@oxyhq/services 29.0.0 → 30.0.0

package/lib/module/notifications/deviceNotifications.js

@@ -1,433 +0,0 @@
-"use strict";
-
-/**
- * The ONE place `@oxyhq/services` touches `expo-notifications`.
- *
- * Every Oxy app that receives push needs the identical adapter — native-only,
- * dynamically imported, reading the OS permission and minting an EXPO push
- * token — so it lives here instead of being copied into each app. The
- * bearer-authenticated transport (`registerPushToken` / `unregisterPushToken`)
- * already lives in `@oxyhq/core`; core may never import an `expo-*` module, and
- * this adapter is the Expo-side half that closes that gap.
- *
- * ## Reached through its OWN entry point, never the root barrel
- *
- * ```ts
- * import { getExpoPushToken } from '@oxyhq/services/notifications';
- * ```
- *
- * This is the only module in the package that depends on peers an app which
- * does not use push genuinely never installs, and a barrel export would put it
- * in EVERY consumer's import graph. `tsc` resolves the specifier of an
- * `import()` even when the call is lazy and inside a try/catch, so a barrel
- * export turned "optional peer" into a hard requirement: consumers with no
- * interest in push failed to type-check with TS2307. The subpath is what keeps
- * the optionality honest — see the note in `src/index.ts`.
- *
- * Metro is the resolver that behaves differently here, and in the useful
- * direction: an unresolvable DYNAMIC `import()` bundles fine (the `catch` below
- * takes over at runtime), where a static import fails the build outright. That
- * is why the runtime shape below must stay dynamic-and-guarded.
- *
- * ## Native-only by construction
- *
- * Every entry point resolves its null/no-op result from `Platform.OS` BEFORE the
- * dynamic `import()`, so a web bundle never requests `expo-notifications` at all.
- * `expo-notifications` and `expo-constants` are OPTIONAL peer dependencies: an
- * app that does not use push never installs them, and a build without them
- * degrades to "notifications unavailable" rather than throwing at
- * module-evaluation time.
- *
- * ## The token is an EXPO push token — never a raw device token
- *
- * {@link getExpoPushToken} calls `getExpoPushTokenAsync()`, which returns the
- * `ExponentPushToken[…]` handle Expo's push service delivers through — the only
- * form it accepts. `getDevicePushTokenAsync()` — the raw APNs/FCM token — is
- * deliberately NOT used anywhere: registering one of those looks entirely
- * successful (the row is stored, the endpoint returns 200) and then every push
- * silently fails at delivery time. `@oxyhq/core`'s `registerPushToken` rejects a
- * raw device token before sending, and this module is the reason it never has to.
- *
- * ## The payload is untrusted
- *
- * Nothing here surfaces a notification's `title` / `body` / `subtitle`. The only
- * payload that leaves this module is the raw `content.data` — the routing keys —
- * typed `unknown`, so a caller has to validate it before acting on it and there
- * is no exported shape that invites rendering push-delivered text. The
- * foreground handler likewise answers with a visibility verdict and nothing else.
- */
-
-import { createLogger } from '@oxyhq/core';
-import { Platform } from 'react-native';
-const log = createLogger('deviceNotifications');
-function isRecord(value) {
-  return typeof value === 'object' && value !== null;
-}
-
-/**
- * Load `expo-notifications`, or `null` when it cannot serve this platform/build.
- *
- * The web guard runs before the `import()`, so a web bundle never reaches for the
- * native module. The dynamic import is intentional: the module registry caches
- * it, so repeated calls are cheap and no module-level mutable cache is
- * introduced here.
- */
-async function loadNotifications() {
-  if (Platform.OS === 'web') {
-    return null;
-  }
-  try {
-    return await import('expo-notifications');
-  } catch (error) {
-    log.warn('expo-notifications is unavailable in this build — push is disabled', {
-      method: 'loadNotifications'
-    }, error);
-    return null;
-  }
-}
-
-/**
- * The EAS project id an Expo push token is minted against, or `null` when the
- * app config carries none.
- *
- * Resolved exactly the way `expo-notifications` resolves it internally
- * (`easConfig.projectId`, then `expoConfig.extra.eas.projectId`) and then handed
- * BACK to `getExpoPushTokenAsync` explicitly, so the two can never disagree.
- * Reading it here is what turns "no project id" from an opaque
- * `ERR_NOTIFICATIONS_NO_EXPERIENCE_ID` rejection into a named, actionable state
- * instead of one more entry in the indistinguishable "permission denied /
- * offline" bucket.
- *
- * A missing `expo-constants` lands on the same `null` outcome — the single
- * actionable warning is emitted once by the caller, so this path only records
- * the extra detail at debug level rather than warning twice for one condition.
