@oxyhq/services 30.0.0 → 30.0.1

package/lib/commonjs/ui/boot/runProviderColdBoot.js

@@ -0,0 +1,205 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.SESSION_HANDOFF_DEADLINE_MS = exports.COLD_BOOT_OVERALL_DEADLINE_MS = void 0;
+exports.runProviderColdBoot = runProviderColdBoot;
+var _core = require("@oxyhq/core");
+var _deviceCredential = require("../utils/deviceCredential.js");
+var _sharedDeviceCredentialStore = require("../session/sharedDeviceCredentialStore.js");
+var _oauthReturn = require("../utils/oauthReturn.js");
+var _isWebBrowser = require("../utils/isWebBrowser.js");
+var _netConnectivity = require("../utils/netConnectivity.js");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
+const SESSION_HANDOFF_DEADLINE_MS = exports.SESSION_HANDOFF_DEADLINE_MS = 6000;
+
+/**
+ * HARD overall deadline (ms) for the whole `runSessionColdBoot` step chain.
+ *
+ * Bounds time-to-route: routing gates on `isAuthResolved`, which resolves when
+ * the cold boot finishes, so a network step that never settles (a black-hole
+ * network that neither connects nor rejects) would otherwise hang routing
+ * indefinitely. 12s comfortably exceeds the healthy worst case of the
+ * sequential, single-attempt (`retry:false`), 5s-capped network steps, so it is
+ * INERT on healthy loads and only trips on a pathological network. Offline
+ * devices short-circuit far sooner via the connectivity hint below.
+ */
+const COLD_BOOT_OVERALL_DEADLINE_MS = exports.COLD_BOOT_OVERALL_DEADLINE_MS = 12_000;
+
+/**
+ * Timeout (ms) for the best-effort native connectivity probe. Kept tight so the
+ * probe never itself adds meaningful latency to a healthy boot — an unknown
+ * result within this window is treated as "online".
+ */
+const OFFLINE_PROBE_TIMEOUT_MS = 500;
+
+/**
+ * Best-effort, FAST connectivity probe run once before the cold boot.
+ *
+ * Returns `true` ONLY on an EXPLICIT disconnected verdict; every ambiguous
+ * outcome (probe timeout, unknown/`null` state, NetInfo unavailable, a thrown
+ * error) resolves to `false` (assume online) so a flaky probe can never falsely
+ * skip a real sign-in. Never rejects. On web it reads `navigator.onLine`; on
+ * native it races `NetInfo.fetch()` against {@link OFFLINE_PROBE_TIMEOUT_MS},
+ * mirroring the existing NetInfo dynamic-import pattern in `OxyProvider`.
+ */
+async function detectOfflineHint() {
+  try {
+    if ((0, _isWebBrowser.isWebBrowser)()) {
+      const online = globalThis.navigator?.onLine;
+      // Only an explicit `false` is an offline verdict; `undefined` ⇒ assume online.
+      return online === false;
+    }
+    const NetInfo = await Promise.resolve().then(() => _interopRequireWildcard(require('@react-native-community/netinfo')));
+    const state = await Promise.race([NetInfo.default.fetch(), new Promise(resolve => {
+      setTimeout(() => resolve(null), OFFLINE_PROBE_TIMEOUT_MS);
+    })]);
+    // `null` ⇒ the probe timed out (unknown → assume online). Only an explicit
+    // disconnected / unreachable verdict disables the network steps.
+    return (0, _netConnectivity.isNetConnectivityExplicitlyOffline)(state);
+  } catch {
+    // NetInfo missing / probe threw — never block sign-in on a probe failure.
+    return false;
+  }
+}
+/**
+ * Device-first cold boot for `@oxyhq/services` providers.
+ *
+ * Ordered pipeline:
+ * 1. Complete an OAuth authorization-code return already on the URL (web)
+ * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
+ *    primary-identity-key lane in `sessionMode: 'identity'`)
+ *
+ * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
+ * which for an identity-bound client is somebody else's account by construction.
+ * In `'identity'` mode the boot is exactly step 2.
+ *
+ * The boot NEVER navigates the top-level window. There is no automatic
+ * `prompt=none` bounce to the IdP: a web origin with no local device credential
+ * resolves SIGNED OUT and waits for the user's next explicit "Continue with
+ * Oxy", which opens a popup from a real gesture (#691 phase 7b). Step 1 is not a
+ * navigation — it only consumes a code that is already in the address bar.
