@oxy.so/services 4.0.7 → 6.0.0

package/src/ui/components/signIn/signInMethods.ts

@@ -0,0 +1,51 @@
+/**
+ * Which sign-in methods a surface offers, from where it runs.
+ *
+ * One screen everywhere; only the transport behind each block changes:
+ *
+ *  - auth.oxy.so (`page`) is where the web signs in: the embedded Commons QR
+ *    (the split card's right column from `md`, "Continue with Oxy" below it),
+ *    the username with its Continue, and the passkey — asserted right here,
+ *    on the one origin every Oxy passkey belongs to;
+ *  - an app's account dialog on the web (`dialog`) opens that screen in a
+ *    window over the app ("Continue with Oxy"), like "Sign in with Google":
+ *    the browser's session lives on auth.oxy.so, so every Oxy app shares it;
+ *  - native signs in with Commons: "Continue with Oxy", or "Get Commons" on a
+ *    device that has no Commons to continue with.
+ */
+
+import type { CommonsAvailability } from '@oxy.so/core';
+
+/**
+ * `qr`          — auth.oxy.so: the embedded QR from `md`, "Continue with Oxy" below.
+ * `window`      — an app on the web: "Continue with Oxy" opens auth.oxy.so's window.
+ * `continue`    — native "Continue with Oxy": Oxy picks the route (shared
+ *                 keychain, Commons on this device, a push, or the QR view).
+ * `get-commons` — native, and Commons is not installed here.
+ */
+export type CommonsEntry = 'qr' | 'window' | 'continue' | 'get-commons';
+
+export interface SignInMethods {
+  commons: CommonsEntry;
+  /** The username and passkey block: only on auth.oxy.so. */
+  passkey: boolean;
+}
+
+export interface SignInSurfaceFacts {
+  /** Rendering in a browser (react-native-web), not a native app. */
+  web: boolean;
+  /** `page` is auth.oxy.so; `dialog` is an app's account dialog. */
+  host: 'dialog' | 'page';
+  /** The controller's native probe for an installed Commons. */
+  commonsAvailability: CommonsAvailability;
+}
+
+export function resolveSignInMethods(facts: SignInSurfaceFacts): SignInMethods {
+  if (facts.web) {
+    return facts.host === 'page' ? { commons: 'qr', passkey: true } : { commons: 'window', passkey: false };
+  }
+  return {
+    commons: facts.commonsAvailability === 'unavailable' ? 'get-commons' : 'continue',
+    passkey: false,
+  };
+}

package/src/ui/context/OxyContext.tsx

@@ -9,7 +9,7 @@ import {
   useState,
 } from 'react';
 import { Linking, Platform } from 'react-native';
-import { OxyServices, oxyClient } from '@oxy.so/core';
+import { DeviceManager, OxyServices, oxyClient, type OxyAuthScreen } from '@oxy.so/core';
 import type {
   User,
   SessionLoginResponse,
@@ -31,7 +31,6 @@ import {
   notifyAccountDialogVisibility,
 } from '../navigation/accountDialogManager';
 import { redirectToAuthorize } from '../components/oauthNavigation';
-import { openPasskeyHubPopup } from '../components/passkeyHubPopup';
 import {
   startWebOAuthSignIn,
   type StartWebOAuthSignInOptions,
@@ -149,7 +148,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   sessionMode = 'account',
   webAuthMode = 'popup',
   backgroundSession = false,
-  deviceCredentialStorage = 'persistent',
   platformStorage,
   onAuthStateChange,
   onError,
@@ -170,17 +168,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
 
   // The device-first persisted auth-state store (per-origin device credential on
   // web; SecureStore session blob on native). Built ONCE per provider mount.
-  //
-  // `deviceCredentialStorage` is mount-time configuration for the same reason
-  // `sessionMode` is: it decides where the durable credential lives, and letting
-  // it change mid-flight would mean a session that started ephemeral could begin
-  // writing one.
   const authStoreRef = useRef<AuthStateStore | null>(null);
   if (!authStoreRef.current) {
-    authStoreRef.current = createPlatformAuthStateStore({
-      sessionMode,
-      storage: deviceCredentialStorage,
-    });
+    authStoreRef.current = createPlatformAuthStateStore({ sessionMode });
   }
   const authStore = authStoreRef.current;
 