- */
-async function easProjectId() {
-  let constants;
-  try {
-    constants = (await import('expo-constants')).default;
-  } catch (error) {
-    log.debug('expo-constants is unavailable in this build — no EAS project id can be resolved', {
-      method: 'easProjectId'
-    }, error);
-    return null;
-  }
-  const fromEasConfig = constants.easConfig?.projectId;
-  if (typeof fromEasConfig === 'string' && fromEasConfig.length > 0) {
-    return fromEasConfig;
-  }
-  const extra = constants.expoConfig?.extra;
-  const eas = isRecord(extra) ? extra.eas : undefined;
-  const projectId = isRecord(eas) ? eas.projectId : undefined;
-  return typeof projectId === 'string' && projectId.length > 0 ? projectId : null;
-}
-
-/**
- * The platform tag the push-token registry stores this installation under, or
- * `null` on a platform Oxy does not deliver push to.
- *
- * Synchronous and import-free — the answer is a property of the bundle, not of
- * any native module.
- *
- * Web is `null` on purpose: the registry accepts a `web` platform, but browser
- * push needs a VAPID key + service-worker subscription no Oxy app has wired, so
- * there is no token to register and claiming otherwise would store a row nothing
- * can ever deliver to.
- */
-export function pushTokenPlatform() {
-  return Platform.OS === 'ios' || Platform.OS === 'android' ? Platform.OS : null;
-}
-
-/**
- * Whether the OS notification permission is ALREADY granted.
- *
- * Never prompts, so an app can re-check on every cold boot without ever asking
- * the user twice. Use {@link requestNotificationPermission} for the one place
- * that is allowed to show the system dialog.
- */
-export async function hasNotificationPermission() {
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return false;
-  }
-  try {
-    const permissions = await notifications.getPermissionsAsync();
-    return permissions.granted === true;
-  } catch (error) {
-    log.warn('could not read the notification permission', {
-      method: 'hasNotificationPermission'
-    }, error);
-    return false;
-  }
-}
-
-/**
- * Ensure the OS notification permission, prompting at most once.
- *
- * An installation that already answered the system dialog is never asked again:
- * an already-granted permission resolves `true` without a second dialog, and a
- * denial with `canAskAgain: false` resolves `false` without issuing a request
- * the OS would silently ignore.
- *
- * @returns Whether notifications are granted once this call is done.
- */
-export async function requestNotificationPermission() {
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return false;
-  }
-  try {
-    const existing = await notifications.getPermissionsAsync();
-    if (existing.granted === true) {
-      return true;
-    }
-    if (existing.canAskAgain === false) {
-      return false;
-    }
-    const requested = await notifications.requestPermissionsAsync();
-    return requested.granted === true;
-  } catch (error) {
-    log.warn('the notification permission could not be resolved', {
-      method: 'requestNotificationPermission'
-    }, error);
-    return false;
-  }
-}
-
-/**
- * This installation's Expo push token (`ExponentPushToken[…]`), or `null` when
- * one cannot be minted.
- *
- * Deliberately `getExpoPushTokenAsync` — see the module header for why the raw
- * device-token variant is never used.
- *
- * Every `null` is logged with the reason it happened. A missing EAS project id
- * in particular is a BUILD MISCONFIGURATION, not a user state: no token can ever
- * be minted, so push is off for every install of that build until the config is
- * fixed. It is reported as such rather than blending into the
- * indistinguishable "permission denied / offline" bucket.
- */
-export async function getExpoPushToken() {
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return null;
-  }
-  const projectId = await easProjectId();
-  if (!projectId) {
-    log.warn('no EAS project id in the app config (expo.extra.eas.projectId) — an Expo push token cannot be minted, so push is disabled for this build', {
-      method: 'getExpoPushToken'
-    });
-    return null;
-  }
-  try {
-    const token = await notifications.getExpoPushTokenAsync({
-      projectId
-    });
-    if (token.data.length === 0) {
-      log.warn('the Expo push service returned an empty token', {
-        method: 'getExpoPushToken'
-      });
-      return null;
-    }
-    return token.data;
-  } catch (error) {
-    log.warn('could not mint an Expo push token', {
-      method: 'getExpoPushToken'
-    }, error);
-    return null;
-  }
-}
-
-/**
- * Take the payload of the notification that COLD-LAUNCHED the app, if any.
- *
- * "Take" is literal: the response is cleared from `expo-notifications` once
- * read, so a listener attached later in the same launch is not handed the same
- * tap again. Clearing is best-effort across OS/module versions, so a caller that
- * must not act twice still needs its own idempotency ledger.
- *
- * @returns The raw, untrusted `content.data` of the launching notification, or
- *   `null`. Parsing/validation is the caller's job.
- */
-export async function takeLaunchNotificationData() {
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return null;
-  }
-  try {
-    const response = notifications.getLastNotificationResponse();
-    if (!response) {
-      return null;
-    }
-    const data = response.notification.request.content.data;
-    try {
-      notifications.clearLastNotificationResponse();
-    } catch (clearError) {
-      log.warn('could not clear the launching notification response', {
-        method: 'takeLaunchNotificationData'
-      }, clearError);
-    }
-    return data;
-  } catch (error) {
-    log.warn('could not read the launching notification', {
-      method: 'takeLaunchNotificationData'
-    }, error);
-    return null;
-  }
-}
-
-/**
- * What the OS should do with a notification that arrives while the app is
- * FOREGROUNDED.
