@oxy.so/services 11.0.0 → 11.2.0-oxy-one.0

package/lib/commonjs/ui/context/useOxyAccountGraph.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","_core","_oxyContextHelpers","_index","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","identityBound","oxyServices","sessionClient","syncFromClient","commitSession","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","useState","refreshAccounts","useCallback","session","accessToken","list","err","isUnauthorizedStatus","current","__DEV__","loggerUtil","debug","component","useEffect","refresh","switchToAccount","accountId","IdentityBoundSessionError","deviceState","getState","some","account","switchAccount","result","actAs","user","sessionId","Error","deviceSecret","deviceId","expiresAt","userId","id","activate","createAccount","data","create"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAqBO,SAASI,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,aAAa;EACbC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAG,IAAAC,eAAQ,EAAgB,EAAE,CAAC;EAE3D,MAAMC,eAAe,GAAG,IAAAC,kBAAW,EAAC,YAA2B;IAC7D,IAAIX,aAAa,IAAI,CAACH,eAAe,IAAI,CAACC,UAAU,IAAI,CAACG,WAAW,CAACW,OAAO,CAACC,WAAW,EAAE;MACxFL,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMM,IAAI,GAAG,MAAMb,WAAW,CAACM,QAAQ,CAACO,IAAI,CAAC,CAAC;MAC9CN,WAAW,CAACM,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,IAAI,IAAAC,uCAAoB,EAACD,GAAG,CAAC,EAAE;QAC7BP,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACW,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXC,YAAU,CAACC,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEN,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAACf,aAAa,EAAEH,eAAe,EAAEI,WAAW,EAAEH,UAAU,EAAEQ,oBAAoB,CAAC,CAAC;EAEnF,IAAAgB,gBAAS,EAAC,MAAM;IACd,IAAI,CAACtB,aAAa,IAAIH,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MAClEY,eAAe,CAAC,CAAC;MACjB,KAAKL,0BAA0B,CAACY,OAAO,EAAEM,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACvB,aAAa,EAAEH,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEY,eAAe,EAAEL,0BAA0B,CAAC,CAAC;EAE1G,MAAMmB,eAAe,GAAG,IAAAb,kBAAW,EACjC,MAAOc,SAAiB,IAAoB;IAC1C,IAAIzB,aAAa,EAAE;MACjB;MACA;MACA;MACA,MAAM,IAAI0B,gCAAyB,CAAC,iBAAiB,CAAC;IACxD;IACA,MAAMC,WAAW,GAAGzB,aAAa,CAAC0B,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAEpB,QAAQ,CAACsB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACL,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAMvB,aAAa,CAAC6B,aAAa,CAACN,SAAS,CAAC;MAC5C,MAAMtB,cAAc,CAAC,CAAC;MACtB;IACF;IAEA,MAAM6B,MAAM,GAAG,MAAM/B,WAAW,CAACM,QAAQ,CAAC0B,KAAK,CAACR,SAAS,CAAC;IAC1D,IAAI,CAACO,MAAM,EAAEE,IAAI,IAAI,CAACF,MAAM,EAAEG,SAAS,EAAE;MACvC,MAAM,IAAIC,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAMhC,aAAa,CACjB;MACE+B,SAAS,EAAEH,MAAM,CAACG,SAAS;MAC3BtB,WAAW,EAAEmB,MAAM,CAACnB,WAAW;MAC/BwB,YAAY,EAAEL,MAAM,CAACK,YAAY;MACjCC,QAAQ,EAAEN,MAAM,CAACM,QAAQ;MACzBC,SAAS,EAAEP,MAAM,CAACO,SAAS;MAC3BC,MAAM,EAAER,MAAM,CAACE,IAAI,CAACO,EAAE;MACtBP,IAAI,EAAEF,MAAM,CAACE;IACf,CAAC;IACD;IACA;IACA;MAAEQ,QAAQ,EAAE;IAAK,CACnB,CAAC;EACH,CAAC;EACD;EACA;EACA;EACA;EACA,CAAC1C,aAAa,EAAEC,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,CAC3E,CAAC;EAED,MAAMuC,aAAa,GAAG,IAAAhC,kBAAW,EAC/B,MAAOiC,IAAwB,IAA2B;IACxD,MAAMd,OAAO,GAAG,MAAM7B,WAAW,CAACM,QAAQ,CAACsC,MAAM,CAACD,IAAI,CAAC;IACvD,MAAMlC,eAAe,CAAC,CAAC;IACvB,OAAOoB,OAAO;EAChB,CAAC,EACD,CAAC7B,WAAW,EAAES,eAAe,CAC/B,CAAC;EAED,OAAO;IACLH,QAAQ;IACRG,eAAe;IACfc,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_react","require","_core","_oxyContextHelpers","_index","useOxyAccountGraph","isAuthenticated","tokenReady","initialized","identityBound","isolatedOAuth","oxyServices","sessionClient","syncFromClient","commitSession","accountDialogControllerRef","clearSessionStateRef","accounts","setAccounts","useState","refreshAccounts","useCallback","session","accessToken","list","err","isUnauthorizedStatus","current","__DEV__","loggerUtil","debug","component","useEffect","refresh","switchToAccount","accountId","Error","IdentityBoundSessionError","deviceState","getState","some","account","switchAccount","result","actAs","user","sessionId","deviceSecret","deviceId","expiresAt","userId","id","activate","createAccount","data","create"],"sourceRoot":"../../../../src","sources":["ui/context/useOxyAccountGraph.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAsBO,SAASI,kBAAkBA,CAAC;EACjCC,eAAe;EACfC,UAAU;EACVC,WAAW;EACXC,aAAa;EACbC,aAAa;EACbC,WAAW;EACXC,aAAa;EACbC,cAAc;EACdC,aAAa;EACbC,0BAA0B;EAC1BC;AACwB,CAAC,EAAE;EAC3B,MAAM,CAACC,QAAQ,EAAEC,WAAW,CAAC,GAAG,IAAAC,eAAQ,EAAgB,EAAE,CAAC;EAE3D,MAAMC,eAAe,GAAG,IAAAC,kBAAW,EAAC,YAA2B;IAC7D,IAAIZ,aAAa,IAAIC,aAAa,IAAI,CAACJ,eAAe,IAAI,CAACC,UAAU,IAAI,CAACI,WAAW,CAACW,OAAO,CAACC,WAAW,EAAE;MACzGL,WAAW,CAAC,EAAE,CAAC;MACf;IACF;IACA,IAAI;MACF,MAAMM,IAAI,GAAG,MAAMb,WAAW,CAACM,QAAQ,CAACO,IAAI,CAAC,CAAC;MAC9CN,WAAW,CAACM,IAAI,CAAC;IACnB,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,IAAI,IAAAC,uCAAoB,EAACD,GAAG,CAAC,EAAE;QAC7BP,WAAW,CAAC,EAAE,CAAC;QACf,MAAMF,oBAAoB,CAACW,OAAO,CAAC,CAAC;QACpC;MACF;MACA,IAAIC,OAAO,EAAE;QACXC,YAAU,CAACC,KAAK,CAAC,yBAAyB,EAAE;UAAEC,SAAS,EAAE;QAAa,CAAC,EAAEN,GAAc,CAAC;MAC1F;IACF;EACF,CAAC,EAAE,CAAChB,aAAa,EAAEC,aAAa,EAAEJ,eAAe,EAAEK,WAAW,EAAEJ,UAAU,EAAES,oBAAoB,CAAC,CAAC;EAElG,IAAAgB,gBAAS,EAAC,MAAM;IACd,IAAI,CAACvB,aAAa,IAAI,CAACC,aAAa,IAAIJ,eAAe,IAAIE,WAAW,IAAID,UAAU,EAAE;MACpFa,eAAe,CAAC,CAAC;MACjB,KAAKL,0BAA0B,CAACY,OAAO,EAAEM,OAAO,CAAC,CAAC;IACpD;EACF,CAAC,EAAE,CAACxB,aAAa,EAAEC,aAAa,EAAEJ,eAAe,EAAEE,WAAW,EAAED,UAAU,EAAEa,eAAe,EAAEL,0BAA0B,CAAC,CAAC;EAEzH,MAAMmB,eAAe,GAAG,IAAAb,kBAAW,EACjC,MAAOc,SAAiB,IAAoB;IAC1C,IAAIzB,aAAa,EAAE,MAAM,IAAI0B,KAAK,CAAC,gEAAgE,CAAC;IACpG,IAAI3B,aAAa,EAAE;MACjB;MACA;MACA;MACA,MAAM,IAAI4B,gCAAyB,CAAC,iBAAiB,CAAC;IACxD;IACA,MAAMC,WAAW,GAAG1B,aAAa,CAAC2B,QAAQ,CAAC,CAAC;IAC5C,IAAID,WAAW,EAAErB,QAAQ,CAACuB,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACN,SAAS,KAAKA,SAAS,CAAC,EAAE;MAC5E,MAAMvB,aAAa,CAAC8B,aAAa,CAACP,SAAS,CAAC;MAC5C,MAAMtB,cAAc,CAAC,CAAC;MACtB;IACF;IAEA,MAAM8B,MAAM,GAAG,MAAMhC,WAAW,CAACM,QAAQ,CAAC2B,KAAK,CAACT,SAAS,CAAC;IAC1D,IAAI,CAACQ,MAAM,EAAEE,IAAI,IAAI,CAACF,MAAM,EAAEG,SAAS,EAAE;MACvC,MAAM,IAAIV,KAAK,CAAC,+CAA+C,CAAC;IAClE;IACA,MAAMtB,aAAa,CACjB;MACEgC,SAAS,EAAEH,MAAM,CAACG,SAAS;MAC3BvB,WAAW,EAAEoB,MAAM,CAACpB,WAAW;MAC/BwB,YAAY,EAAEJ,MAAM,CAACI,YAAY;MACjCC,QAAQ,EAAEL,MAAM,CAACK,QAAQ;MACzBC,SAAS,EAAEN,MAAM,CAACM,SAAS;MAC3BC,MAAM,EAAEP,MAAM,CAACE,IAAI,CAACM,EAAE;MACtBN,IAAI,EAAEF,MAAM,CAACE;IACf,CAAC;IACD;IACA;IACA;MAAEO,QAAQ,EAAE;IAAK,CACnB,CAAC;EACH,CAAC;EACD;EACA;EACA;EACA;EACA,CAAC3C,aAAa,EAAEC,aAAa,EAAEC,WAAW,EAAEC,aAAa,EAAEC,cAAc,EAAEC,aAAa,CAC1F,CAAC;EAED,MAAMuC,aAAa,GAAG,IAAAhC,kBAAW,EAC/B,MAAOiC,IAAwB,IAA2B;IACxD,MAAMb,OAAO,GAAG,MAAM9B,WAAW,CAACM,QAAQ,CAACsC,MAAM,CAACD,IAAI,CAAC;IACvD,MAAMlC,eAAe,CAAC,CAAC;IACvB,OAAOqB,OAAO;EAChB,CAAC,EACD,CAAC9B,WAAW,EAAES,eAAe,CAC/B,CAAC;EAED,OAAO;IACLH,QAAQ;IACRG,eAAe;IACfc,eAAe;IACfmB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/hooks/queries/usePersonalPlans.js