+ */
+async function runProviderColdBoot(opts) {
+  const {
+    oxyServices,
+    authStore,
+    clientId,
+    authRedirectUri,
+    sessionMode = 'account',
+    identity,
+    sessionClient,
+    syncDeviceCredentialToHost,
+    commitSession,
+    markAuthResolved,
+    setTokenReady
+  } = opts;
+  const identityBound = sessionMode === 'identity';
+  setTokenReady(false);
+  try {
+    // The redirect transport's RETURN leg. An app reaches it whenever the browser
+    // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
+    // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
+    // load-bearing even though nothing here ever starts a redirect. It consumes a
+    // code (or a stale OAuth `error`) already in the address bar and rewrites the
+    // URL via `history.replaceState`; it never begins a navigation.
+    const oauthCompleted = identityBound ? false : await (0, _oauthReturn.tryCompleteOAuthReturn)({
+      oxyServices,
+      clientId,
+      authRedirectUri,
+      commitSession: input => commitSession(input, {
+        activate: true
+      })
+    });
+    if (oauthCompleted) {
+      setTokenReady(true);
+      markAuthResolved();
+      return;
+    }
+
+    // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
+    // the two doomed network steps so routing settles immediately instead of
+    // burning the overall deadline on a mint that cannot succeed. Any ambiguity
+    // resolves to "online" — the network steps still run.
+    const offline = await detectOfflineHint();
+    await (0, _core.runSessionColdBoot)({
+      oxy: oxyServices,
+      store: authStore,
+      platform: {
+        isWeb: (0, _isWebBrowser.isWebBrowser)(),
+        isNative: !(0, _isWebBrowser.isWebBrowser)()
+      },
+      sessionMode,
+      identity,
+      // The device-wide shared credential slot, enabling the `shared-device-adopt`
+      // lane: a newly installed official app joins this device's existing session
+      // instead of falling back to signing a challenge with the Commons identity
+      // key. `null` on web, where each origin is its own device by design; the
+      // core lane is also skipped outright in `sessionMode: 'identity'`.
+      sharedDeviceCredential: (0, _sharedDeviceCredentialStore.createPlatformSharedDeviceCredentialStore)() ?? undefined,
+      overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
+      isOffline: () => offline,
+      onStepDeadline: stepId => {
+        _core.logger.warn(`Cold-boot step "${stepId}" exceeded the ${COLD_BOOT_OVERALL_DEADLINE_MS}ms overall deadline — abandoned; routing proceeds signed-out`, {
+          component: 'runProviderColdBoot',
+          method: 'onStepDeadline'
+        });
+      },
+      onSession: async session => {
+        // Mint already persisted `{deviceId, deviceSecret}` to the store; sync the
+        // in-memory SessionClient host so sockets + tab-focus re-mint can use it.
+        await syncDeviceCredentialToHost();
+        const handoff = commitSession({
+          sessionId: session.sessionId,
+          accessToken: session.accessToken,
+          userId: session.userId
+        }, {
+          activate: false
+        });
+        let handoffDeadlineId;
+        await Promise.race([handoff, new Promise(resolve => {
+          handoffDeadlineId = setTimeout(resolve, SESSION_HANDOFF_DEADLINE_MS);
+        })]).finally(() => {
+          if (handoffDeadlineId !== undefined) {
+            clearTimeout(handoffDeadlineId);
+          }
+        });
+        markAuthResolved();
+      },
+      onSignedOut: async () => {
+        await syncDeviceCredentialToHost();
+        const cred = await (0, _deviceCredential.loadPersistedDeviceCredential)(authStore);
+        if (cred) {
+          try {
+            await sessionClient.start();