- *
- * `'suppress'` is `expo-notifications`' own default for a foregrounded app, so a
- * decision function that only ever returns `'show'` for the payloads it
- * recognises leaves every other notification exactly as it behaves today.
- */
-
-/**
- * Whether the process-wide foreground handler has already been ATTEMPTED.
- *
- * `setNotificationHandler` is global, last-writer-wins process state, so this is
- * a one-shot install rather than something a mount/unmount cycle owns. A failed
- * attempt is deliberately not retried: the only failure modes are permanent for
- * the life of the process (web, a build without the native module, a native
- * module that threw on registration).
- *
- * Module-scoped and only ever touched from an async install call — never read
- * during render, so the React Compiler has no memoizable position to freeze it
- * into.
- */
-let foregroundHandlerAttempted = false;
-
-/** How prominently Android surfaces a channel's notifications. */
-
-/** An Android notification channel this app delivers on. */
-
-/**
- * Create (or update) an Android notification channel.
- *
- * A no-op everywhere but Android: iOS has no channels, and web never loads the
- * native module. Call it BEFORE registering a push token, so the very first
- * notification the server sends already has a channel to land on.
- *
- * Failure is non-fatal and logged: a missing channel costs visibility, and
- * refusing to register a token over it would cost the feature entirely.
- *
- * @returns Whether the channel was actually created (`false` off Android, or
- *   when the native module is unavailable, or when creation failed).
- */
-export async function ensureNotificationChannel(spec) {
-  if (Platform.OS !== 'android') {
-    return false;
-  }
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return false;
-  }
-  try {
-    await notifications.setNotificationChannelAsync(spec.id, {
-      name: spec.name,
-      importance: spec.importance === 'high' ? notifications.AndroidImportance.HIGH : notifications.AndroidImportance.DEFAULT,
-      ...(spec.description ? {
-        description: spec.description
-      } : {})
-    });
-    return true;
-  } catch (error) {
-    log.warn('could not create the notification channel', {
-      method: 'ensureNotificationChannel',
-      channelId: spec.id
-    }, error);
-    return false;
-  }
-}
-
-/**
- * Install the ONE process-wide handler that decides whether an incoming
- * notification is shown while the app is in the FOREGROUND.
- *
- * Without a handler, `expo-notifications` shows nothing at all while the app is
- * open — which is exactly when a time-critical notification (a "Sign in with
- * Oxy" approval request, say) matters most, because the user is already holding
- * the phone.
- *
- * The handler ONLY decides visibility. It never navigates, never acts on the
- * notification, and never reads the payload for display — `decide` is handed the
- * raw, untrusted `content.data` and may answer nothing but `'show'` /
- * `'suppress'`. Acting on a notification stays with a TAP, routed by
- * {@link subscribeToNotificationResponses}. No notification actions/categories
- * are registered here, so the banner cannot carry an action button.
- *
- * The one-shot latch is set BEFORE the first `await`, so concurrent callers
- * cannot both reach `setNotificationHandler`.
- *
- * @param decide - Maps the raw, untrusted payload to a presentation verdict.
- *   Must not throw; a throw is reported by the OS as a handling error and the
- *   notification is dropped.
- * @returns Whether a handler was installed by THIS call (`false` on a repeat
- *   call, on web, or when the native module is unavailable).
- */
-export async function installForegroundNotificationHandler(decide) {
-  if (foregroundHandlerAttempted) {
-    return false;
-  }
-  foregroundHandlerAttempted = true;
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return false;
-  }
-  try {
-    notifications.setNotificationHandler({
-      handleNotification: async notification => {
-        const data = notification.request.content.data;
-        const show = decide(data) === 'show';
-        return {
-          // Banner: the whole point — make the notification visible on screen.
-          shouldShowBanner: show,
-          // Notification centre: so the user can still review it after
-          // dismissing the banner.
-          shouldShowList: show,
-          // No sound: the app is foregrounded, so the user is already looking at
-          // the screen the banner appears on.
-          shouldPlaySound: false,
-          // Badging is an app-level unread concept this adapter has no view of.
-          shouldSetBadge: false
-        };
-      }
-    });
-    return true;
-  } catch (error) {
-    log.warn('could not install the foreground notification handler', {
-      method: 'installForegroundNotificationHandler'
-    }, error);
-    return false;
-  }
-}
-
-/**
- * Subscribe to notification TAPS (responses) while the app is running.
- *
- * @param listener - Receives the raw, untrusted `content.data` of the tapped
- *   notification. Parsing/validation is the caller's job.
- * @returns An unsubscribe function. Safe to call even if the subscription could
- *   not be established.