@@ -794,6 +784,20 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id],
   );
 
+  // On the web an Oxy app signs in and creates accounts in auth.oxy.so's
+  // window over the app, like "Sign in with Google": the passkey belongs to
+  // that origin, and the browser's session lives there, shared by every Oxy
+  // app. A blocked window falls back to the same page in this tab.
+  const continueOnAuth = useCallback(
+    (screen: OxyAuthScreen): Promise<WebOAuthSignInResult> =>
+      startWebOAuthSignInForContext({
+        redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
+        transport: 'popup',
+        screen,
+      }),
+    [startWebOAuthSignInForContext, authRedirectUri],
+  );
+
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
@@ -863,11 +867,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       // controller short-circuits, so `redirectToAuthorize` never runs for the
       // `oxycommons://` payload.
       canOpenApp: isWebBrowser() ? undefined : (url) => Linking.canOpenURL(url),
-      // Web-only: lets `startPasskeyHubSignIn` open the auth.oxy.so passkey hub
-      // popup (b2) for a non-Oxy origin. `undefined` on native — there is no
-      // popup concept there, and off-origin passkey sign-in isn't reachable
-      // (Commons owns the native flow).
-      openPopup: isWebBrowser() ? openPasskeyHubPopup : undefined,
       // Which surface a sign-in starts from — a FACT only this consumer can
       // supply (headless core never touches a platform global). It decides
       // whether automatic delivery may take the same-device Commons deep link;
@@ -983,7 +982,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
-        deviceFingerprint: opts?.deviceFingerprint,
+        // The same shape every other sign-in path sends; the server only reads it
+        // to place a device that has no persisted id yet.
+        deviceFingerprint: opts?.deviceFingerprint ?? JSON.stringify(DeviceManager.getDeviceFingerprint()),
       });
     },
     [oxyServices, authStore, commitSession],
@@ -1284,6 +1285,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignIn: startWebOAuthSignInForContext,
+      continueOnAuth,
       requestOAuthConsent: requestOAuthConsentForContext,
       logout,
       logoutAll,
@@ -1341,6 +1343,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignInForContext,
+      continueOnAuth,
       requestOAuthConsentForContext,
       logout,
       logoutAll,

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -1,11 +1,8 @@
 import type { User } from '@oxy.so/core';
 import { logger } from '@oxy.so/core';
-import type { WebAuthMode } from '../../oauth/types';
 import {
   commitDeviceSetAndResolve,
-  maybeSyncHubAfterCommit,
   type CommitDeviceSetAndResolveDeps,
-  type MaybeSyncHubAfterCommitDeps,
 } from '../commitSessionFlow';
 
 // A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
@@ -206,92 +203,6 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
   });
 });
 
-/**
- * Post-sign-in hub sync is a FULL-PAGE redirect to auth.oxy.so. It runs from the
- * ONE commit funnel, so gating it here gates every commit path at once —
- * `webAuthMode: 'popup'` must never bounce the tab, whichever path signed the
- * user in (#691 phase 7).
- */
-describe('maybeSyncHubAfterCommit — webAuthMode transport gate (#691 phase 7)', () => {
-  const buildHubDeps = (
-    overrides: Partial<MaybeSyncHubAfterCommitDeps> = {},
-  ): MaybeSyncHubAfterCommitDeps => ({
-    activate: true,
-    hubSyncRequested: true,
-    hubSyncEnabled: true,
-    webAuthMode: 'redirect',
-    syncHub: jest.fn(async () => true),
-    ...overrides,
-  });
-
-  it("redirect mode: syncs the hub after a deliberate sign-in (unchanged)", async () => {
-    const deps = buildHubDeps();
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(true);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-
-  it('popup mode: NEVER syncs the hub, even on an otherwise-eligible sign-in', async () => {
-    const deps = buildHubDeps({ webAuthMode: 'popup' });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('popup mode: no commit path can opt back in', async () => {
-    // Every commit path differs only in `activate` / `hubSyncRequested`; the
-    // transport gate outranks all of them.
-    for (const activate of [true, false]) {
-      for (const hubSyncRequested of [true, false]) {
-        const deps = buildHubDeps({ webAuthMode: 'popup', activate, hubSyncRequested });
-        await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-        expect(deps.syncHub).not.toHaveBeenCalled();
-      }
-    }
-  });
-
-  it.each(['popup', 'redirect'] as const)(
-    'never syncs on a cold-boot restore, in either mode (%s)',
-    async (webAuthMode: WebAuthMode) => {
-      const deps = buildHubDeps({ webAuthMode, activate: false });
-
-      await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-      expect(deps.syncHub).not.toHaveBeenCalled();
-    },
-  );
-
-  it('redirect mode: honours the per-commit opt-out (account switch / popup OAuth lanes)', async () => {
-    const deps = buildHubDeps({ hubSyncRequested: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: honours the provider-level hubSync opt-out', async () => {
-    const deps = buildHubDeps({ hubSyncEnabled: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: a failing hub sync is non-fatal and never rejects', async () => {
-    const deps = buildHubDeps({
-      syncHub: jest.fn(async () => {
-        throw new Error('hub ticket failed');
-      }),
-    });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-});
-
 describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
   it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
     const order: string[] = [];

