@oxy.so/services 12.13.0 → 12.14.0

package/lib/commonjs/ui/boot/runProviderColdBoot.js

@@ -88,9 +88,177 @@ async function detectOfflineHint() {
     return false;
   }
 }
+/** Starts the provider's fresh classification; a rejection is observed, not swallowed. */
+function startClassification(opts) {
+  const classification = (async () => opts.resolveSessionLane?.() ?? (0, _applicationSessionLane.resolveApplicationSessionLane)(opts.oxyServices, opts.clientId))();
+  // Observed so a rejection that lands before it is awaited is not reported as
+  // unhandled; every caller still awaits it and sees the rejection.
+  classification.catch(() => undefined);
+  return classification;
+}
+
+/** What the device lanes made of this holder: a session, a verdict against it, or no answer. */
+
+/**
+ * The device lanes of the boot (`runSessionColdBoot`), for a first boot or for
+ * the background check of a painted one.
+ *
+ * A first boot (`painted: false`) is on the critical path: its committed
+ * session resolves auth, bounded by {@link SESSION_HANDOFF_DEADLINE_MS}. A
+ * painted boot already resolved auth from the cache, so nothing waits on the
+ * handoff and the pure-local warm token is skipped: the check needs the mint's
+ * verdict, which a still-valid token cannot give.
+ */
+async function restoreDeviceSession(opts, painted) {
+  const {
+    oxyServices,
+    authStore,
+    sessionMode = 'account',
+    identity,
+    sessionClient,
+    syncDeviceCredentialToHost,
+    commitSession,
+    markAuthResolved
+  } = opts;
+  await opts.beforeDeviceBoot?.();
+
+  // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
+  // the two doomed network steps so routing settles immediately instead of
+  // burning the overall deadline on a mint that cannot succeed. Any ambiguity
+  // resolves to "online" — the network steps still run.
+  const offline = await detectOfflineHint();
+  let outcome = 'unreachable';
+  let holderRejected = false;
+  await (0, _session.runSessionColdBoot)({
+    oxy: oxyServices,
+    store: authStore,
+    platform: {
+      isWeb: (0, _isWebBrowser.isWebBrowser)(),
+      isNative: !(0, _isWebBrowser.isWebBrowser)()
+    },
+    sessionMode,
+    identity,
+    // The device-wide shared credential slot, enabling the `shared-device-adopt`
+    // lane: a newly installed official app joins this device's existing session
+    // instead of falling back to signing a challenge with the Commons identity
+    // key. `null` on web, where each origin is its own device by design; the
+    // core lane is also skipped outright in `sessionMode: 'identity'`.
+    sharedDeviceCredential: (0, _sharedDeviceCredentialStore.createPlatformSharedDeviceCredentialStore)() ?? undefined,
+    overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
+    isOffline: () => offline,
+    requireServerVerdict: painted,
+    onHolderRejected: () => {
+      holderRejected = true;
+    },
+    onStepDeadline: stepId => {
+      _core.logger.warn(`Cold-boot step "${stepId}" exceeded the ${COLD_BOOT_OVERALL_DEADLINE_MS}ms overall deadline — abandoned; routing proceeds signed-out`, {
+        component: 'runProviderColdBoot',
+        method: 'onStepDeadline'
+      });
+    },
+    onSession: async session => {
+      outcome = 'session';
+      // Mint already persisted `{deviceId, deviceSecret}` to the store; sync the
+      // in-memory SessionClient host so sockets + tab-focus re-mint can use it.
+      await syncDeviceCredentialToHost();
+      const handoff = commitSession({
+        sessionId: session.sessionId,
+        accessToken: session.accessToken,
+        userId: session.userId,
+        deviceState: session.state
+      }, {
+        activate: false
+      });
+      if (painted) {
+        // The account is already on screen; the commit refreshes its profile.
+        await handoff;
+        return;
+      }
+      let handoffDeadlineId;
+      await Promise.race([handoff, new Promise(resolve => {
+        handoffDeadlineId = setTimeout(resolve, SESSION_HANDOFF_DEADLINE_MS);
+      })]).finally(() => {
+        if (handoffDeadlineId !== undefined) {
+          clearTimeout(handoffDeadlineId);
+        }
+      });
+      markAuthResolved();
+    },
+    onSignedOut: async () => {
+      outcome = holderRejected ? 'rejected' : 'unreachable';
+      await syncDeviceCredentialToHost();
+      // A painted session is the caller's to end or keep (see verifyCachedSession).
+      if (painted) return;
+      const cred = await (0, _deviceCredential.loadPersistedDeviceCredential)(authStore);
+      if (cred) {
+        try {
+          await sessionClient.start();
+        } catch (socketError) {
+          if (__DEV__) {
+            _core.logger.debug('Device socket start failed (non-fatal)', {
+              component: 'runProviderColdBoot'
+            }, socketError);
+          }
+        }
+      }
+      markAuthResolved();
+    },
+    onStepError: (id, error) => {
+      if (__DEV__) {
+        _core.logger.debug(`Cold-boot step "${id}" errored (non-fatal, falling through)`, {
+          component: 'runProviderColdBoot'
+        }, error);
+      }
+    }
+  });
+  await opts.afterDeviceBoot?.();
+  return outcome;
+}
+
+/**
+ * The background check of a painted session: the registry's classification and
+ * a mint with this holder's own credential (whose commit refreshes the profile).
+ * Each is asked until the server answers it. A verdict against the session
+ * signs out at that moment; no answer keeps the cached session on screen and
+ * hands the caller a retry.
+ */
+async function verifyCachedSession(opts, verified, classification) {
+  if (!verified.lane) {
+    let lane = null;
+    try {
+      lane = await classification;
+    } catch {
+      // The registry could not be asked (offline, timeout, 5xx). That is no
+      // verdict on this app: the cached `device` classification stands until it
+      // answers.
+    }
+    if (lane === 'oauth') {
+      await opts.onCachedSessionRejected?.();
+      return;
+    }
+    verified.lane = lane === 'device';
+  }
+  if (!verified.session) {
+    const outcome = await restoreDeviceSession(opts, true);
+    if (outcome === 'rejected') {
+      await opts.onCachedSessionRejected?.();
+      return;
+    }
+    verified.session = outcome === 'session';
+  }
+  if (!verified.lane || !verified.session) {
+    opts.onCachedSessionUnconfirmed?.(() => verifyCachedSession(opts, verified, verified.lane ? Promise.resolve('device') : startClassification(opts)));
+  }
+}
+
 /**
  * Device-first cold boot for `@oxy.so/services` providers.
