@oxyhq/services 30.0.0 → 30.1.0

package/lib/typescript/module/ui/screens/trust/TrustFAQScreen.d.ts

@@ -0,0 +1,5 @@
+import React from 'react';
+import type { BaseScreenProps } from '../../types/navigation.js';
+declare const _default: React.NamedExoticComponent<BaseScreenProps>;
+export default _default;
+//# sourceMappingURL=TrustFAQScreen.d.ts.map

package/lib/typescript/module/ui/screens/trust/TrustFAQScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustFAQScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustFAQScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAyC,MAAM,OAAO,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;;AAkG9D,wBAA0C"}

package/lib/typescript/module/ui/screens/trust/TrustLeaderboardScreen.d.ts

@@ -0,0 +1,5 @@
+import type React from 'react';
+import type { BaseScreenProps } from '../../types/navigation.js';
+declare const TrustLeaderboardScreen: React.FC<BaseScreenProps>;
+export default TrustLeaderboardScreen;
+//# sourceMappingURL=TrustLeaderboardScreen.d.ts.map

package/lib/typescript/module/ui/screens/trust/TrustLeaderboardScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustLeaderboardScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustLeaderboardScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAgB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AAY9D,QAAA,MAAM,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAuJrD,CAAC;AA0CF,eAAe,sBAAsB,CAAC"}

package/lib/typescript/module/ui/screens/trust/TrustRewardsScreen.d.ts

@@ -0,0 +1,5 @@
+import type React from 'react';
+import type { BaseScreenProps } from '../../types/navigation.js';
+declare const TrustRewardsScreen: React.FC<BaseScreenProps>;
+export default TrustRewardsScreen;
+//# sourceMappingURL=TrustRewardsScreen.d.ts.map

package/lib/typescript/module/ui/screens/trust/TrustRewardsScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustRewardsScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustRewardsScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAG/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AA0E9D,QAAA,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAmXjD,CAAC;AAkIF,eAAe,kBAAkB,CAAC"}

package/lib/typescript/module/ui/screens/trust/TrustRulesScreen.d.ts

@@ -0,0 +1,5 @@
+import type React from 'react';
+import type { BaseScreenProps } from '../../types/navigation.js';
+declare const TrustRulesScreen: React.FC<BaseScreenProps>;
+export default TrustRulesScreen;
+//# sourceMappingURL=TrustRulesScreen.d.ts.map

package/lib/typescript/module/ui/screens/trust/TrustRulesScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustRulesScreen.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/screens/trust/TrustRulesScreen.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAQ/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAAwB,CAAC;AAiB9D,QAAA,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,CAqF/C,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/lib/typescript/module/ui/server.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Server-safe UI exports (noops)
+ *
+ * Import from this module for SSR environments where React components
+ * shouldn't be rendered on the server.
+ *
+ * @example
+ * import { OxyProvider, useOxy } from '@oxyhq/services/ui/server';
+ */
+export declare const OxyProvider: () => null;
+export declare const OxySignInButton: () => null;
+export declare const LogoIcon: () => null;
+export declare const LogoText: () => null;
+export declare const FollowButton: () => null;
+export declare const OxyPayButton: () => null;
+export declare const useOxy: () => {};
+export declare const useAuth: () => {};
+export declare const useFollow: () => {};
+export declare const useStorage: () => {
+    storage: null;
+    isReady: boolean;
+};
+export declare const ProfileScreen: () => null;
+export declare const useAuthStore: () => {};
+export declare const toast: (() => void) & {
+    success: () => void;
+    error: () => void;
+    info: () => void;
+    warning: () => void;
+    loading: () => void;
+    dismiss: () => void;
+};
+export { handleAuthError, isInvalidSessionError, isTimeoutOrNetworkError, extractErrorMessage, } from './utils/errorHandlers.js';
+export type { HandleAuthErrorOptions } from './utils/errorHandlers.js';
+//# sourceMappingURL=server.d.ts.map

