@oxy.so/services 11.0.0 → 11.2.0-oxy-one.0

package/lib/commonjs/ui/context/OxyContext.js

@@ -4,6 +4,8 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.useOxyAuthActions = exports.useOxy = exports.useOptionalOxy = exports.OxyRuntimeProvider = exports.OxyProviderMissingError = void 0;
+var _nativeAuthTransport = require("../oauth/nativeAuthTransport.js");
+var _isolatedOAuthSession = require("./isolatedOAuthSession.js");
 var _react = require("react");
 var _reactNative = require("react-native");
 var _core = require("@oxy.so/core");
@@ -13,11 +15,14 @@ var _accountDialogManager = require("../navigation/accountDialogManager.js");
 var _oauthNavigation = require("../components/oauthNavigation.js");
 var _browserAuthTransport = require("../oauth/browserAuthTransport.js");
 var _browserBridge = require("../oauth/browserBridge.js");
+var _sharedDeviceCredentialStore = require("../session/sharedDeviceCredentialStore.js");
 var _deviceCredentialTracker = require("../session/deviceCredentialTracker.js");
 var _explicitOAuthConsent = require("../oauth/explicitOAuthConsent.js");
 var _isWebBrowser = require("../utils/isWebBrowser.js");
 var _deliveryPlatform = require("../utils/deliveryPlatform.js");
 var _runProviderColdBoot = require("../boot/runProviderColdBoot.js");
+var _applicationSessionLane = require("../oauth/applicationSessionLane.js");
+var _errorHandlers = require("../utils/errorHandlers.js");
 var _deviceCredential = require("../utils/deviceCredential.js");
 var _tokenLossRecovery = require("../session/tokenLossRecovery.js");
 var _authStore = require("../stores/authStore.js");
@@ -139,9 +144,25 @@ const OxyRuntimeProvider = ({
   // Server-authoritative device session client. Built ONCE per `oxyServices`
   // instance. Device-scoped sockets connect with deviceId+deviceSecret when no
   // bearer is planted yet, so cross-origin apps sync via `session_state`.
+  const runtimeRef = (0, _react.useRef)(null);
+  const registeredLaneRef = (0, _react.useRef)({
+    clientId: clientIdProp,
+    services: oxyServices,
+    lane: null,
+    pending: null
+  });
+  if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
+    registeredLaneRef.current = {
+      clientId: clientIdProp,
+      services: oxyServices,
+      lane: null,
+      pending: null
+    };
+  }
   const sessionClientPairRef = (0, _react.useRef)(null);
   if (!sessionClientPairRef.current) {
     sessionClientPairRef.current = (0, _index2.createSessionClient)(oxyServices, origin => {
+      if (runtimeRef.current && (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtimeRef.current)) return;
       // Erase the DURABLE device credential only on a `request`-origin verdict
       // (a REST sign-out / revocation). A `push`-origin empty state is a socket
       // broadcast that may be a transient reconnect artifact — clearing the
@@ -159,7 +180,10 @@ const OxyRuntimeProvider = ({
     // option — and the pinned account id once an identity-bound provider has
     // resolved its pin. Read through the ref so the resolver stays stable for
     // the client's lifetime while still seeing later resolutions.
-    () => identityRef.current?.getPinnedAccountId() ?? null);
+    () => identityRef.current?.getPinnedAccountId() ?? null, () => registeredLaneRef.current.lane === 'device' && (!runtimeRef.current || !(0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtimeRef.current)), async () => {
+      if (identityRef.current || registeredLaneRef.current.lane !== 'device') return;
+      if ((await authStore.setAutomaticIdentitySignInSuppressed?.(true)) === false) throw new Error('Failed to persist explicit sign-out intent');
+    });
   }
   const {
     client: sessionClient,
@@ -179,7 +203,6 @@ const OxyRuntimeProvider = ({
   const saveSessionIdsRef = (0, _react.useRef)(() => undefined);
   const subjectChangeRef = (0, _react.useRef)(() => undefined);
   const reestablishRef = (0, _react.useRef)(() => undefined);
-  const runtimeRef = (0, _react.useRef)(null);
   if (!runtimeRef.current) {
     runtimeRef.current = (0, _index.createOxyRuntime)({
       oxyServices,
@@ -394,11 +417,56 @@ const OxyRuntimeProvider = ({
     const cred = await (0, _deviceCredential.loadPersistedDeviceCredential)(authStore);
     sessionClientHost.setDeviceCredential(cred);
   }, [authStore, sessionClientHost]);
+
+  // Provider-owned classification: never accept a caller/button's trust verdict.