  *
+ * A returning session saved on this device (account mode, the app last
+ * classified `device`, its profile cached) paints first, with no network, and
+ * is then checked in the background — see `paintCachedSession`. Otherwise, a
+ * first boot:
+ *
  * Ordered pipeline:
  * 1. Complete an OAuth authorization-code return already on the URL (web)
  * 2. `runSessionColdBoot` — device-secret mint (+ the native Commons-proof lane,
@@ -113,9 +281,6 @@ async function runProviderColdBoot(opts) {
     clientId,
     authRedirectUri,
     sessionMode = 'account',
-    identity,
-    sessionClient,
-    syncDeviceCredentialToHost,
     commitSession,
     markAuthResolved,
     setTokenReady
@@ -124,13 +289,24 @@ async function runProviderColdBoot(opts) {
   setTokenReady(false);
   try {
     // Classification precedes every USE of a local secret, the shared credential
-    // and the identity key. Unavailable registry metadata fails closed, including
-    // offline boot. It starts now, before anything else, so its round trip
-    // overlaps the local work below.
-    const classification = (async () => opts.resolveSessionLane?.() ?? (0, _applicationSessionLane.resolveApplicationSessionLane)(oxyServices, clientId))();
-    // Observed so a rejection that lands before it is awaited is not reported as
-    // unhandled; every path below still awaits it and sees the rejection.
-    classification.catch(() => undefined);
+    // and the identity key. Unavailable registry metadata fails closed on a first
+    // boot, including offline. It starts now, before anything else, so its round
+    // trip overlaps the local work below.
+    const classification = startClassification(opts);
+
+    // A returning session saved on this device paints at once from the cache:
+    // the account, its cached content, auth resolved, no network on the way.
+    // The classification and the session are then checked in the background,
+    // and a verdict against either signs out at that moment. Identity-bound
+    // clients and OAuth returns keep the path below.
+    const freshLaunch = !identityBound && !hasOAuthReturnOnUrl();
+    if (freshLaunch && (await opts.paintCachedSession?.())) {
+      await verifyCachedSession(opts, {
+        lane: false,
+        session: false
+      }, classification);
+      return;
+    }
 
     // The verdict decides HOW a session is restored, never WHETHER there is one.
     // A web origin with nothing to restore and no OAuth return on the URL ends
@@ -138,7 +314,7 @@ async function runProviderColdBoot(opts) {
     // for an answer that cannot change the outcome. The classification still
     // completes below and still gates every later sign-in
     // (`ensureDeviceSessionLane` shares this same in-flight lookup).
-    if (!identityBound && (0, _isWebBrowser.isWebBrowser)() && !hasOAuthReturnOnUrl()) {
+    if (freshLaunch && (0, _isWebBrowser.isWebBrowser)()) {
       if (!(await hasRestorableState(authStore))) {
         markAuthResolved();
         const lane = await classification;
@@ -174,83 +350,7 @@ async function runProviderColdBoot(opts) {
       setTokenReady(true);
       return;
     }
-    await opts.beforeDeviceBoot?.();
-
-    // Best-effort connectivity probe up front: an EXPLICIT offline verdict skips
-    // the two doomed network steps so routing settles immediately instead of
-    // burning the overall deadline on a mint that cannot succeed. Any ambiguity
-    // resolves to "online" — the network steps still run.
-    const offline = await detectOfflineHint();
-    await (0, _session.runSessionColdBoot)({
-      oxy: oxyServices,
-      store: authStore,
-      platform: {
-        isWeb: (0, _isWebBrowser.isWebBrowser)(),
-        isNative: !(0, _isWebBrowser.isWebBrowser)()
-      },
-      sessionMode,
-      identity,
-      // The device-wide shared credential slot, enabling the `shared-device-adopt`
-      // lane: a newly installed official app joins this device's existing session
-      // instead of falling back to signing a challenge with the Commons identity
-      // key. `null` on web, where each origin is its own device by design; the
-      // core lane is also skipped outright in `sessionMode: 'identity'`.
-      sharedDeviceCredential: (0, _sharedDeviceCredentialStore.createPlatformSharedDeviceCredentialStore)() ?? undefined,
-      overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
-      isOffline: () => offline,
-      onStepDeadline: stepId => {
-        _core.logger.warn(`Cold-boot step "${stepId}" exceeded the ${COLD_BOOT_OVERALL_DEADLINE_MS}ms overall deadline — abandoned; routing proceeds signed-out`, {
-          component: 'runProviderColdBoot',
-          method: 'onStepDeadline'
-        });
-      },
-      onSession: async session => {
-        // Mint already persisted `{deviceId, deviceSecret}` to the store; sync the
-        // in-memory SessionClient host so sockets + tab-focus re-mint can use it.
