@oxy.so/services 11.0.0 → 11.2.0-oxy-one.0

package/lib/module/ui/components/OxySignInButton.js.map

@@ -1 +1 @@
-{"version":3,"names":["useCallback","useState","useEffect","useRef","Platform","logger","generatePkcePair","generateOAuthState","buildOAuthAuthorizeUrl","useAuthStore","useShallow","SocialButton","socialButtonLabel","toast","useOxy","useI18n","subscribeToAccountDialog","openAuthorizeUrlNative","closeOAuthPopup","openOAuthPopup","jsx","_jsx","ACTION_KEYS","signIn","continue","signUp","OxySignInButton","variant","appearance","action","size","fullWidth","iconOnly","onPress","style","textStyle","text","disabled","showWhenAuthenticated","oauthRedirectUri","onOAuthResult","t","openAccountDialog","oxyServices","clientId","webAuthMode","startWebOAuthSignIn","isAuthenticated","isLoading","state","isModalOpen","setIsModalOpen","appResolutionRef","routingRef","shouldPreOpenPopup","OS","Boolean","resolvePublicApplication","cached","current","promise","apps","getPublic","catch","error","notifyNotConfigured","appName","description","app","notifyFailed","startOfficialSignIn","startThirdPartyOAuth","popup","undefined","component","application","name","result","redirectUri","status","warn","reason","pkce","Promise","all","authorizeUrl","codeChallenge","redirectUrl","codeVerifier","routeSignIn","resolving","type","isOfficial","Error","String","handlePress","isButtonDisabled","resolvedAppearance","actionKey","translated","label","brand","accessibilityLabel","children"],"sourceRoot":"../../../../src","sources":["ui/components/OxySignInButton.tsx"],"mappings":";;AACA,SAASA,WAAW,EAAEC,QAAQ,EAAEC,SAAS,EAAEC,MAAM,QAAQ,OAAO;AAChE,SAAyDC,QAAQ,QAAQ,cAAc;AACvF,SACIC,MAAM,EACNC,gBAAgB,EAChBC,kBAAkB,EAClBC,sBAAsB,QAEnB,cAAc;AACrB,SAASC,YAAY,QAAQ,wBAAqB;AAClD,SAASC,UAAU,QAAQ,uBAAuB;AAClD,SACIC,YAAY,EACZC,iBAAiB,QAId,6BAA6B;AACpC,SAASC,KAAK,QAAQ,qBAAqB;AAC3C,SAASC,MAAM,QAAQ,0BAAuB;AAC9C,SAASC,OAAO,QAAQ,qBAAkB;AAC1C,SAASC,wBAAwB,QAAQ,uCAAoC;AAC7E,SAASC,sBAAsB,QAAQ,sBAAmB;AAC1D,SAASC,eAAe,EAAEC,cAAc,QAAQ,wBAAqB;;AAGrE;AACA;AACA;AACA;AACA;AACA;;AAUA;AAAA,SAAAC,GAAA,IAAAC,IAAA;AAwGA,MAAMC,WAAkD,GAAG;EACvDC,MAAM,EAAE,+BAA+B;EACvCC,QAAQ,EAAE,iCAAiC;EAC3CC,MAAM,EAAE;AACZ,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAA+C,GAAGA,CAAC;EAC5DC,OAAO,GAAG,SAAS;EACnBC,UAAU;EACVC,MAAM,GAAG,QAAQ;EACjBC,IAAI,GAAG,IAAI;EACXC,SAAS,GAAG,KAAK;EACjBC,QAAQ,GAAG,KAAK;EAChBC,OAAO;EACPC,KAAK;EACLC,SAAS;EACTC,IAAI;EACJC,QAAQ,GAAG,KAAK;EAChBC,qBAAqB,GAAG,KAAK;EAC7BC,gBAAgB;EAChBC;AACJ,CAAC,KAAK;EACF,MAAM;IAAEC;EAAE,CAAC,GAAG1B,OAAO,CAAC,CAAC;EACvB,MAAM;IAAE2B,iBAAiB;IAAEC,WAAW;IAAEC,QAAQ;IAAEC,WAAW;IAAEC;EAAoB,CAAC,GAAGhC,MAAM,CAAC,CAAC;EAC/F,MAAM;IAAEiC,eAAe;IAAEC;EAAU,CAAC,GAAGvC,YAAY,CAC/CC,UAAU,CAAEuC,KAAK,KAAM;IAAEF,eAAe,EAAEE,KAAK,CAACF,eAAe;IAAEC,SAAS,EAAEC,KAAK,CAACD;EAAU,CAAC,CAAC,CAClG,CAAC;EACD;EACA;EACA;EACA,MAAM,CAACE,WAAW,EAAEC,cAAc,CAAC,GAAGlD,QAAQ,CAAC,KAAK,CAAC;EAErDC,SAAS,CAAC,MAAMc,wBAAwB,CAACmC,cAAc,CAAC,EAAE,EAAE,CAAC;;EAE7D;EACA;EACA;EACA;EACA;EACA,MAAMC,gBAAgB,GAAGjD,MAAM,CAIrB,IAAI,CAAC;EACf;EACA;EACA;EACA,MAAMkD,UAAU,GAAGlD,MAAM,CAAC,KAAK,CAAC;EAChC;EACA;EACA;EACA;EACA,MAAMmD,kBAAkB,GACpBlD,QAAQ,CAACmD,EAAE,KAAK,KAAK,IAAIV,WAAW,KAAK,OAAO,IAAIW,OAAO,CAACjB,gBAAgB,CAAC;EAEjF,MAAMkB,wBAAwB,GAAGzD,WAAW,CAAC,MAAyC;IAClF,IAAI,CAAC4C,QAAQ,EAAE,OAAO,IAAI;IAC1B,MAAMc,MAAM,GAAGN,gBAAgB,CAACO,OAAO;IACvC,IAAID,MAAM,IAAIA,MAAM,CAACd,QAAQ,KAAKA,QAAQ,IAAIc,MAAM,CAACf,WAAW,KAAKA,WAAW,EAAE;MAC9E,OAAOe,MAAM,CAACE,OAAO;IACzB;IACA,MAAMA,OAAO,GAAGjB,WAAW,CAACkB,IAAI,CAACC,SAAS,CAAClB,QAAQ,CAAC,CAACmB,KAAK,CAAEC,KAAK,IAAK;MAClE;MACA;MACA,IAAIZ,gBAAgB,CAACO,OAAO,EAAEC,OAAO,KAAKA,OAAO,EAAE;QAC/CR,gBAAgB,CAACO,OAAO,GAAG,IAAI;MACnC;MACA,MAAMK,KAAK;IACf,CAAC,CAAC;IACFZ,gBAAgB,CAACO,OAAO,GAAG;MAAEf,QAAQ;MAAED,WAAW;MAAEiB;IAAQ,CAAC;IAC7D,OAAOA,OAAO;EAClB,CAAC,EAAE,CAAChB,QAAQ,EAAED,WAAW,CAAC,CAAC;;EAE3B;EACA;EACA;EACA;EACA,MAAMsB,mBAAmB,GAAGjE,WAAW,CAClCkE,OAAe,IAAK;IACjBrD,KAAK,CAACmD,KAAK,CAACvB,CAAC,CAAC,6BAA6B,CAAC,EAAE;MAC1C0B,WAAW,EAAE1B,CAAC,CAAC,wCAAwC,EAAE;QAAE2B,GAAG,EAAEF;MAAQ,CAAC;IAC7E,CAAC,CAAC;EACN,CAAC,EACD,CAACzB,CAAC,CACN,CAAC;EACD,MAAM4B,YAAY,GAAGrE,WAAW,CAAC,MAAM;IACnCa,KAAK,CAACmD,KAAK,CAACvB,CAAC,CAAC,sBAAsB,CAAC,EAAE;MACnC0B,WAAW,EAAE1B,CAAC,CAAC,iCAAiC;IACpD,CAAC,CAAC;EACN,CAAC,EAAE,CAACA,CAAC,CAAC,CAAC;;EAEP;EACA,MAAM6B,mBAAmB,GAAGtE,WAAW,CAAC,MAAM;IAC1C0C,iBAAiB,CAAC,QAAQ,CAAC;EAC/B,CAAC,EAAE,CAACA,iBAAiB,CAAC,CAAC;;EAEvB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM6B,oBAAoB,GAAGvE,WAAW,CACpC,OAAOoE,GAAsB,EAAEI,KAA8B,KAAoB;IAC7E,IAAI,CAAC5B,QAAQ,EAAE;MACX1B,eAAe,CAACsD,KAAK,CAAC;MACtBF,mBAAmB,CAAC,CAAC;MACrB;IACJ;IACA,IAAI,CAAC/B,gBAAgB,EAAE;MACnBrB,eAAe,CAACsD,KAAK,CAAC;MACtBnE,MAAM,CAAC2D,KAAK,CACR,0HAA0H,EAC1HS,SAAS,EACT;QAAEC,SAAS,EAAE,iBAAiB;QAAE9B,QAAQ;QAAE+B,WAAW,EAAEP,GAAG,CAACQ;MAAK,CACpE,CAAC;MACDX,mBAAmB,CAACG,GAAG,CAACQ,IAAI,CAAC;MAC7B;IACJ;IAEA,IAAIxE,QAAQ,CAACmD,EAAE,KAAK,KAAK,EAAE;MACvB,MAAMsB,MAAM,GAAG,MAAM/B,mBAAmB,CAAC;QACrCgC,WAAW,EAAEvC,gBAAgB;QAC7B;QACA;QACA;QACA;QACA,IAAIe,kBAAkB,GAAG;UAAEkB;QAAM,CAAC,GAAG,CAAC,CAAC;MAC3C,CAAC,CAAC;MACF,IAAIK,MAAM,CAACE,MAAM,KAAK,QAAQ,EAAE;QAC5B1E,MAAM,CAAC2E,IAAI,CACP,wCAAwCH,MAAM,CAACI,MAAM,GAAG,EACxD;UAAEP,SAAS,EAAE,iBAAiB;UAAEC,WAAW,EAAEP,GAAG,CAACQ;QAAK,CAAC,EACvDC,MAAM,CAACV,WACX,CAAC;QACDE,YAAY,CAAC,CAAC;MAClB;MACA;IACJ;;IAEA;IACA;IACA,MAAM,CAACa,IAAI,EAAEjC,KAAK,CAAC,GAAG,MAAMkC,OAAO,CAACC,GAAG,CAAC,CAAC9E,gBAAgB,CAAC,CAAC,EAAEC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM8E,YAAY,GAAG7E,sBAAsB,CAAC;MACxCoC,QAAQ;MACRkC,WAAW,EAAEvC,gBAAgB;MAC7BU,KAAK;MACLqC,aAAa,EAAEJ,IAAI,CAACI;IACxB,CAAC,CAAC;IACF,MAAM;MAAEC;IAAY,CAAC,GAAG,MAAMtE,sBAAsB,CAACoE,YAAY,EAAE9C,gBAAgB,CAAC;IACpF,IAAIC,aAAa,EAAE;MACfA,aAAa,CAAC;QAAE+C,WAAW;QAAEtC,KAAK;QAAEuC,YAAY,EAAEN,IAAI,CAACM;MAAa,CAAC,CAAC;MACtE;IACJ;IACAnF,MAAM,CAAC2E,IAAI,CACP,yLAAyL,EACzL;MAAEN,SAAS,EAAE,iBAAiB;MAAEC,WAAW,EAAEP,GAAG,CAACQ;IAAK,CAC1D,CAAC;IACDX,mBAAmB,CAACG,GAAG,CAACQ,IAAI,CAAC;EACjC,CAAC,EACD,CACIhC,QAAQ,EACRL,gBAAgB,EAChBC,aAAa,EACb8B,mBAAmB,EACnBxB,mBAAmB,EACnBQ,kBAAkB,EAClBW,mBAAmB,EACnBI,YAAY,CAEpB,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA,MAAMoB,WAAW,GAAGzF,WAAW,CAC3B,MAAOwE,KAA8B,IAAoB;IACrD,IAAInB,UAAU,CAACM,OAAO,EAAE;MACpBzC,eAAe,CAACsD,KAAK,CAAC;MACtB;IACJ;IACAnB,UAAU,CAACM,OAAO,GAAG,IAAI;IACzB,IAAI;MACA,MAAM+B,SAAS,GAAGjC,wBAAwB,CAAC,CAAC;MAC5C,IAAI,CAACiC,SAAS,EAAE;QACZxE,eAAe,CAACsD,KAAK,CAAC;QACtBF,mBAAmB,CAAC,CAAC;QACrB;MACJ;MACA,IAAIF,GAAsB;MAC1B,IAAI;QACAA,GAAG,GAAG,MAAMsB,SAAS;MACzB,CAAC,CAAC,OAAO1B,KAAK,EAAE;QACZ9C,eAAe,CAACsD,KAAK,CAAC;QACtBnE,MAAM,CAAC2E,IAAI,CACP,qEAAqE,EACrE;UAAEN,SAAS,EAAE,iBAAiB;UAAE9B;QAAS,CAAC,EAC1CoB,KACJ,CAAC;QACDK,YAAY,CAAC,CAAC;QACd;MACJ;MACA,IAAID,GAAG,CAACuB,IAAI,KAAK,aAAa,IAAI,CAACvB,GAAG,CAACwB,UAAU,EAAE;QAC/C,MAAMrB,oBAAoB,CAACH,GAAG,EAAEI,KAAK,CAAC;QACtC;MACJ;MACAtD,eAAe,CAACsD,KAAK,CAAC;MACtBF,mBAAmB,CAAC,CAAC;IACzB,CAAC,CAAC,OAAON,KAAK,EAAE;MACZ;MACA;MACA;MACA;MACA9C,eAAe,CAACsD,KAAK,CAAC;MACtBnE,MAAM,CAAC2D,KAAK,CACR,yDAAyD,EACzDA,KAAK,YAAY6B,KAAK,GAAG7B,KAAK,GAAG,IAAI6B,KAAK,CAACC,MAAM,CAAC9B,KAAK,CAAC,CAAC,EACzD;QAAEU,SAAS,EAAE,iBAAiB;QAAE9B;MAAS,CAC7C,CAAC;MACDyB,YAAY,CAAC,CAAC;IAClB,CAAC,SAAS;MACNhB,UAAU,CAACM,OAAO,GAAG,KAAK;IAC9B;EACJ,CAAC,EACD,CACIF,wBAAwB,EACxBa,mBAAmB,EACnBC,oBAAoB,EACpB3B,QAAQ,EACRyB,YAAY,CAEpB,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA,MAAM0B,WAAW,GAAG/F,WAAW,CAAC,MAAM;IAClC,IAAIiC,OAAO,EAAE;MACTA,OAAO,CAAC,CAAC;MACT;IACJ;IACA,KAAKwD,WAAW,CAACnC,kBAAkB,GAAGnC,cAAc,CAAC,CAAC,GAAG,IAAI,CAAC;EAClE,CAAC,EAAE,CAACc,OAAO,EAAEwD,WAAW,EAAEnC,kBAAkB,CAAC,CAAC;;EAE9C;EACA,IAAIP,eAAe,IAAI,CAACT,qBAAqB,EAAE,OAAO,IAAI;EAE1D,MAAM0D,gBAAgB,GAAG3D,QAAQ,IAAIW,SAAS,IAAIE,WAAW;;EAE7D;EACA;EACA,MAAM+C,kBAA0C,GAC5CrE,UAAU,KAAKD,OAAO,KAAK,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC;;EAElE;EACA;EACA,MAAMuE,SAAS,GAAG5E,WAAW,CAACO,MAAM,CAAC;EACrC,MAAMsE,UAAU,GAAG1D,CAAC,CAACyD,SAAS,CAAC;EAC/B,MAAME,KAAK,GAAGhE,IAAI,KAAK+D,UAAU,KAAKD,SAAS,GAAGtF,iBAAiB,CAAC,KAAK,EAAEiB,MAAM,CAAC,GAAGsE,UAAU,CAAC;EAEhG,oBACI9E,IAAA,CAACV,YAAY;IACT0F,KAAK,EAAC,KAAK;IACXxE,MAAM,EAAEA,MAAO;IACfD,UAAU,EAAEqE,kBAAmB;IAC/BnE,IAAI,EAAEA,IAAK;IACXC,SAAS,EAAEA,SAAU;IACrBC,QAAQ,EAAEA,QAAS;IACnBC,OAAO,EAAE8D,WAAY;IACrB1D,QAAQ,EAAE2D,gBAAiB;IAC3B9D,KAAK,EAAEA,KAAM;IACbC,SAAS,EAAEA,SAAU;IACrBmE,kBAAkB,EAAEtE,QAAQ,GAAGoE,KAAK,GAAG3B,SAAU;IAAA8B,QAAA,EAEhDvD,SAAS,IAAIE,WAAW,GAAGT,CAAC,CAAC,yBAAyB,CAAC,GAAG2D;EAAK,CACtD,CAAC;AAEvB,CAAC;AAED,eAAe1E,eAAe","ignoreList":[]}