+  // Recovery asks freshly; concurrent boot/recovery requests share one lookup.
+  const resolveRegisteredLane = (0, _react.useCallback)(async () => {
+    const selected = registeredLaneRef.current;
+    if (selected.clientId !== clientIdProp || selected.services !== oxyServices) throw new Error('Provider classification was superseded');
+    if (selected.pending) return selected.pending;
+    selected.lane = null;
+    const pending = (async () => {
+      const lane = await (0, _applicationSessionLane.resolveApplicationSessionLane)(oxyServices, clientIdProp);
+      if (registeredLaneRef.current !== selected) throw new Error('Provider classification was superseded');
+      if (lane === 'oauth' && !(0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) {
+        sessionClient.resetLocalState();
+        sessionClientHost.setDeviceCredential(null);
+        await clearSessionStateRef.current();
+      }
+      if (registeredLaneRef.current !== selected) throw new Error('Provider classification was superseded');
+      selected.lane = lane;
+      return lane;
+    })();
+    selected.pending = pending;
+    try {
+      return await pending;
+    } finally {
+      if (selected.pending === pending) selected.pending = null;
+    }
+  }, [oxyServices, clientIdProp, runtime, sessionClient, sessionClientHost]);
+  const ensureDeviceSessionLane = (0, _react.useCallback)(() => {
+    if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
+      throw new Error('Provider classification was superseded');
+    }
+    if (registeredLaneRef.current.lane === 'oauth' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) {
+      throw new Error('This application requires explicit OAuth sign-in');
+    }
+    if (registeredLaneRef.current.lane === 'device') return;
+    return resolveRegisteredLane().then(lane => {
+      if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
+        throw new Error('Provider classification was superseded');
+      }
+      if (lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) {
+        throw new Error('This application requires explicit OAuth sign-in');
+      }
+    });
+  }, [resolveRegisteredLane, runtime, clientIdProp, oxyServices]);
   const {
     signIn,
     logout,
     logoutAll
   } = (0, _useAuthOperations.useAuthOperations)({
+    ensureDeviceSessionLane,
     oxyServices,
     store: authStore,
     storage,
@@ -481,8 +549,9 @@ const OxyRuntimeProvider = ({
     };
     const recovery = (0, _tokenLossRecovery.createTokenLossRecovery)({
       remint: () => oxyServices.http.refreshAccessToken('preflight'),
-      hasDeviceCredential: () => (0, _deviceCredential.hasPersistedSessionCredential)(authStore),
+      hasDeviceCredential: () => registeredLaneRef.current.lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime) ? Promise.resolve(false) : (0, _deviceCredential.hasPersistedSessionCredential)(authStore),
       hasKeyedRecovery: async () => {
+        if (registeredLaneRef.current.lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return false;
         if (_reactNative.Platform.OS === 'web') {
           return false;
         }
@@ -533,19 +602,27 @@ const OxyRuntimeProvider = ({
   // account instead of the device's active one, and its recovery arm becomes the
   // PRIMARY-key identity sign-in rather than the cross-app shared keychain.
