@oxy.so/services 11.0.0 → 11.2.0-oxy-one.0

package/src/ui/context/hooks/useAuthOperations.ts

@@ -1,4 +1,5 @@
 import { useCallback } from 'react';
+import { logoutIsolatedOAuthSession, readIsolatedOAuthSession } from '../isolatedOAuthSession';
 import type { ApiError, User } from '@oxy.so/core';
 import type { AuthStateStore, IdentityBinding, SessionClient } from '@oxy.so/core/session';
 import type { ClientSession, SessionLoginResponse } from '@oxy.so/core';
@@ -13,6 +14,7 @@ import { SignatureService } from '@oxy.so/core/crypto';
 
 export interface UseAuthOperationsOptions {
   oxyServices: OxyServices;
+  ensureDeviceSessionLane: () => void | Promise<void>;
   storage: StorageInterface | null;
   /**
    * The device-first persisted auth-state store. On EXPLICIT full sign-out the
@@ -79,8 +81,8 @@ const LOGOUT_ALL_ERROR_CODE = 'LOGOUT_ALL_ERROR';
 export function clearPersistedAuthSafe(
   store: AuthStateStore,
   logger?: (message: string, error?: unknown) => void,
-): void {
-  store.clear().catch((clearError) => {
+): Promise<void> {
+  return store.clear().catch((clearError) => {
     logger?.('Failed to clear persisted auth state on sign-out', clearError);
   });
 }
@@ -91,6 +93,7 @@ export function clearPersistedAuthSafe(
  */
 export const useAuthOperations = ({
   oxyServices,
+  ensureDeviceSessionLane,
   store,
   runtime,
   saveActiveSessionId,
@@ -109,6 +112,7 @@ export const useAuthOperations = ({
    */
   const performSignIn = useCallback(
     async (publicKey: string): Promise<User> => {
+      await ensureDeviceSessionLane();
       const deviceFingerprintObj = DeviceManager.getDeviceFingerprint();
       const deviceFingerprint = JSON.stringify(deviceFingerprintObj);
       const deviceInfo = await DeviceManager.getDeviceInfo();
@@ -181,9 +185,11 @@ export const useAuthOperations = ({
       // exposed sessions/activeSessionId/user. Best-effort: a failure here must
       // NEVER fail the sign-in itself — cold boot re-registers this account into
       // the device set on the next load regardless.
+      let deviceRegistrationCommitted = false;
       try {
         await sessionClient.registerAndActivate(sessionResponse.user.id);
         await syncFromClient();
+        deviceRegistrationCommitted = true;
       } catch (registrationError) {
         logger?.('Failed to register sign-in into device session set', registrationError);
       }
@@ -231,6 +237,7 @@ export const useAuthOperations = ({
           { merge: false },
         );
         onAuthStateChange?.(fullUser);
+        if (deviceRegistrationCommitted && !identityBinding && await store.setAutomaticIdentitySignInSuppressed?.(false) === false) logger?.('Failed to release explicit sign-out intent after sign-in');
         return fullUser;
       }
 
@@ -243,10 +250,11 @@ export const useAuthOperations = ({
       });
       await saveActiveSessionId(sessionResponse.sessionId);
       onAuthStateChange?.(fullUser);
-
+      if (deviceRegistrationCommitted && !identityBinding && await store.setAutomaticIdentitySignInSuppressed?.(false) === false) logger?.('Failed to release explicit sign-out intent after sign-in');
       return fullUser;
     },
     [
+      ensureDeviceSessionLane,
       logger,
       onAuthStateChange,
       oxyServices,
@@ -298,6 +306,23 @@ export const useAuthOperations = ({
       const activeSessionId = runtime.getSnapshot().activeSessionId;
       if (!activeSessionId) return { status: 'signed-out' };
 