package/src/ui/context/commitSessionFlow.ts

@@ -1,8 +1,5 @@
 import type { User } from '@oxy.so/core';
 import { logger as loggerUtil } from '@oxy.so/core';
-import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
-import type { WebAuthMode } from '../oauth/types';
-import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -133,61 +130,3 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
-
-export interface MaybeSyncHubAfterCommitDeps {
-  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
-  activate: boolean;
-  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
-  hubSyncRequested: boolean;
-  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
-  hubSyncEnabled: boolean;
-  /**
-   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
-   * A first-class input: `'popup'` forbids the redirect outright.
-   */
-  webAuthMode: WebAuthMode;
-  /**
-   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
-   * navigation was actually started.
-   */
-  syncHub: () => Promise<boolean>;
-}
-
-/**
- * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
- * official origins can silently restore a session on their next cold boot.
- *
- * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
- * on this legacy lane lives — and is tested — in one place. Returns whether the
- * full-page redirect was started; a failure is non-fatal and never propagates
- * (the sign-in itself already succeeded).
- *
- * Four gates, all of which must pass:
- * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
- * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
- * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
- * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
- *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
- *    bounces the tab defeats the entire point of the mode, no matter which
- *    commit path produced the session (issue #691, "Cold boot and cross-domain
- *    behavior"). Redirect mode — the default and the compatibility path — is
- *    unchanged, and this whole function disappears with it in phase 7b.
- */
-export async function maybeSyncHubAfterCommit(
-  deps: MaybeSyncHubAfterCommitDeps,
-): Promise<boolean> {
-  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
-
-  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
-  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
-  if (!isWebBrowser()) return false;
-
-  try {
-    return await syncHub();
-  } catch (hubError) {
-    if (__DEV__) {
-      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
-    }
-    return false;
-  }
-}

package/src/ui/context/oxyContextTypes.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode } from '@oxy.so/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode, OxyAuthScreen } from '@oxy.so/core';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -124,6 +124,14 @@ export interface OxyContextState {
    */
   startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
 
+  /**
+   * Sign in (`signin`), create an account (`signup`) or recover one
+   * (`recover`) in auth.oxy.so's window over the app, where the browser's
+   * shared Oxy session lives. Web only; call it from the press, so the window
+   * opens with the gesture.
+   */
+  continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
+
   /**
    * Ask the already-authenticated user for explicit OAuth consent to exact
    * application scopes. Must be called from a user gesture. Works on web and
@@ -219,14 +227,6 @@ export interface OxyRuntimeProviderProps {
    * @default false
    */
   backgroundSession?: boolean;
-  /**
-   * Whether this origin/app persists the durable device credential at all. See
-   * `OxyProviderProps.deviceCredentialStorage` for the full rule and the one
-   * caller of `'ephemeral'`.
-   *
-   * @default 'persistent'
-   */
-  deviceCredentialStorage?: 'persistent' | 'ephemeral';
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
   /** Storage instance owned by the public provider; internal composition seam. */

package/src/ui/hooks/accountDialogSnapshot.ts

@@ -1,4 +1,5 @@
-import type { AccountDialogSnapshot } from '@oxy.so/core';
+import { useCallback, useSyncExternalStore } from 'react';
+import type { AccountDialogController, AccountDialogSnapshot } from '@oxy.so/core';
 