package/lib/typescript/module/ui/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/ui/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,eAAO,MAAM,WAAW,YAAgB,CAAC;AACzC,eAAO,MAAM,eAAe,YAAgB,CAAC;AAC7C,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,QAAQ,YAAgB,CAAC;AACtC,eAAO,MAAM,YAAY,YAAgB,CAAC;AAC1C,eAAO,MAAM,YAAY,YAAgB,CAAC;AAG1C,eAAO,MAAM,MAAM,UAAW,CAAC;AAG/B,eAAO,MAAM,OAAO,UAAW,CAAC;AAChC,eAAO,MAAM,SAAS,UAAW,CAAC;AAClC,eAAO,MAAM,UAAU;;;CAA0B,CAAC;AAGlD,eAAO,MAAM,aAAa,YAAgB,CAAC;AAG3C,eAAO,MAAM,YAAY,UAAW,CAAC;AAGrC,eAAO,MAAM,KAAK;;;;;;;CAUjB,CAAC;AAGF,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC"}

package/lib/typescript/module/ui/session/authStore.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Platform `AuthStateStore` for `@oxyhq/services`.
+ *
+ * The device model persists the durable device credential (`deviceId` +
+ * `deviceSecret`) per origin (web) / per device (native), and the SDK re-mints
+ * the access token from that credential on cold boot. `@oxyhq/core` owns the
+ * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
+ * `createMemoryAuthStateStore`); this module only selects the seam:
+ *
+ *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
+ *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
+ *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
+ *    the shared `createNativeSecureKeyValueStorage()` adapter
+ *    (`expo-secure-store`, AsyncStorage fallback), WRAPPED so every credential
+ *    it persists is also mirrored into the device-wide shared slot.
+ *
+ * The native wrapper is how several official apps end up on ONE `DeviceSession`
+ * (and therefore one active context): whichever app proves a credential publishes
+ * it, and a later-installed sibling adopts it during cold boot instead of asking
+ * for the Commons identity key. The mirror is additive — it can neither change
+ * nor fail the app's own durable write.
+ */
+import { type AuthStateStore, type SessionMode } from '@oxyhq/core';
+export interface PlatformAuthStateStoreOptions {
+    /**
+     * Who owns the session this provider resolves. Only `'account'` mirrors into
+     * the device-wide shared slot.
+     *
+     * `'identity'` (the vault) is deliberately excluded, which keeps its storage
+     * behaviour byte-for-byte what it is today. The vault's credential is a
+     * perfectly valid device credential, so publishing it would arguably be
+     * correct — but it would also let every ordinary app on the device join the
+     * vault's device session as a side effect of the vault persisting a token, and
+     * "a background write changes which session five other apps boot into" is not
+     * a decision a storage seam gets to make.
+     */
+    sessionMode?: SessionMode;
+    /**
+     * Whether this origin/app may persist a durable device credential AT ALL.
+     *
+     * `'ephemeral'` stores nothing durable and mirrors nothing: the session lives
+     * in memory for the lifetime of the page and is gone on reload. Its one caller
+     * is `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
+     * where the durable credential for the browser profile is the server-side
+     * DeviceSession behind the `__Host-oxy-device` handle.
+     *
+     * See `OxyProviderProps.deviceCredentialStorage` for why the answer to "let the
+     * hub be authoritative" is to stop persisting the other credential rather than
+     * to consult it second.
+     */
+    storage?: 'persistent' | 'ephemeral';
+}
+/**
+ * Build the platform {@link AuthStateStore} for this runtime.
+ *
+ * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
+ * token) per-app in SecureStore; the SDK re-mints the access token from the
+ * device credential on the next cold boot.
+ *
+ * ## The ephemeral check is FIRST, and the order is load-bearing
+ *
+ * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
+ * never reach the native path — and therefore can never reach the shared-slot
+ * mirroring wrapper. Checked after that branch instead, an origin that has
+ * declined to persist a credential would publish one into the device-wide slot
+ * every sibling app adopts on cold boot: it would keep nothing itself while
+ * deciding which session five other apps boot into.
+ *
+ * That is unreachable today because the only ephemeral caller is a web origin, so
+ * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
+ * of guarantee that stops holding when someone adds the second caller, so it is
+ * structural here rather than incidental, and
+ * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
+ */
+export declare function createPlatformAuthStateStore(options?: PlatformAuthStateStoreOptions): AuthStateStore;
+//# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/session/authStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,cAAc,CAiBhB"}