@@ -0,0 +1,43 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.usePersonalPlanSubscriptions = usePersonalPlanSubscriptions;
+exports.usePersonalPlans = usePersonalPlans;
+var _reactQuery = require("@tanstack/react-query");
+var _core = require("@oxy.so/core");
+var _OxyContext = require("../../context/OxyContext.js");
+/** Public discovery; deliberately outside persisted customer payment queries. */
+function usePersonalPlans() {
+  const {
+    oxyServices
+  } = (0, _OxyContext.useOxy)();
+  return (0, _reactQuery.useQuery)({
+    queryKey: ['personal-plan-catalogue'],
+    queryFn: () => oxyServices.billing.personalPlans(),
+    staleTime: 0
+  });
+}
+
+/** Account and session partitioning plus a server-side expected-subject fence. */
+function usePersonalPlanSubscriptions() {
+  const {
+    oxyServices,
+    user,
+    isAuthenticated,
+    activeSessionId
+  } = (0, _OxyContext.useOxy)();
+  const accountId = user?.id;
+  return (0, _reactQuery.useQuery)({
+    queryKey: ['personal-plan-sources', accountId, activeSessionId],
+    queryFn: () => {
+      if (!accountId) throw new Error('Authentication required');
+      return (0, _core.authenticatedApiCall)(oxyServices, activeSessionId, () => oxyServices.billing.productSubscriptions(accountId));
+    },
+    enabled: isAuthenticated && !!accountId,
+    staleTime: 0,
+    gcTime: 0
+  });
+}
+//# sourceMappingURL=usePersonalPlans.js.map

package/lib/commonjs/ui/hooks/queries/usePersonalPlans.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_reactQuery","require","_core","_OxyContext","usePersonalPlans","oxyServices","useOxy","useQuery","queryKey","queryFn","billing","personalPlans","staleTime","usePersonalPlanSubscriptions","user","isAuthenticated","activeSessionId","accountId","id","Error","authenticatedApiCall","productSubscriptions","enabled","gcTime"],"sourceRoot":"../../../../../src","sources":["ui/hooks/queries/usePersonalPlans.ts"],"mappings":";;;;;;;AAAA,IAAAA,WAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AAEA;AACO,SAASG,gBAAgBA,CAAA,EAAG;EACjC,MAAM;IAAEC;EAAY,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EAChC,OAAO,IAAAC,oBAAQ,EAAC;IAAEC,QAAQ,EAAE,CAAC,yBAAyB,CAAC;IACrDC,OAAO,EAAEA,CAAA,KAAMJ,WAAW,CAACK,OAAO,CAACC,aAAa,CAAC,CAAC;IAAEC,SAAS,EAAE;EAAE,CAAC,CAAC;AACvE;;AAEA;AACO,SAASC,4BAA4BA,CAAA,EAAG;EAC7C,MAAM;IAAER,WAAW;IAAES,IAAI;IAAEC,eAAe;IAAEC;EAAgB,CAAC,GAAG,IAAAV,kBAAM,EAAC,CAAC;EACxE,MAAMW,SAAS,GAAGH,IAAI,EAAEI,EAAE;EAC1B,OAAO,IAAAX,oBAAQ,EAAC;IAAEC,QAAQ,EAAE,CAAC,uBAAuB,EAAES,SAAS,EAAED,eAAe,CAAC;IAC/EP,OAAO,EAAEA,CAAA,KAAM;MACb,IAAI,CAACQ,SAAS,EAAE,MAAM,IAAIE,KAAK,CAAC,yBAAyB,CAAC;MAC1D,OAAO,IAAAC,0BAAoB,EAACf,WAAW,EAAEW,eAAe,EACtD,MAAMX,WAAW,CAACK,OAAO,CAACW,oBAAoB,CAACJ,SAAS,CAAC,CAAC;IAC9D,CAAC;IACDK,OAAO,EAAEP,eAAe,IAAI,CAAC,CAACE,SAAS;IAAEL,SAAS,EAAE,CAAC;IAAEW,MAAM,EAAE;EAAE,CAAC,CAAC;AACvE","ignoreList":[]}

package/lib/commonjs/ui/hooks/useAuth.js

@@ -83,9 +83,12 @@ function useAuth() {
     getPublicKey,
     showBottomSheet,
     openAvatarPicker,
-    openAccountDialog
+    openAccountDialog,
+    ensureDeviceSessionLane
   } = (0, _OxyContext.useOxyAuthActions)();
   const signIn = (0, _react.useCallback)(async publicKey => {
+    const classification = ensureDeviceSessionLane();
+    if (classification) await classification;
     // Native: sign in directly with the cryptographic identity when a public key
     // is provided, or an existing keychain identity is found.
     if (publicKey) {
@@ -116,9 +119,10 @@ function useAuth() {
     return {
       status: 'dialog-opened'
     };
-  }, [oxySignIn, hasIdentity, getPublicKey, openAccountDialog]);
+  }, [oxySignIn, hasIdentity, getPublicKey, openAccountDialog, ensureDeviceSessionLane]);
   const signOut = (0, _react.useCallback)(async () => {
-    await logout();
+    const result = await logout();
+    if (result.status === 'failed') throw result.error;
   }, [logout]);
   const signOutAll = (0, _react.useCallback)(async () => {
     await logoutAll();

package/lib/commonjs/ui/hooks/useAuth.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","_OxyContext","_isWebBrowser","_index","selectAuthState","snapshot","user","account","isAuthenticated","isLoading","isReady","tokenReady","hasAccessToken","canUsePrivateApi","authResolved","isPrivateApiPending","isAuthResolved","error","message","authStatesEqual","left","right","useAuth","runtime","useOxyRuntime","useRuntimeSelector","signIn","oxySignIn","logout","logoutAll","refreshSessions","oxyServices","switchToAccount","hasIdentity","getPublicKey","showBottomSheet","openAvatarPicker","openAccountDialog","useOxyAuthActions","useCallback","publicKey","status","isWebBrowser","hasExisting","existingKey","signOut","signOutAll","refresh"],"sourceRoot":"../../../../src","sources":["ui/hooks/useAuth.ts"],"mappings":";;;;;;AA4BA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AAEA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAhCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA8FA,MAAMI,eAAe,GAAIC,QAA4B,KAAiB;EACpEC,IAAI,EAAED,QAAQ,CAACE,OAAO;EACtBC,eAAe,EAAEH,QAAQ,CAACE,OAAO,KAAK,IAAI;EAC1CE,SAAS,EAAEJ,QAAQ,CAACI,SAAS;EAC7BC,OAAO,EAAEL,QAAQ,CAACM,UAAU;EAC5BC,cAAc,EAAEP,QAAQ,CAACO,cAAc;EACvCC,gBAAgB,EAAER,QAAQ,CAACS,YAAY,IAClCT,QAAQ,CAACE,OAAO,KAAK,IAAI,IACzBF,QAAQ,CAACM,UAAU,IACnBN,QAAQ,CAACO,cAAc;EAC5BG,mBAAmB,EAAE,CAACV,QAAQ,CAACS,YAAY,IACrCT,QAAQ,CAACE,OAAO,KAAK,IAAI,KAAK,CAACF,QAAQ,CAACM,UAAU,IAAI,CAACN,QAAQ,CAACO,cAAc,CAAE;EACtFI,cAAc,EAAEX,QAAQ,CAACS,YAAY;EACrCG,KAAK,EAAEZ,QAAQ,CAACY,KAAK,EAAEC,OAAO,IAAI;AACpC,CAAC,CAAC;AAEF,MAAMC,eAAe,GAAGA,CAACC,IAAe,EAAEC,KAAgB,KACxDD,IAAI,CAACd,IAAI,KAAKe,KAAK,CAACf,IAAI,IACrBc,IAAI,CAACZ,eAAe,KAAKa,KAAK,CAACb,eAAe,IAC9CY,IAAI,CAACX,SAAS,KAAKY,KAAK,CAACZ,SAAS,IAClCW,IAAI,CAACV,OAAO,KAAKW,KAAK,CAACX,OAAO,IAC9BU,IAAI,CAACR,cAAc,KAAKS,KAAK,CAACT,cAAc,IAC5CQ,IAAI,CAACP,gBAAgB,KAAKQ,KAAK,CAACR,gBAAgB,IAChDO,IAAI,CAACL,mBAAmB,KAAKM,KAAK,CAACN,mBAAmB,IACtDK,IAAI,CAACJ,cAAc,KAAKK,KAAK,CAACL,cAAc,IAC5CI,IAAI,CAACH,KAAK,KAAKI,KAAK,CAACJ,KAAK;;AAE/B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,OAAOA,CAAA,EAAkB;EACvC,MAAMC,OAAO,GAAG,IAAAC,oBAAa,EAAC,CAAC;EAC/B,MAAM;IACJlB,IAAI;IACJE,eAAe;IACfC,SAAS;IACTC,OAAO;IACPE,cAAc;IACdC,gBAAgB;IAChBE,mBAAmB;IACnBC,cAAc;IACdC;EACF,CAAC,GAAG,IAAAQ,yBAAkB,EAACF,OAAO,EAAEnB,eAAe,EAAEe,eAAe,CAAC;EACjE,MAAM;IACJO,MAAM,EAAEC,SAAS;IACjBC,MAAM;IACNC,SAAS;IACTC,eAAe;IACfC,WAAW;IACXC,eAAe;IACfC,WAAW;IACXC,YAAY;IACZC,eAAe;IACfC,gBAAgB;IAChBC;EACF,CAAC,GAAG,IAAAC,6BAAiB,EAAC,CAAC;EAEvB,MAAMZ,MAAM,GAAG,IAAAa,kBAAW,EAAC,MAAOC,SAAkB,IAA6B;IAC/E;IACA;IACA,IAAIA,SAAS,EAAE;MACb,OAAO;QAAEC,MAAM,EAAE,eAAe;QAAEnC,IAAI,EAAE,MAAMqB,SAAS,CAACa,SAAS;MAAE,CAAC;IACtE;IACA,IAAI,CAAC,IAAAE,0BAAY,EAAC,CAAC,EAAE;MACnB,MAAMC,WAAW,GAAG,MAAMV,WAAW,CAAC,CAAC;MACvC,IAAIU,WAAW,EAAE;QACf,MAAMC,WAAW,GAAG,MAAMV,YAAY,CAAC,CAAC;QACxC,IAAIU,WAAW,EAAE;UACf,OAAO;YAAEH,MAAM,EAAE,eAAe;YAAEnC,IAAI,EAAE,MAAMqB,SAAS,CAACiB,WAAW;UAAE,CAAC;QACxE;MACF;IACF;;IAEA;IACA;IACA;IACA;IACA;IACAP,iBAAiB,CAAC,QAAQ,CAAC;IAC3B,OAAO;MAAEI,MAAM,EAAE;IAAgB,CAAC;EACpC,CAAC,EAAE,CAACd,SAAS,EAAEM,WAAW,EAAEC,YAAY,EAAEG,iBAAiB,CAAC,CAAC;EAE7D,MAAMQ,OAAO,GAAG,IAAAN,kBAAW,EAAC,YAA2B;IACrD,MAAMX,MAAM,CAAC,CAAC;EAChB,CAAC,EAAE,CAACA,MAAM,CAAC,CAAC;EAEZ,MAAMkB,UAAU,GAAG,IAAAP,kBAAW,EAAC,YAA2B;IACxD,MAAMV,SAAS,CAAC,CAAC;EACnB,CAAC,EAAE,CAACA,SAAS,CAAC,CAAC;EAEf,MAAMkB,OAAO,GAAG,IAAAR,kBAAW,EAAC,YAA2B;IACrD,MAAMT,eAAe,CAAC,CAAC;EACzB,CAAC,EAAE,CAACA,eAAe,CAAC,CAAC;EAErB,OAAO;IACL;IACAxB,IAAI;IACJE,eAAe;IACfC,SAAS,EAAEA,SAAS,IAAI,CAACO,cAAc;IACvCN,OAAO;IACPE,cAAc;IACdC,gBAAgB;IAChBE,mBAAmB;IACnBC,cAAc;IACdC,KAAK;IAEL;IACAS,MAAM;IACNmB,OAAO;IACPC,UAAU;IACVC,OAAO;IAEP;IACAhB,WAAW;IACXC,eAAe;IACfG,eAAe;IACfC;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_react","require","_OxyContext","_isWebBrowser","_index","selectAuthState","snapshot","user","account","isAuthenticated","isLoading","isReady","tokenReady","hasAccessToken","canUsePrivateApi","authResolved","isPrivateApiPending","isAuthResolved","error","message","authStatesEqual","left","right","useAuth","runtime","useOxyRuntime","useRuntimeSelector","signIn","oxySignIn","logout","logoutAll","refreshSessions","oxyServices","switchToAccount","hasIdentity","getPublicKey","showBottomSheet","openAvatarPicker","openAccountDialog","ensureDeviceSessionLane","useOxyAuthActions","useCallback","publicKey","classification","status","isWebBrowser","hasExisting","existingKey","signOut","result","signOutAll","refresh"],"sourceRoot":"../../../../src","sources":["ui/hooks/useAuth.ts"],"mappings":";;;;;;AA4BA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AAEA,IAAAE,aAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAhCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA8FA,MAAMI,eAAe,GAAIC,QAA4B,KAAiB;EACpEC,IAAI,EAAED,QAAQ,CAACE,OAAO;EACtBC,eAAe,EAAEH,QAAQ,CAACE,OAAO,KAAK,IAAI;EAC1CE,SAAS,EAAEJ,QAAQ,CAACI,SAAS;EAC7BC,OAAO,EAAEL,QAAQ,CAACM,UAAU;EAC5BC,cAAc,EAAEP,QAAQ,CAACO,cAAc;EACvCC,gBAAgB,EAAER,QAAQ,CAACS,YAAY,IAClCT,QAAQ,CAACE,OAAO,KAAK,IAAI,IACzBF,QAAQ,CAACM,UAAU,IACnBN,QAAQ,CAACO,cAAc;EAC5BG,mBAAmB,EAAE,CAACV,QAAQ,CAACS,YAAY,IACrCT,QAAQ,CAACE,OAAO,KAAK,IAAI,KAAK,CAACF,QAAQ,CAACM,UAAU,IAAI,CAACN,QAAQ,CAACO,cAAc,CAAE;EACtFI,cAAc,EAAEX,QAAQ,CAACS,YAAY;EACrCG,KAAK,EAAEZ,QAAQ,CAACY,KAAK,EAAEC,OAAO,IAAI;AACpC,CAAC,CAAC;AAEF,MAAMC,eAAe,GAAGA,CAACC,IAAe,EAAEC,KAAgB,KACxDD,IAAI,CAACd,IAAI,KAAKe,KAAK,CAACf,IAAI,IACrBc,IAAI,CAACZ,eAAe,KAAKa,KAAK,CAACb,eAAe,IAC9CY,IAAI,CAACX,SAAS,KAAKY,KAAK,CAACZ,SAAS,IAClCW,IAAI,CAACV,OAAO,KAAKW,KAAK,CAACX,OAAO,IAC9BU,IAAI,CAACR,cAAc,KAAKS,KAAK,CAACT,cAAc,IAC5CQ,IAAI,CAACP,gBAAgB,KAAKQ,KAAK,CAACR,gBAAgB,IAChDO,IAAI,CAACL,mBAAmB,KAAKM,KAAK,CAACN,mBAAmB,IACtDK,IAAI,CAACJ,cAAc,KAAKK,KAAK,CAACL,cAAc,IAC5CI,IAAI,CAACH,KAAK,KAAKI,KAAK,CAACJ,KAAK;;AAE/B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,OAAOA,CAAA,EAAkB;EACvC,MAAMC,OAAO,GAAG,IAAAC,oBAAa,EAAC,CAAC;EAC/B,MAAM;IACJlB,IAAI;IACJE,eAAe;IACfC,SAAS;IACTC,OAAO;IACPE,cAAc;IACdC,gBAAgB;IAChBE,mBAAmB;IACnBC,cAAc;IACdC;EACF,CAAC,GAAG,IAAAQ,yBAAkB,EAACF,OAAO,EAAEnB,eAAe,EAAEe,eAAe,CAAC;EACjE,MAAM;IACJO,MAAM,EAAEC,SAAS;IACjBC,MAAM;IACNC,SAAS;IACTC,eAAe;IACfC,WAAW;IACXC,eAAe;IACfC,WAAW;IACXC,YAAY;IACZC,eAAe;IACfC,gBAAgB;IAChBC,iBAAiB;IACjBC;EACF,CAAC,GAAG,IAAAC,6BAAiB,EAAC,CAAC;EAEvB,MAAMb,MAAM,GAAG,IAAAc,kBAAW,EAAC,MAAOC,SAAkB,IAA6B;IAC/E,MAAMC,cAAc,GAAGJ,uBAAuB,CAAC,CAAC;IAChD,IAAII,cAAc,EAAE,MAAMA,cAAc;IACxC;IACA;IACA,IAAID,SAAS,EAAE;MACb,OAAO;QAAEE,MAAM,EAAE,eAAe;QAAErC,IAAI,EAAE,MAAMqB,SAAS,CAACc,SAAS;MAAE,CAAC;IACtE;IACA,IAAI,CAAC,IAAAG,0BAAY,EAAC,CAAC,EAAE;MACnB,MAAMC,WAAW,GAAG,MAAMZ,WAAW,CAAC,CAAC;MACvC,IAAIY,WAAW,EAAE;QACf,MAAMC,WAAW,GAAG,MAAMZ,YAAY,CAAC,CAAC;QACxC,IAAIY,WAAW,EAAE;UACf,OAAO;YAAEH,MAAM,EAAE,eAAe;YAAErC,IAAI,EAAE,MAAMqB,SAAS,CAACmB,WAAW;UAAE,CAAC;QACxE;MACF;IACF;;IAEA;IACA;IACA;IACA;IACA;IACAT,iBAAiB,CAAC,QAAQ,CAAC;IAC3B,OAAO;MAAEM,MAAM,EAAE;IAAgB,CAAC;EACpC,CAAC,EAAE,CAAChB,SAAS,EAAEM,WAAW,EAAEC,YAAY,EAAEG,iBAAiB,EAAEC,uBAAuB,CAAC,CAAC;EAEtF,MAAMS,OAAO,GAAG,IAAAP,kBAAW,EAAC,YAA2B;IACrD,MAAMQ,MAAM,GAAG,MAAMpB,MAAM,CAAC,CAAC;IAC7B,IAAIoB,MAAM,CAACL,MAAM,KAAK,QAAQ,EAAE,MAAMK,MAAM,CAAC/B,KAAK;EACpD,CAAC,EAAE,CAACW,MAAM,CAAC,CAAC;EAEZ,MAAMqB,UAAU,GAAG,IAAAT,kBAAW,EAAC,YAA2B;IACxD,MAAMX,SAAS,CAAC,CAAC;EACnB,CAAC,EAAE,CAACA,SAAS,CAAC,CAAC;EAEf,MAAMqB,OAAO,GAAG,IAAAV,kBAAW,EAAC,YAA2B;IACrD,MAAMV,eAAe,CAAC,CAAC;EACzB,CAAC,EAAE,CAACA,eAAe,CAAC,CAAC;EAErB,OAAO;IACL;IACAxB,IAAI;IACJE,eAAe;IACfC,SAAS,EAAEA,SAAS,IAAI,CAACO,cAAc;IACvCN,OAAO;IACPE,cAAc;IACdC,gBAAgB;IAChBE,mBAAmB;IACnBC,cAAc;IACdC,KAAK;IAEL;IACAS,MAAM;IACNqB,OAAO;IACPE,UAAU;IACVC,OAAO;IAEP;IACAnB,WAAW;IACXC,eAAe;IACfG,eAAe;IACfC;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/oauth/applicationSessionLane.js