- */
-export async function subscribeToNotificationResponses(listener) {
-  const notifications = await loadNotifications();
-  if (!notifications) {
-    return () => undefined;
-  }
-  try {
-    const subscription = notifications.addNotificationResponseReceivedListener(response => {
-      listener(response.notification.request.content.data);
-    });
-    return () => subscription.remove();
-  } catch (error) {
-    log.warn('could not subscribe to notification taps', {
-      method: 'subscribeToNotificationResponses'
-    }, error);
-    return () => undefined;
-  }
-}
-//# sourceMappingURL=deviceNotifications.js.map

package/lib/module/notifications/deviceNotifications.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["createLogger","Platform","log","isRecord","value","loadNotifications","OS","error","warn","method","easProjectId","constants","default","debug","fromEasConfig","easConfig","projectId","length","extra","expoConfig","eas","undefined","pushTokenPlatform","hasNotificationPermission","notifications","permissions","getPermissionsAsync","granted","requestNotificationPermission","existing","canAskAgain","requested","requestPermissionsAsync","getExpoPushToken","token","getExpoPushTokenAsync","data","takeLaunchNotificationData","response","getLastNotificationResponse","notification","request","content","clearLastNotificationResponse","clearError","foregroundHandlerAttempted","ensureNotificationChannel","spec","setNotificationChannelAsync","id","name","importance","AndroidImportance","HIGH","DEFAULT","description","channelId","installForegroundNotificationHandler","decide","setNotificationHandler","handleNotification","show","shouldShowBanner","shouldShowList","shouldPlaySound","shouldSetBadge","subscribeToNotificationResponses","listener","subscription","addNotificationResponseReceivedListener","remove"],"sourceRoot":"../../../src","sources":["notifications/deviceNotifications.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,YAAY,QAAQ,aAAa;AAE1C,SAASC,QAAQ,QAAQ,cAAc;AAEvC,MAAMC,GAAG,GAAGF,YAAY,CAAC,qBAAqB,CAAC;AAK/C,SAASG,QAAQA,CAACC,KAAc,EAAoC;EAClE,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,KAAK,IAAI;AACpD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAwC;EACtE,IAAIJ,QAAQ,CAACK,EAAE,KAAK,KAAK,EAAE;IACzB,OAAO,IAAI;EACb;EACA,IAAI;IACF,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC;EAC3C,CAAC,CAAC,OAAOC,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,oEAAoE,EACpE;MAAEC,MAAM,EAAE;IAAoB,CAAC,EAC/BF,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeG,YAAYA,CAAA,EAA2B;EACpD,IAAIC,SAAqC;EACzC,IAAI;IACFA,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAEC,OAAO;EACtD,CAAC,CAAC,OAAOL,KAAK,EAAE;IACdL,GAAG,CAACW,KAAK,CACP,iFAAiF,EACjF;MAAEJ,MAAM,EAAE;IAAe,CAAC,EAC1BF,KACF,CAAC;IACD,OAAO,IAAI;EACb;EAEA,MAAMO,aAAa,GAAGH,SAAS,CAACI,SAAS,EAAEC,SAAS;EACpD,IAAI,OAAOF,aAAa,KAAK,QAAQ,IAAIA,aAAa,CAACG,MAAM,GAAG,CAAC,EAAE;IACjE,OAAOH,aAAa;EACtB;EAEA,MAAMI,KAAc,GAAGP,SAAS,CAACQ,UAAU,EAAED,KAAK;EAClD,MAAME,GAAG,GAAGjB,QAAQ,CAACe,KAAK,CAAC,GAAGA,KAAK,CAACE,GAAG,GAAGC,SAAS;EACnD,MAAML,SAAS,GAAGb,QAAQ,CAACiB,GAAG,CAAC,GAAGA,GAAG,CAACJ,SAAS,GAAGK,SAAS;EAC3D,OAAO,OAAOL,SAAS,KAAK,QAAQ,IAAIA,SAAS,CAACC,MAAM,GAAG,CAAC,GAAGD,SAAS,GAAG,IAAI;AACjF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASM,iBAAiBA,CAAA,EAA6B;EAC5D,OAAOrB,QAAQ,CAACK,EAAE,KAAK,KAAK,IAAIL,QAAQ,CAACK,EAAE,KAAK,SAAS,GAAGL,QAAQ,CAACK,EAAE,GAAG,IAAI;AAChF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeiB,yBAAyBA,CAAA,EAAqB;EAClE,MAAMC,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMC,WAAW,GAAG,MAAMD,aAAa,CAACE,mBAAmB,CAAC,CAAC;IAC7D,OAAOD,WAAW,CAACE,OAAO,KAAK,IAAI;EACrC,CAAC,CAAC,OAAOpB,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,4CAA4C,EAC5C;MAAEC,MAAM,EAAE;IAA4B,CAAC,EACvCF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeqB,6BAA6BA,CAAA,EAAqB;EACtE,MAAMJ,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMK,QAAQ,GAAG,MAAML,aAAa,CAACE,mBAAmB,CAAC,CAAC;IAC1D,IAAIG,QAAQ,CAACF,OAAO,KAAK,IAAI,EAAE;MAC7B,OAAO,IAAI;IACb;IACA,IAAIE,QAAQ,CAACC,WAAW,KAAK,KAAK,EAAE;MAClC,OAAO,KAAK;IACd;IACA,MAAMC,SAAS,GAAG,MAAMP,aAAa,CAACQ,uBAAuB,CAAC,CAAC;IAC/D,OAAOD,SAAS,CAACJ,OAAO,KAAK,IAAI;EACnC,CAAC,CAAC,OAAOpB,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,mDAAmD,EACnD;MAAEC,MAAM,EAAE;IAAgC,CAAC,EAC3CF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe0B,gBAAgBA,CAAA,EAA2B;EAC/D,MAAMT,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,IAAI;EACb;EAEA,MAAMR,SAAS,GAAG,MAAMN,YAAY,CAAC,CAAC;EACtC,IAAI,CAACM,SAAS,EAAE;IACdd,GAAG,CAACM,IAAI,CACN,0IAA0I,EAC1I;MAAEC,MAAM,EAAE;IAAmB,CAC/B,CAAC;IACD,OAAO,IAAI;EACb;EAEA,IAAI;IACF,MAAMyB,KAAK,GAAG,MAAMV,aAAa,CAACW,qBAAqB,CAAC;MAAEnB;IAAU,CAAC,CAAC;IACtE,IAAIkB,KAAK,CAACE,IAAI,CAACnB,MAAM,KAAK,CAAC,EAAE;MAC3Bf,GAAG,CAACM,IAAI,CAAC,+CAA+C,EAAE;QAAEC,MAAM,EAAE;MAAmB,CAAC,CAAC;MACzF,OAAO,IAAI;IACb;IACA,OAAOyB,KAAK,CAACE,IAAI;EACnB,CAAC,CAAC,OAAO7B,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CAAC,mCAAmC,EAAE;MAAEC,MAAM,EAAE;IAAmB,CAAC,EAAEF,KAAK,CAAC;IACpF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe8B,0BAA0BA,CAAA,EAAqB;EACnE,MAAMb,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMc,QAAQ,GAAGd,aAAa,CAACe,2BAA2B,CAAC,CAAC;IAC5D,IAAI,CAACD,QAAQ,EAAE;MACb,OAAO,IAAI;IACb;IACA,MAAMF,IAAa,GAAGE,QAAQ,CAACE,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI;IAChE,IAAI;MACFZ,aAAa,CAACmB,6BAA6B,CAAC,CAAC;IAC/C,CAAC,CAAC,OAAOC,UAAU,EAAE;MACnB1C,GAAG,CAACM,IAAI,CACN,qDAAqD,EACrD;QAAEC,MAAM,EAAE;MAA6B,CAAC,EACxCmC,UACF,CAAC;IACH;IACA,OAAOR,IAAI;EACb,CAAC,CAAC,OAAO7B,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,2CAA2C,EAC3C;MAAEC,MAAM,EAAE;IAA6B,CAAC,EACxCF,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAIsC,0BAA0B,GAAG,KAAK;;AAEtC;;AAGA;;AAiBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,IAA6B,EACX;EAClB,IAAI9C,QAAQ,CAACK,EAAE,KAAK,SAAS,EAAE;IAC7B,OAAO,KAAK;EACd;EACA,MAAMkB,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACF,MAAMA,aAAa,CAACwB,2BAA2B,CAACD,IAAI,CAACE,EAAE,EAAE;MACvDC,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfC,UAAU,EACRJ,IAAI,CAACI,UAAU,KAAK,MAAM,GACtB3B,aAAa,CAAC4B,iBAAiB,CAACC,IAAI,GACpC7B,aAAa,CAAC4B,iBAAiB,CAACE,OAAO;MAC7C,IAAIP,IAAI,CAACQ,WAAW,GAAG;QAAEA,WAAW,EAAER,IAAI,CAACQ;MAAY,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAOhD,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,2CAA2C,EAC3C;MAAEC,MAAM,EAAE,2BAA2B;MAAE+C,SAAS,EAAET,IAAI,CAACE;IAAG,CAAC,EAC3D1C,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAekD,oCAAoCA,CACxDC,MAAiD,EAC/B;EAClB,IAAIb,0BAA0B,EAAE;IAC9B,OAAO,KAAK;EACd;EACAA,0BAA0B,GAAG,IAAI;EAEjC,MAAMrB,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,KAAK;EACd;EACA,IAAI;IACFA,aAAa,CAACmC,sBAAsB,CAAC;MACnCC,kBAAkB,EAAE,MAAOpB,YAAY,IAAK;QAC1C,MAAMJ,IAAa,GAAGI,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI;QACvD,MAAMyB,IAAI,GAAGH,MAAM,CAACtB,IAAI,CAAC,KAAK,MAAM;QACpC,OAAO;UACL;UACA0B,gBAAgB,EAAED,IAAI;UACtB;UACA;UACAE,cAAc,EAAEF,IAAI;UACpB;UACA;UACAG,eAAe,EAAE,KAAK;UACtB;UACAC,cAAc,EAAE;QAClB,CAAC;MACH;IACF,CAAC,CAAC;IACF,OAAO,IAAI;EACb,CAAC,CAAC,OAAO1D,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,uDAAuD,EACvD;MAAEC,MAAM,EAAE;IAAuC,CAAC,EAClDF,KACF,CAAC;IACD,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe2D,gCAAgCA,CACpDC,QAAiC,EACZ;EACrB,MAAM3C,aAAa,GAAG,MAAMnB,iBAAiB,CAAC,CAAC;EAC/C,IAAI,CAACmB,aAAa,EAAE;IAClB,OAAO,MAAMH,SAAS;EACxB;EACA,IAAI;IACF,MAAM+C,YAAY,GAAG5C,aAAa,CAAC6C,uCAAuC,CAAE/B,QAAQ,IAAK;MACvF6B,QAAQ,CAAC7B,QAAQ,CAACE,YAAY,CAACC,OAAO,CAACC,OAAO,CAACN,IAAI,CAAC;IACtD,CAAC,CAAC;IACF,OAAO,MAAMgC,YAAY,CAACE,MAAM,CAAC,CAAC;EACpC,CAAC,CAAC,OAAO/D,KAAK,EAAE;IACdL,GAAG,CAACM,IAAI,CACN,0CAA0C,EAC1C;MAAEC,MAAM,EAAE;IAAmC,CAAC,EAC9CF,KACF,CAAC;IACD,OAAO,MAAMc,SAAS;EACxB;AACF","ignoreList":[]}