package/lib/typescript/module/ui/session/backgroundSession.d.ts

@@ -0,0 +1,42 @@
+import type { OxyServices } from '@oxyhq/core';
+/** Whether this platform/app can hold a background credential at all. */
+export declare function isBackgroundSessionSupported(): boolean;
+/**
+ * Drop the stored credential. No-op where unsupported, and never throws.
+ *
+ * Called on sign-out and BEFORE an account switch's network work, so the window
+ * in which background code could still serve the previous account is as short as
+ * one local write.
+ */
+export declare function clearBackgroundSession(): Promise<void>;
+export interface BackgroundSessionSyncInput {
+    oxyServices: OxyServices;
+    /** The signed-in account, or `null` when signed out. */
+    userId: string | null;
+    /** Whether a bearer is available yet — provisioning requires one. */
+    canUsePrivateApi: boolean;
+    /**
+     * Whether this run is still the current one. A run that loses its relevance
+     * mid-flight (unmount, or another identity change) must not write the
+     * credential it was about to write.
+     */
+    isCurrent: () => boolean;
+}
+/**
+ * Bring the native credential in line with the session JS currently holds.
+ *
+ * Ordering is the load-bearing part: a credential belonging to a DIFFERENT
+ * account is cleared before any network call, so a crash mid-provision leaves
+ * background code signed out rather than serving the previous account's data
+ * under the new account's name. The server enforces the same rule independently
+ * (a mint is re-authorized against the live device session, and against its ACTIVE
+ * account), so this is the fast local half of a belt-and-braces pair, not the only
+ * guard.
+ *
+ * Throws for exactly one thing — a `@oxyhq/core` too old to provision (see
+ * {@link assertProvisioningAvailable}). Every other failure is caught and logged:
+ * a background credential is an enhancement, and failing to provision one must
+ * not disturb the session that is working.
+ */
+export declare function syncBackgroundSession(input: BackgroundSessionSyncInput): Promise<void>;
+//# sourceMappingURL=backgroundSession.d.ts.map

package/lib/typescript/module/ui/session/backgroundSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backgroundSession.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/backgroundSession.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyG/C,yEAAyE;AACzE,wBAAgB,4BAA4B,IAAI,OAAO,CAEtD;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa5D;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,WAAW,CAAC;IACzB,wDAAwD;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC;CAC1B;AA8BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqF5F"}

package/lib/typescript/module/ui/session/createSessionClient.d.ts

@@ -0,0 +1,40 @@
+import { SessionClient, createSessionClientHost, type OxyServices, type SessionStateOrigin } from '@oxyhq/core';
+/**
+ * Wire a `SessionClient` for `@oxyhq/services`.
+ *
+ * The platform-agnostic parts (host adapter, client, projection helpers) live
+ * ONCE in `@oxyhq/core`; this thin factory only injects the pieces specific to
+ * the RN/Expo SDK:
+ *
+ *  - `socket.io-client`'s `io`, STATICALLY imported (socket.io-client is a real
+ *    dependency of `@oxyhq/services`) so realtime session sync never relies on
+ *    core's lazy dynamic import of a bare specifier — bundler-fragile in
+ *    Metro/Expo-web against the published core dist.
+ *  - the device-first {@link createTokenTransport}, which mints a fallback token
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
+ *
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
+ *
+ * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
+ * when signed out (after the one-shot join redirect).
+ *
+ * `getPinnedAccountId` reports the account an IDENTITY-BOUND provider
+ * (`sessionMode: 'identity'`) is pinned to, and `null` for every account-mode
+ * provider — which is exactly the value `SessionClient` and the transport read
+ * when the option is absent, so account mode is unchanged. While it reports an
+ * account, the client tracks device state truthfully but never re-binds its
+ * bearer to the device's mutable active account.
+ */
+export declare function createSessionClient(oxyServices: OxyServices, onUnauthenticated?: (origin: SessionStateOrigin) => void, getPinnedAccountId?: () => string | null): {
+    client: SessionClient;
+    host: ReturnType<typeof createSessionClientHost>;
+};
+//# sourceMappingURL=createSessionClient.d.ts.map