+      const isolated = readIsolatedOAuthSession(runtime);
+      if (isolated) {
+        const result = await logoutIsolatedOAuthSession({
+          session: isolated,
+          targetSessionId,
+          revokeSelf: (sessionId) => oxyServices.session.logout(sessionId),
+          clearSessionState,
+        });
+        if (result.status === 'failed') {
+          handleAuthError(result.error, {
+            defaultMessage: 'Logout failed', code: LOGOUT_ERROR_CODE, onError,
+            setAuthError: (message) => runtime.setError(message), logger,
+          });
+        }
+        return result;
+      }
+
       const sessionToLogout = targetSessionId || activeSessionId;
 
       try {
@@ -325,7 +350,8 @@ export const useAuthOperations = ({
           // Genuine FULL sign-out (no sessions remain): clear the persisted
           // device credential so a reload's cold boot finds nothing to restore,
           // then tear down local state.
-          clearPersistedAuthSafe(store, logger);
+          if (!identityBinding && await store.setAutomaticIdentitySignInSuppressed?.(true) === false) throw new Error('Failed to persist explicit sign-out intent');
+          await clearPersistedAuthSafe(store, logger);
           await clearSessionState();
         }
         return { status: 'signed-out' };
@@ -338,11 +364,16 @@ export const useAuthOperations = ({
         // "signed in" against a bearer the 401 lane has already cleared.
         if (isInvalid && sessionToLogout === activeSessionId) {
           // The active session is invalid → full sign-out; clear persisted state.
-          clearPersistedAuthSafe(store, logger);
+          const intentPersisted = identityBinding ? true : await store.setAutomaticIdentitySignInSuppressed?.(true);
+          await clearPersistedAuthSafe(store, logger);
           await clearSessionState();
-          return { status: 'signed-out' };
+          return intentPersisted === false ? { status: 'failed', error: new Error('Failed to persist explicit sign-out intent') } : { status: 'signed-out' };
         }
 
+        if (sessionClient.getState()?.accounts.length === 0) {
+          await clearPersistedAuthSafe(store, logger);
+          await clearSessionState();
+        }
         handleAuthError(error, {
           defaultMessage: 'Logout failed',
           code: LOGOUT_ERROR_CODE,
@@ -358,12 +389,14 @@ export const useAuthOperations = ({
     },
     [
       clearSessionState,
+      oxyServices,
       store,
       logger,
       onError,
       runtime,
       sessionClient,
       syncFromClient,
+      identityBinding,
     ],
   );
 
@@ -371,6 +404,9 @@ export const useAuthOperations = ({
    * Logout from all sessions
    */
   const logoutAll = useCallback(async (): Promise<void> => {
+    if (readIsolatedOAuthSession(runtime)) {
+      throw new Error('An isolated OAuth session cannot sign out other sessions');
+    }
     const activeSessionId = runtime.getSnapshot().activeSessionId;
     if (!activeSessionId) {
       const error = new Error('No active session found');
@@ -379,6 +415,7 @@ export const useAuthOperations = ({
       throw error;
     }
 
+    let deviceSignOutAttempted = false;
     try {
       // Revoke the user's sessions on every other device and every refresh-
       // token family first. SessionClient's `{ all: true }` operation is only
@@ -386,11 +423,13 @@ export const useAuthOperations = ({
       // itself. The global endpoint deliberately preserves the current
       // session long enough for the device-scoped cleanup below to authenticate.
       await oxyServices.session.logoutAll(activeSessionId);
+      deviceSignOutAttempted = true;
       await sessionClient.signOut({ all: true });
       // logoutAll is ALWAYS a full sign-out: clear the persisted device
       // credential so the next cold boot finds no session to restore, then tear
       // down local state.
-      clearPersistedAuthSafe(store, logger);
+      if (!identityBinding && await store.setAutomaticIdentitySignInSuppressed?.(true) === false) throw new Error('Failed to persist explicit sign-out intent');
+      await clearPersistedAuthSafe(store, logger);
       await clearSessionState();
     } catch (error) {
       if (isInvalidSessionError(error)) {
@@ -403,11 +442,18 @@ export const useAuthOperations = ({
         // `onTokensChanged(null)` by now, so rejecting here would contradict
         // the SDK's own authoritative 401 lane and hand the caller a failure
         // for work that is complete. Finish the local teardown and resolve.
-        clearPersistedAuthSafe(store, logger);
+        const intentPersisted = identityBinding ? true : await store.setAutomaticIdentitySignInSuppressed?.(true);
+        await clearPersistedAuthSafe(store, logger);
         await clearSessionState();
+        if (intentPersisted === false) throw new Error('Failed to persist explicit sign-out intent');
         return;
       }
 