@@ -0,0 +1,32 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.APPLICATION_CLASSIFICATION_DEADLINE_MS = void 0;
+exports.classifyApplicationSessionLane = classifyApplicationSessionLane;
+exports.resolveApplicationSessionLane = resolveApplicationSessionLane;
+var _contracts = require("@oxy.so/contracts");
+function classifyApplicationSessionLane(metadata) {
+  const application = _contracts.publicApplicationSchema.parse(metadata);
+  return application.type === 'third_party' && !application.isOfficial && !application.isInternal ? 'oauth' : 'device';
+}
+const APPLICATION_CLASSIFICATION_DEADLINE_MS = exports.APPLICATION_CLASSIFICATION_DEADLINE_MS = 5000;
+
+/** The active registry projection is authoritative; names and origins confer no trust. */
+async function resolveApplicationSessionLane(oxyServices, clientId) {
+  if (!clientId) throw new Error('A registered clientId is required');
+  // The public endpoint rejects inactive applications and unusable credentials.
+  let timer;
+  try {
+    const metadata = await Promise.race([oxyServices.apps.getPublic(clientId, {
+      cache: false
+    }), new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error('Application classification timed out')), APPLICATION_CLASSIFICATION_DEADLINE_MS);
+    })]);
+    return classifyApplicationSessionLane(metadata);
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+}
+//# sourceMappingURL=applicationSessionLane.js.map

package/lib/commonjs/ui/oauth/applicationSessionLane.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_contracts","require","classifyApplicationSessionLane","metadata","application","publicApplicationSchema","parse","type","isOfficial","isInternal","APPLICATION_CLASSIFICATION_DEADLINE_MS","exports","resolveApplicationSessionLane","oxyServices","clientId","Error","timer","Promise","race","apps","getPublic","cache","_","reject","setTimeout","undefined","clearTimeout"],"sourceRoot":"../../../../src","sources":["ui/oauth/applicationSessionLane.ts"],"mappings":";;;;;;;;AAAA,IAAAA,UAAA,GAAAC,OAAA;AAGO,SAASC,8BAA8BA,CAACC,QAAiB,EAAsB;EACpF,MAAMC,WAAW,GAAGC,kCAAuB,CAACC,KAAK,CAACH,QAAQ,CAAC;EAC3D,OAAOC,WAAW,CAACG,IAAI,KAAK,aAAa,IAAI,CAACH,WAAW,CAACI,UAAU,IAAI,CAACJ,WAAW,CAACK,UAAU,GAAG,OAAO,GAAG,QAAQ;AACtH;AAEO,MAAMC,sCAAsC,GAAAC,OAAA,CAAAD,sCAAA,GAAG,IAAI;;AAE1D;AACO,eAAeE,6BAA6BA,CACjDC,WAAwB,EACxBC,QAAmC,EACN;EAC7B,IAAI,CAACA,QAAQ,EAAE,MAAM,IAAIC,KAAK,CAAC,mCAAmC,CAAC;EACnE;EACA,IAAIC,KAAgD;EACpD,IAAI;IACF,MAAMb,QAAQ,GAAG,MAAMc,OAAO,CAACC,IAAI,CAAC,CAClCL,WAAW,CAACM,IAAI,CAACC,SAAS,CAACN,QAAQ,EAAE;MAAEO,KAAK,EAAE;IAAM,CAAC,CAAC,EACtD,IAAIJ,OAAO,CAAQ,CAACK,CAAC,EAAEC,MAAM,KAAK;MAAEP,KAAK,GAAGQ,UAAU,CAAC,MAAMD,MAAM,CAAC,IAAIR,KAAK,CAAC,sCAAsC,CAAC,CAAC,EAAEL,sCAAsC,CAAC;IAAE,CAAC,CAAC,CACpK,CAAC;IACF,OAAOR,8BAA8B,CAACC,QAAQ,CAAC;EACjD,CAAC,SAAS;IAAE,IAAIa,KAAK,KAAKS,SAAS,EAAEC,YAAY,CAACV,KAAK,CAAC;EAAE;AAC5D","ignoreList":[]}

package/lib/commonjs/ui/oauth/completeOAuthCode.js

@@ -16,10 +16,10 @@ var _core = require("@oxy.so/core");
  *
  * Ordering is deliberate and load-bearing:
  *   1. validate `state` BEFORE anything is sent to the token endpoint,
- *   2. exchange the code for a session,
+ *   2. exchange the code for session material without changing the bearer,
  *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
  *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
- *   4. commit the session.
+ *   4. validate and commit the session through the provider's funnel.
  *
  * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
  * and a failed exchange.
@@ -50,6 +50,8 @@ async function completeOAuthCode(input) {
       clientId: input.clientId,
       redirectUri: input.redirectUri,
       codeVerifier: input.handshake.codeVerifier
+    }, {
+      plantTokens: false
     });
     runCleanup();
     await input.commitSession({

package/lib/commonjs/ui/oauth/completeOAuthCode.js.map

@@ -1 +1 @@
-{"version":3,"names":["_core","require","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","logger","warn","component","ok","reason","result","oxyServices","auth","oauth","exchangeCode","code","clientId","redirectUri","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;;;;;AAqBA,IAAAA,KAAA,GAAAC,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AA2BO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FE,YAAM,CAACC,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFP,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMZ,KAAK,CAACa,WAAW,CAACC,IAAI,CAACC,KAAK,CAACC,YAAY,CAAC;MAC7DC,IAAI,EAAEjB,KAAK,CAACiB,IAAI;MAChBC,QAAQ,EAAElB,KAAK,CAACkB,QAAQ;MACxBC,WAAW,EAAEnB,KAAK,CAACmB,WAAW;MAC9BC,YAAY,EAAEpB,KAAK,CAACI,SAAS,CAACgB;IAChC,CAAC,CAAC;IACFlB,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACqB,aAAa,CAAC;MACxBC,SAAS,EAAEV,MAAM,CAACU,SAAS;MAC3BC,WAAW,EAAEX,MAAM,CAACW,WAAW;MAC/BC,QAAQ,EAAEZ,MAAM,CAACY,QAAQ;MACzBC,YAAY,EAAEb,MAAM,CAACa,YAAY;MACjCC,MAAM,EAAEd,MAAM,CAACe,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEjB,MAAM,CAACiB,SAAS;MAC3BF,IAAI,EAAEf,MAAM,CAACe;IACf,CAAC,CAAC;IACF,OAAO;MAAEjB,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOoB,KAAK,EAAE;IACdvB,YAAM,CAACC,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEqB,KAAK,CAAC;IACpF5B,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}
+{"version":3,"names":["_core","require","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","logger","warn","component","ok","reason","result","oxyServices","auth","oauth","exchangeCode","code","clientId","redirectUri","codeVerifier","plantTokens","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;;;;;AAqBA,IAAAA,KAAA,GAAAC,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AA2BO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FE,YAAM,CAACC,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFP,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMZ,KAAK,CAACa,WAAW,CAACC,IAAI,CAACC,KAAK,CAACC,YAAY,CAAC;MAC7DC,IAAI,EAAEjB,KAAK,CAACiB,IAAI;MAChBC,QAAQ,EAAElB,KAAK,CAACkB,QAAQ;MACxBC,WAAW,EAAEnB,KAAK,CAACmB,WAAW;MAC9BC,YAAY,EAAEpB,KAAK,CAACI,SAAS,CAACgB;IAChC,CAAC,EAAE;MAAEC,WAAW,EAAE;IAAM,CAAC,CAAC;IAC1BnB,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACsB,aAAa,CAAC;MACxBC,SAAS,EAAEX,MAAM,CAACW,SAAS;MAC3BC,WAAW,EAAEZ,MAAM,CAACY,WAAW;MAC/BC,QAAQ,EAAEb,MAAM,CAACa,QAAQ;MACzBC,YAAY,EAAEd,MAAM,CAACc,YAAY;MACjCC,MAAM,EAAEf,MAAM,CAACgB,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAElB,MAAM,CAACkB,SAAS;MAC3BF,IAAI,EAAEhB,MAAM,CAACgB;IACf,CAAC,CAAC;IACF,OAAO;MAAElB,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOqB,KAAK,EAAE;IACdxB,YAAM,CAACC,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEsB,KAAK,CAAC;IACpF7B,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}