+{"version":3,"names":["classifyApplicationSessionLane","useCallback","useState","useEffect","useRef","Platform","logger","generatePkcePair","generateOAuthState","buildOAuthAuthorizeUrl","useAuthStore","useShallow","SocialButton","socialButtonLabel","toast","useOxy","useI18n","subscribeToAccountDialog","openAuthorizeUrlNative","closeOAuthPopup","openOAuthPopup","jsx","_jsx","ACTION_KEYS","signIn","continue","signUp","OxySignInButton","variant","appearance","action","size","fullWidth","iconOnly","onPress","style","textStyle","text","disabled","showWhenAuthenticated","oauthRedirectUri","onOAuthResult","nativeOAuthCompletion","t","openAccountDialog","oxyServices","clientId","webAuthMode","startWebOAuthSignIn","startNativeOAuthSignIn","isAuthenticated","isLoading","state","isModalOpen","setIsModalOpen","appResolutionRef","routingRef","shouldPreOpenPopup","OS","Boolean","resolvePublicApplication","cached","current","promise","apps","getPublic","cache","catch","error","notifyNotConfigured","appName","description","app","notifyFailed","startOfficialSignIn","startThirdPartyOAuth","popup","undefined","component","application","name","result","redirectUri","status","warn","reason","pkce","Promise","all","authorizeUrl","codeChallenge","redirectUrl","codeVerifier","routeSignIn","resolving","Error","String","handlePress","isButtonDisabled","resolvedAppearance","actionKey","translated","label","brand","accessibilityLabel","children"],"sourceRoot":"../../../../src","sources":["ui/components/OxySignInButton.tsx"],"mappings":";;AAAA,SAASA,8BAA8B,QAAQ,oCAAiC;AAEhF,SAASC,WAAW,EAAEC,QAAQ,EAAEC,SAAS,EAAEC,MAAM,QAAQ,OAAO;AAChE,SAAyDC,QAAQ,QAAQ,cAAc;AACvF,SACIC,MAAM,EACNC,gBAAgB,EAChBC,kBAAkB,EAClBC,sBAAsB,QAEnB,cAAc;AACrB,SAASC,YAAY,QAAQ,wBAAqB;AAClD,SAASC,UAAU,QAAQ,uBAAuB;AAClD,SACIC,YAAY,EACZC,iBAAiB,QAId,6BAA6B;AACpC,SAASC,KAAK,QAAQ,qBAAqB;AAC3C,SAASC,MAAM,QAAQ,0BAAuB;AAC9C,SAASC,OAAO,QAAQ,qBAAkB;AAC1C,SAASC,wBAAwB,QAAQ,uCAAoC;AAC7E,SAASC,sBAAsB,QAAQ,sBAAmB;AAC1D,SAASC,eAAe,EAAEC,cAAc,QAAQ,wBAAqB;;AAGrE;AACA;AACA;AACA;AACA;AACA;;AAUA;AAAA,SAAAC,GAAA,IAAAC,IAAA;AA0GA,MAAMC,WAAkD,GAAG;EACvDC,MAAM,EAAE,+BAA+B;EACvCC,QAAQ,EAAE,iCAAiC;EAC3CC,MAAM,EAAE;AACZ,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAA+C,GAAGA,CAAC;EAC5DC,OAAO,GAAG,SAAS;EACnBC,UAAU;EACVC,MAAM,GAAG,QAAQ;EACjBC,IAAI,GAAG,IAAI;EACXC,SAAS,GAAG,KAAK;EACjBC,QAAQ,GAAG,KAAK;EAChBC,OAAO;EACPC,KAAK;EACLC,SAAS;EACTC,IAAI;EACJC,QAAQ,GAAG,KAAK;EAChBC,qBAAqB,GAAG,KAAK;EAC7BC,gBAAgB;EAChBC,aAAa;EACbC;AACJ,CAAC,KAAK;EACF,MAAM;IAAEC;EAAE,CAAC,GAAG3B,OAAO,CAAC,CAAC;EACvB,MAAM;IAAE4B,iBAAiB;IAAEC,WAAW;IAAEC,QAAQ;IAAEC,WAAW;IAAEC,mBAAmB;IAAEC;EAAuB,CAAC,GAAGlC,MAAM,CAAC,CAAC;EACvH,MAAM;IAAEmC,eAAe;IAAEC;EAAU,CAAC,GAAGzC,YAAY,CAC/CC,UAAU,CAAEyC,KAAK,KAAM;IAAEF,eAAe,EAAEE,KAAK,CAACF,eAAe;IAAEC,SAAS,EAAEC,KAAK,CAACD;EAAU,CAAC,CAAC,CAClG,CAAC;EACD;EACA;EACA;EACA,MAAM,CAACE,WAAW,EAAEC,cAAc,CAAC,GAAGpD,QAAQ,CAAC,KAAK,CAAC;EAErDC,SAAS,CAAC,MAAMc,wBAAwB,CAACqC,cAAc,CAAC,EAAE,EAAE,CAAC;;EAE7D;EACA;EACA;EACA;EACA;EACA,MAAMC,gBAAgB,GAAGnD,MAAM,CAIrB,IAAI,CAAC;EACf;EACA;EACA;EACA,MAAMoD,UAAU,GAAGpD,MAAM,CAAC,KAAK,CAAC;EAChC;EACA;EACA;EACA;EACA,MAAMqD,kBAAkB,GACpBpD,QAAQ,CAACqD,EAAE,KAAK,KAAK,IAAIX,WAAW,KAAK,OAAO,IAAIY,OAAO,CAACnB,gBAAgB,CAAC;EAEjF,MAAMoB,wBAAwB,GAAG3D,WAAW,CAAC,MAAyC;IAClF,IAAI,CAAC6C,QAAQ,EAAE,OAAO,IAAI;IAC1B,MAAMe,MAAM,GAAGN,gBAAgB,CAACO,OAAO;IACvC,IAAID,MAAM,IAAIA,MAAM,CAACf,QAAQ,KAAKA,QAAQ,IAAIe,MAAM,CAAChB,WAAW,KAAKA,WAAW,EAAE;MAC9E,OAAOgB,MAAM,CAACE,OAAO;IACzB;IACA,MAAMA,OAAO,GAAGlB,WAAW,CAACmB,IAAI,CAACC,SAAS,CAACnB,QAAQ,EAAE;MAAEoB,KAAK,EAAE;IAAM,CAAC,CAAC,CAACC,KAAK,CAAEC,KAAK,IAAK;MACpF;MACA;MACA,IAAIb,gBAAgB,CAACO,OAAO,EAAEC,OAAO,KAAKA,OAAO,EAAE;QAC/CR,gBAAgB,CAACO,OAAO,GAAG,IAAI;MACnC;MACA,MAAMM,KAAK;IACf,CAAC,CAAC;IACFb,gBAAgB,CAACO,OAAO,GAAG;MAAEhB,QAAQ;MAAED,WAAW;MAAEkB;IAAQ,CAAC;IAC7D,OAAOA,OAAO;EAClB,CAAC,EAAE,CAACjB,QAAQ,EAAED,WAAW,CAAC,CAAC;;EAE3B;EACA;EACA;EACA;EACA,MAAMwB,mBAAmB,GAAGpE,WAAW,CAClCqE,OAAe,IAAK;IACjBxD,KAAK,CAACsD,KAAK,CAACzB,CAAC,CAAC,6BAA6B,CAAC,EAAE;MAC1C4B,WAAW,EAAE5B,CAAC,CAAC,wCAAwC,EAAE;QAAE6B,GAAG,EAAEF;MAAQ,CAAC;IAC7E,CAAC,CAAC;EACN,CAAC,EACD,CAAC3B,CAAC,CACN,CAAC;EACD,MAAM8B,YAAY,GAAGxE,WAAW,CAAC,MAAM;IACnCa,KAAK,CAACsD,KAAK,CAACzB,CAAC,CAAC,sBAAsB,CAAC,EAAE;MACnC4B,WAAW,EAAE5B,CAAC,CAAC,iCAAiC;IACpD,CAAC,CAAC;EACN,CAAC,EAAE,CAACA,CAAC,CAAC,CAAC;;EAEP;EACA,MAAM+B,mBAAmB,GAAGzE,WAAW,CAAC,MAAM;IAC1C2C,iBAAiB,CAAC,QAAQ,CAAC;EAC/B,CAAC,EAAE,CAACA,iBAAiB,CAAC,CAAC;;EAEvB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,MAAM+B,oBAAoB,GAAG1E,WAAW,CACpC,OAAOuE,GAAsB,EAAEI,KAA8B,KAAoB;IAC7E,IAAI,CAAC9B,QAAQ,EAAE;MACX3B,eAAe,CAACyD,KAAK,CAAC;MACtBF,mBAAmB,CAAC,CAAC;MACrB;IACJ;IACA,IAAI,CAAClC,gBAAgB,EAAE;MACnBrB,eAAe,CAACyD,KAAK,CAAC;MACtBtE,MAAM,CAAC8D,KAAK,CACR,0HAA0H,EAC1HS,SAAS,EACT;QAAEC,SAAS,EAAE,iBAAiB;QAAEhC,QAAQ;QAAEiC,WAAW,EAAEP,GAAG,CAACQ;MAAK,CACpE,CAAC;MACDX,mBAAmB,CAACG,GAAG,CAACQ,IAAI,CAAC;MAC7B;IACJ;IAEA,IAAI3E,QAAQ,CAACqD,EAAE,KAAK,KAAK,EAAE;MACvB,MAAMuB,MAAM,GAAG,MAAMjC,mBAAmB,CAAC;QACrCkC,WAAW,EAAE1C,gBAAgB;QAC7B;QACA;QACA;QACA;QACA,IAAIiB,kBAAkB,GAAG;UAAEmB;QAAM,CAAC,GAAG,CAAC,CAAC;MAC3C,CAAC,CAAC;MACF,IAAIK,MAAM,CAACE,MAAM,KAAK,QAAQ,EAAE;QAC5B7E,MAAM,CAAC8E,IAAI,CACP,wCAAwCH,MAAM,CAACI,MAAM,GAAG,EACxD;UAAEP,SAAS,EAAE,iBAAiB;UAAEC,WAAW,EAAEP,GAAG,CAACQ;QAAK,CAAC,EACvDC,MAAM,CAACV,WACX,CAAC;QACDE,YAAY,CAAC,CAAC;MAClB;MACA;IACJ;IAEA,IAAI/B,qBAAqB,KAAK,KAAK,EAAE;MACjC,IAAID,aAAa,EAAE;QAAE4B,mBAAmB,CAACG,GAAG,CAACQ,IAAI,CAAC;QAAE;MAAQ;MAC5D,MAAMC,MAAM,GAAG,MAAMhC,sBAAsB,CAAC;QAAEiC,WAAW,EAAE1C;MAAiB,CAAC,CAAC;MAC9E,IAAIyC,MAAM,CAACE,MAAM,KAAK,QAAQ,EAAEV,YAAY,CAAC,CAAC;MAC9C,IAAIQ,MAAM,CAACE,MAAM,KAAK,aAAa,EAAEd,mBAAmB,CAACG,GAAG,CAACQ,IAAI,CAAC;MAClE;IACJ;;IAEA;IACA;IACA,MAAM,CAACM,IAAI,EAAElC,KAAK,CAAC,GAAG,MAAMmC,OAAO,CAACC,GAAG,CAAC,CAACjF,gBAAgB,CAAC,CAAC,EAAEC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACnF,MAAMiF,YAAY,GAAGhF,sBAAsB,CAAC;MACxCqC,QAAQ;MACRoC,WAAW,EAAE1C,gBAAgB;MAC7BY,KAAK;MACLsC,aAAa,EAAEJ,IAAI,CAACI;IACxB,CAAC,CAAC;IACF,MAAM;MAAEC;IAAY,CAAC,GAAG,MAAMzE,sBAAsB,CAACuE,YAAY,EAAEjD,gBAAgB,CAAC;IACpF,IAAIC,aAAa,EAAE;MACfA,aAAa,CAAC;QAAEkD,WAAW;QAAEvC,KAAK;QAAEwC,YAAY,EAAEN,IAAI,CAACM;MAAa,CAAC,CAAC;MACtE;IACJ;IACAtF,MAAM,CAAC8E,IAAI,CACP,yLAAyL,EACzL;MAAEN,SAAS,EAAE,iBAAiB;MAAEC,WAAW,EAAEP,GAAG,CAACQ;IAAK,CAC1D,CAAC;IACDX,mBAAmB,CAACG,GAAG,CAACQ,IAAI,CAAC;EACjC,CAAC,EACD,CACIlC,QAAQ,EACRN,gBAAgB,EAChBC,aAAa,EACbC,qBAAqB,EACrBO,sBAAsB,EACtByB,mBAAmB,EACnB1B,mBAAmB,EACnBS,kBAAkB,EAClBY,mBAAmB,EACnBI,YAAY,CAEpB,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA;EACA,MAAMoB,WAAW,GAAG5F,WAAW,CAC3B,MAAO2E,KAA8B,IAAoB;IACrD,IAAIpB,UAAU,CAACM,OAAO,EAAE;MACpB3C,eAAe,CAACyD,KAAK,CAAC;MACtB;IACJ;IACApB,UAAU,CAACM,OAAO,GAAG,IAAI;IACzB,IAAI;MACA,MAAMgC,SAAS,GAAGlC,wBAAwB,CAAC,CAAC;MAC5C,IAAI,CAACkC,SAAS,EAAE;QACZ3E,eAAe,CAACyD,KAAK,CAAC;QACtBP,mBAAmB,CAAC,UAAU,CAAC;QAC/B;MACJ;MACA,IAAIG,GAAsB;MAC1B,IAAI;QACAA,GAAG,GAAG,MAAMsB,SAAS;MACzB,CAAC,CAAC,OAAO1B,KAAK,EAAE;QACZjD,eAAe,CAACyD,KAAK,CAAC;QACtBtE,MAAM,CAAC8E,IAAI,CACP,qEAAqE,EACrE;UAAEN,SAAS,EAAE,iBAAiB;UAAEhC;QAAS,CAAC,EAC1CsB,KACJ,CAAC;QACDK,YAAY,CAAC,CAAC;QACd;MACJ;MACA,IAAIzE,8BAA8B,CAACwE,GAAG,CAAC,KAAK,OAAO,EAAE;QACjD,MAAMG,oBAAoB,CAACH,GAAG,EAAEI,KAAK,CAAC;QACtC;MACJ;MACAzD,eAAe,CAACyD,KAAK,CAAC;MACtBF,mBAAmB,CAAC,CAAC;IACzB,CAAC,CAAC,OAAON,KAAK,EAAE;MACZ;MACA;MACA;MACA;MACAjD,eAAe,CAACyD,KAAK,CAAC;MACtBtE,MAAM,CAAC8D,KAAK,CACR,yDAAyD,EACzDA,KAAK,YAAY2B,KAAK,GAAG3B,KAAK,GAAG,IAAI2B,KAAK,CAACC,MAAM,CAAC5B,KAAK,CAAC,CAAC,EACzD;QAAEU,SAAS,EAAE,iBAAiB;QAAEhC;MAAS,CAC7C,CAAC;MACD2B,YAAY,CAAC,CAAC;IAClB,CAAC,SAAS;MACNlB,gBAAgB,CAACO,OAAO,GAAG,IAAI;MAC/BN,UAAU,CAACM,OAAO,GAAG,KAAK;IAC9B;EACJ,CAAC,EACD,CACIF,wBAAwB,EACxBc,mBAAmB,EACnBC,oBAAoB,EACpB7B,QAAQ,EACRuB,mBAAmB,EACnBI,YAAY,CAEpB,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA,MAAMwB,WAAW,GAAGhG,WAAW,CAAC,MAAM;IAClC,IAAIiC,OAAO,EAAE;MACTA,OAAO,CAAC,CAAC;MACT;IACJ;IACA,KAAK2D,WAAW,CAACpC,kBAAkB,GAAGrC,cAAc,CAAC,CAAC,GAAG,IAAI,CAAC;EAClE,CAAC,EAAE,CAACc,OAAO,EAAE2D,WAAW,EAAEpC,kBAAkB,CAAC,CAAC;;EAE9C;EACA,IAAIP,eAAe,IAAI,CAACX,qBAAqB,EAAE,OAAO,IAAI;EAE1D,MAAM2D,gBAAgB,GAAG5D,QAAQ,IAAIa,SAAS,IAAIE,WAAW;;EAE7D;EACA;EACA,MAAM8C,kBAA0C,GAC5CtE,UAAU,KAAKD,OAAO,KAAK,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC;;EAElE;EACA;EACA,MAAMwE,SAAS,GAAG7E,WAAW,CAACO,MAAM,CAAC;EACrC,MAAMuE,UAAU,GAAG1D,CAAC,CAACyD,SAAS,CAAC;EAC/B,MAAME,KAAK,GAAGjE,IAAI,KAAKgE,UAAU,KAAKD,SAAS,GAAGvF,iBAAiB,CAAC,KAAK,EAAEiB,MAAM,CAAC,GAAGuE,UAAU,CAAC;EAEhG,oBACI/E,IAAA,CAACV,YAAY;IACT2F,KAAK,EAAC,KAAK;IACXzE,MAAM,EAAEA,MAAO;IACfD,UAAU,EAAEsE,kBAAmB;IAC/BpE,IAAI,EAAEA,IAAK;IACXC,SAAS,EAAEA,SAAU;IACrBC,QAAQ,EAAEA,QAAS;IACnBC,OAAO,EAAE+D,WAAY;IACrB3D,QAAQ,EAAE4D,gBAAiB;IAC3B/D,KAAK,EAAEA,KAAM;IACbC,SAAS,EAAEA,SAAU;IACrBoE,kBAAkB,EAAEvE,QAAQ,GAAGqE,KAAK,GAAGzB,SAAU;IAAA4B,QAAA,EAEhDtD,SAAS,IAAIE,WAAW,GAAGV,CAAC,CAAC,yBAAyB,CAAC,GAAG2D;EAAK,CACtD,CAAC;AAEvB,CAAC;AAED,eAAe3E,eAAe","ignoreList":[]}

package/lib/module/ui/context/OxyContext.js

@@ -1,20 +1,25 @@
 "use strict";
 
+import { startNativeOAuthSignIn } from "../oauth/nativeAuthTransport.js";
+import { clearIsolatedOAuthSession, hasIsolatedOAuthSession, readIsolatedOAuthSession, setIsolatedOAuthSession } from "./isolatedOAuthSession.js";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';
-import { Linking, Platform } from 'react-native';
+import { AppState, Linking, Platform } from 'react-native';
 import { OxyServices } from '@oxy.so/core';
 import { KeyManager } from '@oxy.so/core/crypto';
-import { refreshDeviceSecretArm, establishIdentitySession, installAuthRefreshHandler, startTokenRefreshScheduler, createAccountDialogController } from '@oxy.so/core/session';
+import { refreshDeviceSecretArm, establishIdentitySession, createAuthRefreshHandler, startTokenRefreshScheduler, createAccountDialogController } from '@oxy.so/core/session';
 import { logger as loggerUtil } from '@oxy.so/core';
 import { registerAccountDialogControls, notifyAccountDialogVisibility } from "../navigation/accountDialogManager.js";
 import { redirectToAuthorize } from "../components/oauthNavigation.js";
 import { startWebOAuthSignIn } from "../oauth/browserAuthTransport.js";
 import { openBridgeWindow, resolveBridgeOrigin, runBrowserBridge } from "../oauth/browserBridge.js";
+import { createPlatformSharedDeviceCredentialStore } from "../session/sharedDeviceCredentialStore.js";
 import { trackDeviceCredential } from "../session/deviceCredentialTracker.js";
 import { requestOAuthConsent } from "../oauth/explicitOAuthConsent.js";
 import { isWebBrowser } from "../utils/isWebBrowser.js";
 import { resolveDeliveryPlatform } from "../utils/deliveryPlatform.js";
 import { runProviderColdBoot } from "../boot/runProviderColdBoot.js";
+import { resolveApplicationSessionLane } from "../oauth/applicationSessionLane.js";
+import { handleAuthError } from "../utils/errorHandlers.js";
 import { hasPersistedSessionCredential, loadPersistedDeviceCredential } from "../utils/deviceCredential.js";
 import { createTokenLossRecovery } from "../session/tokenLossRecovery.js";
 import { bindAuthStoreToRuntime } from "../stores/authStore.js";
@@ -135,9 +140,25 @@ export const OxyRuntimeProvider = ({
   // Server-authoritative device session client. Built ONCE per `oxyServices`
   // instance. Device-scoped sockets connect with deviceId+deviceSecret when no
   // bearer is planted yet, so cross-origin apps sync via `session_state`.