package/lib/module/package.json

@@ -1 +0,0 @@
-{"type":"module"}

package/lib/module/ui/boot/runProviderColdBoot.js

@@ -1,199 +0,0 @@
-"use strict";
-
-import { logger as loggerUtil, runSessionColdBoot } from '@oxyhq/core';
-import { loadPersistedDeviceCredential } from "../utils/deviceCredential.js";
-import { createPlatformSharedDeviceCredentialStore } from "../session/sharedDeviceCredentialStore.js";
-import { tryCompleteOAuthReturn } from "../utils/oauthReturn.js";
-import { isWebBrowser } from "../utils/isWebBrowser.js";
-import { isNetConnectivityExplicitlyOffline } from "../utils/netConnectivity.js";
-/** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
-export const SESSION_HANDOFF_DEADLINE_MS = 6000;
-
-/**
- * HARD overall deadline (ms) for the whole `runSessionColdBoot` step chain.
- *
- * Bounds time-to-route: routing gates on `isAuthResolved`, which resolves when
- * the cold boot finishes, so a network step that never settles (a black-hole
- * network that neither connects nor rejects) would otherwise hang routing
- * indefinitely. 12s comfortably exceeds the healthy worst case of the
- * sequential, single-attempt (`retry:false`), 5s-capped network steps, so it is
- * INERT on healthy loads and only trips on a pathological network. Offline
- * devices short-circuit far sooner via the connectivity hint below.
- */
-export const COLD_BOOT_OVERALL_DEADLINE_MS = 12_000;
-
-/**
- * Timeout (ms) for the best-effort native connectivity probe. Kept tight so the
- * probe never itself adds meaningful latency to a healthy boot — an unknown
- * result within this window is treated as "online".
- */
-const OFFLINE_PROBE_TIMEOUT_MS = 500;
-
-/**
- * Best-effort, FAST connectivity probe run once before the cold boot.
- *
- * Returns `true` ONLY on an EXPLICIT disconnected verdict; every ambiguous
- * outcome (probe timeout, unknown/`null` state, NetInfo unavailable, a thrown
- * error) resolves to `false` (assume online) so a flaky probe can never falsely
- * skip a real sign-in. Never rejects. On web it reads `navigator.onLine`; on
- * native it races `NetInfo.fetch()` against {@link OFFLINE_PROBE_TIMEOUT_MS},
- * mirroring the existing NetInfo dynamic-import pattern in `OxyProvider`.
- */
-async function detectOfflineHint() {
-  try {
-    if (isWebBrowser()) {
-      const online = globalThis.navigator?.onLine;
-      // Only an explicit `false` is an offline verdict; `undefined` ⇒ assume online.
-      return online === false;
-    }
-    const NetInfo = await import('@react-native-community/netinfo');
-    const state = await Promise.race([NetInfo.default.fetch(), new Promise(resolve => {
-      setTimeout(() => resolve(null), OFFLINE_PROBE_TIMEOUT_MS);
-    })]);
-    // `null` ⇒ the probe timed out (unknown → assume online). Only an explicit
-    // disconnected / unreachable verdict disables the network steps.
-    return isNetConnectivityExplicitlyOffline(state);
-  } catch {
-    // NetInfo missing / probe threw — never block sign-in on a probe failure.
-    return false;
-  }
-}
-/**
- * Device-first cold boot for `@oxyhq/services` providers.
- *
- * Ordered pipeline:
- * 1. Complete an OAuth authorization-code return already on the URL (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
- *    primary-identity-key lane in `sessionMode: 'identity'`)
- *
- * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
- * which for an identity-bound client is somebody else's account by construction.