-        await syncDeviceCredentialToHost();
-        const handoff = commitSession({
-          sessionId: session.sessionId,
-          accessToken: session.accessToken,
-          userId: session.userId,
-          deviceState: session.state
-        }, {
-          activate: false
-        });
-        let handoffDeadlineId;
-        await Promise.race([handoff, new Promise(resolve => {
-          handoffDeadlineId = setTimeout(resolve, SESSION_HANDOFF_DEADLINE_MS);
-        })]).finally(() => {
-          if (handoffDeadlineId !== undefined) {
-            clearTimeout(handoffDeadlineId);
-          }
-        });
-        markAuthResolved();
-      },
-      onSignedOut: async () => {
-        await syncDeviceCredentialToHost();
-        const cred = await (0, _deviceCredential.loadPersistedDeviceCredential)(authStore);
-        if (cred) {
-          try {
-            await sessionClient.start();
-          } catch (socketError) {
-            if (__DEV__) {
-              _core.logger.debug('Device socket start failed (non-fatal)', {
-                component: 'runProviderColdBoot'
-              }, socketError);
-            }
-          }
-        }
-        markAuthResolved();
-      },
-      onStepError: (id, error) => {
-        if (__DEV__) {
-          _core.logger.debug(`Cold-boot step "${id}" errored (non-fatal, falling through)`, {
-            component: 'runProviderColdBoot'
-          }, error);
-        }
-      }
-    });
-    await opts.afterDeviceBoot?.();
+    await restoreDeviceSession(opts, false);
   } catch (error) {
     if (__DEV__) {
       _core.logger.error('Cold boot error', error instanceof Error ? error : new Error(String(error)), {

package/lib/commonjs/ui/boot/runProviderColdBoot.js.map

@@ -1 +1 @@
-{"version":3,"names":["_applicationSessionLane","require","_core","_session","_deviceCredential","_sharedDeviceCredentialStore","_oauthReturn","_isWebBrowser","_netConnectivity","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","hasOAuthReturnOnUrl","search","globalThis","location","params","URLSearchParams","hasRestorableState","store","persisted","load","Boolean","accessToken","deviceSecret","SESSION_HANDOFF_DEADLINE_MS","exports","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","isWebBrowser","online","navigator","onLine","NetInfo","Promise","resolve","then","state","race","fetch","setTimeout","isNetConnectivityExplicitlyOffline","runProviderColdBoot","opts","oxyServices","authStore","clientId","authRedirectUri","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","setTokenReady","identityBound","classification","resolveSessionLane","resolveApplicationSessionLane","catch","undefined","lane","onClassified","oauthCompleted","tryCompleteOAuthReturn","input","activate","oauth","beforeDeviceBoot","offline","runSessionColdBoot","oxy","platform","isWeb","isNative","sharedDeviceCredential","createPlatformSharedDeviceCredentialStore","overallDeadlineMs","isOffline","onStepDeadline","stepId","loggerUtil","warn","component","method","onSession","session","handoff","sessionId","userId","deviceState","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","loadPersistedDeviceCredential","start","socketError","__DEV__","debug","onStepError","id","error","afterDeviceBoot","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;;;;;;AAAA,IAAAA,uBAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAOA,IAAAG,iBAAA,GAAAH,OAAA;AACA,IAAAI,4BAAA,GAAAJ,OAAA;AACA,IAAAK,YAAA,GAAAL,OAAA;AACA,IAAAM,aAAA,GAAAN,OAAA;AACA,IAAAO,gBAAA,GAAAP,OAAA;AAA8E,SAAAQ,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA;AAG9E;AACA;AACA;AACA;AACA,SAASkB,mBAAmBA,CAAA,EAAY;EACtC,MAAMC,MAAM,GAAIC,UAAU,CAAwCC,QAAQ,EAAEF,MAAM;EAClF,IAAI,CAACA,MAAM,EAAE,OAAO,KAAK;EACzB,MAAMG,MAAM,GAAG,IAAIC,eAAe,CAACJ,MAAM,CAAC;EAC1C,OAAOG,MAAM,CAACZ,GAAG,CAAC,MAAM,CAAC,IAAIY,MAAM,CAACZ,GAAG,CAAC,OAAO,CAAC;AAClD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAec,kBAAkBA,CAACC,KAAqB,EAAoB;EACzE,MAAMC,SAAS,GAAG,MAAMD,KAAK,CAACE,IAAI,CAAC,CAAC;EACpC,OAAOC,OAAO,CAACF,SAAS,EAAEG,WAAW,IAAIH,SAAS,EAAEI,YAAY,CAAC;AACnE;;AAEA;AACO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,6BAA6B,GAAAD,OAAA,CAAAC,6BAAA,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAI,IAAAC,0BAAY,EAAC,CAAC,EAAE;MAClB,MAAMC,MAAM,GAAIjB,UAAU,CAA0CkB,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOF,MAAM,KAAK,KAAK;IACzB;IACA,MAAMG,OAAO,GAAG,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7C,uBAAA,CAAAR,OAAA,CAAa,iCAAiC,GAAC;IAC/D,MAAMsD,KAAK,GAAG,MAAMH,OAAO,CAACI,IAAI,CAAC,CAC/BL,OAAO,CAAC/B,OAAO,CAACqC,KAAK,CAAC,CAAC,EACvB,IAAIL,OAAO,CAAQC,OAAO,IAAK;MAC7BK,UAAU,CAAC,MAAML,OAAO,CAAC,IAAI,CAAC,EAAER,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAO,IAAAc,mDAAkC,EAACJ,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAiCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeK,mBAAmBA,CAACC,IAAgC,EAAiB;EACzF,MAAM;IACJC,WAAW;IACXC,SAAS;IACTC,QAAQ;IACRC,eAAe;IACfC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC,gBAAgB;IAChBC;EACF,CAAC,GAAGX,IAAI;EAER,MAAMY,aAAa,GAAGP,WAAW,KAAK,UAAU;EAEhDM,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAG,CAAC,YACtBb,IAAI,CAACc,kBAAkB,GAAG,CAAC,IAAI,IAAAC,qDAA6B,EAACd,WAAW,EAAEE,QAAQ,CAAC,EAAE,CAAC;IACxF;IACA;IACAU,cAAc,CAACG,KAAK,CAAC,MAAMC,SAAS,CAAC;;IAErC;IACA;IACA;IACA;IACA;IACA;IACA,IAAI,CAACL,aAAa,IAAI,IAAA1B,0BAAY,EAAC,CAAC,IAAI,CAAClB,mBAAmB,CAAC,CAAC,EAAE;MAC9D,IAAI,EAAE,MAAMM,kBAAkB,CAAC4B,SAAS,CAAC,CAAC,EAAE;QAC1CQ,gBAAgB,CAAC,CAAC;QAClB,MAAMQ,IAAI,GAAG,MAAML,cAAc;QACjC,MAAMb,IAAI,CAACmB,YAAY,GAAGD,IAAI,CAAC;QAC/B,IAAIA,IAAI,KAAK,OAAO,EAAEP,aAAa,CAAC,IAAI,CAAC;QACzC;MACF;IACF;IAEA,MAAMO,IAAI,GAAG,MAAML,cAAc;IACjC,MAAMb,IAAI,CAACmB,YAAY,GAAGD,IAAI,CAAC;IAC/B,IAAIN,aAAa,IAAIM,IAAI,KAAK,QAAQ,EAAE;IACxC;IACA;IACA;IACA;IACA;IACA;IACA,MAAME,cAAc,GAAGR,aAAa,GAChC,KAAK,GACL,MAAM,IAAAS,mCAAsB,EAAC;MAC3BpB,WAAW;MACXE,QAAQ;MACRC,eAAe;MACfK,aAAa,EAAGa,KAAK,IAAKb,aAAa,CAACa,KAAK,EAAE;QAAEC,QAAQ,EAAE,IAAI;QAAEC,KAAK,EAAE;MAAK,CAAC;IAChF,CAAC,CAAC;IACN,IAAIJ,cAAc,EAAE;MAClBT,aAAa,CAAC,IAAI,CAAC;MACnBD,gBAAgB,CAAC,CAAC;MAClB;IACF;IAEA,IAAIQ,IAAI,KAAK,OAAO,EAAE;MACpBP,aAAa,CAAC,IAAI,CAAC;MACnB;IACF;IAEA,MAAMX,IAAI,CAACyB,gBAAgB,GAAG,CAAC;;IAE/B;IACA;IACA;IACA;IACA,MAAMC,OAAO,GAAG,MAAMzC,iBAAiB,CAAC,CAAC;IAEzC,MAAM,IAAA0C,2BAAkB,EAAC;MACvBC,GAAG,EAAE3B,WAAW;MAChB1B,KAAK,EAAE2B,SAAS;MAChB2B,QAAQ,EAAE;QAAEC,KAAK,EAAE,IAAA5C,0BAAY,EAAC,CAAC;QAAE6C,QAAQ,EAAE,CAAC,IAAA7C,0BAAY,EAAC;MAAE,CAAC;MAC9DmB,WAAW;MACXC,QAAQ;MACR;MACA;MACA;MACA;MACA;MACA0B,sBAAsB,EAAE,IAAAC,sEAAyC,EAAC,CAAC,IAAIhB,SAAS;MAChFiB,iBAAiB,EAAEnD,6BAA6B;MAChDoD,SAAS,EAAEA,CAAA,KAAMT,OAAO;MACxBU,cAAc,EAAGC,MAAM,IAAK;QAC1BC,YAAU,CAACC,IAAI,CACb,mBAAmBF,MAAM,kBAAkBtD,6BAA6B,8DAA8D,EACtI;UAAEyD,SAAS,EAAE,qBAAqB;UAAEC,MAAM,EAAE;QAAiB,CAC/D,CAAC;MACH,CAAC;MACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;QAC5B;QACA;QACA,MAAMnC,0BAA0B,CAAC,CAAC;QAClC,MAAMoC,OAAO,GAAGnC,aAAa,CAC3B;UACEoC,SAAS,EAAEF,OAAO,CAACE,SAAS;UAC5BlE,WAAW,EAAEgE,OAAO,CAAChE,WAAW;UAChCmE,MAAM,EAAEH,OAAO,CAACG,MAAM;UACtBC,WAAW,EAAEJ,OAAO,CAACjD;QACvB,CAAC,EACD;UAAE6B,QAAQ,EAAE;QAAM,CACpB,CAAC;QACD,IAAIyB,iBAA4D;QAChE,MAAMzD,OAAO,CAACI,IAAI,CAAC,CACjBiD,OAAO,EACP,IAAIrD,OAAO,CAAQC,OAAO,IAAK;UAC7BwD,iBAAiB,GAAGnD,UAAU,CAACL,OAAO,EAAEX,2BAA2B,CAAC;QACtE,CAAC,CAAC,CACH,CAAC,CAACoE,OAAO,CAAC,MAAM;UACf,IAAID,iBAAiB,KAAK/B,SAAS,EAAE;YACnCiC,YAAY,CAACF,iBAAiB,CAAC;UACjC;QACF,CAAC,CAAC;QACFtC,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDyC,WAAW,EAAE,MAAAA,CAAA,KAAY;QACvB,MAAM3C,0BAA0B,CAAC,CAAC;QAClC,MAAM4C,IAAI,GAAG,MAAM,IAAAC,+CAA6B,EAACnD,SAAS,CAAC;QAC3D,IAAIkD,IAAI,EAAE;UACR,IAAI;YACF,MAAM7C,aAAa,CAAC+C,KAAK,CAAC,CAAC;UAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;YACpB,IAAIC,OAAO,EAAE;cACXlB,YAAU,CAACmB,KAAK,CACd,wCAAwC,EACxC;gBAAEjB,SAAS,EAAE;cAAsB,CAAC,EACpCe,WACF,CAAC;YACH;UACF;QACF;QACA7C,gBAAgB,CAAC,CAAC;MACpB,CAAC;MACDgD,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;QAC1B,IAAIJ,OAAO,EAAE;UACXlB,YAAU,CAACmB,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;YAAEnB,SAAS,EAAE;UAAsB,CAAC,EACpCoB,KACF,CAAC;QACH;MACF;IACF,CAAC,CAAC;IACF,MAAM5D,IAAI,CAAC6D,eAAe,GAAG,CAAC;EAChC,CAAC,CAAC,OAAOD,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXlB,YAAU,CAACsB,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYE,KAAK,GAAGF,KAAK,GAAG,IAAIE,KAAK,CAACC,MAAM,CAACH,KAAK,CAAC,CAAC,EACzD;QAAEpB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACR9B,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}
