@oxyhq/services 13.0.2 → 13.1.0

package/src/ui/context/OxyContext.tsx

@@ -43,7 +43,7 @@ import { useAuthOperations } from './hooks/useAuthOperations';
 import { useDeviceManagement } from '../hooks/useDeviceManagement';
 import { getStorageKeys, createPlatformStorage, type StorageInterface } from '../utils/storageHelpers';
 import { isInvalidSessionError, isTimeoutOrNetworkError } from '../utils/errorHandlers';
-import { readActiveAuthuser, writeActiveAuthuser } from '../utils/activeAuthuser';
+import { readActiveAuthuser, writeActiveAuthuser, clearSignedOut, isSilentRestoreSuppressed } from '../utils/activeAuthuser';
 import type { RouteName } from '../navigation/routes';
 import { showBottomSheet as globalShowBottomSheet } from '../navigation/bottomSheetManager';
 import { useQueryClient } from '@tanstack/react-query';
@@ -161,42 +161,26 @@ export interface OxyContextState {
   // the caller). The cryptographic Commons/DID "identity" is a SEPARATE concept.
   //
   // UX concept: the user picks an account and the WHOLE app becomes that account
-  // — a genuine switch, NOT an "acting on behalf of" delegation. `actingAs` +
-  // `X-Acting-As` remain the underlying transport (the only one that works for
-  // passwordless org/project/bot accounts), but the framing everywhere is simply
-  // "this is the active account". Read {@link activeAccount} for "who am I"
-  // surfaces; `actingAs` is the low-level mechanism state.
-  /**
-   * The id of the account switched INTO (`X-Acting-As`), or `null` when the
-   * active account is the sign-in's own personal account. This is the underlying
-   * mechanism state — UI should present the result through {@link activeAccount}
-   * rather than framing it as delegation.
-   */
-  actingAs: string | null;
+  // — a genuine, REAL-SESSION switch (`switchToAccount`), identical to switching
+  // between device sign-ins. There is NO separate "active account" concept:
+  // `user` IS the active account after a switch. The removed `X-Acting-As`
+  // delegation header is gone entirely.
   /** Every account the caller can access — own personal root, owned, and shared — from `listAccounts()`. */
   accounts: AccountNode[];
   /**
-   * The {@link AccountNode} switched into, resolved from `accounts` by
-   * `actingAs`. `null` when the active account is the sign-in's own personal
-   * account, or while the switched-into id has not yet appeared in the loaded
-   * `accounts` list.
-   */
-  actingAsAccount: AccountNode | null;
-  /**
-   * The effective ACTIVE account presented across the whole app — the account
-   * the user switched into when one is set and resolved, otherwise the signed-in
-   * user's own personal account. This is the single "who am I" source every
-   * identity surface (header avatar/name, profile chrome, context cues) should
-   * read, so a switch is reflected everywhere as a real account change.
+   * Switch the active session INTO an account from the {@link accounts} graph
+   * (a managed org/project/bot, or an account shared with the caller).
    *
-   * It is a {@link User} (the personal user, or the switched-into account's
-   * embedded user) so every identity surface renders it identically. Falls back
-   * to the personal `user` during the brief window after a switch before
-   * `accounts` has loaded the switched-into node, so the header never flashes
-   * empty. `null` only when signed out.
+   * Mints and plants a REAL session for the target via
+   * `oxyServices.switchToAccount`, then commits it into context state the SAME
+   * way sign-in / {@link switchSession} do — so afterwards `user` IS the target
+   * account and every request authenticates as it. The minted session joins the
+   * device multi-account set (server-set httpOnly `oxy_rt_<authuser>` cookie), so
+   * it survives reload / `refresh-all` and appears in the device account list
+   * exactly like a device sign-in. Refreshes the account graph and invalidates
+   * all React Query data so everything reloads as the new account.
    */
-  activeAccount: User | null;
-  setActingAs: (accountId: string | null) => void;
+  switchToAccount: (accountId: string) => Promise<void>;
   refreshAccounts: () => Promise<void>;
   createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
 }
@@ -1325,6 +1309,54 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       }
     }
 
+    // LAST-ACTIVE-ACCOUNT priority (web multi-account). When the user has an
+    // explicit persisted active slot (`oxy_active_authuser`, written on every
+    // device sign-in / account SWITCH / cookie restore), the multi-account
+    // refresh-cookie restore is the ONLY cold-boot step that honors WHICH slot
+    // was last active — `restoreViaRefreshCookie` selects it via
+    // `selectActiveRefreshAccount(accounts, readActiveAuthuser())`. The
+    // `fedcm-silent` and per-apex `silent-iframe` steps only ever recover the
+    // PRIMARY central IdP session, so if either ran first they would clobber a
+    // switched (managed/org) account back to the primary on reload — the exact
+    // "switch is lost on reload" regression. So when a slot selection exists we
+    // run cookie-restore BEFORE those probes (and disable the later duplicate).