+  const runtimeRef = useRef(null);
+  const registeredLaneRef = useRef({
+    clientId: clientIdProp,
+    services: oxyServices,
+    lane: null,
+    pending: null
+  });
+  if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
+    registeredLaneRef.current = {
+      clientId: clientIdProp,
+      services: oxyServices,
+      lane: null,
+      pending: null
+    };
+  }
   const sessionClientPairRef = useRef(null);
   if (!sessionClientPairRef.current) {
     sessionClientPairRef.current = createSessionClient(oxyServices, origin => {
+      if (runtimeRef.current && hasIsolatedOAuthSession(runtimeRef.current)) return;
       // Erase the DURABLE device credential only on a `request`-origin verdict
       // (a REST sign-out / revocation). A `push`-origin empty state is a socket
       // broadcast that may be a transient reconnect artifact — clearing the
@@ -155,7 +176,10 @@ export const OxyRuntimeProvider = ({
     // option — and the pinned account id once an identity-bound provider has
     // resolved its pin. Read through the ref so the resolver stays stable for
     // the client's lifetime while still seeing later resolutions.
-    () => identityRef.current?.getPinnedAccountId() ?? null);
+    () => identityRef.current?.getPinnedAccountId() ?? null, () => registeredLaneRef.current.lane === 'device' && (!runtimeRef.current || !hasIsolatedOAuthSession(runtimeRef.current)), async () => {
+      if (identityRef.current || registeredLaneRef.current.lane !== 'device') return;
+      if ((await authStore.setAutomaticIdentitySignInSuppressed?.(true)) === false) throw new Error('Failed to persist explicit sign-out intent');
+    });
   }
   const {
     client: sessionClient,
@@ -175,7 +199,6 @@ export const OxyRuntimeProvider = ({
   const saveSessionIdsRef = useRef(() => undefined);
   const subjectChangeRef = useRef(() => undefined);
   const reestablishRef = useRef(() => undefined);
-  const runtimeRef = useRef(null);
   if (!runtimeRef.current) {
     runtimeRef.current = createOxyRuntime({
       oxyServices,
@@ -390,11 +413,56 @@ export const OxyRuntimeProvider = ({
     const cred = await loadPersistedDeviceCredential(authStore);
     sessionClientHost.setDeviceCredential(cred);
   }, [authStore, sessionClientHost]);
+
+  // Provider-owned classification: never accept a caller/button's trust verdict.
+  // Recovery asks freshly; concurrent boot/recovery requests share one lookup.
+  const resolveRegisteredLane = useCallback(async () => {
+    const selected = registeredLaneRef.current;
+    if (selected.clientId !== clientIdProp || selected.services !== oxyServices) throw new Error('Provider classification was superseded');
+    if (selected.pending) return selected.pending;
+    selected.lane = null;
+    const pending = (async () => {
+      const lane = await resolveApplicationSessionLane(oxyServices, clientIdProp);
+      if (registeredLaneRef.current !== selected) throw new Error('Provider classification was superseded');
+      if (lane === 'oauth' && !hasIsolatedOAuthSession(runtime)) {
+        sessionClient.resetLocalState();
+        sessionClientHost.setDeviceCredential(null);
+        await clearSessionStateRef.current();
+      }
+      if (registeredLaneRef.current !== selected) throw new Error('Provider classification was superseded');
+      selected.lane = lane;
+      return lane;
+    })();
+    selected.pending = pending;
+    try {
+      return await pending;
+    } finally {
+      if (selected.pending === pending) selected.pending = null;
+    }
+  }, [oxyServices, clientIdProp, runtime, sessionClient, sessionClientHost]);
+  const ensureDeviceSessionLane = useCallback(() => {
+    if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
+      throw new Error('Provider classification was superseded');
+    }
+    if (registeredLaneRef.current.lane === 'oauth' || hasIsolatedOAuthSession(runtime)) {
+      throw new Error('This application requires explicit OAuth sign-in');
+    }
+    if (registeredLaneRef.current.lane === 'device') return;
+    return resolveRegisteredLane().then(lane => {
+      if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
+        throw new Error('Provider classification was superseded');
+      }
+      if (lane !== 'device' || hasIsolatedOAuthSession(runtime)) {
+        throw new Error('This application requires explicit OAuth sign-in');
+      }
+    });
+  }, [resolveRegisteredLane, runtime, clientIdProp, oxyServices]);
   const {
     signIn,
     logout,
     logoutAll
   } = useAuthOperations({
+    ensureDeviceSessionLane,
     oxyServices,
     store: authStore,
     storage,
@@ -477,8 +545,9 @@ export const OxyRuntimeProvider = ({
     };
     const recovery = createTokenLossRecovery({
       remint: () => oxyServices.http.refreshAccessToken('preflight'),
-      hasDeviceCredential: () => hasPersistedSessionCredential(authStore),
+      hasDeviceCredential: () => registeredLaneRef.current.lane !== 'device' || hasIsolatedOAuthSession(runtime) ? Promise.resolve(false) : hasPersistedSessionCredential(authStore),
       hasKeyedRecovery: async () => {
+        if (registeredLaneRef.current.lane !== 'device' || hasIsolatedOAuthSession(runtime)) return false;
         if (Platform.OS === 'web') {
           return false;
         }
@@ -529,19 +598,27 @@ export const OxyRuntimeProvider = ({
   // account instead of the device's active one, and its recovery arm becomes the
   // PRIMARY-key identity sign-in rather than the cross-app shared keychain.
   useEffect(() => {
-    const dispose = installAuthRefreshHandler({
+    let disposed = false;
+    const refresh = createAuthRefreshHandler({
       oxy: oxyServices,
       store: authStore,
+      isCurrent: () => !disposed && registeredLaneRef.current.lane === 'device' && !hasIsolatedOAuthSession(runtime),
       ...(identity ? {
         identity: identity.binding
+      } : {}),
+      ...(!identity && !isWebBrowser() ? {
+        allowCommonsIdentityFallback: false,
+        sharedDeviceCredential: createPlatformSharedDeviceCredentialStore() ?? undefined
       } : {})
     });
+    oxyServices.http.setAuthRefreshHandler(reason => registeredLaneRef.current.lane !== 'device' || hasIsolatedOAuthSession(runtime) ? Promise.resolve(null) : refresh(reason));
     const scheduler = startTokenRefreshScheduler(oxyServices);
     return () => {
+      disposed = true;
       scheduler.dispose();
-      dispose();
+      oxyServices.http.setAuthRefreshHandler(null);
     };
-  }, [oxyServices, authStore, identity]);
+  }, [oxyServices, authStore, identity, runtime]);
 
   // ── Session commit funnel ────────────────────────────────────────────────
   // The single place a session becomes committed: plant tokens, persist the
@@ -550,6 +627,22 @@ export const OxyRuntimeProvider = ({
   // Used by the QR device flow (`handleWebSession`), password sign-in, 2FA
   // completion, and the cold boot.