package/lib/typescript/module/ui/session/createSessionClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSessionClient.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/createSessionClient.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,EACxD,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GACvC;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CAClD,CAUA"}

package/lib/typescript/module/ui/session/identityBinding.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Identity-bound sessions — the PLATFORM half of `sessionMode: 'identity'`.
+ *
+ * `@oxyhq/core` owns everything platform-agnostic about an identity-bound
+ * session: the pin store shapes, `resolveIdentityPin`,
+ * `establishIdentitySession`, and the pinned cold-boot / re-mint lanes. What it
+ * deliberately leaves out is WHICH pin store a given runtime should use, so this
+ * module supplies it — web `localStorage` vs the same native SecureStore adapter
+ * the device credential already persists through — and adds the one piece of
+ * state the provider needs on top: a memoised, SYNCHRONOUSLY readable pinned
+ * account id.
+ *
+ * Why the memo matters: `SessionClient.getPinnedAccountId` is a synchronous read
+ * on the socket/apply path, while resolving the pin is asynchronous (a storage
+ * read plus a keychain read, through `resolveIdentityPin`). The provider
+ * resolves it before the cold boot and after every (re-)established identity
+ * session; every read after that is free.
+ */
+import { type IdentityBinding } from '@oxyhq/core';
+/**
+ * The provider-scoped identity binding: the core {@link IdentityBinding} handed
+ * to the cold boot and the re-mint handler, plus the resolved pin the projection
+ * and `SessionClient` bind to.
+ */
+export interface IdentitySessionBinding {
+    /** Handed to `runSessionColdBoot` and `installAuthRefreshHandler`. */
+    readonly binding: IdentityBinding;
+    /**
+     * The last resolved pinned account id, read synchronously. `null` until the
+     * first resolve lands, and after a resolve that found no usable pin.
+     */
+    getPinnedAccountId(): string | null;
+    /**
+     * Resolve the pin, reusing the memo once a pinned account is known.
+     * Concurrent callers share one in-flight resolve.
+     */
+    ensurePinnedAccountId(): Promise<string | null>;
+    /**
+     * Drop the memo and re-resolve. Used after a lane that may have rewritten or
+     * cleared the pin (the cold boot, or a re-established identity session).
+     */
+    refreshPinnedAccountId(): Promise<string | null>;
+}
+/**
+ * Thrown by every account-graph mutation while the provider runs in
+ * `sessionMode: 'identity'`.
+ *
+ * An identity-bound app's user is the owner of the local identity key — fixed,
+ * for the lifetime of that key. Switching it is not a temporarily-unavailable
+ * operation that could be retried, it is not part of this mode's contract at
+ * all, so the surfaces reject loudly rather than resolving to a no-op that would
+ * read to the caller as a successful switch.
+ */
+export declare class IdentityBoundSessionError extends Error {
+    readonly operation: string;
+    readonly name = "IdentityBoundSessionError";
+    readonly code = "identity_bound_session";
+    constructor(operation: string);
+}
+/**
+ * Build the identity binding for this runtime. Called ONCE per provider mount,
+ * and ONLY when `sessionMode: 'identity'` — account-mode providers never
+ * construct a pin store.
+ */
+export declare function createIdentitySessionBinding(): IdentitySessionBinding;
+//# sourceMappingURL=identityBinding.d.ts.map

package/lib/typescript/module/ui/session/identityBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityBinding.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/identityBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAIrB;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAAC;IACpC;;;OAGG;IACH,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD;;;OAGG;IACH,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClD;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAGtC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAFtC,SAAkB,IAAI,+BAA+B;IACrD,QAAQ,CAAC,IAAI,4BAA4B;gBACpB,SAAS,EAAE,MAAM;CAKvC;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,sBAAsB,CAsCrE"}