+          } catch (socketError) {
+            if (__DEV__) {
+              _core.logger.debug('Device socket start failed (non-fatal)', {
+                component: 'runProviderColdBoot'
+              }, socketError);
+            }
+          }
+        }
+        markAuthResolved();
+      },
+      onStepError: (id, error) => {
+        if (__DEV__) {
+          _core.logger.debug(`Cold-boot step "${id}" errored (non-fatal, falling through)`, {
+            component: 'runProviderColdBoot'
+          }, error);
+        }
+      }
+    });
+  } catch (error) {
+    if (__DEV__) {
+      _core.logger.error('Cold boot error', error instanceof Error ? error : new Error(String(error)), {
+        component: 'runProviderColdBoot'
+      });
+    }
+  } finally {
+    markAuthResolved();
+  }
+}
+//# sourceMappingURL=runProviderColdBoot.js.map

package/lib/commonjs/ui/boot/runProviderColdBoot.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","_deviceCredential","_sharedDeviceCredentialStore","_oauthReturn","_isWebBrowser","_netConnectivity","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","SESSION_HANDOFF_DEADLINE_MS","exports","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","isWebBrowser","online","globalThis","navigator","onLine","NetInfo","Promise","resolve","then","state","race","fetch","setTimeout","isNetConnectivityExplicitlyOffline","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","oauthCompleted","tryCompleteOAuthReturn","input","activate","offline","runSessionColdBoot","oxy","store","platform","isWeb","isNative","sharedDeviceCredential","createPlatformSharedDeviceCredentialStore","undefined","overallDeadlineMs","isOffline","onStepDeadline","stepId","loggerUtil","warn","component","method","onSession","session","handoff","sessionId","accessToken","userId","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","loadPersistedDeviceCredential","start","socketError","__DEV__","debug","onStepError","id","error","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AASA,IAAAC,iBAAA,GAAAD,OAAA;AACA,IAAAE,4BAAA,GAAAF,OAAA;AACA,IAAAG,YAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AACA,IAAAK,gBAAA,GAAAL,OAAA;AAA8E,SAAAM,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA;AAG9E;AACO,MAAMkB,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,6BAA6B,GAAAD,OAAA,CAAAC,6BAAA,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAI,IAAAC,0BAAY,EAAC,CAAC,EAAE;MAClB,MAAMC,MAAM,GAAIC,UAAU,CAA0CC,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOH,MAAM,KAAK,KAAK;IACzB;IACA,MAAMI,OAAO,GAAG,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAAjC,uBAAA,CAAAN,OAAA,CAAa,iCAAiC,GAAC;IAC/D,MAAMwC,KAAK,GAAG,MAAMH,OAAO,CAACI,IAAI,CAAC,CAC/BL,OAAO,CAACnB,OAAO,CAACyB,KAAK,CAAC,CAAC,EACvB,IAAIL,OAAO,CAAQC,OAAO,IAAK;MAC7BK,UAAU,CAAC,MAAML,OAAO,CAAC,IAAI,CAAC,EAAET,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAO,IAAAe,mDAAkC,EAACJ,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAwBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeK,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAGD,aAAa,GAChC,KAAK,GACL,MAAM,IAAAE,mCAAsB,EAAC;MAC3Bb,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGM,KAAK,IAAKN,aAAa,CAACM,KAAK,EAAE;QAAEC,QAAQ,EAAE;MAAK,CAAC;IACnE,CAAC,CAAC;IACN,IAAIH,cAAc,EAAE;MAClBF,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;;IAEA;IACA;IACA;IACA;IACA,MAAMO,OAAO,GAAG,MAAMjC,iBAAiB,CAAC,CAAC;IAEzC,MAAM,IAAAkC,wBAAkB,EAAC;MACvBC,GAAG,EAAElB,WAAW;MAChBmB,KAAK,EAAElB,SAAS;MAChBmB,QAAQ,EAAE;QAAEC,KAAK,EAAE,IAAArC,0BAAY,EAAC,CAAC;QAAEsC,QAAQ,EAAE,CAAC,IAAAtC,0BAAY,EAAC;MAAE,CAAC;MAC9DoB,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACAkB,sBAAsB,EAAE,IAAAC,sEAAyC,EAAC,CAAC,IAAIC,SAAS;MAChFC,iBAAiB,EAAE7C,6BAA6B;MAChD8C,SAAS,EAAEA,CAAA,KAAMX,OAAO;MACxBY,cAAc,EAAGC,MAAM,IAAK;QAC1BC,YAAU,CAACC,IAAI,CACb,mBAAmBF,MAAM,kBAAkBhD,6BAA6B,8DAA8D,EACtI;UAAEmD,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAM5B,0BAA0B,CAAC,CAAC;QAClC,MAAM6B,OAAO,GAAG5B,aAAa,CAC3B;UACE6B,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5BC,WAAW,EAAEH,OAAO,CAACG,WAAW;UAChCC,MAAM,EAAEJ,OAAO,CAACI;QAClB,CAAC,EACD;UAAExB,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIyB,iBAA4D;QAChE,MAAMlD,OAAO,CAACI,IAAI,CAAC,CACjB0C,OAAO,EACP,IAAI9C,OAAO,CAAQC,OAAO,IAAK;UAC7BiD,iBAAiB,GAAG5C,UAAU,CAACL,OAAO,EAAEZ,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAAC8D,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAKf,SAAS,EAAE;YACnCiB,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACF/B,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDkC,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAMpC,0BAA0B,CAAC,CAAC;QAClC,MAAMqC,IAAI,GAAG,MAAM,IAAAC,+CAA6B,EAAC5C,SAAS,CAAC;QAC3D,IAAI2C,IAAI,EAAE;UACR,IAAI;YACF,MAAMtC,aAAa,CAACwC,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACXlB,YAAU,CAACmB,KAAK,CACd,wCAAwC,EACxC;gBAAEjB,SAAS,EAAE;cAAsB,CAAC,EACpCe,WACF,CAAC;YACH;UACF;QACF;QACAtC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDyC,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACXlB,YAAU,CAACmB,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAEnB,SAAS,EAAE;UAAsB,CAAC,EACpCoB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;EACJ,CAAC,CAAC,OAAOA,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXlB,YAAU,CAACsB,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,EACzD;QAAEpB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACRvB,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}

package/lib/commonjs/ui/client.js

@@ -0,0 +1,142 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "FollowButton", {
+  enumerable: true,
+  get: function () {
+    return _FollowButton.default;
+  }
+});
+Object.defineProperty(exports, "LogoIcon", {
+  enumerable: true,
+  get: function () {
+    return _LogoIcon.LogoIcon;
+  }
+});
+Object.defineProperty(exports, "LogoText", {
+  enumerable: true,
+  get: function () {
+    return _LogoText.LogoText;
+  }
+});
+Object.defineProperty(exports, "ManageAccountScreen", {
+  enumerable: true,
+  get: function () {
+    return _ManageAccountScreen.default;
+  }
+});
+Object.defineProperty(exports, "OxyAuthPrompt", {
+  enumerable: true,
+  get: function () {
+    return _OxyAuthPrompt.default;
+  }
+});
+Object.defineProperty(exports, "OxyPayButton", {
+  enumerable: true,
+  get: function () {
+    return _OxyPayButton.default;
+  }
+});
+Object.defineProperty(exports, "OxyProvider", {
+  enumerable: true,
+  get: function () {
+    return _OxyProvider.default;
+  }
+});
+Object.defineProperty(exports, "OxyProviderMissingError", {
+  enumerable: true,
+  get: function () {
+    return _OxyContext.OxyProviderMissingError;
+  }
+});
+Object.defineProperty(exports, "OxySignInButton", {
+  enumerable: true,
+  get: function () {
+    return _OxySignInButton.default;
+  }
+});
+Object.defineProperty(exports, "ProfileScreen", {
+  enumerable: true,
+  get: function () {
+    return _ProfileScreen.default;
+  }
+});
+Object.defineProperty(exports, "extractErrorMessage", {
+  enumerable: true,
+  get: function () {
+    return _errorHandlers.extractErrorMessage;
+  }
+});
+Object.defineProperty(exports, "handleAuthError", {
+  enumerable: true,
+  get: function () {
+    return _errorHandlers.handleAuthError;
+  }
+});
+Object.defineProperty(exports, "isInvalidSessionError", {
+  enumerable: true,
+  get: function () {
+    return _errorHandlers.isInvalidSessionError;
+  }
+});
+Object.defineProperty(exports, "isTimeoutOrNetworkError", {
+  enumerable: true,
+  get: function () {
+    return _errorHandlers.isTimeoutOrNetworkError;
+  }
+});
+Object.defineProperty(exports, "useAuth", {