+      if (deviceSignOutAttempted && sessionClient.getState()?.accounts.length === 0) {
+        await clearPersistedAuthSafe(store, logger);
+        await clearSessionState();
+      }
+
       const message = handleAuthError(error, {
         defaultMessage: 'Logout all failed',
         code: LOGOUT_ALL_ERROR_CODE,
@@ -421,7 +467,7 @@ export const useAuthOperations = ({
       // would erase the server's reason from every caller's toast.
       throw error instanceof Error ? error : new Error(message);
     }
-  }, [clearSessionState, store, logger, onError, oxyServices, runtime, sessionClient]);
+  }, [clearSessionState, store, logger, onError, oxyServices, runtime, sessionClient, identityBinding]);
 
   return {
     signIn,

package/src/ui/context/isolatedOAuthSession.ts

@@ -0,0 +1,48 @@
+import type { OxyRuntime } from '../runtime';
+import type { LogoutResult } from './oxyContextTypes';
+import { isInvalidSessionError } from '../utils/errorHandlers';
+
+interface IsolatedOAuthSession {
+  readonly sessionId: string;
+  readonly clientId: string;
+}
+
+// Provider-local, ephemeral provenance. Only the SDK OAuth commit sets it;
+// missing device state is never treated as evidence of an isolated session.
+const isolatedSessions = new WeakMap<OxyRuntime, IsolatedOAuthSession>();
+
+export function setIsolatedOAuthSession(runtime: OxyRuntime, session: IsolatedOAuthSession): void {
+  isolatedSessions.set(runtime, Object.freeze({ ...session }));
+}
+
+export function hasIsolatedOAuthSession(runtime: OxyRuntime): boolean {
+  return isolatedSessions.has(runtime);
+}
+
+export function clearIsolatedOAuthSession(runtime: OxyRuntime): void {
+  isolatedSessions.delete(runtime);
+}
+
+export function readIsolatedOAuthSession(runtime: OxyRuntime): IsolatedOAuthSession | null {
+  const session = isolatedSessions.get(runtime);
+  return session && session.sessionId === runtime.getSnapshot().activeSessionId ? session : null;
+}
+
+/** Exact self-revocation; never a fallback for an unknown device session. */
+export async function logoutIsolatedOAuthSession(input: {
+  session: IsolatedOAuthSession;
+  targetSessionId?: string;
+  revokeSelf: (sessionId: string) => Promise<void>;
+  clearSessionState: () => Promise<void>;
+}): Promise<LogoutResult> {
+  if (input.targetSessionId && input.targetSessionId !== input.session.sessionId) {
+    return { status: 'failed', error: new Error('An isolated OAuth session may sign out only itself') };
+  }
+  try {
+    await input.revokeSelf(input.session.sessionId);
+  } catch (error) {
+    if (!isInvalidSessionError(error)) return { status: 'failed', error };
+  }
+  await input.clearSessionState();
+  return { status: 'signed-out' };
+}

package/src/ui/context/oxyContextTypes.ts

@@ -1,3 +1,4 @@
+import type { StartNativeOAuthSignInOptions, NativeOAuthSignInResult } from '../oauth/nativeAuthTransport';
 import type { ReactNode } from 'react';
 import type { LoginSessionResult } from '@oxy.so/contracts';
 import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, ApiError } from '@oxy.so/core';
@@ -106,6 +107,9 @@ export interface OxyContextState {
    * No-op outside a browser and in `sessionMode: 'identity'`, both of which
    * resolve to `{ status: 'unsupported' }`.
    */
+  /** Native SDK finalizer; call only from an explicit user gesture. */
+  startNativeOAuthSignIn: (options: StartNativeOAuthSignInOptions) => Promise<NativeOAuthSignInResult>;
+
   startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
 