   (0, _react.useEffect)(() => {
-    const dispose = (0, _session.installAuthRefreshHandler)({
+    let disposed = false;
+    const refresh = (0, _session.createAuthRefreshHandler)({
       oxy: oxyServices,
       store: authStore,
+      isCurrent: () => !disposed && registeredLaneRef.current.lane === 'device' && !(0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime),
       ...(identity ? {
         identity: identity.binding
+      } : {}),
+      ...(!identity && !(0, _isWebBrowser.isWebBrowser)() ? {
+        allowCommonsIdentityFallback: false,
+        sharedDeviceCredential: (0, _sharedDeviceCredentialStore.createPlatformSharedDeviceCredentialStore)() ?? undefined
       } : {})
     });
+    oxyServices.http.setAuthRefreshHandler(reason => registeredLaneRef.current.lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime) ? Promise.resolve(null) : refresh(reason));
     const scheduler = (0, _session.startTokenRefreshScheduler)(oxyServices);
     return () => {
+      disposed = true;
       scheduler.dispose();
-      dispose();
+      oxyServices.http.setAuthRefreshHandler(null);
     };
-  }, [oxyServices, authStore, identity]);
+  }, [oxyServices, authStore, identity, runtime]);
 
   // ── Session commit funnel ────────────────────────────────────────────────
   // The single place a session becomes committed: plant tokens, persist the
@@ -554,6 +631,22 @@ const OxyRuntimeProvider = ({
   // Used by the QR device flow (`handleWebSession`), password sign-in, 2FA
   // completion, and the cold boot.
   const commitSession = (0, _react.useCallback)(async (input, options) => {
+    const isolatedOAuth = options.oauth === true && !input.deviceId && !input.deviceSecret;
+    if (isolatedOAuth || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) {
+      sessionClient.resetLocalState();
+      sessionClientHost.setDeviceCredential(null);
+      await authStore.clear();
+      await clearSessionStateRef.current();
+    }
+    if (isolatedOAuth) {
+      if (!clientId) throw new Error('An isolated OAuth commit requires its registered client ID');
+      (0, _isolatedOAuthSession.setIsolatedOAuthSession)(runtime, {
+        sessionId: input.sessionId,
+        clientId
+      });
+    } else {
+      (0, _isolatedOAuthSession.clearIsolatedOAuthSession)(runtime);
+    }
     if (input.accessToken) {
       oxyServices.session.setAccessToken(input.accessToken);
     }
@@ -603,7 +696,7 @@ const OxyRuntimeProvider = ({
           userId: input.userId,
           isCurrent: true
         }], {
-          merge: true
+          merge: !isolatedOAuth
         });
         runtime.setActiveSessionId(input.sessionId);
       });
@@ -619,6 +712,7 @@ const OxyRuntimeProvider = ({
     // on the next load).
     await (0, _commitSessionFlow.commitDeviceSetAndResolve)({
       activate: options.activate,
+      isolatedOAuth,
       hasDeviceState: input.deviceState !== undefined,
       userId: input.userId,
       fallbackUser: input.user ?? null,
@@ -631,7 +725,10 @@ const OxyRuntimeProvider = ({
       onAuthStateChange: onAuthStateChangeRef.current,
       markAuthResolved: markAuthResolvedRef.current
     });
-  }, [oxyServices, authStore, runtime, sessionClient, sessionClientHost, syncFromClient, logger]);
+    if (options.activate && !isolatedOAuth && !identity && input.userId && runtime.getSnapshot().account?.id === input.userId) {
+      if ((await authStore.setAutomaticIdentitySignInSuppressed?.(false)) === false) logger('Failed to release explicit sign-out intent after sign-in');
+    }
+  }, [oxyServices, authStore, runtime, sessionClient, sessionClientHost, syncFromClient, logger, clientId, identity]);
   const commitSessionRef = (0, _react.useRef)(commitSession);
   commitSessionRef.current = commitSession;
 
@@ -666,9 +763,21 @@ const OxyRuntimeProvider = ({
     authorizeBaseUrl,
     identityBound: isIdentityBound,
     commitSession: input => commitSessionRef.current(input, {
-      activate: true
+      activate: true,
+      oauth: true
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound]);
+  const startNativeOAuthSignInForContext = (0, _react.useCallback)(options => (0, _nativeAuthTransport.startNativeOAuthSignIn)({
+    platform: _reactNative.Platform.OS === 'ios' || _reactNative.Platform.OS === 'android' ? 'native' : 'unsupported',
+    oxyServices,
+    clientId,
+    authorizeBaseUrl,
+    identityBound: isIdentityBound,
+    commitSession: input => commitSessionRef.current(input, {
+      activate: true,
+      oauth: true
+    })
+  }, options), [oxyServices, clientId, authorizeBaseUrl, isIdentityBound]);
   const requestOAuthConsentForContext = (0, _react.useCallback)(options => (0, _explicitOAuthConsent.requestOAuthConsent)({
     platform: _reactNative.Platform.OS === 'web' ? 'web' : _reactNative.Platform.OS === 'ios' || _reactNative.Platform.OS === 'android' ? 'native' : 'unsupported',
     mode: webAuthMode,
@@ -678,7 +787,8 @@ const OxyRuntimeProvider = ({
     identityBound: isIdentityBound,
     expectedUserId: user?.id ?? null,
     commitSession: input => commitSessionRef.current(input, {
-      activate: true
+      activate: true,
+      oauth: true
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id]);
 
@@ -766,8 +876,8 @@ const OxyRuntimeProvider = ({
   // Native is untouched: its apps already share a device through the keychain.