+    //
+    // Read ONCE here (synchronously usable by the step `enabled` gates below).
+    // It is non-null ONLY on first-party web apps that persist the slot. Both the
+    // device sign-in/switch paths AND `handleWebSSOSession` (FedCM/SSO/credentials
+    // commit funnel) now persist it — but only when the session genuinely joined
+    // the device set: `establishDeviceRefreshSlot` returns an `authuser` ONLY on
+    // first-party web (same registrable apex as the API), so a cross-apex RP never
+    // writes a phantom slot and native has no localStorage. Both therefore keep
+    // their existing order untouched. The earlier `stored-session` step still runs
+    // first (FIX-A latency), and when a slot exists but its cookies have all
+    // lapsed, cookie-restore simply returns no accounts and the chain falls through
+    // to the cross-domain fallbacks exactly as before.
+    const prioritizeMultiAccount = isWebBrowser() && readActiveAuthuser() !== null;
+
+    // DELIBERATELY-SIGNED-OUT gate (web): when the user pressed "Sign out", any
+    // credential that can silently re-mint a session may still be live on the
+    // next reload — the central IdP session (FedCM credential association /
+    // per-apex `fedcm_session` cookie) AND the device refresh cookies. Since
+    // PR #455 the PRIMARY web session also joins the `oxy_rt_<authuser>` device
+    // set, so the un-gated cookie-restore steps would `refresh-all` that still-
+    // present cookie and sign the user back in without intent — exactly the
+    // "sign-out is silently undone" regression. So this flag gates EVERY
+    // AUTOMATIC silent-restore cold-boot step: `stored-session`,
+    // `cookie-restore-active`, `fedcm-silent`, `silent-iframe`, and
+    // `cookie-restore`. The gate — not a cookie wipe — is the authority: the
+    // account may stay "known" for a fast deliberate re-sign-in, but no step
+    // restores it silently while the flag is set. Read the durable flag ONCE here
+    // (synchronously usable by every step `enabled` gate). Any deliberate sign-in
+    // (password, FedCM, account switch, device claim) clears it, so there is no
+    // "stuck signed out" state. The `sso-bounce` step needs no extra gate: it is
+    // already self-suppressed after sign-out (its `hasPriorSession` hint is
+    // cleared). `sso-return` is NOT gated — it commits the result of a deliberate
+    // top-level `/sso` bounce the user just initiated. `shared-key-signin` is
+    // native-only and the flag never sets on native (`markSignedOut` no-ops
+    // off-web), so its gate would be moot; it is left untouched.
+    const silentRestoreBlocked = isSilentRestoreSuppressed();
+
     try {
       const outcome = await runColdBoot<true>({
         steps: [
@@ -1342,12 +1374,17 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             },
           },
           {
-            // 2) Stored-session bearer restore. NO `enabled` gate — runs on ALL
-            // platforms. This is native's ONLY restore path (every web-only step
-            // is disabled off-browser, so native reaches exactly this) AND the
-            // common WEB reload winner.
+            // 2) Stored-session bearer restore. Runs on ALL platforms EXCEPT when
+            // the deliberately-signed-out flag is set (web only — it never sets on
+            // native, so native still always reaches exactly this step, its ONLY
+            // restore path). This is also the common WEB reload winner.
+            //
+            // SIGNED-OUT GATE: after a deliberate full sign-out the stored session
+            // state is cleared, so this would normally skip anyway — but the gate
+            // makes that authoritative rather than incidental, so no residual
+            // stored token can silently restore while the user is signed out.
             //
-            // ORDERING (FIX A): this step now runs BEFORE the slow web-only
+            // ORDERING (FIX A): this step runs BEFORE the slow web-only
             // probes (`fedcm-silent`, `silent-iframe`, `cookie-restore`). On a
             // normal reload the local bearer validates in one round-trip and
             // wins; `runColdBoot` then short-circuits and never even evaluates
@@ -1358,6 +1395,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // local session this step skips and the cross-domain fallback chain
             // (fedcm → iframe → cookie → sso-bounce) runs exactly as before.
             id: 'stored-session',
+            enabled: () => !silentRestoreBlocked,
             run: async () => {
               const restored = await restoreStoredSession();
               if (restored) {
@@ -1419,6 +1457,34 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
               return { kind: 'session', session: true };
             },
           },
+          {
+            // 2.75) LAST-ACTIVE multi-account restore (WEB, prioritized). Runs
+            // ONLY when an explicit persisted slot selection exists
+            // (`prioritizeMultiAccount`) — i.e. the user previously signed in or
+            // SWITCHED accounts on this first-party app. It runs BEFORE the
+            // `fedcm-silent` / `silent-iframe` probes (which only ever recover the
+            // PRIMARY central session) so a switched managed/org account survives
+            // reload instead of being clobbered back to the primary. The restore
+            // itself is the SAME `restoreViaRefreshCookie` as the terminal-tier
+            // step below: it rotates every device-local `oxy_rt_<authuser>` cookie
+            // and picks the persisted slot via `selectActiveRefreshAccount`,
+            // committing it (token + state + durable persistence + `markAuthResolved`).
