@oxy.so/services 4.0.6 → 6.0.0

package/src/ui/components/signIn/OxySignUpPanel.tsx

@@ -0,0 +1,86 @@
+/**
+ * Account creation in the account dialog.
+ *
+ * On the web the account is made on auth.oxy.so, in its window over the app
+ * (`onCreateOnWeb`), and this app is signed in as it. On native, Commons
+ * creates the identity: straight in when it is installed, "Get Commons"
+ * otherwise.
+ */
+
+import type React from 'react';
+import { useCallback } from 'react';
+import { Linking, Platform } from 'react-native';
+import { Button } from '@oxy.so/bloom/button';
+import { RiKey2Line } from '@oxy.so/bloom/icons/RiKey2Line';
+import { useTheme } from '@oxy.so/bloom/theme';
+import { toast } from '@oxy.so/bloom/toast';
+import { useOxy } from '../../context/OxyContext';
+import { useAccountDialogSnapshot } from '../../hooks/accountDialogSnapshot';
+import { useI18n } from '../../hooks/useI18n';
+import { getCommonsAcquisitionUrl } from '../../utils/commonsStoreLinks';
+import { isWebBrowser } from '../../utils/isWebBrowser';
+import { SubtleLink } from '../authChooser/primitives';
+import { OxyAuthScreen, OxyAuthScreenHeader, OxyAuthTerms } from './OxyAuthScreen';
+
+/** Commons' own identity-creation deep link. */
+const COMMONS_CREATE_IDENTITY_URL = 'oxycommons://create-identity';
+
+export interface OxySignUpPanelProps {
+  /** "Already have an account? Sign in". */
+  onSignIn: () => void;
+  /** The web's one action: auth.oxy.so's sign-up, in its window. */
+  onCreateOnWeb: () => void;
+}
+
+export const OxySignUpPanel: React.FC<OxySignUpPanelProps> = ({ onSignIn, onCreateOnWeb }) => {
+  const theme = useTheme();
+  const { t } = useI18n();
+  const { accountDialogController: controller } = useOxy();
+  const snapshot = useAccountDialogSnapshot(controller);
+  const web = isWebBrowser();
+
+  const openExternal = useCallback(
+    (url: string) => {
+      Promise.resolve()
+        .then(() => Linking.openURL(url))
+        .catch(() => toast.error(t('accountSwitcher.linkOpenFailed')));
+    },
+    [t],
+  );
+
+  const commonsInstalled = snapshot.commonsAvailability === 'available';
+
+  return (
+    <OxyAuthScreen>
+      <OxyAuthScreenHeader title={t('signup.title')} description={web ? t('signup.webSubtitle') : t('signup.subtitle')} />
+      {web ? (
+        <Button
+          appearance="solid"
+          tone="action"
+          size="lg"
+          fullWidth
+          leadingIcon={RiKey2Line}
+          onPress={onCreateOnWeb}
+          testID="signup-open-identity"
+        >
+          {t('signup.createAccount')}
+        </Button>
+      ) : (
+        <Button
+          appearance="solid"
+          tone="action"
+          size="lg"
+          fullWidth
+          onPress={() =>
+            openExternal(commonsInstalled ? COMMONS_CREATE_IDENTITY_URL : getCommonsAcquisitionUrl(Platform.OS))
+          }
+          testID="signup-commons"
+        >
+          {commonsInstalled ? t('signup.createInCommons') : t('accountSwitcher.getCommons')}
+        </Button>
+      )}
+      <SubtleLink label={t('signup.backToSignInLink')} theme={theme} onPress={onSignIn} testID="back-to-sign-in" />
+      <OxyAuthTerms />
+    </OxyAuthScreen>
+  );
+};

package/src/ui/components/signIn/artwork.ts

@@ -0,0 +1,13 @@
+/**
+ * The photos the sign-in split card's carousel turns through. Shipped with the
+ * SDK and imported like its icon fonts, so every host serves them from its own
+ * origin — nothing to allow in anyone's CSP.
+ */
+
+import type { AuthMediaSlide } from '@oxy.so/bloom/auth-card';
+import slide1 from '../../../assets/signIn/slide-1.jpg';
+import slide2 from '../../../assets/signIn/slide-2.jpg';
+import slide3 from '../../../assets/signIn/slide-3.jpg';
+import slide4 from '../../../assets/signIn/slide-4.jpg';
+
+export const SIGN_IN_SLIDES: AuthMediaSlide[] = [slide1, slide2, slide3, slide4].map((source) => ({ source }));