   /**

package/src/ui/context/useOxyAccountGraph.ts

@@ -16,6 +16,7 @@ interface UseOxyAccountGraphParams {
    * permanently. The graph is therefore never fetched and every switch rejects.
    */
   identityBound: boolean;
+  isolatedOAuth: boolean;
   oxyServices: OxyServices;
   sessionClient: SessionClient;
   syncFromClient: () => Promise<void>;
@@ -29,6 +30,7 @@ export function useOxyAccountGraph({
   tokenReady,
   initialized,
   identityBound,
+  isolatedOAuth,
   oxyServices,
   sessionClient,
   syncFromClient,
@@ -39,7 +41,7 @@ export function useOxyAccountGraph({
   const [accounts, setAccounts] = useState<AccountNode[]>([]);
 
   const refreshAccounts = useCallback(async (): Promise<void> => {
-    if (identityBound || !isAuthenticated || !tokenReady || !oxyServices.session.accessToken) {
+    if (identityBound || isolatedOAuth || !isAuthenticated || !tokenReady || !oxyServices.session.accessToken) {
       setAccounts([]);
       return;
     }
@@ -56,17 +58,18 @@ export function useOxyAccountGraph({
         loggerUtil.debug('Failed to load accounts', { component: 'OxyContext' }, err as unknown);
       }
     }
-  }, [identityBound, isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
+  }, [identityBound, isolatedOAuth, isAuthenticated, oxyServices, tokenReady, clearSessionStateRef]);
 
   useEffect(() => {
-    if (!identityBound && isAuthenticated && initialized && tokenReady) {
+    if (!identityBound && !isolatedOAuth && isAuthenticated && initialized && tokenReady) {
       refreshAccounts();
       void accountDialogControllerRef.current?.refresh();
     }
-  }, [identityBound, isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
+  }, [identityBound, isolatedOAuth, isAuthenticated, initialized, tokenReady, refreshAccounts, accountDialogControllerRef]);
 
   const switchToAccount = useCallback(
     async (accountId: string): Promise<void> => {
+      if (isolatedOAuth) throw new Error('An isolated OAuth session cannot switch shared device accounts');
       if (identityBound) {
         // Loud rejection, never a silent no-op: a resolved promise here would
         // read to the caller as a completed switch that simply left the user
@@ -103,7 +106,7 @@ export function useOxyAccountGraph({
     // runs inside the runtime's subject transition, BEFORE any subscriber is
     // woken — so a socket-pushed switch (which never reached this function at
     // all) gets it too.
-    [identityBound, oxyServices, sessionClient, syncFromClient, commitSession],
+    [identityBound, isolatedOAuth, oxyServices, sessionClient, syncFromClient, commitSession],
   );
 
   const createAccount = useCallback(

package/src/ui/hooks/queries/usePersonalPlans.ts

@@ -0,0 +1,23 @@
+import { useQuery } from '@tanstack/react-query';
+import { authenticatedApiCall } from '@oxy.so/core';
+import { useOxy } from '../../context/OxyContext';
+
+/** Public discovery; deliberately outside persisted customer payment queries. */
+export function usePersonalPlans() {
+  const { oxyServices } = useOxy();
+  return useQuery({ queryKey: ['personal-plan-catalogue'],
+    queryFn: () => oxyServices.billing.personalPlans(), staleTime: 0 });
+}
+
+/** Account and session partitioning plus a server-side expected-subject fence. */
+export function usePersonalPlanSubscriptions() {
+  const { oxyServices, user, isAuthenticated, activeSessionId } = useOxy();
+  const accountId = user?.id;
+  return useQuery({ queryKey: ['personal-plan-sources', accountId, activeSessionId],
+    queryFn: () => {
+      if (!accountId) throw new Error('Authentication required');
+      return authenticatedApiCall(oxyServices, activeSessionId,
+        () => oxyServices.billing.productSubscriptions(accountId));
+    },
+    enabled: isAuthenticated && !!accountId, staleTime: 0, gcTime: 0 });
+}

