACF;QACA;QACA;QACA,MAAMG,eAAe,GAAGD,KAAK,CAACC,eAAe;QAC7C,IAAIA,eAAe,KAAK,IAAI,IAAIJ,WAAW,CAACK,gBAAgB,CAAC,CAAC,KAAKD,eAAe,EAAE;UAClF;QACF;MACF,CAAC,CAAC,OAAOE,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,+CAA+C,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MACtG;MAEA,IAAI;QACF;QACA;QACA,MAAMI,KAAK,GAAG,MAAMV,WAAW,CAACW,WAAW,CAACC,kBAAkB,CAAC,WAAW,CAAC;QAC3E,IAAI,CAACF,KAAK,EAAE;UACVH,YAAM,CAACM,KAAK,CAAC,gDAAgD,EAAE;YAC7DJ,SAAS,EAAE,gBAAgB;YAC3BK,QAAQ,EAAEX,KAAK,CAACW;UAClB,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOR,KAAK,EAAE;QACdC,YAAM,CAACC,IAAI,CAAC,mCAAmC,EAAE;UAAEC,SAAS,EAAE;QAAiB,CAAC,EAAEH,KAAK,CAAC;MAC1F;IACF;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/session/useBackgroundSessionSync.js

@@ -1,81 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.useBackgroundSessionSync = useBackgroundSessionSync;
-var _react = require("react");
-var _reactNative = require("react-native");
-var _backgroundSession = require("./backgroundSession.js");
-/**
- * Keeps the native background credential in step with the session, so an app
- * enables background authentication with one prop and writes no session code of
- * its own.
- *
- * See `./backgroundSession` for what the credential is and why it is separate
- * from the rotating device secret.
- */
-
-/**
- * An effect is the right shape here, unusually for this codebase: the work is a
- * side effect on native storage, and it has to react both to an identity change
- * (a value) and to the app being foregrounded (a subscription). There is no
- * derived-state or React Query formulation of "write a credential to the
- * keystore when the user changes or the app comes back".
- *
- * Re-runs on identity change, which is what makes sign-out and account switching
- * work: `syncBackgroundSession` clears a credential belonging to anyone other
- * than `userId` before it does any network work.
- */
-function useBackgroundSessionSync({
-  enabled,
-  oxyServices,
-  userId,
-  canUsePrivateApi
-}) {
-  (0, _react.useEffect)(() => {
-    if (!(0, _backgroundSession.isBackgroundSessionSupported)()) {
-      return;
-    }
-    if (!enabled) {
-      // An app that leaves the feature off must not keep a credential THIS app
-      // provisioned earlier. The store is package-scoped (see
-      // OxyBackgroundSessionStore), so this cannot revoke a sibling Oxy app's
-      // credential under the shared UID.
-      void (0, _backgroundSession.clearBackgroundSession)();
-      return;
-    }
-
-    // A run that is superseded (unmount, or another identity change) must not
-    // write the credential it was about to write.
-    let current = true;
-    // Deliberately NOT caught. `syncBackgroundSession` already handles every
-    // runtime failure internally and throws for exactly one thing: an installed
-    // `@oxyhq/core` too old to provision. That is a dependency mistake which must
-    // surface, so it is allowed to reject — adding a `.catch()` here would put it
-    // back behind the silence it was moved out of.
-    const run = () => {
-      void (0, _backgroundSession.syncBackgroundSession)({
-        oxyServices,
-        userId,
-        canUsePrivateApi,
-        isCurrent: () => current
-      });
-    };
-    run();
-    const subscription = _reactNative.AppState.addEventListener('change', state => {
-      if (state === 'active') {
-        run();
-      }
-    });
-    return () => {
-      current = false;
-      subscription.remove();
-      // Deliberately NOT clearing here. Unmount is the app closing, which is
-      // precisely when the credential has to survive — clearing on teardown
-      // would defeat the entire feature. Revocation happens on sign-out (via a
-      // `userId` of null), on the server, or when the credential expires.
-    };
-  }, [enabled, oxyServices, userId, canUsePrivateApi]);
-}
-//# sourceMappingURL=useBackgroundSessionSync.js.map

package/lib/commonjs/ui/session/useBackgroundSessionSync.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_react","require","_reactNative","_backgroundSession","useBackgroundSessionSync","enabled","oxyServices","userId","canUsePrivateApi","useEffect","isBackgroundSessionSupported","clearBackgroundSession","current","run","syncBackgroundSession","isCurrent","subscription","AppState","addEventListener","state","remove"],"sourceRoot":"../../../../src","sources":["ui/session/useBackgroundSessionSync.ts"],"mappings":";;;;;;AAQA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAEA,IAAAE,kBAAA,GAAAF,OAAA;AAXA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,wBAAwBA,CAAC;EACvCC,OAAO;EACPC,WAAW;EACXC,MAAM;EACNC;AAC6B,CAAC,EAAQ;EACtC,IAAAC,gBAAS,EAAC,MAAM;IACd,IAAI,CAAC,IAAAC,+CAA4B,EAAC,CAAC,EAAE;MACnC;IACF;IAEA,IAAI,CAACL,OAAO,EAAE;MACZ;MACA;MACA;MACA;MACA,KAAK,IAAAM,yCAAsB,EAAC,CAAC;MAC7B;IACF;;IAEA;IACA;IACA,IAAIC,OAAO,GAAG,IAAI;IAClB;IACA;IACA;IACA;IACA;IACA,MAAMC,GAAG,GAAGA,CAAA,KAAM;MAChB,KAAK,IAAAC,wCAAqB,EAAC;QACzBR,WAAW;QACXC,MAAM;QACNC,gBAAgB;QAChBO,SAAS,EAAEA,CAAA,KAAMH;MACnB,CAAC,CAAC;IACJ,CAAC;IAEDC,GAAG,CAAC,CAAC;IACL,MAAMG,YAAY,GAAGC,qBAAQ,CAACC,gBAAgB,CAAC,QAAQ,EAAGC,KAAK,IAAK;MAClE,IAAIA,KAAK,KAAK,QAAQ,EAAE;QACtBN,GAAG,CAAC,CAAC;MACP;IACF,CAAC,CAAC;IAEF,OAAO,MAAM;MACXD,OAAO,GAAG,KAAK;MACfI,YAAY,CAACI,MAAM,CAAC,CAAC;MACrB;MACA;MACA;MACA;IACF,CAAC;EACH,CAAC,EAAE,CAACf,OAAO,EAAEC,WAAW,EAAEC,MAAM,EAAEC,gBAAgB,CAAC,CAAC;AACtD","ignoreList":[]}