+  enumerable: true,
+  get: function () {
+    return _useAuth.useAuth;
+  }
+});
+Object.defineProperty(exports, "useAuthStore", {
+  enumerable: true,
+  get: function () {
+    return _authStore.useAuthStore;
+  }
+});
+Object.defineProperty(exports, "useFollow", {
+  enumerable: true,
+  get: function () {
+    return _useFollow.useFollow;
+  }
+});
+Object.defineProperty(exports, "useOptionalOxy", {
+  enumerable: true,
+  get: function () {
+    return _OxyContext.useOptionalOxy;
+  }
+});
+Object.defineProperty(exports, "useOxy", {
+  enumerable: true,
+  get: function () {
+    return _OxyContext.useOxy;
+  }
+});
+Object.defineProperty(exports, "useStorage", {
+  enumerable: true,
+  get: function () {
+    return _useStorage.useStorage;
+  }
+});
+var _OxyProvider = _interopRequireDefault(require("./components/OxyProvider.js"));
+var _OxySignInButton = _interopRequireDefault(require("./components/OxySignInButton.js"));
+var _OxyAuthPrompt = _interopRequireDefault(require("./components/OxyAuthPrompt.js"));
+var _LogoIcon = require("./components/logo/LogoIcon.js");
+var _LogoText = require("./components/logo/LogoText.js");
+var _FollowButton = _interopRequireDefault(require("./components/FollowButton.js"));
+var _OxyPayButton = _interopRequireDefault(require("./components/OxyPayButton.js"));
+var _OxyContext = require("./context/OxyContext.js");
+var _useAuth = require("./hooks/useAuth.js");
+var _useFollow = require("./hooks/useFollow.js");
+var _useStorage = require("./hooks/useStorage.js");
+var _ProfileScreen = _interopRequireDefault(require("./screens/ProfileScreen.js"));
+var _ManageAccountScreen = _interopRequireDefault(require("./screens/ManageAccountScreen.js"));
+var _authStore = require("./stores/authStore.js");
+var _errorHandlers = require("./utils/errorHandlers.js");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+//# sourceMappingURL=client.js.map

package/lib/commonjs/ui/client.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_OxyProvider","_interopRequireDefault","require","_OxySignInButton","_OxyAuthPrompt","_LogoIcon","_LogoText","_FollowButton","_OxyPayButton","_OxyContext","_useAuth","_useFollow","_useStorage","_ProfileScreen","_ManageAccountScreen","_authStore","_errorHandlers","e","__esModule","default"],"sourceRoot":"../../../src","sources":["ui/client.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,IAAAA,YAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,cAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,SAAA,GAAAH,OAAA;AACA,IAAAI,SAAA,GAAAJ,OAAA;AACA,IAAAK,aAAA,GAAAN,sBAAA,CAAAC,OAAA;AACA,IAAAM,aAAA,GAAAP,sBAAA,CAAAC,OAAA;AAGA,IAAAO,WAAA,GAAAP,OAAA;AAGA,IAAAQ,QAAA,GAAAR,OAAA;AAEA,IAAAS,UAAA,GAAAT,OAAA;AACA,IAAAU,WAAA,GAAAV,OAAA;AAIA,IAAAW,cAAA,GAAAZ,sBAAA,CAAAC,OAAA;AACA,IAAAY,oBAAA,GAAAb,sBAAA,CAAAC,OAAA;AAGA,IAAAa,UAAA,GAAAb,OAAA;AAGA,IAAAc,cAAA,GAAAd,OAAA;AAK+B,SAAAD,uBAAAgB,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA","ignoreList":[]}

package/lib/commonjs/ui/components/AvatarCameraBadge.js

@@ -0,0 +1,43 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _components = require("react-native-css/components");
+var _Ionicons = _interopRequireDefault(require("@expo/vector-icons/Ionicons"));
+var _theme = require("@oxyhq/bloom/theme");
+var _jsxRuntime = require("react/jsx-runtime");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+/**
+ * The camera overlay badge on a pressable avatar — the "tap to change your
+ * photo" affordance. Shared verbatim by {@link ProfileSummaryCard} (ManageAccount
+ * / EditProfile) and the account-menu hero avatar (`AccountsView`), so the badge
+ * reads identically everywhere. Renders as an absolutely-positioned bottom-right
+ * overlay; the caller wraps it (with the avatar) in a `position: relative`
+ * pressable.