package/lib/commonjs/ui/oauth/nativeAuthTransport.js

@@ -0,0 +1,119 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.startNativeOAuthSignIn = startNativeOAuthSignIn;
+var _oauthNavigation = require("../components/oauthNavigation.js");
+var _applicationSessionLane = require("./applicationSessionLane.js");
+var _completeOAuthCode = require("./completeOAuthCode.js");
+var _oauthHandshake = require("./oauthHandshake.js");
+const attempts = new WeakSet();
+function isExactRedirectUri(value) {
+  if (!value || value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const uri = new URL(value);
+    return !uri.username && !uri.password && !uri.hash && !['code', 'state', 'error', 'error_description'].some(key => uri.searchParams.has(key));
+  } catch {
+    return false;
+  }
+}
+
+/** SDK owns the in-memory handshake, observed native callback and session commit. */
+async function startNativeOAuthSignIn(context, options) {
+  if (context.platform !== 'native') return {
+    status: 'unsupported',
+    reason: 'unsupported-platform'
+  };
+  if (!context.clientId) return {
+    status: 'unsupported',
+    reason: 'missing-client-id'
+  };
+  if (context.identityBound) return {
+    status: 'unsupported',
+    reason: 'identity-bound'
+  };
+  if (!isExactRedirectUri(options.redirectUri)) return {
+    status: 'failed',
+    reason: 'invalid-redirect-uri'
+  };
+  if (attempts.has(context.oxyServices)) return {
+    status: 'failed',
+    reason: 'already-in-progress'
+  };
+  attempts.add(context.oxyServices);
+  try {
+    let lane;
+    try {
+      lane = await (0, _applicationSessionLane.resolveApplicationSessionLane)(context.oxyServices, context.clientId);
+    } catch {
+      return {
+        status: 'failed',
+        reason: 'client-resolution-failed'
+      };
+    }
+    if (lane !== 'oauth') return {
+      status: 'unsupported',
+      reason: 'not-third-party'
+    };
+    const prepared = await (0, _oauthHandshake.prepareAuthorizeRequest)({
+      clientId: context.clientId,
+      redirectUri: options.redirectUri,
+      authorizeBaseUrl: context.authorizeBaseUrl
+    });
+    const {
+      redirectUrl
+    } = await (0, _oauthNavigation.openAuthorizeUrlNative)(prepared.authorizeUrl, options.redirectUri, {
+      allowExternalFallback: false
+    });
+    if (!redirectUrl) return {
+      status: 'cancelled'
+    };
+    const prefix = `${options.redirectUri}${options.redirectUri.includes('?') ? '&' : '?'}`;
+    if (!redirectUrl.startsWith(prefix) || redirectUrl.includes('#')) return {
+      status: 'failed',
+      reason: 'native-callback-invalid'
+    };
+    const parameters = new URLSearchParams(redirectUrl.slice(prefix.length));
+    if ([...new URL(options.redirectUri).searchParams.keys()].some(key => parameters.has(key))) return {
+      status: 'failed',
+      reason: 'native-callback-invalid'
+    };
+    if (['code', 'state', 'error', 'error_description'].some(key => parameters.getAll(key).length > 1)) return {
+      status: 'failed',
+      reason: 'native-callback-invalid'
+    };
+    if (parameters.get('state') !== prepared.handshake.state) return {
+      status: 'failed',
+      reason: 'state-mismatch'
+    };
+    const code = parameters.get('code');
+    if (parameters.has('error') || !code) return {
+      status: 'failed',
+      reason: 'native-callback-invalid'
+    };
+    const completion = await (0, _completeOAuthCode.completeOAuthCode)({
+      oxyServices: context.oxyServices,
+      clientId: context.clientId,
+      code,
+      returnedState: parameters.get('state'),
+      handshake: prepared.handshake,
+      redirectUri: options.redirectUri,
+      commitSession: context.commitSession
+    });
+    return completion.ok ? {
+      status: 'signed-in'
+    } : {
+      status: 'failed',
+      reason: completion.reason
+    };
+  } catch {
+    return {
+      status: 'failed',
+      reason: 'exchange-failed'
+    };
+  } finally {
+    attempts.delete(context.oxyServices);
+  }
+}
+//# sourceMappingURL=nativeAuthTransport.js.map

package/lib/commonjs/ui/oauth/nativeAuthTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_oauthNavigation","require","_applicationSessionLane","_completeOAuthCode","_oauthHandshake","attempts","WeakSet","isExactRedirectUri","value","trim","test","uri","URL","username","password","hash","some","key","searchParams","has","startNativeOAuthSignIn","context","options","platform","status","reason","clientId","identityBound","redirectUri","oxyServices","add","lane","resolveApplicationSessionLane","prepared","prepareAuthorizeRequest","authorizeBaseUrl","redirectUrl","openAuthorizeUrlNative","authorizeUrl","allowExternalFallback","prefix","includes","startsWith","parameters","URLSearchParams","slice","length","keys","getAll","get","handshake","state","code","completion","completeOAuthCode","returnedState","commitSession","ok","delete"],"sourceRoot":"../../../../src","sources":["ui/oauth/nativeAuthTransport.ts"],"mappings":";;;;;;AACA,IAAAA,gBAAA,GAAAC,OAAA;AACA,IAAAC,uBAAA,GAAAD,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AACA,IAAAG,eAAA,GAAAH,OAAA;AAoBA,MAAMI,QAAQ,GAAG,IAAIC,OAAO,CAAc,CAAC;AAE3C,SAASC,kBAAkBA,CAACC,KAAa,EAAW;EAClD,IAAI,CAACA,KAAK,IAAIA,KAAK,KAAKA,KAAK,CAACC,IAAI,CAAC,CAAC,IAAI,IAAI,CAACC,IAAI,CAACF,KAAK,CAAC,EAAE,OAAO,KAAK;EACtE,IAAI;IACF,MAAMG,GAAG,GAAG,IAAIC,GAAG,CAACJ,KAAK,CAAC;IAC1B,OAAO,CAACG,GAAG,CAACE,QAAQ,IAAI,CAACF,GAAG,CAACG,QAAQ,IAAI,CAACH,GAAG,CAACI,IAAI,IAChD,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAACC,IAAI,CAAEC,GAAG,IAAKN,GAAG,CAACO,YAAY,CAACC,GAAG,CAACF,GAAG,CAAC,CAAC;EAC7F,CAAC,CAAC,MAAM;IAAE,OAAO,KAAK;EAAE;AAC1B;;AAEA;AACO,eAAeG,sBAAsBA,CAC1CC,OAAiC,EACjCC,OAAsC,EACJ;EAClC,IAAID,OAAO,CAACE,QAAQ,KAAK,QAAQ,EAAE,OAAO;IAAEC,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAuB,CAAC;EACnG,IAAI,CAACJ,OAAO,CAACK,QAAQ,EAAE,OAAO;IAAEF,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAoB,CAAC;EACpF,IAAIJ,OAAO,CAACM,aAAa,EAAE,OAAO;IAAEH,MAAM,EAAE,aAAa;IAAEC,MAAM,EAAE;EAAiB,CAAC;EACrF,IAAI,CAAClB,kBAAkB,CAACe,OAAO,CAACM,WAAW,CAAC,EAAE,OAAO;IAAEJ,MAAM,EAAE,QAAQ;IAAEC,MAAM,EAAE;EAAuB,CAAC;EACzG,IAAIpB,QAAQ,CAACc,GAAG,CAACE,OAAO,CAACQ,WAAW,CAAC,EAAE,OAAO;IAAEL,MAAM,EAAE,QAAQ;IAAEC,MAAM,EAAE;EAAsB,CAAC;EACjGpB,QAAQ,CAACyB,GAAG,CAACT,OAAO,CAACQ,WAAW,CAAC;EACjC,IAAI;IACF,IAAIE,IAAwB;IAC5B,IAAI;MAAEA,IAAI,GAAG,MAAM,IAAAC,qDAA6B,EAACX,OAAO,CAACQ,WAAW,EAAER,OAAO,CAACK,QAAQ,CAAC;IAAE,CAAC,CAC1F,MAAM;MAAE,OAAO;QAAEF,MAAM,EAAE,QAAQ;QAAEC,MAAM,EAAE;MAA2B,CAAC;IAAE;IACzE,IAAIM,IAAI,KAAK,OAAO,EAAE,OAAO;MAAEP,MAAM,EAAE,aAAa;MAAEC,MAAM,EAAE;IAAkB,CAAC;IACjF,MAAMQ,QAAQ,GAAG,MAAM,IAAAC,uCAAuB,EAAC;MAAER,QAAQ,EAAEL,OAAO,CAACK,QAAQ;MAAEE,WAAW,EAAEN,OAAO,CAACM,WAAW;MAAEO,gBAAgB,EAAEd,OAAO,CAACc;IAAiB,CAAC,CAAC;IAC5J,MAAM;MAAEC;IAAY,CAAC,GAAG,MAAM,IAAAC,uCAAsB,EAACJ,QAAQ,CAACK,YAAY,EAAEhB,OAAO,CAACM,WAAW,EAAE;MAAEW,qBAAqB,EAAE;IAAM,CAAC,CAAC;IAClI,IAAI,CAACH,WAAW,EAAE,OAAO;MAAEZ,MAAM,EAAE;IAAY,CAAC;IAChD,MAAMgB,MAAM,GAAG,GAAGlB,OAAO,CAACM,WAAW,GAAGN,OAAO,CAACM,WAAW,CAACa,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;IACvF,IAAI,CAACL,WAAW,CAACM,UAAU,CAACF,MAAM,CAAC,IAAIJ,WAAW,CAACK,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO;MAAEjB,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA0B,CAAC;IAChI,MAAMkB,UAAU,GAAG,IAAIC,eAAe,CAACR,WAAW,CAACS,KAAK,CAACL,MAAM,CAACM,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,IAAIlC,GAAG,CAACU,OAAO,CAACM,WAAW,CAAC,CAACV,YAAY,CAAC6B,IAAI,CAAC,CAAC,CAAC,CAAC/B,IAAI,CAAEC,GAAG,IAAK0B,UAAU,CAACxB,GAAG,CAACF,GAAG,CAAC,CAAC,EAAE,OAAO;MAAEO,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA0B,CAAC;IAC5J,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAACT,IAAI,CAAEC,GAAG,IAAK0B,UAAU,CAACK,MAAM,CAAC/B,GAAG,CAAC,CAAC6B,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO;MAAEtB,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA0B,CAAC;IACpK,IAAIkB,UAAU,CAACM,GAAG,CAAC,OAAO,CAAC,KAAKhB,QAAQ,CAACiB,SAAS,CAACC,KAAK,EAAE,OAAO;MAAE3B,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAiB,CAAC;IAC/G,MAAM2B,IAAI,GAAGT,UAAU,CAACM,GAAG,CAAC,MAAM,CAAC;IACnC,IAAIN,UAAU,CAACxB,GAAG,CAAC,OAAO,CAAC,IAAI,CAACiC,IAAI,EAAE,OAAO;MAAE5B,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAA0B,CAAC;IACpG,MAAM4B,UAAU,GAAG,MAAM,IAAAC,oCAAiB,EAAC;MAAEzB,WAAW,EAAER,OAAO,CAACQ,WAAW;MAAEH,QAAQ,EAAEL,OAAO,CAACK,QAAQ;MAAE0B,IAAI;MAAEG,aAAa,EAAEZ,UAAU,CAACM,GAAG,CAAC,OAAO,CAAC;MAAEC,SAAS,EAAEjB,QAAQ,CAACiB,SAAS;MAAEtB,WAAW,EAAEN,OAAO,CAACM,WAAW;MAAE4B,aAAa,EAAEnC,OAAO,CAACmC;IAAc,CAAC,CAAC;IACjQ,OAAOH,UAAU,CAACI,EAAE,GAAG;MAAEjC,MAAM,EAAE;IAAY,CAAC,GAAG;MAAEA,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE4B,UAAU,CAAC5B;IAAO,CAAC;EAClG,CAAC,CAAC,MAAM;IAAE,OAAO;MAAED,MAAM,EAAE,QAAQ;MAAEC,MAAM,EAAE;IAAkB,CAAC;EAAE,CAAC,SAC3D;IAAEpB,QAAQ,CAACqD,MAAM,CAACrC,OAAO,CAACQ,WAAW,CAAC;EAAE;AAClD","ignoreList":[]}