   (0, _react.useEffect)(() => {
     if (!(0, _isWebBrowser.isWebBrowser)()) return undefined;
-    return oxyServices.session.setDeviceCredentialProvider(() => (0, _deviceCredential.loadPersistedDeviceCredential)(authStore));
-  }, [oxyServices, authStore]);
+    return oxyServices.session.setDeviceCredentialProvider(() => registeredLaneRef.current.lane === 'device' && !(0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime) ? (0, _deviceCredential.loadPersistedDeviceCredential)(authStore) : Promise.resolve(null));
+  }, [oxyServices, authStore, runtime]);
 
   // ── The browser bridge (ADR 0029 D2) ──────────────────────────────────────
   // The first time a person presses sign-in in this app on the web and it holds
@@ -780,7 +890,7 @@ const OxyRuntimeProvider = ({
   const bridgeInFlightRef = (0, _react.useRef)(false);
   const closeAccountDialogRef = (0, _react.useRef)(() => undefined);
   const startBrowserBridge = (0, _react.useCallback)(() => {
-    if (isIdentityBound || !clientId || !(0, _isWebBrowser.isWebBrowser)() || bridgeInFlightRef.current) return;
+    if (registeredLaneRef.current.lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime) || isIdentityBound || !clientId || !(0, _isWebBrowser.isWebBrowser)() || bridgeInFlightRef.current) return;
     if (authStoreRef.current?.heldDeviceCredential() !== null) return;
     const bridgeOrigin = (0, _browserBridge.resolveBridgeOrigin)(authorizeBaseUrl);
     const pageOrigin = globalThis.location?.origin;
@@ -835,8 +945,10 @@ const OxyRuntimeProvider = ({
     }).finally(() => {
       bridgeInFlightRef.current = false;
     });
-  }, [isIdentityBound, clientId, authorizeBaseUrl, authRedirectUri, oxyServices, authStore, sessionClientHost, logger]);
-  const openAccountDialog = (0, _react.useCallback)(view => {
+  }, [isIdentityBound, clientId, authorizeBaseUrl, authRedirectUri, oxyServices, authStore, sessionClientHost, logger, runtime]);
+  const openClassifiedAccountDialog = (0, _react.useCallback)(view => {
+    if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) return;
+    if (registeredLaneRef.current.lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
     if (isIdentityBound) {
       // No controller was built, and there is nothing to choose: this app's user
       // is fixed to the owner of the local identity key.
@@ -899,7 +1011,24 @@ const OxyRuntimeProvider = ({
       }
     });
     setAccountDialogOpen(true);
-  }, [isIdentityBound, startBrowserBridge]);
+  }, [isIdentityBound, startBrowserBridge, runtime, clientIdProp, oxyServices]);
+  const openAccountDialog = (0, _react.useCallback)(view => {
+    if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) return;
+    if (registeredLaneRef.current.lane === 'device') {
+      // Preserve the browser bridge's synchronous user-gesture path.