package/src/ui/components/signIn/passkeyError.ts

@@ -0,0 +1,44 @@
+/**
+ * The message for a failed passkey sign-in, and whether it was rate-limited.
+ *
+ * A dismissed or timed-out browser prompt rejects with a `NotAllowedError` /
+ * `AbortError` DOMException, often re-wrapped by `@simplewebauthn/browser` as a
+ * `WebAuthnError` whose `cause` is the original — so the cancellation shape is
+ * looked for along the cause chain, and reported calmly instead of as the raw
+ * "The operation either timed out or was not allowed…".
+ */
+
+import type { Translate } from '../authChooser/types';
+
+/** How long the surface waits after a 429 before it lets the person retry. */
+export const RATE_LIMIT_SECONDS = 60;
+
+function isCancellation(error: unknown): boolean {
+  let current: unknown = error;
+  for (let depth = 0; depth < 5 && current instanceof Error; depth += 1) {
+    if (current.name === 'NotAllowedError' || current.name === 'AbortError') return true;
+    // `@simplewebauthn/browser`'s stable code for an aborted ceremony.
+    if ((current as { code?: unknown }).code === 'ERROR_CEREMONY_ABORTED') return true;
+    current = (current as { cause?: unknown }).cause;
+  }
+  return false;
+}
+
+/** An HTTP status off a thrown SDK error (ApiError- or axios-shaped). */
+function errorStatus(error: unknown): number | undefined {
+  return (
+    (error as { status?: number } | undefined)?.status ??
+    (error as { response?: { status?: number } } | undefined)?.response?.status
+  );
+}
+
+export function isRateLimited(error: unknown): boolean {
+  return errorStatus(error) === 429;
+}
+
+/** The inline message for a passkey ceremony that did not sign anyone in. */
+export function describePasskeyError(error: unknown, t: Translate): string {
+  if (isCancellation(error)) return t('signin.errors.passkeyCancelled');
+  if (error instanceof Error && error.message.trim().length > 0) return error.message;
+  return t('signin.errors.passkeyFailed');
+}

package/src/ui/components/signIn/signInMethods.ts

@@ -0,0 +1,51 @@
+/**
+ * Which sign-in methods a surface offers, from where it runs.
+ *
+ * One screen everywhere; only the transport behind each block changes:
+ *
+ *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
+ *    (the split card's right column from `md`, "Continue with Oxy" below it),
+ *    the username with its Continue, and the passkey — asserted right here,
+ *    on the one origin every Oxy passkey belongs to;
+ *  - an app's account dialog on the web (`dialog`) opens that screen in a
+ *    window over the app ("Continue with Oxy"), like "Sign in with Google":
+ *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
+ *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
+ *    device that has no Commons to continue with.
+ */
+
+import type { CommonsAvailability } from '@oxy.so/core';
+
+/**
+ * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
+ * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
+ *                 keychain, Commons on this device, a push, or the QR view).
+ * `get-commons` — native, and Commons is not installed here.
+ */
+export type CommonsEntry = 'qr' | 'window' | 'continue' | 'get-commons';
+
+export interface SignInMethods {
+  commons: CommonsEntry;
+  /** The username and passkey block: only on auth.oxy.so. */
+  passkey: boolean;
+}
+
+export interface SignInSurfaceFacts {
+  /** Rendering in a browser (react-native-web), not a native app. */
+  web: boolean;
+  /** `page` is auth.oxy.so; `dialog` is an app's account dialog. */
+  host: 'dialog' | 'page';
+  /** The controller's native probe for an installed Commons. */
+  commonsAvailability: CommonsAvailability;
+}
+
+export function resolveSignInMethods(facts: SignInSurfaceFacts): SignInMethods {
+  if (facts.web) {
+    return facts.host === 'page' ? { commons: 'qr', passkey: true } : { commons: 'window', passkey: false };
+  }
+  return {
+    commons: facts.commonsAvailability === 'unavailable' ? 'get-commons' : 'continue',
+    passkey: false,
+  };
+}