package/src/ui/hooks/useAuth.ts

@@ -180,9 +180,12 @@ export function useAuth(): UseAuthReturn {
     showBottomSheet,
     openAvatarPicker,
     openAccountDialog,
+    ensureDeviceSessionLane,
   } = useOxyAuthActions();
 
   const signIn = useCallback(async (publicKey?: string): Promise<SignInOutcome> => {
+    const classification = ensureDeviceSessionLane();
+    if (classification) await classification;
     // Native: sign in directly with the cryptographic identity when a public key
     // is provided, or an existing keychain identity is found.
     if (publicKey) {
@@ -205,10 +208,11 @@ export function useAuth(): UseAuthReturn {
     // report the initiated UI action instead of leaking a promise that never settles.
     openAccountDialog('signin');
     return { status: 'dialog-opened' };
-  }, [oxySignIn, hasIdentity, getPublicKey, openAccountDialog]);
+  }, [oxySignIn, hasIdentity, getPublicKey, openAccountDialog, ensureDeviceSessionLane]);
 
   const signOut = useCallback(async (): Promise<void> => {
-    await logout();
+    const result = await logout();
+    if (result.status === 'failed') throw result.error;
   }, [logout]);
 
   const signOutAll = useCallback(async (): Promise<void> => {

package/src/ui/oauth/__tests__/completeOAuthCode.test.ts

@@ -41,7 +41,7 @@ describe('completeOAuthCode', () => {
       clientId: 'oxy_dk_test',
       redirectUri: REDIRECT_URI,
       codeVerifier: HANDSHAKE.codeVerifier,
-    });
+    }, { plantTokens: false });
     expect(committed).toEqual([
       {
         sessionId: 'sess-1',