+      openClassifiedAccountDialog(view);
+      return;
+    }
+    void Promise.resolve().then(() => ensureDeviceSessionLane()).then(() => openClassifiedAccountDialog(view)).catch(error => {
+      (0, _errorHandlers.handleAuthError)(error, {
+        defaultMessage: 'Sign in failed',
+        code: 'LOGIN_ERROR',
+        onError,
+        setAuthError: message => runtime.setError(message),
+        logger
+      });
+    });
+  }, [ensureDeviceSessionLane, openClassifiedAccountDialog, onError, runtime, logger, clientIdProp, oxyServices]);
   const closeAccountDialog = (0, _react.useCallback)(() => {
     accountDialogControllerRef.current?.cancelSignIn();
     dismissAccountDialogSurface();
@@ -942,9 +1071,6 @@ const OxyRuntimeProvider = ({
     // SYNCHRONOUS read on `SessionClient`'s apply path, and a stale `null` there
     // would let a pinned client behave like an account-mode one for the first
     // state it applies (including re-electing the device's active account).
-    if (identity) {
-      await identity.ensurePinnedAccountId();
-    }
     await (0, _runProviderColdBoot.runProviderColdBoot)({
       oxyServices,
       authStore,
@@ -952,6 +1078,13 @@ const OxyRuntimeProvider = ({
       authRedirectUri,
       sessionMode,
       identity: identity?.binding,
+      resolveSessionLane: resolveRegisteredLane,
+      beforeDeviceBoot: identity ? async () => {
+        await identity.ensurePinnedAccountId();
+      } : undefined,
+      afterDeviceBoot: identity ? async () => {
+        await identity.refreshPinnedAccountId();
+      } : undefined,
       sessionClient,
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
@@ -961,10 +1094,7 @@ const OxyRuntimeProvider = ({
     // The boot may have (re-)established the identity session or cleared a pin
     // whose key no longer exists, so re-resolve rather than trusting the memo
     // taken before it ran.
-    if (identity) {
-      await identity.refreshPinnedAccountId();
-    }
-  }, [oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient, setTokenReady]);
+  }, [resolveRegisteredLane, oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient, setTokenReady]);
   (0, _react.useEffect)(() => {
     if (initialized) {
       return;
@@ -980,30 +1110,51 @@ const OxyRuntimeProvider = ({
     });
   }, [runColdBoot, storage, initialized, logger]);
 
-  // Reconcile device state when the tab returns to foreground (background tabs may
-  // miss socket pushes or have stale bearer tokens).
+  // Reconcile device state on foreground: suspended native apps and background
+  // tabs may miss a sibling's active-context switch or socket pushes.
   (0, _react.useEffect)(() => {
-    if (!(0, _isWebBrowser.isWebBrowser)()) return;
-    const onVisibility = () => {
-      if (document.visibilityState !== 'visible') return;
-      const reconcile = async () => {
-        if (!oxyServices.session.accessToken && sessionClientHost.getDeviceCredential()) {
-          // Route through the ONE shared single-flight the scheduler/preflight/401
-          // use — never a private mint lane — so a tab-focus reconcile can't
-          // double-rotate the device secret against them.
+    let disposed = false;
+    let pending = null;
+    const reconcile = () => {
+      if (disposed || pending || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
+      pending = (async () => {
+        if (!(0, _isWebBrowser.isWebBrowser)() && !identity || !oxyServices.session.accessToken && sessionClientHost.getDeviceCredential()) {
+          // The scheduler/preflight/401 paths own the same mint single-flight.