 /**
  * The snapshot `useSyncExternalStore` reads before a controller exists.
@@ -36,6 +37,24 @@ export const EMPTY_ACCOUNT_DIALOG_SNAPSHOT: AccountDialogSnapshot = {
     openedAt: null,
     progress: 'idle',
     attempt: 0,
+    inline: false,
   },
   commonsAvailability: 'unknown',
 };
+
+/**
+ * Bind a surface to `controller`'s snapshot (the inert one while there is no
+ * controller). `getSnapshot` returns a stable reference between changes, so
+ * it is `useSyncExternalStore`-safe.
+ */
+export function useAccountDialogSnapshot(controller: AccountDialogController | null): AccountDialogSnapshot {
+  const subscribe = useCallback(
+    (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
+    [controller],
+  );
+  const getSnapshot = useCallback(
+    () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
+    [controller],
+  );
+  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}

package/src/ui/hooks/useDeviceSwitcher.ts

@@ -1,4 +1,4 @@
-import { useCallback, useMemo, useSyncExternalStore } from 'react';
+import { useCallback, useMemo } from 'react';
 import {
     buildSwitcherRows,
     projectDevicePrincipals,
@@ -7,7 +7,7 @@ import {
 } from '@oxy.so/core';
 import { useOxy } from '../context/OxyContext';
 import { useI18n } from './useI18n';
-import { EMPTY_ACCOUNT_DIALOG_SNAPSHOT } from './accountDialogSnapshot';
+import { useAccountDialogSnapshot } from './accountDialogSnapshot';
 
 export interface UseDeviceSwitcherResult {
     /**
@@ -60,15 +60,7 @@ export function useDeviceSwitcher(): UseDeviceSwitcherResult {
     const { accountDialogController: controller, oxyServices } = useOxy();
     const { locale } = useI18n();
 
-    const subscribe = useCallback(
-        (listener: () => void) => (controller ? controller.subscribe(listener) : () => undefined),
-        [controller],
-    );
-    const getSnapshot = useCallback(
-        () => (controller ? controller.getSnapshot() : EMPTY_ACCOUNT_DIALOG_SNAPSHOT),
-        [controller],
-    );
-    const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+    const snapshot = useAccountDialogSnapshot(controller);
 
     // `directory` is a stable reference between reads (`SessionClient` holds the
     // one it applied), so this recomputes only when the device actually moved.

package/src/ui/oauth/__tests__/browserAuthTransport.test.ts

@@ -153,6 +153,27 @@ describe('startWebOAuthSignIn', () => {
       expect(openSpy).toHaveBeenCalledTimes(1);
     });
 
+    // An Oxy app's account dialog asks for the window whatever the provider's
+    // `webAuthMode`, and for the IdP screen the person lands on.
+    it('opens the window for `transport: popup` even in redirect mode, with its screen', async () => {
+      const context = makeContext({ mode: 'redirect' });
+      const popup = fakePopup();
+      const openSpy = jest.spyOn(window, 'open').mockReturnValue(popup as unknown as Window);
+
+      const pending = startWebOAuthSignIn(context, { redirectUri: REDIRECT_URI, transport: 'popup', screen: 'signup' });
+      const authorizeUrl = await waitForAuthorizeUrl(popup);
+      expect(authorizeUrl.searchParams.get('screen')).toBe('signup');
+      expect(authorizeUrl.searchParams.get('response_mode')).toBe('web_message');
+      dispatchFromPopup(
+        { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: 'code-1', state: authorizeUrl.searchParams.get('state') },
+        popup,
+      );
+
+      await expect(pending).resolves.toEqual({ status: 'signed-in' });
+      expect(openSpy).toHaveBeenCalledTimes(1);
+      expect(mockRedirect).not.toHaveBeenCalled();
+    });
+
     it('falls back to a full-page redirect when the popup was blocked', async () => {
       const context = makeContext();
 

package/src/ui/oauth/browserAuthTransport.ts

@@ -14,7 +14,7 @@
  * remains the native lane and is untouched by this module.
  */
 