+ */const badgeStyle = {
+  position: 'absolute',
+  right: 0,
+  bottom: 0,
+  width: 28,
+  height: 28,
+  borderRadius: 14,
+  alignItems: 'center',
+  justifyContent: 'center',
+  borderWidth: 2
+};
+const AvatarCameraBadge = () => {
+  const theme = (0, _theme.useTheme)();
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(_components.View, {
+    style: badgeStyle,
+    className: "bg-fill-brand border-border-image",
+    children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_Ionicons.default, {
+      name: "camera",
+      size: 14,
+      color: theme.colors.primaryForeground
+    })
+  });
+};
+var _default = exports.default = AvatarCameraBadge;
+//# sourceMappingURL=AvatarCameraBadge.js.map

package/lib/commonjs/ui/components/AvatarCameraBadge.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_components","require","_Ionicons","_interopRequireDefault","_theme","_jsxRuntime","e","__esModule","default","badgeStyle","position","right","bottom","width","height","borderRadius","alignItems","justifyContent","borderWidth","AvatarCameraBadge","theme","useTheme","jsx","View","style","className","children","name","size","color","colors","primaryForeground","_default","exports"],"sourceRoot":"../../../../src","sources":["ui/components/AvatarCameraBadge.tsx"],"mappings":";;;;;;AAEA,IAAAA,WAAA,GAAAC,OAAA;AACA,IAAAC,SAAA,GAAAC,sBAAA,CAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAA8C,IAAAI,WAAA,GAAAJ,OAAA;AAAA,SAAAE,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAE9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,GACA,MAAMG,UAAqB,GAAG;EAC5BC,QAAQ,EAAE,UAAU;EACpBC,KAAK,EAAE,CAAC;EACRC,MAAM,EAAE,CAAC;EACTC,KAAK,EAAE,EAAE;EACTC,MAAM,EAAE,EAAE;EACVC,YAAY,EAAE,EAAE;EAChBC,UAAU,EAAE,QAAQ;EACpBC,cAAc,EAAE,QAAQ;EACxBC,WAAW,EAAE;AACf,CAAC;AAED,MAAMC,iBAA2B,GAAGA,CAAA,KAAM;EACxC,MAAMC,KAAK,GAAG,IAAAC,eAAQ,EAAC,CAAC;EACxB,oBACE,IAAAhB,WAAA,CAAAiB,GAAA,EAACtB,WAAA,CAAAuB,IAAI;IAACC,KAAK,EAAEf,UAAW;IAACgB,SAAS,EAAC,mCAAmC;IAAAC,QAAA,eACpE,IAAArB,WAAA,CAAAiB,GAAA,EAACpB,SAAA,CAAAM,OAAQ;MAACmB,IAAI,EAAC,QAAQ;MAACC,IAAI,EAAE,EAAG;MAACC,KAAK,EAAET,KAAK,CAACU,MAAM,CAACC;IAAkB,CAAE;EAAC,CACvE,CAAC;AAEX,CAAC;AAAC,IAAAC,QAAA,GAAAC,OAAA,CAAAzB,OAAA,GAEaW,iBAAiB","ignoreList":[]}

package/lib/commonjs/ui/components/FollowButton.js

@@ -0,0 +1,255 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = exports.FollowButton = void 0;
+var _react = require("react");
+var _reactNative = require("react-native");
+var _OxyContext = require("../context/OxyContext.js");
+var _toast = require("@oxyhq/bloom/toast");
+var _button = require("@oxyhq/bloom/button");
+var _useFollow = require("../hooks/useFollow.js");
+var _followStore = require("../stores/followStore.js");
+var _theme = require("@oxyhq/bloom/theme");
+var _shallow = require("zustand/react/shallow");
+var _jsxRuntime = require("react/jsx-runtime");
+const DEFAULT_FOLLOW_ALL_LABEL = 'Follow all';
+const DEFAULT_FOLLOWED_ALL_LABEL = 'Following';
+
+/** Props shared by both single- and multi-user follow modes. */
+
+/** Single-user mode — follows/unfollows one user (existing behavior). */
+
+/** Multi-user mode — follows MANY users in one "Follow all" action (follow-only). */
+
+/**
+ * FollowButton accepts EITHER single-user mode (`userId`) or multi-user mode
+ * (`userIds`), never both. Existing `{ userId, ... }` callers remain valid.
+ */
+
+const isMultiMode = props => 'userIds' in props && Array.isArray(props.userIds);
+const FollowButtonInner = /*#__PURE__*/(0, _react.memo)(function FollowButtonInner({
+  userId,
+  oxyServices,
+  initiallyFollowing,
+  size = 'medium',
+  onFollowChange,
+  style,
+  textStyle,
+  disabled = false,
+  showLoadingState = true,
+  preventParentActions = true
+}) {
+  const {
+    colors
+  } = (0, _theme.useTheme)();
+  const {
+    isFollowing,
+    isKnown,
+    isLoading,
+    toggleFollow,
+    resolveStatus
+  } = (0, _useFollow.useFollowForButton)(userId, oxyServices, initiallyFollowing);
+  const handlePress = (0, _react.useCallback)(async event => {
+    if (preventParentActions && event?.preventDefault) {
+      event.preventDefault();
+      event.stopPropagation?.();
+    }
+    // Ignore presses while a mutation is in flight or the status is still unknown.
+    if (disabled || isLoading || !isKnown) return;
+    try {
+      const accepted = await toggleFollow();
+      if (accepted) onFollowChange?.(!isFollowing);
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      _toast.toast.error(error.message || 'Failed to update follow status');
+    }
+  }, [disabled, isLoading, isKnown, toggleFollow, onFollowChange, isFollowing, preventParentActions]);
+
+  // Enqueue a batched status fetch ONLY when the status is genuinely unknown
+  // (not seeded from `initiallyFollowing`, not already resolved). All buttons
+  // that enqueue in the same commit coalesce into a single bulk request; known/
+  // seeded ids never fetch. Once resolved, `isKnown` flips true and this no-ops.
+  (0, _react.useEffect)(() => {
+    if (!isKnown) resolveStatus();
+  }, [isKnown, resolveStatus]);
+
+  // While the status is genuinely unknown (being resolved), present a NEUTRAL,
+  // non-interactive state rather than a definitive "Follow".
+  const isBusy = isLoading || !isKnown;
+  const showFollowing = isKnown && isFollowing;
+  const showSpinner = showLoadingState && isBusy;
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
+    variant: showFollowing ? 'secondary' : 'primary',
+    size: size,
+    onPress: () => {
+      void handlePress();
+    },
+    disabled: disabled || isBusy,
+    style: style,
+    textStyle: textStyle,
+    icon: showSpinner ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+      size: "small",
+      color: showFollowing ? colors.text : colors.primaryForeground
+    }) : undefined,
+    children: showSpinner ? undefined : isKnown ? isFollowing ? 'Following' : 'Follow' : undefined
+  });
+});
+const FollowButtonMultiInner = /*#__PURE__*/(0, _react.memo)(function FollowButtonMultiInner({
+  userIds,
+  initiallyAllFollowing = false,
+  size = 'medium',
+  followAllLabel = DEFAULT_FOLLOW_ALL_LABEL,
+  followedAllLabel = DEFAULT_FOLLOWED_ALL_LABEL,
+  onFollowChange,
+  onBulkFollow,
+  onBulkUnfollow,
+  style,
+  textStyle,
+  disabled = false,
+  showLoadingState = true,
+  preventParentActions = true
+}) {
+  const {
+    colors
+  } = (0, _theme.useTheme)();
+  const follow = (0, _useFollow.useFollow)(userIds);
+  const followAllUsers = 'followAllUsers' in follow ? follow.followAllUsers : undefined;
+  const unfollowAllUsers = 'unfollowAllUsers' in follow ? follow.unfollowAllUsers : undefined;
+  const isAnyLoading = 'isAnyLoading' in follow ? follow.isAnyLoading : false;
+  const initialFollowStatuses = (0, _followStore.useFollowStore)((0, _shallow.useShallow)(state => {
+    const statuses = {};
+    for (const uid of userIds) {
+      statuses[uid] = Object.prototype.hasOwnProperty.call(state.followingUsers, uid) ? state.followingUsers[uid] : null;
+    }
+    return statuses;
+  }));
+  const hasKnownNotFollowing = userIds.some(uid => initialFollowStatuses[uid] === false);
+
+  // `allFollowing` is store-derived (LIVE aggregate of each target's follow
+  // status) — it reacts in real time as individual members are followed or
+  // unfollowed elsewhere. `initiallyAllFollowing` preserves the public initial
+  // state contract until the store learns that any member is not followed. Only
+  // `isSubmitting` is transient local state for the in-flight bulk call.
+  const storeAllFollowing = 'allFollowing' in follow ? follow.allFollowing : false;
+  const allFollowing = storeAllFollowing || initiallyAllFollowing && !hasKnownNotFollowing;
+  const fetchAllStatuses = 'fetchAllStatuses' in follow ? follow.fetchAllStatuses : undefined;
+  const [isSubmitting, setIsSubmitting] = (0, _react.useState)(false);
+  const isLoading = isSubmitting || isAnyLoading;
+
+  // Populate the store with each member's follow status on mount and whenever
+  // the target set changes. `fetchAllStatuses` is recreated when `userIds`
+  // changes inside `useFollow`, so it is the sole effect dependency — no need
+  // for a joined-string key. `allFollowing`/loading are intentionally NOT in
+  // the deps.