   const commitSession = useCallback(async (input, options) => {
+    const isolatedOAuth = options.oauth === true && !input.deviceId && !input.deviceSecret;
+    if (isolatedOAuth || hasIsolatedOAuthSession(runtime)) {
+      sessionClient.resetLocalState();
+      sessionClientHost.setDeviceCredential(null);
+      await authStore.clear();
+      await clearSessionStateRef.current();
+    }
+    if (isolatedOAuth) {
+      if (!clientId) throw new Error('An isolated OAuth commit requires its registered client ID');
+      setIsolatedOAuthSession(runtime, {
+        sessionId: input.sessionId,
+        clientId
+      });
+    } else {
+      clearIsolatedOAuthSession(runtime);
+    }
     if (input.accessToken) {
       oxyServices.session.setAccessToken(input.accessToken);
     }
@@ -599,7 +692,7 @@ export const OxyRuntimeProvider = ({
           userId: input.userId,
           isCurrent: true
         }], {
-          merge: true
+          merge: !isolatedOAuth
         });
         runtime.setActiveSessionId(input.sessionId);
       });
@@ -615,6 +708,7 @@ export const OxyRuntimeProvider = ({
     // on the next load).
     await commitDeviceSetAndResolve({
       activate: options.activate,
+      isolatedOAuth,
       hasDeviceState: input.deviceState !== undefined,
       userId: input.userId,
       fallbackUser: input.user ?? null,
@@ -627,7 +721,10 @@ export const OxyRuntimeProvider = ({
       onAuthStateChange: onAuthStateChangeRef.current,
       markAuthResolved: markAuthResolvedRef.current
     });
-  }, [oxyServices, authStore, runtime, sessionClient, sessionClientHost, syncFromClient, logger]);
+    if (options.activate && !isolatedOAuth && !identity && input.userId && runtime.getSnapshot().account?.id === input.userId) {
+      if ((await authStore.setAutomaticIdentitySignInSuppressed?.(false)) === false) logger('Failed to release explicit sign-out intent after sign-in');
+    }
+  }, [oxyServices, authStore, runtime, sessionClient, sessionClientHost, syncFromClient, logger, clientId, identity]);
   const commitSessionRef = useRef(commitSession);
   commitSessionRef.current = commitSession;
 
@@ -662,9 +759,21 @@ export const OxyRuntimeProvider = ({
     authorizeBaseUrl,
     identityBound: isIdentityBound,
     commitSession: input => commitSessionRef.current(input, {
-      activate: true
+      activate: true,
+      oauth: true
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound]);
+  const startNativeOAuthSignInForContext = useCallback(options => startNativeOAuthSignIn({
+    platform: Platform.OS === 'ios' || Platform.OS === 'android' ? 'native' : 'unsupported',
+    oxyServices,
+    clientId,
+    authorizeBaseUrl,
+    identityBound: isIdentityBound,
+    commitSession: input => commitSessionRef.current(input, {
+      activate: true,
+      oauth: true
+    })
+  }, options), [oxyServices, clientId, authorizeBaseUrl, isIdentityBound]);
   const requestOAuthConsentForContext = useCallback(options => requestOAuthConsent({
     platform: Platform.OS === 'web' ? 'web' : Platform.OS === 'ios' || Platform.OS === 'android' ? 'native' : 'unsupported',
     mode: webAuthMode,
@@ -674,7 +783,8 @@ export const OxyRuntimeProvider = ({
     identityBound: isIdentityBound,
     expectedUserId: user?.id ?? null,
     commitSession: input => commitSessionRef.current(input, {
-      activate: true
+      activate: true,
+      oauth: true
     })
   }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id]);
 
@@ -762,8 +872,8 @@ export const OxyRuntimeProvider = ({
   // Native is untouched: its apps already share a device through the keychain.
   useEffect(() => {
     if (!isWebBrowser()) return undefined;
-    return oxyServices.session.setDeviceCredentialProvider(() => loadPersistedDeviceCredential(authStore));
-  }, [oxyServices, authStore]);
+    return oxyServices.session.setDeviceCredentialProvider(() => registeredLaneRef.current.lane === 'device' && !hasIsolatedOAuthSession(runtime) ? loadPersistedDeviceCredential(authStore) : Promise.resolve(null));
+  }, [oxyServices, authStore, runtime]);
 
   // ── The browser bridge (ADR 0029 D2) ──────────────────────────────────────
   // The first time a person presses sign-in in this app on the web and it holds
@@ -776,7 +886,7 @@ export const OxyRuntimeProvider = ({
   const bridgeInFlightRef = useRef(false);
   const closeAccountDialogRef = useRef(() => undefined);
   const startBrowserBridge = useCallback(() => {
-    if (isIdentityBound || !clientId || !isWebBrowser() || bridgeInFlightRef.current) return;
+    if (registeredLaneRef.current.lane !== 'device' || hasIsolatedOAuthSession(runtime) || isIdentityBound || !clientId || !isWebBrowser() || bridgeInFlightRef.current) return;
     if (authStoreRef.current?.heldDeviceCredential() !== null) return;
     const bridgeOrigin = resolveBridgeOrigin(authorizeBaseUrl);
     const pageOrigin = globalThis.location?.origin;
@@ -831,8 +941,10 @@ export const OxyRuntimeProvider = ({
     }).finally(() => {
       bridgeInFlightRef.current = false;
     });
-  }, [isIdentityBound, clientId, authorizeBaseUrl, authRedirectUri, oxyServices, authStore, sessionClientHost, logger]);
-  const openAccountDialog = useCallback(view => {
+  }, [isIdentityBound, clientId, authorizeBaseUrl, authRedirectUri, oxyServices, authStore, sessionClientHost, logger, runtime]);
+  const openClassifiedAccountDialog = useCallback(view => {
+    if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) return;
+    if (registeredLaneRef.current.lane !== 'device' || hasIsolatedOAuthSession(runtime)) return;
     if (isIdentityBound) {
       // No controller was built, and there is nothing to choose: this app's user
       // is fixed to the owner of the local identity key.
@@ -895,7 +1007,24 @@ export const OxyRuntimeProvider = ({
       }
     });
     setAccountDialogOpen(true);
-  }, [isIdentityBound, startBrowserBridge]);
+  }, [isIdentityBound, startBrowserBridge, runtime, clientIdProp, oxyServices]);
+  const openAccountDialog = useCallback(view => {
+    if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) return;
+    if (registeredLaneRef.current.lane === 'device') {
+      // Preserve the browser bridge's synchronous user-gesture path.
+      openClassifiedAccountDialog(view);
+      return;
+    }
+    void Promise.resolve().then(() => ensureDeviceSessionLane()).then(() => openClassifiedAccountDialog(view)).catch(error => {
+      handleAuthError(error, {
+        defaultMessage: 'Sign in failed',
+        code: 'LOGIN_ERROR',
+        onError,
+        setAuthError: message => runtime.setError(message),
+        logger
+      });
+    });
+  }, [ensureDeviceSessionLane, openClassifiedAccountDialog, onError, runtime, logger, clientIdProp, oxyServices]);
   const closeAccountDialog = useCallback(() => {
     accountDialogControllerRef.current?.cancelSignIn();
     dismissAccountDialogSurface();
@@ -938,9 +1067,6 @@ export const OxyRuntimeProvider = ({
     // SYNCHRONOUS read on `SessionClient`'s apply path, and a stale `null` there
     // would let a pinned client behave like an account-mode one for the first
     // state it applies (including re-electing the device's active account).