-import { logger, persistOAuthHandshake } from '@oxy.so/core';
+import { logger, persistOAuthHandshake, type OxyAuthScreen } from '@oxy.so/core';
 import type { OxyServices } from '@oxy.so/core';
 import { redirectToAuthorize } from '../components/oauthNavigation';
 import { isWebBrowser } from '../utils/isWebBrowser';
@@ -64,6 +64,14 @@ export interface StartWebOAuthSignInOptions {
   popup?: OAuthPopupHandle | null;
   /** Requested scope; defaults to the SDK's standard sign-in scope. */
   scope?: string;
+  /**
+   * The transport for this press, whatever the provider's `webAuthMode`. An
+   * Oxy app's own account dialog asks for `popup`: auth.oxy.so's window over
+   * the app, where the browser's shared session lives.
+   */
+  transport?: WebAuthMode;
+  /** The IdP screen a person with no session there lands on. */
+  screen?: OxyAuthScreen;
   /** Popup timeout override (ms). */
   timeoutMs?: number;
 }
@@ -88,10 +96,10 @@ export async function startWebOAuthSignIn(
   // Claim the window BEFORE the first `await` below, so a caller that invoked us
   // straight from the click still has gesture attribution. An explicit `null`
   // means the caller already tried and was blocked.
-  const popup =
-    context.mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
+  const mode = options.transport ?? context.mode;
+  const popup = mode === 'popup' && options.popup === undefined ? openOAuthPopup() : options.popup ?? null;
 
-  if (context.mode === 'redirect') {
+  if (mode === 'redirect') {
     closeOAuthPopup(popup);
     return startRedirectSignIn(context, options, 'redirect-mode');
   }
@@ -109,6 +117,7 @@ export async function startWebOAuthSignIn(
       authorizeBaseUrl: context.authorizeBaseUrl,
       scope: options.scope,
       responseMode: 'web_message',
+      ...(options.screen ? { screen: options.screen } : {}),
     });
 
     if (!navigateOAuthPopup(popup, prepared.authorizeUrl)) {
@@ -178,6 +187,7 @@ async function startRedirectSignIn(
     redirectUri: options.redirectUri,
     authorizeBaseUrl: context.authorizeBaseUrl,
     scope: options.scope,
+    ...(options.screen ? { screen: options.screen } : {}),
   });
 
   if (!persistOAuthHandshake(

package/src/ui/oauth/oauthHandshake.ts

@@ -9,7 +9,7 @@
  * identical, which is what lets both lanes converge on one completion path.
  */
 
-import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair } from '@oxy.so/core';
+import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair, type OxyAuthScreen } from '@oxy.so/core';
 import type { OAuthHandshake } from './types';
 
 /** Inputs for {@link prepareAuthorizeRequest}. */
@@ -28,6 +28,8 @@ export interface PrepareAuthorizeRequestParams {
    * not a guarantee — an IdP with no opener still redirects.
    */
   responseMode?: 'web_message';
+  /** The IdP screen a person with no session there lands on. */
+  screen?: OxyAuthScreen;
 }
 
 /** A ready-to-use authorize request plus the secrets that finish it. */
@@ -64,6 +66,7 @@ export async function prepareAuthorizeRequest(
     state,
     codeChallenge: pkce.codeChallenge,
     ...(params.responseMode ? { responseMode: params.responseMode } : {}),
+    ...(params.screen ? { screen: params.screen } : {}),
   });
 
   return {

package/src/ui/oauth/oauthPopup.ts

@@ -11,10 +11,9 @@
  *   is still being handled. Anything awaited first (resolving the application,
  *   generating PKCE) loses it and the popup is silently blocked. So the window
  *   is opened EMPTY up front and navigated once the authorize URL exists —
- *   the same shape as `passkeyHubPopup.ts`.
+ *   a plain function a test can substitute.
  * - **No close event.** A cross-origin popup fires nothing when the user
- *   dismisses it; polling `closed` is the only mechanism (as in core's
- *   `AccountDialogController.watchPopup`).
+ *   dismisses it; polling `closed` is the only mechanism.
  * - **No cross-origin reads.** The popup's URL, title, and document are all
  *   opaque. The authorization result arrives ONLY as a `postMessage`.
  */