package/src/ui/oauth/__tests__/nativeAuthTransport.test.ts

@@ -0,0 +1,57 @@
+import type { OxyServices } from '@oxy.so/core';
+import { startNativeOAuthSignIn, type NativeOAuthSignInContext } from '../nativeAuthTransport';
+import { openAuthorizeUrlNative } from '../../components/oauthNavigation';
+import { prepareAuthorizeRequest } from '../oauthHandshake';
+jest.mock('../../components/oauthNavigation', () => ({ openAuthorizeUrlNative: jest.fn() }));
+jest.mock('../oauthHandshake', () => ({ prepareAuthorizeRequest: jest.fn(async () => ({ authorizeUrl: 'https://auth.oxy.so/authorize', handshake: { state: 'expected', codeVerifier: 'verifier' } })) }));
+const open = openAuthorizeUrlNative as jest.Mock;
+const prepare = prepareAuthorizeRequest as jest.Mock;
+const uri = 'externalapp://oauth/callback?tenant=fixed';
+function fixture() {
+  const exchange = jest.fn(async () => ({ sessionId: 'isolated', accessToken: 'bearer', user: { id: 'user' } }));
+  const getPublic = jest.fn(async () => ({ id: 'app', name: 'External', type: 'third_party', isOfficial: false, isInternal: false, scopes: [] }));
+  const context: NativeOAuthSignInContext = { platform: 'native', oxyServices: { apps: { getPublic }, auth: { oauth: { exchangeCode: exchange } } } as unknown as OxyServices, clientId: 'oxy_dk_registered', identityBound: false, commitSession: jest.fn(async () => undefined) };
+  return { context, exchange, getPublic };
+}
+beforeEach(() => { jest.clearAllMocks(); open.mockResolvedValue({ redirectUrl: `${uri}&code=legitimate&state=expected` }); });
+it('uses the common exchange and commits a fixed-query callback without device credentials', async () => {
+  const { context, exchange, getPublic } = fixture();
+  expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({ status: 'signed-in' });
+  expect(getPublic).toHaveBeenCalledWith('oxy_dk_registered', { cache: false });
+  expect(open).toHaveBeenCalledWith('https://auth.oxy.so/authorize', uri, { allowExternalFallback: false });
+  expect(exchange).toHaveBeenCalledWith({ code: 'legitimate', clientId: 'oxy_dk_registered', redirectUri: uri, codeVerifier: 'verifier' }, { plantTokens: false });
+  expect(context.commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'isolated', userId: 'user', deviceId: undefined, deviceSecret: undefined }));
+});
+it.each([
+ `${uri}&code=x&state=expected&code=y`, `${uri}&code=x&state=expected&state=expected`,
+ `${uri}&error=access_denied&state=wrong`, `${uri}&error=access_denied&state=expected`,
+ `${uri}&code=x&state=wrong`, `${uri}&tenant=other&code=x&state=expected`, 'externalapp://oauth/callback?tenant=other&code=x&state=expected',
+ `${uri}/extra?code=x&state=expected`, `${uri}&code=x&state=expected#fragment`,
+])('rejects %s before exchange/commit', async (redirectUrl) => {
+ const { context, exchange } = fixture(); open.mockResolvedValue({ redirectUrl });
+ expect((await startNativeOAuthSignIn(context, { redirectUri: uri })).status).toBe('failed');
+ expect(exchange).not.toHaveBeenCalled(); expect(context.commitSession).not.toHaveBeenCalled();
+});
+it('cancellation commits nothing', async () => {
+ const { context, exchange } = fixture(); open.mockResolvedValue({ redirectUrl: null });
+ expect(await startNativeOAuthSignIn(context, { redirectUri: uri })).toEqual({ status: 'cancelled' });
+ expect(exchange).not.toHaveBeenCalled(); expect(context.commitSession).not.toHaveBeenCalled();
+});
+it.each(['platform','client','identity','official','registry-error'])('direct method rejects %s before opening', async (mode) => {
+ const { context, exchange, getPublic } = fixture();
+ if(mode==='platform') context.platform='unsupported';
+ if(mode==='client') context.clientId=null;
+ if(mode==='identity') context.identityBound=true;
+ if(mode==='official') getPublic.mockResolvedValue({ id:'official', name:'Official', type:'first_party', isOfficial:true, isInternal:false, scopes:[] });
+ if(mode==='registry-error') getPublic.mockRejectedValue(new Error('unavailable'));
+ expect((await startNativeOAuthSignIn(context,{redirectUri:uri})).status).not.toBe('signed-in');
+ expect(open).not.toHaveBeenCalled(); expect(prepare).not.toHaveBeenCalled(); expect(exchange).not.toHaveBeenCalled();
+});
+it('rejects reentry without replacing the first handshake', async () => {
+ const { context }=fixture(); let cancel!: (result:{redirectUrl:null})=>void;
+ open.mockImplementation(()=>new Promise(resolve=>{cancel=resolve;}));
+ const first=startNativeOAuthSignIn(context,{redirectUri:uri});
+ for(let i=0;i<8;i++) await Promise.resolve();
+ expect(await startNativeOAuthSignIn(context,{redirectUri:uri})).toEqual({status:'failed',reason:'already-in-progress'});
+ cancel({redirectUrl:null}); await first;
+});