package/src/ui/context/OxyContext.tsx

@@ -9,7 +9,7 @@ import {
   useState,
 } from 'react';
 import { Linking, Platform } from 'react-native';
-import { OxyServices, oxyClient } from '@oxy.so/core';
+import { DeviceManager, OxyServices, oxyClient, type OxyAuthScreen } from '@oxy.so/core';
 import type {
   User,
   SessionLoginResponse,
@@ -31,7 +31,6 @@ import {
   notifyAccountDialogVisibility,
 } from '../navigation/accountDialogManager';
 import { redirectToAuthorize } from '../components/oauthNavigation';
-import { openPasskeyHubPopup } from '../components/passkeyHubPopup';
 import {
   startWebOAuthSignIn,
   type StartWebOAuthSignInOptions,
@@ -149,7 +148,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   sessionMode = 'account',
   webAuthMode = 'popup',
   backgroundSession = false,
-  deviceCredentialStorage = 'persistent',
   platformStorage,
   onAuthStateChange,
   onError,
@@ -170,17 +168,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
 
   // The device-first persisted auth-state store (per-origin device credential on
   // web; SecureStore session blob on native). Built ONCE per provider mount.
-  //
-  // `deviceCredentialStorage` is mount-time configuration for the same reason
-  // `sessionMode` is: it decides where the durable credential lives, and letting
-  // it change mid-flight would mean a session that started ephemeral could begin
-  // writing one.
   const authStoreRef = useRef<AuthStateStore | null>(null);
   if (!authStoreRef.current) {
-    authStoreRef.current = createPlatformAuthStateStore({
-      sessionMode,
-      storage: deviceCredentialStorage,
-    });
+    authStoreRef.current = createPlatformAuthStateStore({ sessionMode });
   }
   const authStore = authStoreRef.current;
 
@@ -794,6 +784,20 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id],
   );
 
+  // On the web an Oxy app signs in and creates accounts in auth.oxy.so's
+  // window over the app, like "Sign in with Google": the passkey belongs to
+  // that origin, and the browser's session lives there, shared by every Oxy
+  // app. A blocked window falls back to the same page in this tab.
+  const continueOnAuth = useCallback(
+    (screen: OxyAuthScreen): Promise<WebOAuthSignInResult> =>
+      startWebOAuthSignInForContext({
+        redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
+        transport: 'popup',
+        screen,
+      }),
+    [startWebOAuthSignInForContext, authRedirectUri],
+  );
+
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
@@ -863,11 +867,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       // controller short-circuits, so `redirectToAuthorize` never runs for the
       // `oxycommons://` payload.
       canOpenApp: isWebBrowser() ? undefined : (url) => Linking.canOpenURL(url),
-      // Web-only: lets `startPasskeyHubSignIn` open the auth.oxy.so passkey hub
-      // popup (b2) for a non-Oxy origin. `undefined` on native — there is no
-      // popup concept there, and off-origin passkey sign-in isn't reachable
-      // (Commons owns the native flow).
-      openPopup: isWebBrowser() ? openPasskeyHubPopup : undefined,
       // Which surface a sign-in starts from — a FACT only this consumer can
       // supply (headless core never touches a platform global). It decides
       // whether automatic delivery may take the same-device Commons deep link;
@@ -983,7 +982,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
-        deviceFingerprint: opts?.deviceFingerprint,
+        // The same shape every other sign-in path sends; the server only reads it
+        // to place a device that has no persisted id yet.
+        deviceFingerprint: opts?.deviceFingerprint ?? JSON.stringify(DeviceManager.getDeviceFingerprint()),
       });
     },
     [oxyServices, authStore, commitSession],
@@ -1284,6 +1285,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignIn: startWebOAuthSignInForContext,
+      continueOnAuth,
       requestOAuthConsent: requestOAuthConsentForContext,
       logout,
       logoutAll,
@@ -1341,6 +1343,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignInForContext,
+      continueOnAuth,
       requestOAuthConsentForContext,
       logout,
       logoutAll,