package/src/ui/screens/ManageAccountScreen.tsx

@@ -14,7 +14,7 @@ import { useTheme } from '@oxy.so/bloom/theme';
 import { Text } from '@oxy.so/bloom/typography';
 import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
 import {
-    IDENTITY_WEB_ORIGIN,
+    AUTH_WEB_ORIGIN,
     getAccountDisplayName,
     getAccountFallbackHandle,
     getNormalizedUserHandle,
@@ -324,10 +324,9 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
             return;
         }
         // Web: deleting an account is signed with its identity key, which only
-        // the identity origin can unseal — the deletion happens there, never on
-        // this page.
+        // auth.oxy.so can unseal — the deletion happens there, never on this page.
         if (isWebBrowser()) {
-            await Linking.openURL(`${IDENTITY_WEB_ORIGIN}/`).catch(() => {
+            await Linking.openURL(`${AUTH_WEB_ORIGIN}/identity`).catch(() => {
                 toast.error(t('accountSwitcher.linkOpenFailed'));
             });
             return;

package/src/ui/screens/trust/TrustLeaderboardScreen.tsx

@@ -115,7 +115,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
                 </TouchableOpacity>
             );
         },
-        [oxyServices, currentUserId, handleEntryPress, locale],
+        [oxyServices, currentUserId, handleEntryPress, locale, t],
     );
 
     const keyExtractor = useCallback(

package/src/ui/session/authStore.ts

@@ -7,7 +7,6 @@
  * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
  * `createMemoryAuthStateStore`); this module only selects the seam:
  *
- *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
  *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
  *    the shared `createNativeSecureKeyValueStorage()` adapter
@@ -23,7 +22,6 @@
 import {
   createWebAuthStateStore,
   createNativeAuthStateStore,
-  createMemoryAuthStateStore,
   createSharedMirroringAuthStateStore,
   type AuthStateStore,
   type SessionMode,
@@ -46,20 +44,6 @@ export interface PlatformAuthStateStoreOptions {
    * a decision a storage seam gets to make.
    */
   sessionMode?: SessionMode;
-  /**
-   * Whether this origin/app may persist a durable device credential AT ALL.
-   *
-   * `'ephemeral'` stores nothing durable and mirrors nothing: the session lives
-   * in memory for the lifetime of the page and is gone on reload. Its one caller
-   * is `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
-   * where the durable credential for the browser profile is the server-side
-   * DeviceSession behind the `__Host-oxy-device` handle.
-   *
-   * See `OxyProviderProps.deviceCredentialStorage` for why the answer to "let the
-   * hub be authoritative" is to stop persisting the other credential rather than
-   * to consult it second.
-   */
-  storage?: 'persistent' | 'ephemeral';
 }
 
 /**
@@ -68,31 +52,10 @@ export interface PlatformAuthStateStoreOptions {
  * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
  * token) per-app in SecureStore; the SDK re-mints the access token from the
  * device credential on the next cold boot.
- *
- * ## The ephemeral check is FIRST, and the order is load-bearing
- *
- * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
- * never reach the native path — and therefore can never reach the shared-slot
- * mirroring wrapper. Checked after that branch instead, an origin that has
- * declined to persist a credential would publish one into the device-wide slot
- * every sibling app adopts on cold boot: it would keep nothing itself while
- * deciding which session five other apps boot into.
- *
- * That is unreachable today because the only ephemeral caller is a web origin, so
- * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
- * of guarantee that stops holding when someone adds the second caller, so it is
- * structural here rather than incidental, and
- * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
  */
 export function createPlatformAuthStateStore(
   options: PlatformAuthStateStoreOptions = {},
 ): AuthStateStore {
-  // FIRST, above every platform branch — see the docblock for why the ordering
-  // is the guarantee and not a coincidence.
-  if (options.storage === 'ephemeral') {
-    return createMemoryAuthStateStore();
-  }
-
   if (!isReactNative()) {
     return createWebAuthStateStore();
   }