package/lib/typescript/module/ui/session/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Session-sync integration layer — intra-package use only.
+ *
+ * `@oxyhq/core` owns the platform-agnostic `SessionClient`, its host adapter,
+ * and the pure `DeviceSessionState → services` projection helpers; those are
+ * re-exported straight from core here so `OxyContext` has one import site.
+ * `@oxyhq/services` supplies only the platform pieces: the thin
+ * `createSessionClient` factory (injects socket.io-client `io` + the
+ * device-first token transport), the `AuthStateStore` factory, and — for
+ * `sessionMode: 'identity'` — the identity binding (platform pin store + the
+ * memoised pinned account id).
+ */
+export { createSessionClient } from './createSessionClient.js';
+export { createTokenTransport } from './tokenTransport.js';
+export { createPlatformAuthStateStore } from './authStore.js';
+export { useBackgroundSessionSync } from './useBackgroundSessionSync.js';
+export { createIdentitySessionBinding, IdentityBoundSessionError } from './identityBinding.js';
+export type { IdentitySessionBinding } from './identityBinding.js';
+export { createSessionClientHost, accountIdsOf, activeSessionIdOf, activeUserOf, deviceStateToClientSessions, } from '@oxyhq/core';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/ui/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAkB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAa,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,sBAAmB,CAAC;AAC5F,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAmB,CAAC;AAChE,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,aAAa,CAAC"}

package/lib/typescript/module/ui/session/nativeSecureStorage.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The native secure key/value seam every durable `@oxyhq/core` store in this
+ * package is built on.
+ *
+ * `@oxyhq/core` owns the store LOGIC (`createNativeAuthStateStore` for the
+ * zero-cookie device credential, `createNativeIdentityPinStore` for the identity
+ * pin) and takes its persistence as an injected `NativeKeyValueStorage`. This
+ * module supplies that injection ONCE, so those stores can never drift onto
+ * different backings — a device credential in SecureStore and a pin in
+ * AsyncStorage would resolve differently after a keystore reset.
+ *
+ * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
+ * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
+ * controller), so the web bundle never pulls it and a device without it falls
+ * back to AsyncStorage rather than crashing.
+ */
+import type { NativeKeyValueStorage } from '@oxyhq/core';
+/**
+ * A native `NativeKeyValueStorage` that prefers `expo-secure-store` (encrypted
+ * at rest) and falls back to AsyncStorage when SecureStore is not installed.
+ * The SecureStore module is resolved lazily on first access so construction
+ * stays synchronous.
+ */
+export declare function createNativeSecureKeyValueStorage(): NativeKeyValueStorage;
+//# sourceMappingURL=nativeSecureStorage.d.ts.map

package/lib/typescript/module/ui/session/nativeSecureStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeSecureStorage.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/nativeSecureStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA0CzD;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,qBAAqB,CAiCzE"}

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts

@@ -0,0 +1,32 @@
+import { type SharedDeviceCredentialStore } from '@oxyhq/core';
+/**
+ * The iOS Keychain Access Group every official Oxy app declares in its
+ * entitlements. Shared with the identity slots — the group is the app-group
+ * boundary, not the secret's identity.
+ */
+export declare const IOS_KEYCHAIN_ACCESS_GROUP = "group.so.oxy.shared";
+/**
+ * The iOS `keychainService` for the DEVICE SESSION credential. Deliberately
+ * distinct from every identity and recovery service; do not reuse one of those
+ * here, and do not drop it (an item written with no service shares the legacy
+ * identity slot's namespace inside the group).
+ */
+export declare const IOS_DEVICE_SESSION_KEYCHAIN_SERVICE = "oxy_device_session";
+/** The single key holding the JSON-encoded `{deviceId, deviceSecret}` pair. */
+export declare const SHARED_DEVICE_SESSION_STORAGE_KEY = "oxy_shared_device_session_v1";
+/**
+ * The shared DeviceSession credential slot for this runtime, or `null` when
+ * there is none.
+ *
+ * The branch is on the PLATFORM, not on which module happens to load, because
+ * `expo-secure-store` loads perfectly well on Android — it would just quietly
+ * ignore `keychainAccessGroup` and read a package-private item, which looks
+ * exactly like an empty shared slot. This is the same iOS-vs-Android split
+ * `KeyManager` makes for the shared identity, for the same reason.
+ *
+ * Any other native platform gets the broker, which answers `unsupported` when
+ * the module is not linked — so the lane is simply off, which is the safe
+ * direction.
+ */
+export declare function createPlatformSharedDeviceCredentialStore(): SharedDeviceCredentialStore | null;
+//# sourceMappingURL=sharedDeviceCredentialStore.d.ts.map