package/lib/commonjs/ui/session/createSessionClient.js

@@ -40,12 +40,24 @@ var _tokenTransport = require("./tokenTransport.js");
  * account, the client tracks device state truthfully but never re-binds its
  * bearer to the device's mutable active account.
  */
-function createSessionClient(oxyServices, onUnauthenticated, getPinnedAccountId) {
-  const host = (0, _session.createSessionClientHost)(oxyServices);
+function createSessionClient(oxyServices, onUnauthenticated, getPinnedAccountId, isDeviceSessionAllowed = () => true, onFullExplicitSignOut) {
+  const baseHost = (0, _session.createSessionClientHost)(oxyServices);
+  const host = {
+    ...baseHost,
+    getAccessToken: () => isDeviceSessionAllowed() ? baseHost.getAccessToken() : null,
+    setTokens: token => {
+      if (isDeviceSessionAllowed()) baseHost.setTokens(token);
+    },
+    makeRequest: async (method, url, data, requestOptions) => {
+      if (!isDeviceSessionAllowed()) throw new Error('An isolated OAuth session cannot access the shared device');
+      return baseHost.makeRequest(method, url, data, requestOptions);
+    }
+  };
   const transport = (0, _tokenTransport.createTokenTransport)(oxyServices, getPinnedAccountId);
   const client = new _session.SessionClient(host, {
     transport,
     onUnauthenticated,
+    onFullExplicitSignOut,
     getPinnedAccountId
   });
   return {

package/lib/commonjs/ui/session/createSessionClient.js.map

@@ -1 +1 @@
-{"version":3,"names":["_session","require","_tokenTransport","createSessionClient","oxyServices","onUnauthenticated","getPinnedAccountId","host","createSessionClientHost","transport","createTokenTransport","client","SessionClient"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,eAAA,GAAAD,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EACxDC,kBAAwC,EAIxC;EACA,MAAMC,IAAI,GAAG,IAAAC,gCAAuB,EAACJ,WAAW,CAAC;EACjD,MAAMK,SAAS,GAAG,IAAAC,oCAAoB,EAACN,WAAW,EAAEE,kBAAkB,CAAC;EACvE,MAAMK,MAAM,GAAG,IAAIC,sBAAa,CAACL,IAAI,EAAE;IACrCE,SAAS;IACTJ,iBAAiB;IACjBC;EACF,CAAC,CAAC;EACF,OAAO;IAAEK,MAAM;IAAEJ;EAAK,CAAC;AACzB","ignoreList":[]}
+{"version":3,"names":["_session","require","_tokenTransport","createSessionClient","oxyServices","onUnauthenticated","getPinnedAccountId","isDeviceSessionAllowed","onFullExplicitSignOut","baseHost","createSessionClientHost","host","getAccessToken","setTokens","token","makeRequest","method","url","data","requestOptions","Error","transport","createTokenTransport","client","SessionClient"],"sourceRoot":"../../../../src","sources":["ui/session/createSessionClient.ts"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,eAAA,GAAAD,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,mBAAmBA,CACjCC,WAAwB,EACxBC,iBAAwD,EACxDC,kBAAwC,EACxCC,sBAAqC,GAAGA,CAAA,KAAM,IAAI,EAClDC,qBAA2C,EAI3C;EACA,MAAMC,QAAQ,GAAG,IAAAC,gCAAuB,EAACN,WAAW,CAAC;EACrD,MAAMO,IAAI,GAAG;IACX,GAAGF,QAAQ;IACXG,cAAc,EAAEA,CAAA,KAAML,sBAAsB,CAAC,CAAC,GAAGE,QAAQ,CAACG,cAAc,CAAC,CAAC,GAAG,IAAI;IACjFC,SAAS,EAAGC,KAAa,IAAK;MAAE,IAAIP,sBAAsB,CAAC,CAAC,EAAEE,QAAQ,CAACI,SAAS,CAACC,KAAK,CAAC;IAAE,CAAC;IAC1FC,WAAW,EAAE,MAAAA,CAAUC,MAAsB,EAAEC,GAAW,EAAEC,IAAc,EAAEC,cAAoC,KAAiB;MAC/H,IAAI,CAACZ,sBAAsB,CAAC,CAAC,EAAE,MAAM,IAAIa,KAAK,CAAC,2DAA2D,CAAC;MAC3G,OAAOX,QAAQ,CAACM,WAAW,CAAIC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,cAAc,CAAC;IACnE;EACF,CAAC;EACD,MAAME,SAAS,GAAG,IAAAC,oCAAoB,EAAClB,WAAW,EAAEE,kBAAkB,CAAC;EACvE,MAAMiB,MAAM,GAAG,IAAIC,sBAAa,CAACb,IAAI,EAAE;IACrCU,SAAS;IACThB,iBAAiB;IACjBG,qBAAqB;IACrBF;EACF,CAAC,CAAC;EACF,OAAO;IAAEiB,MAAM;IAAEZ;EAAK,CAAC;AACzB","ignoreList":[]}

package/lib/commonjs/ui/session/deviceCredentialTracker.js

@@ -23,6 +23,7 @@ function credentialOf(state) {
 function trackDeviceCredential(store) {
   let held;
   return {
+    ...store,
     load: async () => {
       const state = await store.load();
       held = credentialOf(state);
@@ -32,6 +33,13 @@ function trackDeviceCredential(store) {
       held = credentialOf(state);
       return store.save(state);
     },
+    ...(store.saveIfCurrent ? {
+      saveIfCurrent: async (state, guard) => {
+        const committed = await store.saveIfCurrent?.(state, guard);
+        if (committed) held = credentialOf(state);
+        return committed === true;
+      }
+    } : {}),
     clear: async () => {
       held = null;
       await store.clear();

package/lib/commonjs/ui/session/deviceCredentialTracker.js.map

@@ -1 +1 @@
-{"version":3,"names":["credentialOf","state","deviceId","deviceSecret","trackDeviceCredential","store","held","load","save","clear","heldDeviceCredential"],"sourceRoot":"../../../../src","sources":["ui/session/deviceCredentialTracker.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAgBA,SAASA,YAAYA,CAACC,KAA0D,EAA+B;EAC7G,OAAOA,KAAK,EAAEC,QAAQ,IAAID,KAAK,CAACE,YAAY,GACxC;IAAED,QAAQ,EAAED,KAAK,CAACC,QAAQ;IAAEC,YAAY,EAAEF,KAAK,CAACE;EAAa,CAAC,GAC9D,IAAI;AACV;AAEO,SAASC,qBAAqBA,CAACC,KAAqB,EAAoC;EAC7F,IAAIC,IAA6C;EACjD,OAAO;IACLC,IAAI,EAAE,MAAAA,CAAA,KAAY;MAChB,MAAMN,KAAK,GAAG,MAAMI,KAAK,CAACE,IAAI,CAAC,CAAC;MAChCD,IAAI,GAAGN,YAAY,CAACC,KAAK,CAAC;MAC1B,OAAOA,KAAK;IACd,CAAC;IACDO,IAAI,EAAE,MAAOP,KAAK,IAAK;MACrBK,IAAI,GAAGN,YAAY,CAACC,KAAK,CAAC;MAC1B,OAAOI,KAAK,CAACG,IAAI,CAACP,KAAK,CAAC;IAC1B,CAAC;IACDQ,KAAK,EAAE,MAAAA,CAAA,KAAY;MACjBH,IAAI,GAAG,IAAI;MACX,MAAMD,KAAK,CAACI,KAAK,CAAC,CAAC;IACrB,CAAC;IACDC,oBAAoB,EAAEA,CAAA,KAAMJ;EAC9B,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["credentialOf","state","deviceId","deviceSecret","trackDeviceCredential","store","held","load","save","saveIfCurrent","guard","committed","clear","heldDeviceCredential"],"sourceRoot":"../../../../src","sources":["ui/session/deviceCredentialTracker.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAgBA,SAASA,YAAYA,CAACC,KAA0D,EAA+B;EAC7G,OAAOA,KAAK,EAAEC,QAAQ,IAAID,KAAK,CAACE,YAAY,GACxC;IAAED,QAAQ,EAAED,KAAK,CAACC,QAAQ;IAAEC,YAAY,EAAEF,KAAK,CAACE;EAAa,CAAC,GAC9D,IAAI;AACV;AAEO,SAASC,qBAAqBA,CAACC,KAAqB,EAAoC;EAC7F,IAAIC,IAA6C;EACjD,OAAO;IACL,GAAGD,KAAK;IACRE,IAAI,EAAE,MAAAA,CAAA,KAAY;MAChB,MAAMN,KAAK,GAAG,MAAMI,KAAK,CAACE,IAAI,CAAC,CAAC;MAChCD,IAAI,GAAGN,YAAY,CAACC,KAAK,CAAC;MAC1B,OAAOA,KAAK;IACd,CAAC;IACDO,IAAI,EAAE,MAAOP,KAAK,IAAK;MACrBK,IAAI,GAAGN,YAAY,CAACC,KAAK,CAAC;MAC1B,OAAOI,KAAK,CAACG,IAAI,CAACP,KAAK,CAAC;IAC1B,CAAC;IACD,IAAII,KAAK,CAACI,aAAa,GAAG;MAACA,aAAa,EAAE,MAAAA,CAAOR,KAAyB,EAAES,KAA0B,KAAK;QACzG,MAAMC,SAAS,GAAG,MAAMN,KAAK,CAACI,aAAa,GAAGR,KAAK,EAAES,KAAK,CAAC;QAC3D,IAAIC,SAAS,EAAEL,IAAI,GAAGN,YAAY,CAACC,KAAK,CAAC;QACzC,OAAOU,SAAS,KAAK,IAAI;MAC3B;IAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACRC,KAAK,EAAE,MAAAA,CAAA,KAAY;MACjBN,IAAI,GAAG,IAAI;MACX,MAAMD,KAAK,CAACO,KAAK,CAAC,CAAC;IACrB,CAAC;IACDC,oBAAoB,EAAEA,CAAA,KAAMP;EAC9B,CAAC;AACH","ignoreList":[]}