-    if (identity) {
-      await identity.ensurePinnedAccountId();
-    }
     await runProviderColdBoot({
       oxyServices,
       authStore,
@@ -948,6 +1074,13 @@ export const OxyRuntimeProvider = ({
       authRedirectUri,
       sessionMode,
       identity: identity?.binding,
+      resolveSessionLane: resolveRegisteredLane,
+      beforeDeviceBoot: identity ? async () => {
+        await identity.ensurePinnedAccountId();
+      } : undefined,
+      afterDeviceBoot: identity ? async () => {
+        await identity.refreshPinnedAccountId();
+      } : undefined,
       sessionClient,
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
@@ -957,10 +1090,7 @@ export const OxyRuntimeProvider = ({
     // The boot may have (re-)established the identity session or cleared a pin
     // whose key no longer exists, so re-resolve rather than trusting the memo
     // taken before it ran.
-    if (identity) {
-      await identity.refreshPinnedAccountId();
-    }
-  }, [oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient, setTokenReady]);
+  }, [resolveRegisteredLane, oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient, setTokenReady]);
   useEffect(() => {
     if (initialized) {
       return;
@@ -976,30 +1106,51 @@ export const OxyRuntimeProvider = ({
     });
   }, [runColdBoot, storage, initialized, logger]);
 
-  // Reconcile device state when the tab returns to foreground (background tabs may
-  // miss socket pushes or have stale bearer tokens).
+  // Reconcile device state on foreground: suspended native apps and background
+  // tabs may miss a sibling's active-context switch or socket pushes.
   useEffect(() => {
-    if (!isWebBrowser()) return;
-    const onVisibility = () => {
-      if (document.visibilityState !== 'visible') return;
-      const reconcile = async () => {
-        if (!oxyServices.session.accessToken && sessionClientHost.getDeviceCredential()) {
-          // Route through the ONE shared single-flight the scheduler/preflight/401
-          // use — never a private mint lane — so a tab-focus reconcile can't
-          // double-rotate the device secret against them.
+    let disposed = false;
+    let pending = null;
+    const reconcile = () => {
+      if (disposed || pending || hasIsolatedOAuthSession(runtime)) return;
+      pending = (async () => {
+        if (!isWebBrowser() && !identity || !oxyServices.session.accessToken && sessionClientHost.getDeviceCredential()) {
+          // The scheduler/preflight/401 paths own the same mint single-flight.
           await oxyServices.http.refreshAccessToken('preflight');
         }
+        if (disposed || hasIsolatedOAuthSession(runtime)) return;
+        if (!isWebBrowser() && !identity) await syncDeviceCredentialToHost();
         if (!oxyServices.session.accessToken && !sessionClientHost.getDeviceCredential()) {
           return;
         }
         await sessionClient.bootstrap();
+        if (disposed || hasIsolatedOAuthSession(runtime)) return;
         await syncFromClient();
+      })().catch(() => undefined).finally(() => {
+        pending = null;
+      });
+    };
+    if (isWebBrowser()) {
+      const onVisibility = () => {
+        if (document.visibilityState === 'visible') reconcile();
+      };
+      document.addEventListener('visibilitychange', onVisibility);
+      return () => {
+        disposed = true;
+        document.removeEventListener('visibilitychange', onVisibility);
       };
-      void reconcile().catch(() => undefined);
+    }
+    let previousState = AppState.currentState;
+    const subscription = AppState.addEventListener('change', state => {
+      const resumed = state === 'active' && (previousState === 'inactive' || previousState === 'background');
+      previousState = state;
+      if (resumed) reconcile();
+    });
+    return () => {
+      disposed = true;
+      subscription.remove();
     };
-    document.addEventListener('visibilitychange', onVisibility);
-    return () => document.removeEventListener('visibilitychange', onVisibility);
-  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient, syncDeviceCredentialToHost, identity, runtime]);
 
   // Reconnect heal: when connectivity transitions offline→online while there is
   // no live access token but a persisted device credential exists, re-mint ONCE
@@ -1023,6 +1174,7 @@ export const OxyRuntimeProvider = ({
         return;
       }
       void (async () => {
+        if (hasIsolatedOAuthSession(runtime)) return;
         if (oxyServices.session.accessToken || !sessionClientHost.getDeviceCredential()) {
           return;
         }
@@ -1034,14 +1186,15 @@ export const OxyRuntimeProvider = ({
         await syncFromClient();
       })().catch(() => undefined);
     });
-  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient, runtime]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
   const refreshSessionsForContext = useCallback(async () => {
+    if (hasIsolatedOAuthSession(runtime)) throw new Error('An isolated OAuth session has no shared device sessions');
     await sessionClient.bootstrap();
     await syncFromClient();
-  }, [sessionClient, syncFromClient]);
+  }, [sessionClient, syncFromClient, runtime]);
 
   // Exposed `switchSession`: route through the server-authoritative
   // `SessionClient`. Resolve the target account from the current device state,
@@ -1050,6 +1203,7 @@ export const OxyRuntimeProvider = ({
   // Identity-bound providers reject: this is the session-keyed twin of
   // `switchToAccount`, so leaving it live would be a bypass around the same rule.
   const switchSessionForContext = useCallback(async sessionId => {
+    if (hasIsolatedOAuthSession(runtime)) throw new Error('An isolated OAuth session cannot switch device sessions');
     if (isIdentityBound) {
       throw new IdentityBoundSessionError('switchSession');
     }
@@ -1096,6 +1250,7 @@ export const OxyRuntimeProvider = ({
     tokenReady,
     initialized,
     identityBound: isIdentityBound,
+    isolatedOAuth: readIsolatedOAuthSession(runtime) !== null,
     oxyServices,
     sessionClient,
     syncFromClient,
@@ -1182,6 +1337,7 @@ export const OxyRuntimeProvider = ({
     revokeSuspiciousSignIn,
     handleWebSession,
     startWebOAuthSignIn: startWebOAuthSignInForContext,
+    startNativeOAuthSignIn: startNativeOAuthSignInForContext,
     requestOAuthConsent: requestOAuthConsentForContext,
     logout,
     logoutAll,
@@ -1209,8 +1365,9 @@ export const OxyRuntimeProvider = ({
     switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isAccountCacheReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, snapshot.storageReady, isAccountCacheReady, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, startNativeOAuthSignInForContext, requestOAuthConsentForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   const authActionsValue = useMemo(() => ({
+    ensureDeviceSessionLane,
     signIn,
     logout,
     logoutAll,
@@ -1222,7 +1379,7 @@ export const OxyRuntimeProvider = ({
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
     openAccountDialog
-  }), [signIn, logout, logoutAll, refreshSessionsForContext, oxyServices, switchToAccount, hasIdentity, getPublicKey, showBottomSheetForContext, openAvatarPicker, openAccountDialog]);
+  }), [ensureDeviceSessionLane, signIn, logout, logoutAll, refreshSessionsForContext, oxyServices, switchToAccount, hasIdentity, getPublicKey, showBottomSheetForContext, openAvatarPicker, openAccountDialog]);
 
   // Two contexts, deliberately. The inner one carries the wide compatibility
   // value every `useOxy()` consumer reads, rebuilt whenever any of its members