+{"version":3,"names":["_applicationSessionLane","require","_core","_session","_deviceCredential","_sharedDeviceCredentialStore","_oauthReturn","_isWebBrowser","_netConnectivity","_interopRequireWildcard","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","hasOAuthReturnOnUrl","search","globalThis","location","params","URLSearchParams","hasRestorableState","store","persisted","load","Boolean","accessToken","deviceSecret","SESSION_HANDOFF_DEADLINE_MS","exports","COLD_BOOT_OVERALL_DEADLINE_MS","OFFLINE_PROBE_TIMEOUT_MS","detectOfflineHint","isWebBrowser","online","navigator","onLine","NetInfo","Promise","resolve","then","state","race","fetch","setTimeout","isNetConnectivityExplicitlyOffline","startClassification","opts","classification","resolveSessionLane","resolveApplicationSessionLane","oxyServices","clientId","catch","undefined","restoreDeviceSession","painted","authStore","sessionMode","identity","sessionClient","syncDeviceCredentialToHost","commitSession","markAuthResolved","beforeDeviceBoot","offline","outcome","holderRejected","runSessionColdBoot","oxy","platform","isWeb","isNative","sharedDeviceCredential","createPlatformSharedDeviceCredentialStore","overallDeadlineMs","isOffline","requireServerVerdict","onHolderRejected","onStepDeadline","stepId","loggerUtil","warn","component","method","onSession","session","handoff","sessionId","userId","deviceState","activate","handoffDeadlineId","finally","clearTimeout","onSignedOut","cred","loadPersistedDeviceCredential","start","socketError","__DEV__","debug","onStepError","id","error","afterDeviceBoot","verifyCachedSession","verified","lane","onCachedSessionRejected","onCachedSessionUnconfirmed","runProviderColdBoot","authRedirectUri","setTokenReady","identityBound","freshLaunch","paintCachedSession","onClassified","oauthCompleted","tryCompleteOAuthReturn","input","oauth","Error","String"],"sourceRoot":"../../../../src","sources":["ui/boot/runProviderColdBoot.ts"],"mappings":";;;;;;;AAAA,IAAAA,uBAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAOA,IAAAG,iBAAA,GAAAH,OAAA;AACA,IAAAI,4BAAA,GAAAJ,OAAA;AACA,IAAAK,YAAA,GAAAL,OAAA;AACA,IAAAM,aAAA,GAAAN,OAAA;AACA,IAAAO,gBAAA,GAAAP,OAAA;AAA8E,SAAAQ,wBAAAC,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAH,uBAAA,YAAAA,CAAAC,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA;AAG9E;AACA;AACA;AACA;AACA,SAASkB,mBAAmBA,CAAA,EAAY;EACtC,MAAMC,MAAM,GAAIC,UAAU,CAAwCC,QAAQ,EAAEF,MAAM;EAClF,IAAI,CAACA,MAAM,EAAE,OAAO,KAAK;EACzB,MAAMG,MAAM,GAAG,IAAIC,eAAe,CAACJ,MAAM,CAAC;EAC1C,OAAOG,MAAM,CAACZ,GAAG,CAAC,MAAM,CAAC,IAAIY,MAAM,CAACZ,GAAG,CAAC,OAAO,CAAC;AAClD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAec,kBAAkBA,CAACC,KAAqB,EAAoB;EACzE,MAAMC,SAAS,GAAG,MAAMD,KAAK,CAACE,IAAI,CAAC,CAAC;EACpC,OAAOC,OAAO,CAACF,SAAS,EAAEG,WAAW,IAAIH,SAAS,EAAEI,YAAY,CAAC;AACnE;;AAEA;AACO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,IAAI;;AAE/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,6BAA6B,GAAAD,OAAA,CAAAC,6BAAA,GAAG,MAAM;;AAEnD;AACA;AACA;AACA;AACA;AACA,MAAMC,wBAAwB,GAAG,GAAG;;AAEpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeC,iBAAiBA,CAAA,EAAqB;EACnD,IAAI;IACF,IAAI,IAAAC,0BAAY,EAAC,CAAC,EAAE;MAClB,MAAMC,MAAM,GAAIjB,UAAU,CAA0CkB,SAAS,EAAEC,MAAM;MACrF;MACA,OAAOF,MAAM,KAAK,KAAK;IACzB;IACA,MAAMG,OAAO,GAAG,MAAAC,OAAA,CAAAC,OAAA,GAAAC,IAAA,OAAA7C,uBAAA,CAAAR,OAAA,CAAa,iCAAiC,GAAC;IAC/D,MAAMsD,KAAK,GAAG,MAAMH,OAAO,CAACI,IAAI,CAAC,CAC/BL,OAAO,CAAC/B,OAAO,CAACqC,KAAK,CAAC,CAAC,EACvB,IAAIL,OAAO,CAAQC,OAAO,IAAK;MAC7BK,UAAU,CAAC,MAAML,OAAO,CAAC,IAAI,CAAC,EAAER,wBAAwB,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;IACF;IACA;IACA,OAAO,IAAAc,mDAAkC,EAACJ,KAAK,CAAC;EAClD,CAAC,CAAC,MAAM;IACN;IACA,OAAO,KAAK;EACd;AACF;AAsDA;AACA,SAASK,mBAAmBA,CAACC,IAAgC,EAA+B;EAC1F,MAAMC,cAAc,GAAG,CAAC,YACtBD,IAAI,CAACE,kBAAkB,GAAG,CAAC,IAC3B,IAAAC,qDAA6B,EAACH,IAAI,CAACI,WAAW,EAAEJ,IAAI,CAACK,QAAQ,CAAC,EAAE,CAAC;EACnE;EACA;EACAJ,cAAc,CAACK,KAAK,CAAC,MAAMC,SAAS,CAAC;EACrC,OAAON,cAAc;AACvB;;AAEA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeO,oBAAoBA,CACjCR,IAAgC,EAChCS,OAAgB,EACe;EAC/B,MAAM;IACJL,WAAW;IACXM,SAAS;IACTC,WAAW,GAAG,SAAS;IACvBC,QAAQ;IACRC,aAAa;IACbC,0BAA0B;IAC1BC,aAAa;IACbC;EACF,CAAC,GAAGhB,IAAI;EAER,MAAMA,IAAI,CAACiB,gBAAgB,GAAG,CAAC;;EAE/B;EACA;EACA;EACA;EACA,MAAMC,OAAO,GAAG,MAAMjC,iBAAiB,CAAC,CAAC;EAEzC,IAAIkC,OAA6B,GAAG,aAAa;EACjD,IAAIC,cAAc,GAAG,KAAK;EAC1B,MAAM,IAAAC,2BAAkB,EAAC;IACvBC,GAAG,EAAElB,WAAW;IAChB7B,KAAK,EAAEmC,SAAS;IAChBa,QAAQ,EAAE;MAAEC,KAAK,EAAE,IAAAtC,0BAAY,EAAC,CAAC;MAAEuC,QAAQ,EAAE,CAAC,IAAAvC,0BAAY,EAAC;IAAE,CAAC;IAC9DyB,WAAW;IACXC,QAAQ;IACR;IACA;IACA;IACA;IACA;IACAc,sBAAsB,EAAE,IAAAC,sEAAyC,EAAC,CAAC,IAAIpB,SAAS;IAChFqB,iBAAiB,EAAE7C,6BAA6B;IAChD8C,SAAS,EAAEA,CAAA,KAAMX,OAAO;IACxBY,oBAAoB,EAAErB,OAAO;IAC7BsB,gBAAgB,EAAEA,CAAA,KAAM;MACtBX,cAAc,GAAG,IAAI;IACvB,CAAC;IACDY,cAAc,EAAGC,MAAM,IAAK;MAC1BC,YAAU,CAACC,IAAI,CACb,mBAAmBF,MAAM,kBAAkBlD,6BAA6B,8DAA8D,EACtI;QAAEqD,SAAS,EAAE,qBAAqB;QAAEC,MAAM,EAAE;MAAiB,CAC/D,CAAC;IACH,CAAC;IACDC,SAAS,EAAE,MAAOC,OAAO,IAAK;MAC5BpB,OAAO,GAAG,SAAS;MACnB;MACA;MACA,MAAML,0BAA0B,CAAC,CAAC;MAClC,MAAM0B,OAAO,GAAGzB,aAAa,CAC3B;QACE0B,SAAS,EAAEF,OAAO,CAACE,SAAS;QAC5B9D,WAAW,EAAE4D,OAAO,CAAC5D,WAAW;QAChC+D,MAAM,EAAEH,OAAO,CAACG,MAAM;QACtBC,WAAW,EAAEJ,OAAO,CAAC7C;MACvB,CAAC,EACD;QAAEkD,QAAQ,EAAE;MAAM,CACpB,CAAC;MACD,IAAInC,OAAO,EAAE;QACX;QACA,MAAM+B,OAAO;QACb;MACF;MACA,IAAIK,iBAA4D;MAChE,MAAMtD,OAAO,CAACI,IAAI,CAAC,CACjB6C,OAAO,EACP,IAAIjD,OAAO,CAAQC,OAAO,IAAK;QAC7BqD,iBAAiB,GAAGhD,UAAU,CAACL,OAAO,EAAEX,2BAA2B,CAAC;MACtE,CAAC,CAAC,CACH,CAAC,CAACiE,OAAO,CAAC,MAAM;QACf,IAAID,iBAAiB,KAAKtC,SAAS,EAAE;UACnCwC,YAAY,CAACF,iBAAiB,CAAC;QACjC;MACF,CAAC,CAAC;MACF7B,gBAAgB,CAAC,CAAC;IACpB,CAAC;IACDgC,WAAW,EAAE,MAAAA,CAAA,KAAY;MACvB7B,OAAO,GAAGC,cAAc,GAAG,UAAU,GAAG,aAAa;MACrD,MAAMN,0BAA0B,CAAC,CAAC;MAClC;MACA,IAAIL,OAAO,EAAE;MACb,MAAMwC,IAAI,GAAG,MAAM,IAAAC,+CAA6B,EAACxC,SAAS,CAAC;MAC3D,IAAIuC,IAAI,EAAE;QACR,IAAI;UACF,MAAMpC,aAAa,CAACsC,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,OAAOC,WAAW,EAAE;UACpB,IAAIC,OAAO,EAAE;YACXnB,YAAU,CAACoB,KAAK,CACd,wCAAwC,EACxC;cAAElB,SAAS,EAAE;YAAsB,CAAC,EACpCgB,WACF,CAAC;UACH;QACF;MACF;MACApC,gBAAgB,CAAC,CAAC;IACpB,CAAC;IACDuC,WAAW,EAAEA,CAACC,EAAE,EAAEC,KAAK,KAAK;MAC1B,IAAIJ,OAAO,EAAE;QACXnB,YAAU,CAACoB,KAAK,CACd,mBAAmBE,EAAE,wCAAwC,EAC7D;UAAEpB,SAAS,EAAE;QAAsB,CAAC,EACpCqB,KACF,CAAC;MACH;IACF;EACF,CAAC,CAAC;EACF,MAAMzD,IAAI,CAAC0D,eAAe,GAAG,CAAC;EAC9B,OAAOvC,OAAO;AAChB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAewC,mBAAmBA,CAChC3D,IAAgC,EAChC4D,QAA6C,EAC7C3D,cAA2C,EAC5B;EACf,IAAI,CAAC2D,QAAQ,CAACC,IAAI,EAAE;IAClB,IAAIA,IAA+B,GAAG,IAAI;IAC1C,IAAI;MACFA,IAAI,GAAG,MAAM5D,cAAc;IAC7B,CAAC,CAAC,MAAM;MACN;MACA;MACA;IAAA;IAEF,IAAI4D,IAAI,KAAK,OAAO,EAAE;MACpB,MAAM7D,IAAI,CAAC8D,uBAAuB,GAAG,CAAC;MACtC;IACF;IACAF,QAAQ,CAACC,IAAI,GAAGA,IAAI,KAAK,QAAQ;EACnC;EACA,IAAI,CAACD,QAAQ,CAACrB,OAAO,EAAE;IACrB,MAAMpB,OAAO,GAAG,MAAMX,oBAAoB,CAACR,IAAI,EAAE,IAAI,CAAC;IACtD,IAAImB,OAAO,KAAK,UAAU,EAAE;MAC1B,MAAMnB,IAAI,CAAC8D,uBAAuB,GAAG,CAAC;MACtC;IACF;IACAF,QAAQ,CAACrB,OAAO,GAAGpB,OAAO,KAAK,SAAS;EAC1C;EACA,IAAI,CAACyC,QAAQ,CAACC,IAAI,IAAI,CAACD,QAAQ,CAACrB,OAAO,EAAE;IACvCvC,IAAI,CAAC+D,0BAA0B,GAAG,MAChCJ,mBAAmB,CACjB3D,IAAI,EACJ4D,QAAQ,EACRA,QAAQ,CAACC,IAAI,GAAGtE,OAAO,CAACC,OAAO,CAAC,QAAQ,CAAC,GAAGO,mBAAmB,CAACC,IAAI,CACtE,CACF,CAAC;EACH;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAegE,mBAAmBA,CAAChE,IAAgC,EAAiB;EACzF,MAAM;IACJI,WAAW;IACXM,SAAS;IACTL,QAAQ;IACR4D,eAAe;IACftD,WAAW,GAAG,SAAS;IACvBI,aAAa;IACbC,gBAAgB;IAChBkD;EACF,CAAC,GAAGlE,IAAI;EAER,MAAMmE,aAAa,GAAGxD,WAAW,KAAK,UAAU;EAEhDuD,aAAa,CAAC,KAAK,CAAC;EAEpB,IAAI;IACF;IACA;IACA;IACA;IACA,MAAMjE,cAAc,GAAGF,mBAAmB,CAACC,IAAI,CAAC;;IAEhD;IACA;IACA;IACA;IACA;IACA,MAAMoE,WAAW,GAAG,CAACD,aAAa,IAAI,CAACnG,mBAAmB,CAAC,CAAC;IAC5D,IAAIoG,WAAW,KAAK,MAAMpE,IAAI,CAACqE,kBAAkB,GAAG,CAAC,CAAC,EAAE;MACtD,MAAMV,mBAAmB,CAAC3D,IAAI,EAAE;QAAE6D,IAAI,EAAE,KAAK;QAAEtB,OAAO,EAAE;MAAM,CAAC,EAAEtC,cAAc,CAAC;MAChF;IACF;;IAEA;IACA;IACA;IACA;IACA;IACA;IACA,IAAImE,WAAW,IAAI,IAAAlF,0BAAY,EAAC,CAAC,EAAE;MACjC,IAAI,EAAE,MAAMZ,kBAAkB,CAACoC,SAAS,CAAC,CAAC,EAAE;QAC1CM,gBAAgB,CAAC,CAAC;QAClB,MAAM6C,IAAI,GAAG,MAAM5D,cAAc;QACjC,MAAMD,IAAI,CAACsE,YAAY,GAAGT,IAAI,CAAC;QAC/B,IAAIA,IAAI,KAAK,OAAO,EAAEK,aAAa,CAAC,IAAI,CAAC;QACzC;MACF;IACF;IAEA,MAAML,IAAI,GAAG,MAAM5D,cAAc;IACjC,MAAMD,IAAI,CAACsE,YAAY,GAAGT,IAAI,CAAC;IAC/B,IAAIM,aAAa,IAAIN,IAAI,KAAK,QAAQ,EAAE;IACxC;IACA;IACA;IACA;IACA;IACA;IACA,MAAMU,cAAc,GAAGJ,aAAa,GAChC,KAAK,GACL,MAAM,IAAAK,mCAAsB,EAAC;MAC3BpE,WAAW;MACXC,QAAQ;MACR4D,eAAe;MACflD,aAAa,EAAG0D,KAAK,IAAK1D,aAAa,CAAC0D,KAAK,EAAE;QAAE7B,QAAQ,EAAE,IAAI;QAAE8B,KAAK,EAAE;MAAK,CAAC;IAChF,CAAC,CAAC;IACN,IAAIH,cAAc,EAAE;MAClBL,aAAa,CAAC,IAAI,CAAC;MACnBlD,gBAAgB,CAAC,CAAC;MAClB;IACF;IAEA,IAAI6C,IAAI,KAAK,OAAO,EAAE;MACpBK,aAAa,CAAC,IAAI,CAAC;MACnB;IACF;IAEA,MAAM1D,oBAAoB,CAACR,IAAI,EAAE,KAAK,CAAC;EACzC,CAAC,CAAC,OAAOyD,KAAK,EAAE;IACd,IAAIJ,OAAO,EAAE;MACXnB,YAAU,CAACuB,KAAK,CACd,iBAAiB,EACjBA,KAAK,YAAYkB,KAAK,GAAGlB,KAAK,GAAG,IAAIkB,KAAK,CAACC,MAAM,CAACnB,KAAK,CAAC,CAAC,EACzD;QAAErB,SAAS,EAAE;MAAsB,CACrC,CAAC;IACH;EACF,CAAC,SAAS;IACRpB,gBAAgB,CAAC,CAAC;EACpB;AACF","ignoreList":[]}

package/lib/commonjs/ui/context/OxyContext.js

@@ -49,6 +49,7 @@ var _applicationSessionLane = require("../oauth/applicationSessionLane.js");
 var _errorHandlers = require("../utils/errorHandlers.js");
 var _deviceCredential = require("../utils/deviceCredential.js");
 var _tokenLossRecovery = require("../session/tokenLossRecovery.js");
+var _cachedBoot = require("../session/cachedBoot.js");
 var _authStore = require("../stores/authStore.js");
 var _useLanguageManagement = require("../hooks/useLanguageManagement.js");
 var _useSessionManagement = require("../hooks/useSessionManagement.js");
@@ -169,6 +170,7 @@ const OxyRuntimeProvider = ({
     clientId: clientIdProp,
     services: oxyServices,
     lane: null,
+    provisional: false,
     pending: null
   });
   if (registeredLaneRef.current.clientId !== clientIdProp || registeredLaneRef.current.services !== oxyServices) {
@@ -176,6 +178,7 @@ const OxyRuntimeProvider = ({
       clientId: clientIdProp,
       services: oxyServices,
       lane: null,
+      provisional: false,
       pending: null
     };
   }
@@ -298,6 +301,12 @@ const OxyRuntimeProvider = ({
     storageReadyRef.current = buildStorageDeferred();
   }
   const storageReady = storageReadyRef.current;
+
+  // What a returning session's first paint needs (the app's classification and
+  // the account's profile), kept in the same storage as the account query cache.
+  const cachedBoot = (0, _react.useMemo)(() => storage ? (0, _cachedBoot.createCachedBootStore)(storage, storageKeyPrefix) : null, [storage, storageKeyPrefix]);
+  const cachedBootRef = (0, _react.useRef)(cachedBoot);
+  cachedBootRef.current = cachedBoot;
   (0, _react.useEffect)(() => {
     // `null` means the public provider owns initialization and has not resolved
     // it yet. `undefined` means this internal provider was mounted directly and
@@ -445,10 +454,16 @@ const OxyRuntimeProvider = ({
     const selected = registeredLaneRef.current;
     if (selected.clientId !== clientIdProp || selected.services !== oxyServices) throw new Error('Provider classification was superseded');
     if (selected.pending) return selected.pending;
-    selected.lane = null;
+    if (!selected.provisional) selected.lane = null;
     const pending = (async () => {
       const lane = await (0, _applicationSessionLane.resolveApplicationSessionLane)(oxyServices, clientIdProp);
       if (registeredLaneRef.current !== selected) throw new Error('Provider classification was superseded');
+      if (clientIdProp) void cachedBootRef.current?.saveLane(clientIdProp, lane);
+      if (selected.provisional) {
+        // The registry has answered: its verdict replaces the cached one now.