package/src/ui/oauth/__tests__/oauthBearerCommit.http.test.ts

@@ -0,0 +1,131 @@
+/** @jest-environment node */
+
+// Only the native browser transport is simulated. Metadata, token exchange and
+// profile reads use the real OxyServices/HttpService against an owned HTTP server.
+jest.mock('../../components/oauthNavigation', () => ({
+  openAuthorizeUrlNative: jest.fn(),
+  redirectToAuthorize: jest.fn(),
+}));
+
+import { createServer, type Server } from 'node:http';
+import { OxyServices } from '@oxy.so/core';
+import { openAuthorizeUrlNative } from '../../components/oauthNavigation';
+import { requestOAuthConsent } from '../explicitOAuthConsent';
+
+const PERSON = '01a0646a-078f-7000-8000-000000000001';
+const ORGANIZATION = '01a0646a-078f-7000-8000-000000000002';
+const CLIENT = 'oxy_dk_fixture';
+const REDIRECT = 'fixture://oauth/consent';
+const EXPIRES_AT = Math.floor(Date.now() / 1000) + 300;
+function token(subject: string): string {
+  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url');
+  return `${encode({ alg: 'none' })}.${encode({ userId: subject, exp: EXPIRES_AT })}.fixture`;
+}
+
+describe('OAuth bearer commit with real HTTP transport', () => {
+  let server: Server;
+  let oxy: OxyServices;
+  let exchangeSubject: string;
+  let exchanges: number;
+  let profileSubjects: string[];
+  let unexpectedRequests: string[];
+  let visibleSubject: string;
+  const openNative = jest.mocked(openAuthorizeUrlNative);
+
+  beforeEach(async () => {
+    exchangeSubject = ORGANIZATION;
+    exchanges = 0;
+    profileSubjects = [];
+    unexpectedRequests = [];
+    visibleSubject = PERSON;
+    openNative.mockReset();
+    openNative.mockImplementation(async (authorizeUrl) => {
+      const state = new URL(authorizeUrl).searchParams.get('state');
+      return { redirectUrl: `${REDIRECT}?code=owned-code&state=${state}` };
+    });
+    server = createServer(async (req, res) => {
+      res.setHeader('Content-Type', 'application/json');
+      if (req.method === 'GET' && req.url === `/auth/oauth/client/${CLIENT}`) {
+        res.end(JSON.stringify({ application: { id: 'fixture-app', scopes: ['user:read'] } }));
+      } else if (req.method === 'POST' && req.url === '/auth/oauth/token') {
+        let body = '';
+        for await (const chunk of req) body += chunk;
+        const params = new URLSearchParams(body);
+        expect(params.get('client_id')).toBe(CLIENT);
+        expect(params.get('redirect_uri')).toBe(REDIRECT);
+        expect(params.get('code_verifier')).toBeTruthy();
+        exchanges += 1;
+        res.end(JSON.stringify({ access_token: token(exchangeSubject), session_id: 'fixture-session',
+          expires_in: 300, user: { id: exchangeSubject, username: exchangeSubject === PERSON ? 'fixture-person' : 'fixture-organization' } }));
+      } else if (req.method === 'GET' && req.url === '/users/me') {
+        const bearer = req.headers.authorization;
+        const subject = bearer === `Bearer ${token(PERSON)}` ? PERSON
+          : bearer === `Bearer ${token(ORGANIZATION)}` ? ORGANIZATION : null;
+        if (!subject) { res.statusCode = 401; res.end(JSON.stringify({ message: 'Unauthorized' })); return; }
+        profileSubjects.push(subject);
+        res.end(JSON.stringify({ id: subject, username: subject === PERSON ? 'fixture-person' : 'fixture-organization' }));
+      } else {
+        unexpectedRequests.push(`${req.method} ${req.url}`);
+        res.statusCode = 500; res.end(JSON.stringify({ message: 'Unexpected fixture request' }));
+      }
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const address = server.address();
+    if (!address || typeof address === 'string') throw new Error('Owned HTTP listener missing');
+    oxy = new OxyServices({ baseURL: `http://127.0.0.1:${address.port}`, enableCache: false, maxRetries: 0 });
+    oxy.session.setAccessToken(token(PERSON));
+  });
+
+  afterEach(async () => {
+    oxy?.dispose();
+    server.closeAllConnections();
+    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+    expect(unexpectedRequests).toEqual([]);
+  });
+
+  async function consent() {
+    return requestOAuthConsent({ platform: 'native', mode: 'popup', oxyServices: oxy,
+      clientId: CLIENT, identityBound: false, expectedUserId: PERSON,
+      commitSession: async (session) => {
+        if (!session.accessToken) throw new Error('Fixture commit requires bearer');
+        oxy.session.setAccessToken(session.accessToken);
+        visibleSubject = session.userId;
+      } }, { redirectUri: REDIRECT, scopes: ['user:read'] });
+  }
+
+  it('rejects a different returned subject without replacing the previous bearer', async () => {
+    const previous = oxy.session.accessToken;
+    expect(await consent()).toEqual({ status: 'failed', reason: 'subject-mismatch' });
+    expect(exchanges).toBe(1);
+    expect(visibleSubject).toBe(PERSON);
+    oxy.cache.clear();
+    expect((await oxy.users.me()).id).toBe(PERSON);
+    expect(profileSubjects).toEqual([PERSON]);
+    expect(oxy.session.accessToken).toBe(previous);
+  });
+
+  it('commits a matching subject and its new bearer after validation', async () => {
+    exchangeSubject = PERSON;
+    const changes: (string | null)[] = [];
+    const unsubscribe = oxy.session.onChange((value) => changes.push(value));
+    expect(await consent()).toEqual({ status: 'consented' });
+    unsubscribe();
+    expect(exchanges).toBe(1);
+    expect(changes).toEqual([token(PERSON)]);
+    expect((await oxy.users.me()).id).toBe(PERSON);
+  });
+
+  it('cancels before exchange and retains the bearer', async () => {
+    openNative.mockResolvedValue({ redirectUrl: null });
+    expect(await consent()).toEqual({ status: 'cancelled' });
+    expect(exchanges).toBe(0);
+    expect((await oxy.users.me()).id).toBe(PERSON);
+  });
+
+  it('preserves legacy direct exchange planting by default', async () => {
+    await oxy.auth.oauth.exchangeCode({ code: 'owned-code', clientId: CLIENT,
+      redirectUri: REDIRECT, codeVerifier: 'fixture-verifier' });
+    expect(exchanges).toBe(1);
+    expect((await oxy.users.me()).id).toBe(ORGANIZATION);
+  });
+});