- * In `'identity'` mode the boot is exactly step 2.
- *
- * The boot NEVER navigates the top-level window. There is no automatic
- * `prompt=none` bounce to the IdP: a web origin with no local device credential
- * resolves SIGNED OUT and waits for the user's next explicit "Continue with
- * Oxy", which opens a popup from a real gesture (#691 phase 7b). Step 1 is not a
- * navigation — it only consumes a code that is already in the address bar.
- */
-export async function runProviderColdBoot(opts) {
-  const {
-    oxyServices,
-    authStore,
-    clientId,
-    authRedirectUri,
-    sessionMode = 'account',
-    identity,
-    sessionClient,
-    syncDeviceCredentialToHost,
-    commitSession,
-    markAuthResolved,
-    setTokenReady
-  } = opts;
-  const identityBound = sessionMode === 'identity';
-  setTokenReady(false);
-  try {
-    // The redirect transport's RETURN leg. An app reaches it whenever the browser
-    // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
-    // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
-    // load-bearing even though nothing here ever starts a redirect. It consumes a
-    // code (or a stale OAuth `error`) already in the address bar and rewrites the
-    // URL via `history.replaceState`; it never begins a navigation.
-    const oauthCompleted = identityBound ? false : await tryCompleteOAuthReturn({
-      oxyServices,
-      clientId,
-      authRedirectUri,
-      commitSession: input => commitSession(input, {
-        activate: true
-      })
-    });
-    if (oauthCompleted) {
-      setTokenReady(true);
-      markAuthResolved();
-      return;
-    }
-
-    // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
-    // the two doomed network steps so routing settles immediately instead of
-    // burning the overall deadline on a mint that cannot succeed. Any ambiguity
-    // resolves to "online" — the network steps still run.
-    const offline = await detectOfflineHint();
-    await runSessionColdBoot({
-      oxy: oxyServices,
-      store: authStore,
-      platform: {
-        isWeb: isWebBrowser(),
-        isNative: !isWebBrowser()
-      },
-      sessionMode,
-      identity,
-      // The device-wide shared credential slot, enabling the `shared-device-adopt`
-      // lane: a newly installed official app joins this device's existing session
-      // instead of falling back to signing a challenge with the Commons identity
-      // key. `null` on web, where each origin is its own device by design; the
-      // core lane is also skipped outright in `sessionMode: 'identity'`.
-      sharedDeviceCredential: createPlatformSharedDeviceCredentialStore() ?? undefined,
-      overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
-      isOffline: () => offline,
-      onStepDeadline: stepId => {
-        loggerUtil.warn(`Cold-boot step "${stepId}" exceeded the ${COLD_BOOT_OVERALL_DEADLINE_MS}ms overall deadline — abandoned; routing proceeds signed-out`, {
-          component: 'runProviderColdBoot',
-          method: 'onStepDeadline'
-        });
-      },
-      onSession: async session => {
-        // Mint already persisted `{deviceId, deviceSecret}` to the store; sync the
-        // in-memory SessionClient host so sockets + tab-focus re-mint can use it.
-        await syncDeviceCredentialToHost();
-        const handoff = commitSession({
-          sessionId: session.sessionId,
-          accessToken: session.accessToken,
-          userId: session.userId
-        }, {
-          activate: false
-        });
-        let handoffDeadlineId;
-        await Promise.race([handoff, new Promise(resolve => {
-          handoffDeadlineId = setTimeout(resolve, SESSION_HANDOFF_DEADLINE_MS);
-        })]).finally(() => {
-          if (handoffDeadlineId !== undefined) {
-            clearTimeout(handoffDeadlineId);
-          }
-        });
-        markAuthResolved();
-      },
-      onSignedOut: async () => {
-        await syncDeviceCredentialToHost();
-        const cred = await loadPersistedDeviceCredential(authStore);
-        if (cred) {
-          try {
-            await sessionClient.start();
-          } catch (socketError) {
-            if (__DEV__) {
-              loggerUtil.debug('Device socket start failed (non-fatal)', {
-                component: 'runProviderColdBoot'
-              }, socketError);
-            }
-          }
-        }
-        markAuthResolved();
-      },
-      onStepError: (id, error) => {
-        if (__DEV__) {
-          loggerUtil.debug(`Cold-boot step "${id}" errored (non-fatal, falling through)`, {
-            component: 'runProviderColdBoot'
-          }, error);
-        }