package/lib/module/index.js

@@ -237,4 +237,5 @@ export { SurfaceHeaderAction } from "./ui/components/SurfaceHeaderAction.js";
 // ---------------------------------------------------------------------------
 // Imperative account dialog entry points (outside React).
 export { openAccountDialog, closeAccountDialog, subscribeToAccountDialog } from "./ui/navigation/accountDialogManager.js";
+export { usePersonalPlans, usePersonalPlanSubscriptions } from "./ui/hooks/queries/usePersonalPlans.js";
 //# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["setPlatformOS","Platform","OS","default","OxyProvider","useOxy","useOptionalOxy","OxyProviderMissingError","useOxyRuntime","useOxySnapshot","useActiveAccount","useDeviceDirectory","OxyRuntimeMissingError","useAuth","createDeferredProductAnalytics","IdentityBoundSessionError","useAuthStore","useAssetStore","useAssets","useAssetsStore","useAsset","useUploadProgress","useAssetLoading","useAssetErrors","useAssetsByApp","useAssetsByEntity","useAssetUsageCount","useIsAssetLinked","setOxyAssetInstance","useFileDownloadUrl","useFollow","useFollowerCounts","useSeedFollowStatuses","useStorage","useUserProfile","useUserProfiles","useCurrentUser","useUserById","useUserByUsername","useUsersBySessions","usePrivacySettings","useConnectedApps","useSessions","useSession","useDeviceSessions","useUserDevices","useSecurityInfo","useAccountStorageUsage","useSecurityActivity","useRecentSecurityActivity","useInfiniteSecurityActivity","useAuthMethods","useSignInMethods","useUserSubscription","useUserPayments","useUserWallet","useUserWalletTransactions","useUpdateProfile","useUploadAvatar","useUpdateAccountSettings","useUpdatePrivacySettings","useUpdateNotificationPreferences","useUpdateUserPreferences","useRevokeConnectedApp","useUploadFile","useSwitchSession","useLogoutSession","useLogoutAll","useUpdateDeviceName","useRemoveDevice","createProfileMutation","createGenericMutation","mutationKeys","queryKeys","invalidateAccountQueries","invalidateUserQueries","invalidateSessionQueries","invalidateDeviceQueries","invalidatePrivacyQueries","invalidateSecurityQueries","invalidateStorageQueries","invalidatePaymentsQueries","invalidateConnectedAppsQueries","invalidateAuthMethodsQueries","upsertCachedUser","upsertCachedUsers","CLEARABLE_USER_FIELDS","clearedFieldsFromProfileUpdate","clearedFieldsFromAccountUpdate","useMutationStatus","useOnlineStatus","useOxyEvent","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage","useFileFiltering","OXY_OAUTH_STATE_STORAGE_KEY","OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY","OxySignInButton","openOAuthPopup","OxyAuthPrompt","OxyOAuthCallback","OxyConsentScreen","RequireOxyAuth","FollowButton","FollowTargetButton","buildFollowMenuItems","resolveFollowPrimaryAction","FOLLOW_ACTION_LEAVES_ACTIVE","useFollowTarget","useFollowTargetStore","UNKNOWN_FOLLOW_STATUS","isFollowedGlobally","withApplicationMode","isCompleteFollowStatus","followRecordToStatus","followRecordsToStatusMap","PeableButton","OxyPayButton","LogoIcon","LogoText","ProfileButton","OxySignInPanel","OxySignUpPanel","OxyAccountPicker","OxyDeleteAccountPanel","OxyLinkCommonsPanel","OxyPasswordPanel","OxyAuthenticatorPanel","OxyAuthScreen","OxyAuthScreenHeader","OxyAuthLoading","OxyAuthTerms","OxySignInRequestSurface","useDeviceSwitcher","showBottomSheet","closeBottomSheet","useSurfaceHeader","SurfaceHeaderAction","openAccountDialog","closeAccountDialog","subscribeToAccountDialog"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA,SAASA,aAAa,QAAyB,cAAc;AAC7D,SAASC,QAAQ,QAAQ,cAAc;AACvCD,aAAa,CAACC,QAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;AACA,SAASC,OAAO,IAAIC,WAAW,QAAQ,gCAA6B;AACpE,SAASC,MAAM,QAAQ,4BAAyB;AAChD;AACA;AACA;AACA,SAASC,cAAc,EAAEC,uBAAuB,QAAQ,4BAAyB;;AAEjF;AACA;AACA;AACA,SACEC,aAAa,EACbC,cAAc,EACdC,gBAAgB,EAChBC,kBAAkB,EAClBC,sBAAsB,QACjB,uBAAc;AAUrB,SAASC,OAAO,QAAQ,uBAAoB;AAE5C,SAASC,8BAA8B,QAAQ,oCAAiC;AAEhF;AACA;AACA;AACA,SAASC,yBAAyB,QAAQ,iCAA8B;;AAExE;AACA;AACA;AACA,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SACIC,aAAa,EACbC,SAAS,IAAIC,cAAc,EAC3BC,QAAQ,EACRC,iBAAiB,EACjBC,eAAe,EACfC,cAAc,EACdC,cAAc,EACdC,iBAAiB,EACjBC,kBAAkB,EAClBC,gBAAgB,QACb,2BAAwB;;AAE/B;AACA;AACA;AACA,SAAST,SAAS,EAAEU,mBAAmB,QAAQ,yBAAsB;AACrE,SAASC,kBAAkB,QAAQ,kCAA+B;AAClE,SAASC,SAAS,EAAEC,iBAAiB,EAAEC,qBAAqB,QAAQ,yBAAsB;AAC1F,SAASC,UAAU,QAAQ,0BAAuB;AAGlD;AACA;AACA;AACA,SACIC,cAAc,EACdC,eAAe,EACfC,cAAc,EACdC,WAAW,EACXC,iBAAiB,EACjBC,kBAAkB,EAClBC,kBAAkB,EAClBC,gBAAgB,QACb,yCAAsC;AAC7C,SACIC,WAAW,EACXC,UAAU,EACVC,iBAAiB,EACjBC,cAAc,EACdC,eAAe,EACfC,sBAAsB,QACnB,0CAAuC;AAC9C,SACIC,mBAAmB,EACnBC,yBAAyB,EACzBC,2BAA2B,QACxB,0CAAuC;AAC9C,SAASC,cAAc,EAAEC,gBAAgB,QAAQ,sCAAmC;AACpF,SACIC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,yBAAyB,QACtB,yCAAsC;;AAE7C;;AAeA;AACA;AACA;AACA,SACIC,gBAAgB,EAChBC,eAAe,EACfC,wBAAwB,EACxBC,wBAAwB,EACxBC,gCAAgC,EAChCC,wBAAwB,EACxBC,qBAAqB,EACrBC,aAAa,QACV,6CAA0C;AACjD,SACIC,gBAAgB,EAChBC,gBAAgB,EAChBC,YAAY,EACZC,mBAAmB,EACnBC,eAAe,QACZ,8CAA2C;AAClD,SACIC,qBAAqB,EACrBC,qBAAqB,QAClB,yCAAsC;AAM7C;AACA,SAASC,YAAY,QAAQ,sCAAmC;;AAEhE;AACA;AACA;AACA;AACA;AACA;AACA,SACIC,SAAS,EACTC,wBAAwB,EACxBC,qBAAqB,EACrBC,wBAAwB,EACxBC,uBAAuB,EACvBC,wBAAwB,EACxBC,yBAAyB,EACzBC,wBAAwB,EACxBC,yBAAyB,EACzBC,8BAA8B,EAC9BC,4BAA4B,QACzB,iCAA8B;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACIC,gBAAgB,EAChBC,iBAAiB,EACjBC,qBAAqB,EACrBC,8BAA8B,EAC9BC,8BAA8B,QAC3B,iCAA8B;AAOrC;AACA,SAASC,iBAAiB,QAAQ,iCAA8B;AAEhE,SAASC,eAAe,QAAQ,+BAA4B;AAC5D,SAASC,WAAW,QAAQ,2BAAwB;;AAEpD;AACA;AACA;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,6BAA0B;AAGjC;AACA;AACA;AACA,SAASC,gBAAgB,QAAQ,gCAA6B;AAG9D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA,SACEC,2BAA2B,EAC3BC,mCAAmC,QAC9B,cAAc;AACrB,SAAS/F,OAAO,IAAIgG,eAAe,QAAQ,oCAAiC;AAG5E;AACA;AACA;AACA;AACA,SAASC,cAAc,QAAQ,0BAAuB;AAgBtD,SAASC,aAAa,QAAQ,kCAA+B;AAE7D,SAASC,gBAAgB,QAAQ,qCAAkC;AAEnE,SAASC,gBAAgB,QAAQ,qCAAkC;AAQnE;AACA;AACA;AACA;AACA;AACA,SAASC,cAAc,QAAQ,mCAAgC;;AAE/D;;AAGA,SAASrG,OAAO,IAAIsG,YAAY,QAAQ,iCAA8B;AAEtE;AACA,SAASC,kBAAkB,QAAQ,uCAAoC;AACvE;AACE;AACA;AACA;AACA;AACA;AACAC,oBAAoB,EACpBC,0BAA0B,EAC1BC,2BAA2B,QACtB,gCAA6B;AAOpC,SAASC,eAAe,QAAQ,+BAA4B;AAE5D,SACEC,oBAAoB,EACpBC,qBAAqB;AACrB;AACA;AACA;AACAC,kBAAkB,EAClBC,mBAAmB;AACnB;AACA;AACAC,sBAAsB,EACtBC,oBAAoB,EACpBC,wBAAwB,QACnB,kCAA+B;AACtC,SAASlH,OAAO,IAAImH,YAAY,QAAQ,iCAA8B;AAEtE;AACA,SAASnH,OAAO,IAAIoH,YAAY,QAAQ,iCAA8B;AACtE;;AAEA,SAASC,QAAQ,QAAQ,kCAA+B;AACxD,SAASC,QAAQ,QAAQ,kCAA+B;;AAExD;AACA;AACA;AACA,SAAStH,OAAO,IAAIuH,aAAa,QAAQ,kCAA+B;AAIxE;AACA;AACA;AACA,SAASC,cAAc,QAAQ,0CAAuC;AAEtE,SAASC,cAAc,QAAQ,0CAAuC;AAEtE,SAASC,gBAAgB,QAAQ,4CAAyC;AAE1E;AACA;AACA;AACA,SAASC,qBAAqB,QAAQ,iDAA8C;AAEpF,SAASC,mBAAmB,QAAQ,+CAA4C;AAEhF,SAASC,gBAAgB,QAAQ,4CAAyC;AAE1E,SAASC,qBAAqB,QAAQ,iDAA8C;AAEpF,SACEC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,YAAY,QACP,yCAAsC;AAG7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,uBAAuB,QAAQ,4CAAyC;AAIjF;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,iBAAiB,QAAQ,iCAA8B;AAGhE;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA,SAASC,eAAe,EAAEC,gBAAgB,QAAQ,uCAAoC;AAGtF;AACA;AACA;AACA,SAASC,gBAAgB,QAAmC,gCAA6B;AACzF,SAASC,mBAAmB,QAAuC,wCAAqC;;AAExG;AACA;AACA;AACA;AACA,SACEC,iBAAiB,EACjBC,kBAAkB,EAClBC,wBAAwB,QACnB,yCAAsC","ignoreList":[]}
+{"version":3,"names":["setPlatformOS","Platform","OS","default","OxyProvider","useOxy","useOptionalOxy","OxyProviderMissingError","useOxyRuntime","useOxySnapshot","useActiveAccount","useDeviceDirectory","OxyRuntimeMissingError","useAuth","createDeferredProductAnalytics","IdentityBoundSessionError","useAuthStore","useAssetStore","useAssets","useAssetsStore","useAsset","useUploadProgress","useAssetLoading","useAssetErrors","useAssetsByApp","useAssetsByEntity","useAssetUsageCount","useIsAssetLinked","setOxyAssetInstance","useFileDownloadUrl","useFollow","useFollowerCounts","useSeedFollowStatuses","useStorage","useUserProfile","useUserProfiles","useCurrentUser","useUserById","useUserByUsername","useUsersBySessions","usePrivacySettings","useConnectedApps","useSessions","useSession","useDeviceSessions","useUserDevices","useSecurityInfo","useAccountStorageUsage","useSecurityActivity","useRecentSecurityActivity","useInfiniteSecurityActivity","useAuthMethods","useSignInMethods","useUserSubscription","useUserPayments","useUserWallet","useUserWalletTransactions","useUpdateProfile","useUploadAvatar","useUpdateAccountSettings","useUpdatePrivacySettings","useUpdateNotificationPreferences","useUpdateUserPreferences","useRevokeConnectedApp","useUploadFile","useSwitchSession","useLogoutSession","useLogoutAll","useUpdateDeviceName","useRemoveDevice","createProfileMutation","createGenericMutation","mutationKeys","queryKeys","invalidateAccountQueries","invalidateUserQueries","invalidateSessionQueries","invalidateDeviceQueries","invalidatePrivacyQueries","invalidateSecurityQueries","invalidateStorageQueries","invalidatePaymentsQueries","invalidateConnectedAppsQueries","invalidateAuthMethodsQueries","upsertCachedUser","upsertCachedUsers","CLEARABLE_USER_FIELDS","clearedFieldsFromProfileUpdate","clearedFieldsFromAccountUpdate","useMutationStatus","useOnlineStatus","useOxyEvent","handleAuthError","isInvalidSessionError","isTimeoutOrNetworkError","extractErrorMessage","useFileFiltering","OXY_OAUTH_STATE_STORAGE_KEY","OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY","OxySignInButton","openOAuthPopup","OxyAuthPrompt","OxyOAuthCallback","OxyConsentScreen","RequireOxyAuth","FollowButton","FollowTargetButton","buildFollowMenuItems","resolveFollowPrimaryAction","FOLLOW_ACTION_LEAVES_ACTIVE","useFollowTarget","useFollowTargetStore","UNKNOWN_FOLLOW_STATUS","isFollowedGlobally","withApplicationMode","isCompleteFollowStatus","followRecordToStatus","followRecordsToStatusMap","PeableButton","OxyPayButton","LogoIcon","LogoText","ProfileButton","OxySignInPanel","OxySignUpPanel","OxyAccountPicker","OxyDeleteAccountPanel","OxyLinkCommonsPanel","OxyPasswordPanel","OxyAuthenticatorPanel","OxyAuthScreen","OxyAuthScreenHeader","OxyAuthLoading","OxyAuthTerms","OxySignInRequestSurface","useDeviceSwitcher","showBottomSheet","closeBottomSheet","useSurfaceHeader","SurfaceHeaderAction","openAccountDialog","closeAccountDialog","subscribeToAccountDialog","usePersonalPlans","usePersonalPlanSubscriptions"],"sourceRoot":"../../src","sources":["index.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;;AAEA,SAASA,aAAa,QAAyB,cAAc;AAC7D,SAASC,QAAQ,QAAQ,cAAc;AACvCD,aAAa,CAACC,QAAQ,CAACC,EAAgB,CAAC;;AAExC;AACA;AACA;AACA,SAASC,OAAO,IAAIC,WAAW,QAAQ,gCAA6B;AACpE,SAASC,MAAM,QAAQ,4BAAyB;AAChD;AACA;AACA;AACA,SAASC,cAAc,EAAEC,uBAAuB,QAAQ,4BAAyB;;AAEjF;AACA;AACA;AACA,SACEC,aAAa,EACbC,cAAc,EACdC,gBAAgB,EAChBC,kBAAkB,EAClBC,sBAAsB,QACjB,uBAAc;AAUrB,SAASC,OAAO,QAAQ,uBAAoB;AAE5C,SAASC,8BAA8B,QAAQ,oCAAiC;AAEhF;AACA;AACA;AACA,SAASC,yBAAyB,QAAQ,iCAA8B;;AAExE;AACA;AACA;AACA,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SACIC,aAAa,EACbC,SAAS,IAAIC,cAAc,EAC3BC,QAAQ,EACRC,iBAAiB,EACjBC,eAAe,EACfC,cAAc,EACdC,cAAc,EACdC,iBAAiB,EACjBC,kBAAkB,EAClBC,gBAAgB,QACb,2BAAwB;;AAE/B;AACA;AACA;AACA,SAAST,SAAS,EAAEU,mBAAmB,QAAQ,yBAAsB;AACrE,SAASC,kBAAkB,QAAQ,kCAA+B;AAClE,SAASC,SAAS,EAAEC,iBAAiB,EAAEC,qBAAqB,QAAQ,yBAAsB;AAC1F,SAASC,UAAU,QAAQ,0BAAuB;AAGlD;AACA;AACA;AACA,SACIC,cAAc,EACdC,eAAe,EACfC,cAAc,EACdC,WAAW,EACXC,iBAAiB,EACjBC,kBAAkB,EAClBC,kBAAkB,EAClBC,gBAAgB,QACb,yCAAsC;AAC7C,SACIC,WAAW,EACXC,UAAU,EACVC,iBAAiB,EACjBC,cAAc,EACdC,eAAe,EACfC,sBAAsB,QACnB,0CAAuC;AAC9C,SACIC,mBAAmB,EACnBC,yBAAyB,EACzBC,2BAA2B,QACxB,0CAAuC;AAC9C,SAASC,cAAc,EAAEC,gBAAgB,QAAQ,sCAAmC;AACpF,SACIC,mBAAmB,EACnBC,eAAe,EACfC,aAAa,EACbC,yBAAyB,QACtB,yCAAsC;;AAE7C;;AAeA;AACA;AACA;AACA,SACIC,gBAAgB,EAChBC,eAAe,EACfC,wBAAwB,EACxBC,wBAAwB,EACxBC,gCAAgC,EAChCC,wBAAwB,EACxBC,qBAAqB,EACrBC,aAAa,QACV,6CAA0C;AACjD,SACIC,gBAAgB,EAChBC,gBAAgB,EAChBC,YAAY,EACZC,mBAAmB,EACnBC,eAAe,QACZ,8CAA2C;AAClD,SACIC,qBAAqB,EACrBC,qBAAqB,QAClB,yCAAsC;AAM7C;AACA,SAASC,YAAY,QAAQ,sCAAmC;;AAEhE;AACA;AACA;AACA;AACA;AACA;AACA,SACIC,SAAS,EACTC,wBAAwB,EACxBC,qBAAqB,EACrBC,wBAAwB,EACxBC,uBAAuB,EACvBC,wBAAwB,EACxBC,yBAAyB,EACzBC,wBAAwB,EACxBC,yBAAyB,EACzBC,8BAA8B,EAC9BC,4BAA4B,QACzB,iCAA8B;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SACIC,gBAAgB,EAChBC,iBAAiB,EACjBC,qBAAqB,EACrBC,8BAA8B,EAC9BC,8BAA8B,QAC3B,iCAA8B;AAOrC;AACA,SAASC,iBAAiB,QAAQ,iCAA8B;AAEhE,SAASC,eAAe,QAAQ,+BAA4B;AAC5D,SAASC,WAAW,QAAQ,2BAAwB;;AAEpD;AACA;AACA;AACA,SACIC,eAAe,EACfC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,QAChB,6BAA0B;AAGjC;AACA;AACA;AACA,SAASC,gBAAgB,QAAQ,gCAA6B;AAG9D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA,SACEC,2BAA2B,EAC3BC,mCAAmC,QAC9B,cAAc;AACrB,SAAS/F,OAAO,IAAIgG,eAAe,QAAQ,oCAAiC;AAG5E;AACA;AACA;AACA;AACA,SAASC,cAAc,QAAQ,0BAAuB;AAgBtD,SAASC,aAAa,QAAQ,kCAA+B;AAE7D,SAASC,gBAAgB,QAAQ,qCAAkC;AAEnE,SAASC,gBAAgB,QAAQ,qCAAkC;AAQnE;AACA;AACA;AACA;AACA;AACA,SAASC,cAAc,QAAQ,mCAAgC;;AAE/D;;AAGA,SAASrG,OAAO,IAAIsG,YAAY,QAAQ,iCAA8B;AAEtE;AACA,SAASC,kBAAkB,QAAQ,uCAAoC;AACvE;AACE;AACA;AACA;AACA;AACA;AACAC,oBAAoB,EACpBC,0BAA0B,EAC1BC,2BAA2B,QACtB,gCAA6B;AAOpC,SAASC,eAAe,QAAQ,+BAA4B;AAE5D,SACEC,oBAAoB,EACpBC,qBAAqB;AACrB;AACA;AACA;AACAC,kBAAkB,EAClBC,mBAAmB;AACnB;AACA;AACAC,sBAAsB,EACtBC,oBAAoB,EACpBC,wBAAwB,QACnB,kCAA+B;AACtC,SAASlH,OAAO,IAAImH,YAAY,QAAQ,iCAA8B;AAEtE;AACA,SAASnH,OAAO,IAAIoH,YAAY,QAAQ,iCAA8B;AACtE;;AAEA,SAASC,QAAQ,QAAQ,kCAA+B;AACxD,SAASC,QAAQ,QAAQ,kCAA+B;;AAExD;AACA;AACA;AACA,SAAStH,OAAO,IAAIuH,aAAa,QAAQ,kCAA+B;AAIxE;AACA;AACA;AACA,SAASC,cAAc,QAAQ,0CAAuC;AAEtE,SAASC,cAAc,QAAQ,0CAAuC;AAEtE,SAASC,gBAAgB,QAAQ,4CAAyC;AAE1E;AACA;AACA;AACA,SAASC,qBAAqB,QAAQ,iDAA8C;AAEpF,SAASC,mBAAmB,QAAQ,+CAA4C;AAEhF,SAASC,gBAAgB,QAAQ,4CAAyC;AAE1E,SAASC,qBAAqB,QAAQ,iDAA8C;AAEpF,SACEC,aAAa,EACbC,mBAAmB,EACnBC,cAAc,EACdC,YAAY,QACP,yCAAsC;AAG7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,uBAAuB,QAAQ,4CAAyC;AAIjF;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,iBAAiB,QAAQ,iCAA8B;AAGhE;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA,SAASC,eAAe,EAAEC,gBAAgB,QAAQ,uCAAoC;AAGtF;AACA;AACA;AACA,SAASC,gBAAgB,QAAmC,gCAA6B;AACzF,SAASC,mBAAmB,QAAuC,wCAAqC;;AAExG;AACA;AACA;AACA;AACA,SACEC,iBAAiB,EACjBC,kBAAkB,EAClBC,wBAAwB,QACnB,yCAAsC;AAI7C,SAASC,gBAAgB,EAAEC,4BAA4B,QAAQ,wCAAqC","ignoreList":[]}