package/lib/typescript/module/ui/session/sharedDeviceCredentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharedDeviceCredentialStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/sharedDeviceCredentialStore.ts"],"names":[],"mappings":"AAyCA,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,+EAA+E;AAC/E,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AA0OhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yCAAyC,IAAI,2BAA2B,GAAG,IAAI,CAK9F"}

package/lib/typescript/module/ui/session/tokenTransport.d.ts

@@ -0,0 +1,33 @@
+import { type OxyServices, type TokenTransport } from '@oxyhq/core';
+/**
+ * Platform `TokenTransport` for `SessionClient` (device-first model).
+ *
+ * `ensureActiveToken` is the fallback the client uses when a `session_state`
+ * push arrived WITHOUT an embedded `activeToken` and the planted bearer does not
+ * already belong to the state's active account. It mints one through the ONE
+ * unified single-flight the scheduler, the request-time preflight, and the 401
+ * retry all use — `oxyServices.httpService.refreshAccessToken(...)` — which runs
+ * the installed refresh handler (present the persisted zero-cookie `deviceId` +
+ * `deviceSecret` at `POST /session/device/token`, which mints for the device's
+ * CURRENT active account). Routing through the SAME entry point means this lane
+ * can never double-rotate the device secret against the others: it has NO
+ * private single-flight of its own.
+ *
+ * The short-circuit compares the planted bearer's ACCOUNT against
+ * `state.activeAccountId`, not mere token presence: a bearer for the PREVIOUS
+ * account (an account switch) must still mint the new account's token — skipping
+ * on presence alone would leave a subscriber observing the new active account
+ * under the old account's bearer (the account-switch 404 race).
+ *
+ * A failure is logged and swallowed: this method must never throw out (it runs
+ * inside the socket state handler).
+ *
+ * `getPinnedAccountId` is the identity-bound escape hatch. Converging the bearer
+ * on `state.activeAccountId` is precisely what an identity-bound client must
+ * never do — its token is minted for the PINNED account by the cold boot /
+ * re-mint lane. `SessionClient` already bypasses the transport entirely while
+ * pinned; this guard is the services-side half of that contract, so no future
+ * wiring can reintroduce the convergence from this end.
+ */
+export declare function createTokenTransport(oxyServices: OxyServices, getPinnedAccountId?: () => string | null): TokenTransport;
+//# sourceMappingURL=tokenTransport.d.ts.map

package/lib/typescript/module/ui/session/tokenTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,WAAW,EACxB,kBAAkB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GACvC,cAAc,CAiChB"}

package/lib/typescript/module/ui/session/useBackgroundSessionSync.d.ts

@@ -0,0 +1,23 @@
+import type { OxyServices } from '@oxyhq/core';
+export interface UseBackgroundSessionSyncInput {
+    /** `OxyProviderProps.backgroundSession`. */
+    enabled: boolean;
+    oxyServices: OxyServices;
+    /** The signed-in account, or `null` when signed out. */
+    userId: string | null;
+    /** Whether a bearer is available yet — provisioning needs one. */
+    canUsePrivateApi: boolean;
+}
+/**
+ * An effect is the right shape here, unusually for this codebase: the work is a
+ * side effect on native storage, and it has to react both to an identity change
+ * (a value) and to the app being foregrounded (a subscription). There is no
+ * derived-state or React Query formulation of "write a credential to the
+ * keystore when the user changes or the app comes back".
+ *
+ * Re-runs on identity change, which is what makes sign-out and account switching
+ * work: `syncBackgroundSession` clears a credential belonging to anyone other
+ * than `userId` before it does any network work.
+ */
+export declare function useBackgroundSessionSync({ enabled, oxyServices, userId, canUsePrivateApi, }: UseBackgroundSessionSyncInput): void;
+//# sourceMappingURL=useBackgroundSessionSync.d.ts.map