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -1,11 +1,8 @@
 import type { User } from '@oxy.so/core';
 import { logger } from '@oxy.so/core';
-import type { WebAuthMode } from '../../oauth/types';
 import {
   commitDeviceSetAndResolve,
-  maybeSyncHubAfterCommit,
   type CommitDeviceSetAndResolveDeps,
-  type MaybeSyncHubAfterCommitDeps,
 } from '../commitSessionFlow';
 
 // A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
@@ -206,92 +203,6 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
   });
 });
 
-/**
- * Post-sign-in hub sync is a FULL-PAGE redirect to auth.oxy.so. It runs from the
- * ONE commit funnel, so gating it here gates every commit path at once —
- * `webAuthMode: 'popup'` must never bounce the tab, whichever path signed the
- * user in (#691 phase 7).
- */
-describe('maybeSyncHubAfterCommit — webAuthMode transport gate (#691 phase 7)', () => {
-  const buildHubDeps = (
-    overrides: Partial<MaybeSyncHubAfterCommitDeps> = {},
-  ): MaybeSyncHubAfterCommitDeps => ({
-    activate: true,
-    hubSyncRequested: true,
-    hubSyncEnabled: true,
-    webAuthMode: 'redirect',
-    syncHub: jest.fn(async () => true),
-    ...overrides,
-  });
-
-  it("redirect mode: syncs the hub after a deliberate sign-in (unchanged)", async () => {
-    const deps = buildHubDeps();
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(true);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-
-  it('popup mode: NEVER syncs the hub, even on an otherwise-eligible sign-in', async () => {
-    const deps = buildHubDeps({ webAuthMode: 'popup' });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('popup mode: no commit path can opt back in', async () => {
-    // Every commit path differs only in `activate` / `hubSyncRequested`; the
-    // transport gate outranks all of them.
-    for (const activate of [true, false]) {
-      for (const hubSyncRequested of [true, false]) {
-        const deps = buildHubDeps({ webAuthMode: 'popup', activate, hubSyncRequested });
-        await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-        expect(deps.syncHub).not.toHaveBeenCalled();
-      }
-    }
-  });
-
-  it.each(['popup', 'redirect'] as const)(
-    'never syncs on a cold-boot restore, in either mode (%s)',
-    async (webAuthMode: WebAuthMode) => {
-      const deps = buildHubDeps({ webAuthMode, activate: false });
-
-      await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-      expect(deps.syncHub).not.toHaveBeenCalled();
-    },
-  );
-
-  it('redirect mode: honours the per-commit opt-out (account switch / popup OAuth lanes)', async () => {
-    const deps = buildHubDeps({ hubSyncRequested: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: honours the provider-level hubSync opt-out', async () => {
-    const deps = buildHubDeps({ hubSyncEnabled: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: a failing hub sync is non-fatal and never rejects', async () => {
-    const deps = buildHubDeps({
-      syncHub: jest.fn(async () => {
-        throw new Error('hub ticket failed');
-      }),
-    });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-});
-
 describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
   it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
     const order: string[] = [];

package/src/ui/context/commitSessionFlow.ts

@@ -1,8 +1,5 @@
 import type { User } from '@oxy.so/core';
 import { logger as loggerUtil } from '@oxy.so/core';
-import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
-import type { WebAuthMode } from '../oauth/types';
-import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -133,61 +130,3 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
-
-export interface MaybeSyncHubAfterCommitDeps {
-  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
-  activate: boolean;
-  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
-  hubSyncRequested: boolean;
-  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
-  hubSyncEnabled: boolean;
-  /**
-   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
-   * A first-class input: `'popup'` forbids the redirect outright.
-   */
-  webAuthMode: WebAuthMode;
-  /**
-   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
-   * navigation was actually started.
-   */
-  syncHub: () => Promise<boolean>;
-}
-
-/**
- * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
- * official origins can silently restore a session on their next cold boot.
- *
- * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
- * on this legacy lane lives — and is tested — in one place. Returns whether the
- * full-page redirect was started; a failure is non-fatal and never propagates
- * (the sign-in itself already succeeded).
- *
- * Four gates, all of which must pass:
- * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
- * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
- * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
- * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
- *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
- *    bounces the tab defeats the entire point of the mode, no matter which
- *    commit path produced the session (issue #691, "Cold boot and cross-domain
- *    behavior"). Redirect mode — the default and the compatibility path — is
- *    unchanged, and this whole function disappears with it in phase 7b.
- */
-export async function maybeSyncHubAfterCommit(
-  deps: MaybeSyncHubAfterCommitDeps,
-): Promise<boolean> {
-  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
-
-  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
-  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
-  if (!isWebBrowser()) return false;
-
-  try {
-    return await syncHub();
-  } catch (hubError) {
-    if (__DEV__) {
-      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
-    }
-    return false;
-  }
-}