package/lib/module/ui/boot/runProviderColdBoot.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { resolveApplicationSessionLane } from "../oauth/applicationSessionLane.js";
 import { logger as loggerUtil } from '@oxy.so/core';
 import { runSessionColdBoot } from '@oxy.so/core/session';
 import { loadPersistedDeviceCredential } from "../utils/deviceCredential.js";
@@ -94,6 +95,11 @@ export async function runProviderColdBoot(opts) {
   const identityBound = sessionMode === 'identity';
   setTokenReady(false);
   try {
+    // Classification precedes every local-secret, shared-credential and identity
+    // probe. Unavailable registry metadata fails closed, including offline boot.
+    const lane = await (opts.resolveSessionLane?.() ?? resolveApplicationSessionLane(oxyServices, clientId));
+    await opts.onClassified?.(lane);
+    if (identityBound && lane !== 'device') return;
     // The redirect transport's RETURN leg. An app reaches it whenever the browser
     // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
     // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
@@ -105,7 +111,8 @@ export async function runProviderColdBoot(opts) {
       clientId,
       authRedirectUri,
       commitSession: input => commitSession(input, {
-        activate: true
+        activate: true,
+        oauth: true
       })
     });
     if (oauthCompleted) {
@@ -113,6 +120,11 @@ export async function runProviderColdBoot(opts) {
       markAuthResolved();
       return;
     }
+    if (lane === 'oauth') {
+      setTokenReady(true);
+      return;
+    }
+    await opts.beforeDeviceBoot?.();
 
     // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
     // the two doomed network steps so routing settles immediately instead of
@@ -188,6 +200,7 @@ export async function runProviderColdBoot(opts) {
         }
       }
     });
+    await opts.afterDeviceBoot?.();
   } catch (error) {
     if (__DEV__) {
       loggerUtil.error('Cold boot error', error instanceof Error ? error : new Error(String(error)), {