package/lib/typescript/module/ui/session/useBackgroundSessionSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useBackgroundSessionSync.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/useBackgroundSessionSync.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO/C,MAAM,WAAW,6BAA6B;IAC5C,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,wDAAwD;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,kEAAkE;IAClE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,MAAM,EACN,gBAAgB,GACjB,EAAE,6BAA6B,GAAG,IAAI,CAgDtC"}

package/lib/typescript/module/ui/stores/assetStore.d.ts

@@ -0,0 +1,54 @@
+import type { Asset, AssetUploadProgress, AssetLink } from '@oxyhq/core';
+interface AssetState {
+    assets: Record<string, Asset>;
+    uploadProgress: Record<string, AssetUploadProgress>;
+    loading: {
+        uploading: boolean;
+        linking: boolean;
+        deleting: boolean;
+    };
+    errors: {
+        upload?: string;
+        link?: string;
+        delete?: string;
+    };
+    setAsset: (asset: Asset) => void;
+    setAssets: (assets: Asset[]) => void;
+    removeAsset: (assetId: string) => void;
+    setUploadProgress: (fileId: string, progress: AssetUploadProgress) => void;
+    removeUploadProgress: (fileId: string) => void;
+    addLink: (assetId: string, link: AssetLink) => void;
+    removeLink: (assetId: string, app: string, entityType: string, entityId: string) => void;
+    setUploading: (uploading: boolean) => void;
+    setLinking: (linking: boolean) => void;
+    setDeleting: (deleting: boolean) => void;
+    setUploadError: (error?: string) => void;
+    setLinkError: (error?: string) => void;
+    setDeleteError: (error?: string) => void;
+    clearErrors: () => void;
+    getAssetsByApp: (app: string) => Asset[];
+    getAssetsByEntity: (app: string, entityType: string, entityId: string) => Asset[];
+    getAssetUsageCount: (assetId: string) => number;
+    isAssetLinked: (assetId: string, app: string, entityType: string, entityId: string) => boolean;
+    reset: () => void;
+}
+export declare const useAssetStore: import("zustand").UseBoundStore<import("zustand").StoreApi<AssetState>>;
+export declare const useAssets: () => Asset[];
+export declare const useAsset: (assetId: string) => Asset;
+export declare const useUploadProgress: () => Record<string, AssetUploadProgress>;
+export declare const useAssetLoading: () => {
+    uploading: boolean;
+    linking: boolean;
+    deleting: boolean;
+};
+export declare const useAssetErrors: () => {
+    upload?: string;
+    link?: string;
+    delete?: string;
+};
+export declare const useAssetsByApp: (app: string) => Asset[];
+export declare const useAssetsByEntity: (app: string, entityType: string, entityId: string) => Asset[];
+export declare const useAssetUsageCount: (assetId: string) => number;
+export declare const useIsAssetLinked: (assetId: string, app: string, entityType: string, entityId: string) => boolean;
+export {};
+//# sourceMappingURL=assetStore.d.ts.map

package/lib/typescript/module/ui/stores/assetStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assetStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/assetStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzE,UAAU,UAAU;IAElB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAGpD,OAAO,EAAE;QACP,SAAS,EAAE,OAAO,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IAGF,MAAM,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAGF,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;IACrC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGvC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3E,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAG/C,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAGzF,YAAY,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IAGzC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,WAAW,EAAE,MAAM,IAAI,CAAC;IAGxB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;IAClF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAG/F,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAaD,eAAO,MAAM,aAAa,yEAiMvB,CAAC;AAGJ,eAAO,MAAM,SAAS,eAA8D,CAAC;AACrF,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,UAAoD,CAAC;AAC7F,eAAO,MAAM,iBAAiB,2CAAuD,CAAC;AACtF,eAAO,MAAM,eAAe;eAhQb,OAAO;aACT,OAAO;cACN,OAAO;CA8PuD,CAAC;AAC7E,eAAO,MAAM,cAAc;aA1Pd,MAAM;WACR,MAAM;aACJ,MAAM;CAwPuD,CAAC;AAG3E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,YACW,CAAC;AAEtD,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,UAAU,MAAM,YACL,CAAC;AAE/E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,WACW,CAAC;AAE9D,eAAO,MAAM,gBAAgB,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,UAAU,MAAM,YAChB,CAAC"}