package/src/ui/context/oxyContextTypes.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode } from '@oxy.so/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode, OxyAuthScreen } from '@oxy.so/core';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -124,6 +124,14 @@ export interface OxyContextState {
    */
   startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
 
+  /**
+   * Sign in (`signin`), create an account (`signup`) or recover one
+   * (`recover`) in auth.oxy.so's window over the app, where the browser's
+   * shared Oxy session lives. Web only; call it from the press, so the window
+   * opens with the gesture.
+   */
+  continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
+
   /**
    * Ask the already-authenticated user for explicit OAuth consent to exact
    * application scopes. Must be called from a user gesture. Works on web and
@@ -219,14 +227,6 @@ export interface OxyRuntimeProviderProps {
    * @default false
    */
   backgroundSession?: boolean;
-  /**
-   * Whether this origin/app persists the durable device credential at all. See
-   * `OxyProviderProps.deviceCredentialStorage` for the full rule and the one
-   * caller of `'ephemeral'`.
-   *
-   * @default 'persistent'
-   */
-  deviceCredentialStorage?: 'persistent' | 'ephemeral';
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
   /** Storage instance owned by the public provider; internal composition seam. */

package/src/ui/hooks/accountDialogSnapshot.ts

@@ -1,4 +1,5 @@
-import type { AccountDialogSnapshot } from '@oxy.so/core';
+import { useCallback, useSyncExternalStore } from 'react';
+import type { AccountDialogController, AccountDialogSnapshot } from '@oxy.so/core';
 
 /**
  * The snapshot `useSyncExternalStore` reads before a controller exists.
@@ -36,6 +37,24 @@ export const EMPTY_ACCOUNT_DIALOG_SNAPSHOT: AccountDialogSnapshot = {
     openedAt: null,
     progress: 'idle',
     attempt: 0,
+    inline: false,
   },
   commonsAvailability: 'unknown',
 };
+
+/**
+ * Bind a surface to `controller`'s snapshot (the inert one while there is no
+ * controller). `getSnapshot` returns a stable reference between changes, so
+ * it is `useSyncExternalStore`-safe.
+ */
+export function useAccountDialogSnapshot(controller: AccountDialogController | null): AccountDialogSnapshot {
+  const subscribe = useCallback(
+    (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
+    [controller],
+  );
+  const getSnapshot = useCallback(
+    () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
+    [controller],
+  );
+  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}

package/src/ui/hooks/useDeviceSwitcher.ts

@@ -1,4 +1,4 @@
-import { useCallback, useMemo, useSyncExternalStore } from 'react';
+import { useCallback, useMemo } from 'react';
 import {
     buildSwitcherRows,
     projectDevicePrincipals,
@@ -7,7 +7,7 @@ import {
 } from '@oxy.so/core';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from './useI18n';
-import { EMPTY_ACCOUNT_DIALOG_SNAPSHOT } from './accountDialogSnapshot';
+import { useAccountDialogSnapshot } from './accountDialogSnapshot';
 
 export interface UseDeviceSwitcherResult {
     /**
@@ -60,15 +60,7 @@ export function useDeviceSwitcher(): UseDeviceSwitcherResult {
     const { accountDialogController: controller, oxyServices } = useOxy();
     const { locale } = useI18n();
 