package/src/ui/oauth/applicationSessionLane.ts

@@ -0,0 +1,26 @@
+import { publicApplicationSchema } from '@oxy.so/contracts';
+import type { OxyServices } from '@oxy.so/core';
+
+export function classifyApplicationSessionLane(metadata: unknown): 'device' | 'oauth' {
+  const application = publicApplicationSchema.parse(metadata);
+  return application.type === 'third_party' && !application.isOfficial && !application.isInternal ? 'oauth' : 'device';
+}
+
+export const APPLICATION_CLASSIFICATION_DEADLINE_MS = 5000;
+
+/** The active registry projection is authoritative; names and origins confer no trust. */
+export async function resolveApplicationSessionLane(
+  oxyServices: OxyServices,
+  clientId: string | null | undefined,
+): Promise<'device' | 'oauth'> {
+  if (!clientId) throw new Error('A registered clientId is required');
+  // The public endpoint rejects inactive applications and unusable credentials.
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const metadata = await Promise.race([
+      oxyServices.apps.getPublic(clientId, { cache: false }),
+      new Promise<never>((_, reject) => { timer = setTimeout(() => reject(new Error('Application classification timed out')), APPLICATION_CLASSIFICATION_DEADLINE_MS); }),
+    ]);
+    return classifyApplicationSessionLane(metadata);
+  } finally { if (timer !== undefined) clearTimeout(timer); }
+}

package/src/ui/oauth/completeOAuthCode.ts

@@ -9,10 +9,10 @@
  *
  * Ordering is deliberate and load-bearing:
  *   1. validate `state` BEFORE anything is sent to the token endpoint,
- *   2. exchange the code for a session,
+ *   2. exchange the code for session material without changing the bearer,
  *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
  *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
- *   4. commit the session.
+ *   4. validate and commit the session through the provider's funnel.
  *
  * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
  * and a failed exchange.
@@ -73,7 +73,7 @@ export async function completeOAuthCode(
       clientId: input.clientId,
       redirectUri: input.redirectUri,
       codeVerifier: input.handshake.codeVerifier,
-    });
+    }, { plantTokens: false });
     runCleanup();
     await input.commitSession({
       sessionId: result.sessionId,