+        selected.provisional = false;
+        selected.lane = lane;
+      }
       if (lane === 'oauth' && !(0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) {
         sessionClient.resetLocalState();
         sessionClientHost.setDeviceCredential(null);
@@ -1101,6 +1116,100 @@ const OxyRuntimeProvider = ({
     if (!accountDialogOpen) (0, _signInFlowStore.clearSignInFlows)(accountDialogControllerRef.current);
   }, [accountDialogOpen]);
 
+  // ── Cached first paint ───────────────────────────────────────────────────
+  // Keep the profile the runtime holds for the signed-in account, so the next
+  // cold boot can paint it before the network answers. Only for a device-lane
+  // account session: an identity-bound client and an isolated OAuth session
+  // always boot through the network. A sign-out deletes it.
+  const cachedAccountJsonRef = (0, _react.useRef)(null);
+  (0, _react.useEffect)(() => {
+    if (!cachedBoot || identity) return;
+    if (user === null) {
+      if (cachedAccountJsonRef.current !== null) {
+        cachedAccountJsonRef.current = null;
+        void cachedBoot.clearAccount();
+      }
+      return;
+    }
+    if (registeredLaneRef.current.lane !== 'device' || (0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
+    const json = JSON.stringify(user);
+    if (json === cachedAccountJsonRef.current) return;
+    cachedAccountJsonRef.current = json;
+    void cachedBoot.saveAccount(user);
+  }, [cachedBoot, identity, user, runtime]);
+
+  // Paint the session saved on this device: the bearer it left (when still
+  // valid), the session mirror, the account from its cached profile, auth
+  // resolved. Local reads only; the boot checks it all in the background.
+  const paintCachedSession = (0, _react.useCallback)(async () => {
+    const cache = cachedBootRef.current;
+    if (identity || !clientIdProp || !cache) return false;
+    const cached = await cache.readSession(clientIdProp, authStore);
+    const selected = registeredLaneRef.current;
+    if (!cached || selected.clientId !== clientIdProp || selected.services !== oxyServices || selected.lane === 'oauth') {
+      return false;
+    }
+    if (selected.lane === null) {
+      // The cached verdict stands in for the registry until it answers, so the
+      // refresh handler, lost-token recovery and sign-in treat this app as the
+      // device lane it was on last run.
+      selected.lane = 'device';
+      selected.provisional = true;
+    }
+    if (cached.warmToken) oxyServices.session.setAccessToken(cached.warmToken);
+    await syncDeviceCredentialToHost();
+    const now = new Date();
+    runtime.batch(() => {
+      runtime.mergeSessions([{
+        sessionId: cached.sessionId,
+        deviceId: cached.deviceId,
+        expiresAt: new Date(now.getTime() + _oxyContextHelpers.DEFAULT_SESSION_VALIDITY_MS).toISOString(),
+        lastActive: now.toISOString(),
+        userId: cached.userId,
+        isCurrent: true
+      }], {
+        merge: true
+      });
+      runtime.setActiveSessionId(cached.sessionId);
+      runtime.setAccount(cached.user);
+    });
+    onAuthStateChangeRef.current?.(cached.user);
+    markAuthResolvedRef.current();
+    return true;
+  }, [identity, clientIdProp, authStore, oxyServices, runtime, syncDeviceCredentialToHost]);
+
+  // A painted session the server could not be asked about yet stays on screen
+  // and is asked again: on the lost-token backoff, and at once when the device
+  // comes back online. Signed out meanwhile, there is nothing left to ask.
+  const cachedSessionCheckRef = (0, _react.useRef)({
+    timer: null,
+    attempt: 0,
+    runNow: null
+  });
+  const scheduleCachedSessionCheck = (0, _react.useCallback)(retry => {
+    const check = cachedSessionCheckRef.current;
+    if (check.timer !== null) clearTimeout(check.timer);
+    const run = () => {
+      if (check.timer !== null) clearTimeout(check.timer);
+      check.timer = null;
+      check.runNow = null;
+      if (runtime.getSnapshot().account === null) return;
+      retry().catch(retryError => {
+        logger('Failed to check the cached session', retryError);
+      });
+    };
+    const delay = _tokenLossRecovery.TOKEN_RECOVERY_BACKOFF_MS[Math.min(check.attempt, _tokenLossRecovery.TOKEN_RECOVERY_BACKOFF_MS.length - 1)];
+    check.attempt += 1;
+    check.runNow = run;
+    check.timer = setTimeout(run, delay);
+  }, [runtime, logger]);
+  (0, _react.useEffect)(() => () => {
+    const check = cachedSessionCheckRef.current;
+    if (check.timer !== null) clearTimeout(check.timer);
+    check.timer = null;
+    check.runNow = null;
+  }, []);
+
   // ── Cold boot ────────────────────────────────────────────────────────────
   // Device-first session restore via `runProviderColdBoot` (see boot/runProviderColdBoot.ts).
   const runColdBoot = (0, _react.useCallback)(async () => {
@@ -1126,12 +1235,15 @@ const OxyRuntimeProvider = ({
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
       markAuthResolved: () => markAuthResolvedRef.current(),
-      setTokenReady
+      setTokenReady,
+      paintCachedSession,
+      onCachedSessionRejected: () => clearSessionStateRef.current(),
+      onCachedSessionUnconfirmed: scheduleCachedSessionCheck
     });
     // The boot may have (re-)established the identity session or cleared a pin
     // whose key no longer exists, so re-resolve rather than trusting the memo
     // taken before it ran.
-  }, [resolveRegisteredLane, oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient, setTokenReady]);
+  }, [resolveRegisteredLane, oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient, setTokenReady, paintCachedSession, scheduleCachedSessionCheck]);
   (0, _react.useEffect)(() => {
     if (initialized) {
       return;
@@ -1214,6 +1326,7 @@ const OxyRuntimeProvider = ({
       if (!online || !wasOffline) {
         return;
       }
+      cachedSessionCheckRef.current.runNow?.();
       void (async () => {
         if ((0, _isolatedOAuthSession.hasIsolatedOAuthSession)(runtime)) return;
         if (oxyServices.session.accessToken || !sessionClientHost.getDeviceCredential()) {