+  (0, _react.useEffect)(() => {
+    fetchAllStatuses?.();
+  }, [fetchAllStatuses]);
+  const handlePress = (0, _react.useCallback)(async event => {
+    if (preventParentActions && event?.preventDefault) {
+      event.preventDefault();
+      event.stopPropagation?.();
+    }
+    if (disabled || isLoading) return;
+    if (allFollowing) {
+      if (!unfollowAllUsers) return;
+      setIsSubmitting(true);
+      try {
+        const result = await unfollowAllUsers();
+        // `unfollowManyUsers` flips each user to not-following in the store, so
+        // `allFollowing` becomes false reactively — no local flag.
+        onFollowChange?.(false);
+        onBulkUnfollow?.(result);
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        _toast.toast.error(error.message || 'Failed to update follow status');
+      } finally {
+        setIsSubmitting(false);
+      }
+      return;
+    }
+    if (!followAllUsers) return;
+    setIsSubmitting(true);
+    try {
+      const result = await followAllUsers();
+      const allAlreadyFollowing = result.followedCount === 0 && result.results.length > 0 && result.results.every(entry => entry.alreadyFollowing);
+      const anyFollowed = result.followedCount > 0 || result.results.some(entry => entry.success || entry.alreadyFollowing);
+
+      // `followManyUsers` marks each user followed in the store, so `allFollowing`
+      // flips to true reactively — no local flag to set here.
+      if (allAlreadyFollowing || anyFollowed) {
+        onFollowChange?.(true);
+      }
+      onBulkFollow?.(result);
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
+      _toast.toast.error(error.message || 'Failed to update follow status');
+    } finally {
+      setIsSubmitting(false);
+    }
+  }, [disabled, isLoading, allFollowing, followAllUsers, unfollowAllUsers, onFollowChange, onBulkFollow, onBulkUnfollow, preventParentActions]);
+  const showSpinner = showLoadingState && isLoading;
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
+    variant: allFollowing ? 'secondary' : 'primary',
+    size: size,
+    onPress: () => {
+      void handlePress();
+    },
+    disabled: disabled || isLoading,
+    style: style,
+    textStyle: textStyle,
+    icon: showSpinner ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+      size: "small",
+      color: allFollowing ? colors.text : colors.primaryForeground
+    }) : undefined,
+    children: showSpinner ? undefined : allFollowing ? followedAllLabel : followAllLabel
+  });
+});
+const FollowButton = props => {
+  const {
+    oxyServices,
+    canUsePrivateApi,
+    user: currentUser
+  } = (0, _OxyContext.useOxy)();
+  const currentUserId = currentUser?.id ? String(currentUser.id).trim() : '';
+  const rawUserIds = isMultiMode(props) ? props.userIds : null;
+
+  // Multi-user mode: dedupe, trim, drop the current user, and bail if empty.
+  const multiUserIds = (0, _react.useMemo)(() => {
+    if (!rawUserIds) return [];
+    const seen = new Set();
+    const cleaned = [];
+    for (const raw of rawUserIds) {
+      const id = raw ? String(raw).trim() : '';
+      if (!id || id === currentUserId || seen.has(id)) continue;
+      seen.add(id);
+      cleaned.push(id);
+    }
+    return cleaned;
+  }, [rawUserIds, currentUserId]);
+  if (!canUsePrivateApi) {
+    return null;
+  }
+  if (isMultiMode(props)) {
+    if (multiUserIds.length === 0) {
+      return null;
+    }
+    return /*#__PURE__*/(0, _jsxRuntime.jsx)(FollowButtonMultiInner, {
+      ...props,
+      userIds: multiUserIds
+    });
+  }
+  const targetUserId = props.userId ? String(props.userId).trim() : '';
+  if (!targetUserId || currentUserId && currentUserId === targetUserId) {
+    return null;
+  }
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(FollowButtonInner, {
+    ...props,
+    userId: targetUserId,
+    oxyServices: oxyServices
+  });
+};
+exports.FollowButton = FollowButton;
+var _default = exports.default = FollowButton;
+//# sourceMappingURL=FollowButton.js.map