           await oxyServices.http.refreshAccessToken('preflight');
         }
+        if (disposed || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
+        if (!(0, _isWebBrowser.isWebBrowser)() && !identity) await syncDeviceCredentialToHost();
         if (!oxyServices.session.accessToken && !sessionClientHost.getDeviceCredential()) {
           return;
         }
         await sessionClient.bootstrap();
+        if (disposed || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
         await syncFromClient();
+      })().catch(() => undefined).finally(() => {
+        pending = null;
+      });
+    };
+    if ((0, _isWebBrowser.isWebBrowser)()) {
+      const onVisibility = () => {
+        if (document.visibilityState === 'visible') reconcile();
+      };
+      document.addEventListener('visibilitychange', onVisibility);
+      return () => {
+        disposed = true;
+        document.removeEventListener('visibilitychange', onVisibility);
       };
-      void reconcile().catch(() => undefined);
+    }
+    let previousState = _reactNative.AppState.currentState;
+    const subscription = _reactNative.AppState.addEventListener('change', state => {
+      const resumed = state === 'active' && (previousState === 'inactive' || previousState === 'background');
+      previousState = state;
+      if (resumed) reconcile();
+    });
+    return () => {
+      disposed = true;
+      subscription.remove();
     };
-    document.addEventListener('visibilitychange', onVisibility);
-    return () => document.removeEventListener('visibilitychange', onVisibility);
-  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient, syncDeviceCredentialToHost, identity, runtime]);
 
   // Reconnect heal: when connectivity transitions offline→online while there is
   // no live access token but a persisted device credential exists, re-mint ONCE
@@ -1027,6 +1178,7 @@ const OxyRuntimeProvider = ({
         return;
       }
       void (async () => {
+        if ((0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
         if (oxyServices.session.accessToken || !sessionClientHost.getDeviceCredential()) {
           return;
         }
@@ -1038,14 +1190,15 @@ const OxyRuntimeProvider = ({
         await syncFromClient();
       })().catch(() => undefined);
     });
-  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient, runtime]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
   const refreshSessionsForContext = (0, _react.useCallback)(async () => {
+    if ((0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) throw new Error('An isolated OAuth session has no shared device sessions');
     await sessionClient.bootstrap();
     await syncFromClient();
-  }, [sessionClient, syncFromClient]);
+  }, [sessionClient, syncFromClient, runtime]);
 
   // Exposed `switchSession`: route through the server-authoritative
   // `SessionClient`. Resolve the target account from the current device state,
@@ -1054,6 +1207,7 @@ const OxyRuntimeProvider = ({
   // Identity-bound providers reject: this is the session-keyed twin of
   // `switchToAccount`, so leaving it live would be a bypass around the same rule.
   const switchSessionForContext = (0, _react.useCallback)(async sessionId => {
+    if ((0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) throw new Error('An isolated OAuth session cannot switch device sessions');
     if (isIdentityBound) {
       throw new _index2.IdentityBoundSessionError('switchSession');
     }
@@ -1100,6 +1254,7 @@ const OxyRuntimeProvider = ({
     tokenReady,
     initialized,
     identityBound: isIdentityBound,
+    isolatedOAuth: (0, _isolatedOAuthSession.readIsolatedOAuthSession)(runtime) !== null,
     oxyServices,
     sessionClient,
     syncFromClient,
@@ -1186,6 +1341,7 @@ const OxyRuntimeProvider = ({
     revokeSuspiciousSignIn,
     handleWebSession,
     startWebOAuthSignIn: startWebOAuthSignInForContext,
+    startNativeOAuthSignIn: startNativeOAuthSignInForContext,
     requestOAuthConsent: requestOAuthConsentForContext,
     logout,
     logoutAll,
@@ -1213,8 +1369,9 @@ const OxyRuntimeProvider = ({
     switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isAccountCacheReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isAccountCacheReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, startNativeOAuthSignInForContext, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   const authActionsValue = (0, _react.useMemo)(() => ({
+    ensureDeviceSessionLane,
     signIn,
     logout,
     logoutAll,
@@ -1226,7 +1383,7 @@ const OxyRuntimeProvider = ({
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
     openAccountDialog
-  }), [signIn, logout, logoutAll, refreshSessionsForContext, oxyServices, switchToAccount, hasIdentity, getPublicKey, showBottomSheetForContext, openAvatarPicker, openAccountDialog]);
+  }), [ensureDeviceSessionLane, signIn, logout, logoutAll, refreshSessionsForContext, oxyServices, switchToAccount, hasIdentity, getPublicKey, showBottomSheetForContext, openAvatarPicker, openAccountDialog]);
 
   // Two contexts, deliberately. The inner one carries the wide compatibility
   // value every `useOxy()` consumer reads, rebuilt whenever any of its members