package/lib/module/ui/boot/runProviderColdBoot.js.map

@@ -1 +1 @@
-{"version":3,"names":["logger","loggerUtil","runSessionColdBoot","loadPersistedDeviceCredential","createPlatformSharedDeviceCredentialStore","tryCompleteOAuthReturn","isWebBrowser","isNetConnectivityExplicitlyOffline","SESSION_HANDOFF_DEADLINE_MS","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","online","globalThis","navigator","onLine","NetInfo","state","Promise","race","default","fetch","resolve","setTimeout","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","oauthCompleted","input","activate","offline","oxy","store","platform","isWeb","isNative","sharedDeviceCredential","undefined","overallDeadlineMs","isOffline","onStepDeadline","stepId","warn","component","method","onSession","session","handoff","sessionId","accessToken","userId","deviceState","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","start","socketError","__DEV__","debug","onStepError","id","error","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;AAAA,SAASA,MAAM,IAAIC,UAAU,QAA0B,cAAc;AACrE,SAASC,kBAAkB,QAAqE,sBAAsB;AAEtH,SAASC,6BAA6B,QAAQ,8BAA2B;AACzE,SAASC,yCAAyC,QAAQ,2CAAwC;AAClG,SAASC,sBAAsB,QAAQ,yBAAsB;AAC7D,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,kCAAkC,QAAQ,6BAA0B;AAG7E;AACA,OAAO,MAAMC,2BAA2B,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,6BAA6B,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAIL,YAAY,CAAC,CAAC,EAAE;MAClB,MAAMM,MAAM,GAAIC,UAAU,CAA0CC,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOH,MAAM,KAAK,KAAK;IACzB;IACA,MAAMI,OAAO,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC;IAC/D,MAAMC,KAAK,GAAG,MAAMC,OAAO,CAACC,IAAI,CAAC,CAC/BH,OAAO,CAACI,OAAO,CAACC,KAAK,CAAC,CAAC,EACvB,IAAIH,OAAO,CAAQI,OAAO,IAAK;MAC7BC,UAAU,CAAC,MAAMD,OAAO,CAAC,IAAI,CAAC,EAAEZ,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAOH,kCAAkC,CAACU,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAwBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeO,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAGD,aAAa,GAChC,KAAK,GACL,MAAMhC,sBAAsB,CAAC;MAC3BqB,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGK,KAAK,IAAKL,aAAa,CAACK,KAAK,EAAE;QAAEC,QAAQ,EAAE;MAAK,CAAC;IACnE,CAAC,CAAC;IACN,IAAIF,cAAc,EAAE;MAClBF,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;;IAEA;IACA;IACA;IACA;IACA,MAAMM,OAAO,GAAG,MAAM9B,iBAAiB,CAAC,CAAC;IAEzC,MAAMT,kBAAkB,CAAC;MACvBwC,GAAG,EAAEhB,WAAW;MAChBiB,KAAK,EAAEhB,SAAS;MAChBiB,QAAQ,EAAE;QAAEC,KAAK,EAAEvC,YAAY,CAAC,CAAC;QAAEwC,QAAQ,EAAE,CAACxC,YAAY,CAAC;MAAE,CAAC;MAC9DwB,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACAgB,sBAAsB,EAAE3C,yCAAyC,CAAC,CAAC,IAAI4C,SAAS;MAChFC,iBAAiB,EAAExC,6BAA6B;MAChDyC,SAAS,EAAEA,CAAA,KAAMT,OAAO;MACxBU,cAAc,EAAGC,MAAM,IAAK;QAC1BnD,UAAU,CAACoD,IAAI,CACb,mBAAmBD,MAAM,kBAAkB3C,6BAA6B,8DAA8D,EACtI;UAAE6C,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAMxB,0BAA0B,CAAC,CAAC;QAClC,MAAMyB,OAAO,GAAGxB,aAAa,CAC3B;UACEyB,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5BC,WAAW,EAAEH,OAAO,CAACG,WAAW;UAChCC,MAAM,EAAEJ,OAAO,CAACI,MAAM;UACtBC,WAAW,EAAEL,OAAO,CAACxC;QACvB,CAAC,EACD;UAAEuB,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIuB,iBAA4D;QAChE,MAAM7C,OAAO,CAACC,IAAI,CAAC,CACjBuC,OAAO,EACP,IAAIxC,OAAO,CAAQI,OAAO,IAAK;UAC7ByC,iBAAiB,GAAGxC,UAAU,CAACD,OAAO,EAAEd,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAACwD,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAKf,SAAS,EAAE;YACnCiB,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACF5B,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACD+B,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAMjC,0BAA0B,CAAC,CAAC;QAClC,MAAMkC,IAAI,GAAG,MAAMhE,6BAA6B,CAACwB,SAAS,CAAC;QAC3D,IAAIwC,IAAI,EAAE;UACR,IAAI;YACF,MAAMnC,aAAa,CAACoC,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACXrE,UAAU,CAACsE,KAAK,CACd,wCAAwC,EACxC;gBAAEjB,SAAS,EAAE;cAAsB,CAAC,EACpCe,WACF,CAAC;YACH;UACF;QACF;QACAlC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDqC,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACXrE,UAAU,CAACsE,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAEnB,SAAS,EAAE;UAAsB,CAAC,EACpCoB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;EACJ,CAAC,CAAC,OAAOA,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXrE,UAAU,CAACyE,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,EACzD;QAAEpB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACRnB,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}
+{"version":3,"names":["resolveApplicationSessionLane","logger","loggerUtil","runSessionColdBoot","loadPersistedDeviceCredential","createPlatformSharedDeviceCredentialStore","tryCompleteOAuthReturn","isWebBrowser","isNetConnectivityExplicitlyOffline","SESSION_HANDOFF_DEADLINE_MS","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","online","globalThis","navigator","onLine","NetInfo","state","Promise","race","default","fetch","resolve","setTimeout","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","lane","resolveSessionLane","onClassified","oauthCompleted","input","activate","oauth","beforeDeviceBoot","offline","oxy","store","platform","isWeb","isNative","sharedDeviceCredential","undefined","overallDeadlineMs","isOffline","onStepDeadline","stepId","warn","component","method","onSession","session","handoff","sessionId","accessToken","userId","deviceState","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","start","socketError","__DEV__","debug","onStepError","id","error","afterDeviceBoot","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;AAAA,SAASA,6BAA6B,QAAQ,oCAAiC;AAC/E,SAASC,MAAM,IAAIC,UAAU,QAA0B,cAAc;AACrE,SAASC,kBAAkB,QAAqE,sBAAsB;AAEtH,SAASC,6BAA6B,QAAQ,8BAA2B;AACzE,SAASC,yCAAyC,QAAQ,2CAAwC;AAClG,SAASC,sBAAsB,QAAQ,yBAAsB;AAC7D,SAASC,YAAY,QAAQ,0BAAuB;AACpD,SAASC,kCAAkC,QAAQ,6BAA0B;AAG7E;AACA,OAAO,MAAMC,2BAA2B,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,6BAA6B,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAIL,YAAY,CAAC,CAAC,EAAE;MAClB,MAAMM,MAAM,GAAIC,UAAU,CAA0CC,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOH,MAAM,KAAK,KAAK;IACzB;IACA,MAAMI,OAAO,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC;IAC/D,MAAMC,KAAK,GAAG,MAAMC,OAAO,CAACC,IAAI,CAAC,CAC/BH,OAAO,CAACI,OAAO,CAACC,KAAK,CAAC,CAAC,EACvB,IAAIH,OAAO,CAAQI,OAAO,IAAK;MAC7BC,UAAU,CAAC,MAAMD,OAAO,CAAC,IAAI,CAAC,EAAEZ,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAOH,kCAAkC,CAACU,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AA8BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeO,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA,MAAME,IAAI,GAAG,OAAOb,IAAI,CAACc,kBAAkB,GAAG,CAAC,IAAIxC,6BAA6B,CAAC2B,WAAW,EAAEE,QAAQ,CAAC,CAAC;IACxG,MAAMH,IAAI,CAACe,YAAY,GAAGF,IAAI,CAAC;IAC/B,IAAID,aAAa,IAAIC,IAAI,KAAK,QAAQ,EAAE;IACxC;IACA;IACA;IACA;IACA;IACA;IACA,MAAMG,cAAc,GAAGJ,aAAa,GAChC,KAAK,GACL,MAAMhC,sBAAsB,CAAC;MAC3BqB,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGQ,KAAK,IAAKR,aAAa,CAACQ,KAAK,EAAE;QAAEC,QAAQ,EAAE,IAAI;QAAEC,KAAK,EAAE;MAAK,CAAC;IAChF,CAAC,CAAC;IACN,IAAIH,cAAc,EAAE;MAClBL,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;IAEA,IAAIG,IAAI,KAAK,OAAO,EAAE;MACpBF,aAAa,CAAC,IAAI,CAAC;MACnB;IACF;IAEA,MAAMX,IAAI,CAACoB,gBAAgB,GAAG,CAAC;;IAE/B;IACA;IACA;IACA;IACA,MAAMC,OAAO,GAAG,MAAMnC,iBAAiB,CAAC,CAAC;IAEzC,MAAMT,kBAAkB,CAAC;MACvB6C,GAAG,EAAErB,WAAW;MAChBsB,KAAK,EAAErB,SAAS;MAChBsB,QAAQ,EAAE;QAAEC,KAAK,EAAE5C,YAAY,CAAC,CAAC;QAAE6C,QAAQ,EAAE,CAAC7C,YAAY,CAAC;MAAE,CAAC;MAC9DwB,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACAqB,sBAAsB,EAAEhD,yCAAyC,CAAC,CAAC,IAAIiD,SAAS;MAChFC,iBAAiB,EAAE7C,6BAA6B;MAChD8C,SAAS,EAAEA,CAAA,KAAMT,OAAO;MACxBU,cAAc,EAAGC,MAAM,IAAK;QAC1BxD,UAAU,CAACyD,IAAI,CACb,mBAAmBD,MAAM,kBAAkBhD,6BAA6B,8DAA8D,EACtI;UAAEkD,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAM7B,0BAA0B,CAAC,CAAC;QAClC,MAAM8B,OAAO,GAAG7B,aAAa,CAC3B;UACE8B,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5BC,WAAW,EAAEH,OAAO,CAACG,WAAW;UAChCC,MAAM,EAAEJ,OAAO,CAACI,MAAM;UACtBC,WAAW,EAAEL,OAAO,CAAC7C;QACvB,CAAC,EACD;UAAE0B,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIyB,iBAA4D;QAChE,MAAMlD,OAAO,CAACC,IAAI,CAAC,CACjB4C,OAAO,EACP,IAAI7C,OAAO,CAAQI,OAAO,IAAK;UAC7B8C,iBAAiB,GAAG7C,UAAU,CAACD,OAAO,EAAEd,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAAC6D,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAKf,SAAS,EAAE;YACnCiB,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACFjC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDoC,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAMtC,0BAA0B,CAAC,CAAC;QAClC,MAAMuC,IAAI,GAAG,MAAMrE,6BAA6B,CAACwB,SAAS,CAAC;QAC3D,IAAI6C,IAAI,EAAE;UACR,IAAI;YACF,MAAMxC,aAAa,CAACyC,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACX1E,UAAU,CAAC2E,KAAK,CACd,wCAAwC,EACxC;gBAAEjB,SAAS,EAAE;cAAsB,CAAC,EACpCe,WACF,CAAC;YACH;UACF;QACF;QACAvC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACD0C,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACX1E,UAAU,CAAC2E,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAEnB,SAAS,EAAE;UAAsB,CAAC,EACpCoB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;IACF,MAAMtD,IAAI,CAACuD,eAAe,GAAG,CAAC;EAChC,CAAC,CAAC,OAAOD,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACX1E,UAAU,CAAC8E,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYE,KAAK,GAAGF,KAAK,GAAG,IAAIE,KAAK,CAACC,MAAM,CAACH,KAAK,CAAC,CAAC,EACzD;QAAEpB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACRxB,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}

package/lib/module/ui/components/OxySignInButton.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { classifyApplicationSessionLane } from "../oauth/applicationSessionLane.js";
 import { useCallback, useState, useEffect, useRef } from 'react';
 import { Platform } from 'react-native';
 import { logger, generatePkcePair, generateOAuthState, buildOAuthAuthorizeUrl } from '@oxy.so/core';
@@ -65,7 +66,8 @@ export const OxySignInButton = ({
   disabled = false,
   showWhenAuthenticated = false,
   oauthRedirectUri,
-  onOAuthResult
+  onOAuthResult,
+  nativeOAuthCompletion
 }) => {
   const {
     t
@@ -75,7 +77,8 @@ export const OxySignInButton = ({
     oxyServices,
     clientId,
     webAuthMode,
-    startWebOAuthSignIn
+    startWebOAuthSignIn,
+    startNativeOAuthSignIn
   } = useOxy();
   const {
     isAuthenticated,
@@ -111,7 +114,9 @@ export const OxySignInButton = ({
     if (cached && cached.clientId === clientId && cached.oxyServices === oxyServices) {
       return cached.promise;
     }
-    const promise = oxyServices.apps.getPublic(clientId).catch(error => {
+    const promise = oxyServices.apps.getPublic(clientId, {
+      cache: false
+    }).catch(error => {
       // Only clear if this is still the live entry (a later resolve may have
       // replaced it after a clientId/oxyServices change).
       if (appResolutionRef.current?.promise === promise) {
@@ -192,6 +197,18 @@ export const OxySignInButton = ({
       }
       return;
     }
+    if (nativeOAuthCompletion === 'sdk') {
+      if (onOAuthResult) {
+        notifyNotConfigured(app.name);
+        return;
+      }
+      const result = await startNativeOAuthSignIn({
+        redirectUri: oauthRedirectUri
+      });
+      if (result.status === 'failed') notifyFailed();
+      if (result.status === 'unsupported') notifyNotConfigured(app.name);
+      return;
+    }
 
     // Native: open the in-app auth session, then hand the handshake to the
     // RP so it can complete the token exchange from its deep-link callback.
@@ -218,7 +235,7 @@ export const OxySignInButton = ({
       application: app.name
     });
     notifyNotConfigured(app.name);
-  }, [clientId, oauthRedirectUri, onOAuthResult, startOfficialSignIn, startWebOAuthSignIn, shouldPreOpenPopup, notifyNotConfigured, notifyFailed]);
+  }, [clientId, oauthRedirectUri, onOAuthResult, nativeOAuthCompletion, startNativeOAuthSignIn, startOfficialSignIn, startWebOAuthSignIn, shouldPreOpenPopup, notifyNotConfigured, notifyFailed]);
 
   // Resolve the Application once, then route: third-party → OAuth; first-party
   // / official → the in-app dialog. An unresolved client must fail closed:
@@ -236,7 +253,7 @@ export const OxySignInButton = ({
       const resolving = resolvePublicApplication();
       if (!resolving) {
         closeOAuthPopup(popup);
-        startOfficialSignIn();
+        notifyNotConfigured('this app');
         return;
       }
       let app;
@@ -251,7 +268,7 @@ export const OxySignInButton = ({
         notifyFailed();
         return;
       }
-      if (app.type === 'third_party' && !app.isOfficial) {
+      if (classifyApplicationSessionLane(app) === 'oauth') {
         await startThirdPartyOAuth(app, popup);
         return;
       }
@@ -269,9 +286,10 @@ export const OxySignInButton = ({
       });
       notifyFailed();
     } finally {
+      appResolutionRef.current = null;
       routingRef.current = false;
     }
-  }, [resolvePublicApplication, startOfficialSignIn, startThirdPartyOAuth, clientId, notifyFailed]);
+  }, [resolvePublicApplication, startOfficialSignIn, startThirdPartyOAuth, clientId, notifyNotConfigured, notifyFailed]);
 
   // Defer to a caller-supplied handler, otherwise route by application type.
   //