-    const subscribe = useCallback(
-        (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
-        [controller],
-    );
-    const getSnapshot = useCallback(
-        () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
-        [controller],
-    );
-    const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+    const snapshot = useAccountDialogSnapshot(controller);
 
     // `directory` is a stable reference between reads (`SessionClient` holds the
     // one it applied), so this recomputes only when the device actually moved.

package/src/ui/oauth/__tests__/browserAuthTransport.test.ts

@@ -153,6 +153,27 @@ describe('startWebOAuthSignIn', () => {
       expect(openSpy).toHaveBeenCalledTimes(1);
     });
 
+    // An Oxy app's account dialog asks for the window whatever the provider's
+    // `webAuthMode`, and for the IdP screen the person lands on.
+    it('opens the window for `transport: popup` even in redirect mode, with its screen', async () => {
+      const context = makeContext({ mode: 'redirect' });
+      const popup = fakePopup();
+      const openSpy = jest.spyOn(window, 'open').mockReturnValue(popup as unknown as Window);
+
+      const pending = startWebOAuthSignIn(context, { redirectUri: REDIRECT_URI, transport: 'popup', screen: 'signup' });
+      const authorizeUrl = await waitForAuthorizeUrl(popup);
+      expect(authorizeUrl.searchParams.get('screen')).toBe('signup');
+      expect(authorizeUrl.searchParams.get('response_mode')).toBe('web_message');
+      dispatchFromPopup(
+        { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 'code-1', state: authorizeUrl.searchParams.get('state') },
+        popup,
+      );
+
+      await expect(pending).resolves.toEqual({ status: 'signed-in' });
+      expect(openSpy).toHaveBeenCalledTimes(1);
+      expect(mockRedirect).not.toHaveBeenCalled();
+    });
+
     it('falls back to a full-page redirect when the popup was blocked', async () => {
       const context = makeContext();
 

package/src/ui/oauth/browserAuthTransport.ts

@@ -14,7 +14,7 @@
  * remains the native lane and is untouched by this module.
  */
 
-import { logger, persistOAuthHandshake } from '@oxy.so/core';
+import { logger, persistOAuthHandshake, type OxyAuthScreen } from '@oxy.so/core';
 import type { OxyServices } from '@oxy.so/core';
 import { redirectToAuthorize } from '../components/oauthNavigation';
 import { isWebBrowser } from '../utils/isWebBrowser';
@@ -64,6 +64,14 @@ export interface StartWebOAuthSignInOptions {
   popup?: OAuthPopupHandle | null;
   /** Requested scope; defaults to the SDK's standard sign-in scope. */
   scope?: string;
+  /**
+   * The transport for this press, whatever the provider's `webAuthMode`. An
+   * Oxy app's own account dialog asks for `popup`: auth.oxy.so's window over
+   * the app, where the browser's shared session lives.
+   */
+  transport?: WebAuthMode;
+  /** The IdP screen a person with no session there lands on. */
+  screen?: OxyAuthScreen;
   /** Popup timeout override (ms). */
   timeoutMs?: number;
 }
@@ -88,10 +96,10 @@ export async function startWebOAuthSignIn(
   // Claim the window BEFORE the first `await` below, so a caller that invoked us
   // straight from the click still has gesture attribution. An explicit `null`
   // means the caller already tried and was blocked.
-  const popup =
-    context.mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
+  const mode = options.transport ?? context.mode;
+  const popup = mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
 
-  if (context.mode === 'redirect') {
+  if (mode === 'redirect') {
     closeOAuthPopup(popup);
     return startRedirectSignIn(context, options, 'redirect-mode');
   }
@@ -109,6 +117,7 @@ export async function startWebOAuthSignIn(
       authorizeBaseUrl: context.authorizeBaseUrl,
       scope: options.scope,
       responseMode: 'web_message',
+      ...(options.screen ? { screen: options.screen } : {}),
     });
 
     if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
@@ -178,6 +187,7 @@ async function startRedirectSignIn(
     redirectUri: options.redirectUri,
     authorizeBaseUrl: context.authorizeBaseUrl,
     scope: options.scope,
+    ...(options.screen ? { screen: options.screen } : {}),
   });
 
   if (!persistOAuthHandshake(