-      }
-    });
-  } catch (error) {
-    if (__DEV__) {
-      loggerUtil.error('Cold boot error', error instanceof Error ? error : new Error(String(error)), {
-        component: 'runProviderColdBoot'
-      });
-    }
-  } finally {
-    markAuthResolved();
-  }
-}
-//# sourceMappingURL=runProviderColdBoot.js.map

package/lib/module/ui/boot/runProviderColdBoot.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["logger","loggerUtil","runSessionColdBoot","loadPersistedDeviceCredential","createPlatformSharedDeviceCredentialStore","tryCompleteOAuthReturn","isWebBrowser","isNetConnectivityExplicitlyOffline","SESSION_HANDOFF_DEADLINE_MS","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","online","globalThis","navigator","onLine","NetInfo","state","Promise","race","default","fetch","resolve","setTimeout","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","oauthCompleted","input","activate","offline","oxy","store","platform","isWeb","isNative","sharedDeviceCredential","undefined","overallDeadlineMs","isOffline","onStepDeadline","stepId","warn","component","method","onSession","session","handoff","sessionId","accessToken","userId","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","start","socketError","__DEV__","debug","onStepError","id","error","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;AAAA,SACEA,MAAM,IAAIC,UAAU,EACpBC,kBAAkB,QAKb,aAAa;AAEpB,SAASC,6BAA6B,QAAQ,8BAA2B;AACzE,SAASC,yCAAyC,QAAQ,2CAAwC;AAClG,SAASC,sBAAsB,QAAQ,yBAAsB;AAC7D,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,kCAAkC,QAAQ,6BAA0B;AAG7E;AACA,OAAO,MAAMC,2BAA2B,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,6BAA6B,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAIL,YAAY,CAAC,CAAC,EAAE;MAClB,MAAMM,MAAM,GAAIC,UAAU,CAA0CC,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOH,MAAM,KAAK,KAAK;IACzB;IACA,MAAMI,OAAO,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC;IAC/D,MAAMC,KAAK,GAAG,MAAMC,OAAO,CAACC,IAAI,CAAC,CAC/BH,OAAO,CAACI,OAAO,CAACC,KAAK,CAAC,CAAC,EACvB,IAAIH,OAAO,CAAQI,OAAO,IAAK;MAC7BC,UAAU,CAAC,MAAMD,OAAO,CAAC,IAAI,CAAC,EAAEZ,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAOH,kCAAkC,CAACU,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAwBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeO,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAGD,aAAa,GAChC,KAAK,GACL,MAAMhC,sBAAsB,CAAC;MAC3BqB,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGK,KAAK,IAAKL,aAAa,CAACK,KAAK,EAAE;QAAEC,QAAQ,EAAE;MAAK,CAAC;IACnE,CAAC,CAAC;IACN,IAAIF,cAAc,EAAE;MAClBF,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;;IAEA;IACA;IACA;IACA;IACA,MAAMM,OAAO,GAAG,MAAM9B,iBAAiB,CAAC,CAAC;IAEzC,MAAMT,kBAAkB,CAAC;MACvBwC,GAAG,EAAEhB,WAAW;MAChBiB,KAAK,EAAEhB,SAAS;MAChBiB,QAAQ,EAAE;QAAEC,KAAK,EAAEvC,YAAY,CAAC,CAAC;QAAEwC,QAAQ,EAAE,CAACxC,YAAY,CAAC;MAAE,CAAC;MAC9DwB,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACAgB,sBAAsB,EAAE3C,yCAAyC,CAAC,CAAC,IAAI4C,SAAS;MAChFC,iBAAiB,EAAExC,6BAA6B;MAChDyC,SAAS,EAAEA,CAAA,KAAMT,OAAO;MACxBU,cAAc,EAAGC,MAAM,IAAK;QAC1BnD,UAAU,CAACoD,IAAI,CACb,mBAAmBD,MAAM,kBAAkB3C,6BAA6B,8DAA8D,EACtI;UAAE6C,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAMxB,0BAA0B,CAAC,CAAC;QAClC,MAAMyB,OAAO,GAAGxB,aAAa,CAC3B;UACEyB,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5BC,WAAW,EAAEH,OAAO,CAACG,WAAW;UAChCC,MAAM,EAAEJ,OAAO,CAACI;QAClB,CAAC,EACD;UAAErB,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIsB,iBAA4D;QAChE,MAAM5C,OAAO,CAACC,IAAI,CAAC,CACjBuC,OAAO,EACP,IAAIxC,OAAO,CAAQI,OAAO,IAAK;UAC7BwC,iBAAiB,GAAGvC,UAAU,CAACD,OAAO,EAAEd,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAACuD,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAKd,SAAS,EAAE;YACnCgB,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACF3B,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACD8B,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAMhC,0BAA0B,CAAC,CAAC;QAClC,MAAMiC,IAAI,GAAG,MAAM/D,6BAA6B,CAACwB,SAAS,CAAC;QAC3D,IAAIuC,IAAI,EAAE;UACR,IAAI;YACF,MAAMlC,aAAa,CAACmC,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACXpE,UAAU,CAACqE,KAAK,CACd,wCAAwC,EACxC;gBAAEhB,SAAS,EAAE;cAAsB,CAAC,EACpCc,WACF,CAAC;YACH;UACF;QACF;QACAjC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDoC,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACXpE,UAAU,CAACqE,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAElB,SAAS,EAAE;UAAsB,CAAC,EACpCmB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;EACJ,CAAC,CAAC,OAAOA,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXpE,UAAU,CAACwE,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,EACzD;QAAEnB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACRnB,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}