package/lib/typescript/module/ui/stores/authStore.d.ts

@@ -0,0 +1,61 @@
+import type { User } from '@oxyhq/core';
+import type { OxyRuntime } from '../runtime/index.js';
+/**
+ * The signed-in user, as a zustand-shaped read/write surface.
+ *
+ * It used to BE a zustand store, and that made it a second owner of the
+ * session: the provider wrote `user`/`isAuthenticated` here, `SessionClient`
+ * wrote the same facts into its device state, and nothing reconciled them —
+ * when they disagreed, which one was right was not answerable. It is now a
+ * projection of the ONE `OxyRuntime` (ADR 0004): reads come off the runtime
+ * snapshot and writes go into the runtime, so there is nothing left to drift.
+ *
+ * The zustand SHAPE is kept deliberately — `useAuthStore(selector)`,
+ * `.getState()`, `.setState()`, `.subscribe()` — because a dozen call sites
+ * across this package and the Commons app read the user out of band, from
+ * mutation success handlers and cache helpers that are not inside a render.
+ * Rewriting them is Phase 8's cut, not this one's.
+ *
+ * `fetchUser` and `lastUserFetch` are GONE rather than projected: they were a
+ * five-minute profile cache with zero readers anywhere in the monorepo, and the
+ * Query cache has owned that job since long before this change.
+ */
+export interface AuthState {
+    user: User | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    error: string | null;
+    loginSuccess: (user: User) => void;
+    loginFailure: (error: string) => void;
+    logout: () => void;
+    /** Replace the signed-in profile after a write (a rename, a new avatar). */
+    setUser: (user: User) => void;
+}
+/** The subset of `AuthState` a caller may push back in through `setState`. */
+export type AuthStatePatch = Partial<Pick<AuthState, 'user' | 'isLoading' | 'error'>>;
+/**
+ * Point this surface at the provider's runtime. Called once by
+ * `OxyRuntimeProvider`; the returned function detaches it again on unmount.
+ *
+ * With nothing bound, reads answer signed-out and writes are dropped. That is
+ * the honest answer for the two places it happens — the SSR shim, and a unit
+ * test poking the store with no provider mounted — and it is why binding is an
+ * explicit call rather than a lazily-created default runtime, which is exactly
+ * the fabricated-forever-loading runtime ADR 0004 deleted.
+ */
+export declare function bindAuthStoreToRuntime(runtime: OxyRuntime): () => void;
+declare function useAuthStoreHook<T>(selector: (state: AuthState) => T): T;
+/**
+ * Read the signed-in user. Zustand-shaped, projected from the runtime.
+ *
+ * A selector that builds an object must be wrapped in `useShallow` (as every
+ * call site here already does) — otherwise a structurally-equal result reads as
+ * a change on every publish.
+ */
+export declare const useAuthStore: typeof useAuthStoreHook & {
+    getState: () => AuthState;
+    setState: (patch: AuthStatePatch) => void;
+    subscribe: (listener: () => void) => (() => void);
+};
+export {};
+//# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/stores/authStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/stores/authStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,4EAA4E;IAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;AAuEtF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,IAAI,CActE;AA6BD,iBAAS,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,CAejE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;oBAnDJ,SAAS;sBAEL,cAAc,KAAG,IAAI;0BAkBjB,MAAM,IAAI,KAAG,CAAC,MAAM,IAAI,CAAC;CAmCpD,CAAC"}