+            // When no slot is persisted this is disabled and the original order is
+            // unchanged; when the slot's cookies have lapsed it returns no accounts
+            // and the chain falls through to the cross-domain fallbacks below.
+            //
+            // SIGNED-OUT GATE: since PR #455 the primary's `oxy_rt` slot survives a
+            // deliberate sign-out, so without this gate `refresh-all` would re-mint
+            // and silently re-log-in the user on reload. The flag is cleared by any
+            // deliberate sign-in (including an account SWITCH, which also writes the
+            // new active slot), so the switch-survives-reload path is unaffected.
+            id: 'cookie-restore-active',
+            enabled: () => prioritizeMultiAccount && !silentRestoreBlocked,
+            run: async () => {
+              const restored = await restoreViaRefreshCookie();
+              return restored ? { kind: 'session', session: true } : { kind: 'skip' };
+            },
+          },
           {
             // 3) FedCM silent reauthn (Chrome) against the CENTRAL IdP
             // (auth.oxy.so). `silentSignInWithFedCM` plants the access token
@@ -1432,7 +1498,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // valid local bearer, and skipping it avoids the silent round-trip.
             id: 'fedcm-silent',
             enabled: () =>
-              !storedSessionRestored && fedcmSupported && !servicesSilentAttempted.has(silentKey),
+              !storedSessionRestored &&
+              !silentRestoreBlocked &&
+              fedcmSupported &&
+              !servicesSilentAttempted.has(silentKey),
             run: async () => {
               servicesSilentAttempted.add(silentKey);
               const session = await oxyServices.silentSignInWithFedCM?.();
@@ -1467,7 +1536,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // FIX-D: bounded by `SILENT_IFRAME_TIMEOUT` (plus `iframe.onerror`
             // fail-fast in core) so a no-message iframe cannot stall cold boot.
             id: 'silent-iframe',
-            enabled: () => !storedSessionRestored && isWebBrowser(),
+            enabled: () => !storedSessionRestored && !silentRestoreBlocked && isWebBrowser(),
             run: async () => {
               if (!commitWebSession) {
                 return { kind: 'skip' };
@@ -1493,8 +1562,20 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // is correct; cross-domain restore is handled by the SSO bounce.
             // FIX-D: `restoreViaRefreshCookie` bounds the request with
             // `COOKIE_RESTORE_TIMEOUT` so a cross-domain stall cannot hang here.
+            //
+            // Disabled when `prioritizeMultiAccount` already ran the
+            // `cookie-restore-active` step above (an explicit persisted slot) — that
+            // earlier step is the identical restore, so this terminal-tier copy
+            // would be a redundant second `refreshAllSessions`. It still runs in the
+            // common no-persisted-slot case (e.g. first visit to a first-party app
+            // whose central refresh cookies already exist).
+            //
+            // SIGNED-OUT GATE (same rationale as `cookie-restore-active`): the
+            // primary's `oxy_rt` slot survives a deliberate sign-out (PR #455), so
+            // this must be skipped while the signed-out flag is set or it would
+            // silently re-restore the primary on reload.
             id: 'cookie-restore',
-            enabled: () => isWebBrowser(),
+            enabled: () => isWebBrowser() && !prioritizeMultiAccount && !silentRestoreBlocked,
             run: async () => {
               const restored = await restoreViaRefreshCookie();
               return restored ? { kind: 'session', session: true } : { kind: 'skip' };
@@ -1743,6 +1824,38 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
     oxyServices.httpService.setTokens(session.accessToken);
 
+    // A committed web session re-enables automatic silent restore: clear the
+    // durable "deliberately signed out" flag. This funnel is reached by deliberate
+    // sign-ins (password, interactive FedCM, `/sso` return) AND by the silent
+    // cold-boot steps — but those are GATED on the flag, so when it is set they
+    // never run and never reach here; clearing is therefore only hit on a genuine
+    // (re-)sign-in or when restore was already permitted, both correct.
+    clearSignedOut();
+
+    // Register this primary session in the device's first-party multi-account
+    // refresh-cookie set (web only). Every web primary-session restore funnels
+    // through here — FedCM silent (`/fedcm/exchange`), per-apex `/auth/silent`
+    // iframe, central `/sso` return, and keyless password sign-in. Of those, only
+    // a same-apex `/fedcm/exchange` plants an `oxy_rt_<authuser>` slot as a side
+    // effect; the cross-origin/credential-less restores (`/sso/exchange`,
+    // `/auth/silent` postMessage) cannot set an `api.oxy.so` cookie at all. So
+    // WITHOUT this call a web primary never joins the device set: `refresh-all`
+    // returns zero accounts, and account-switch persistence + the
+    // `cookie-restore-active` cold-boot step have no foundation. Calling the shared
+    // `POST /auth/session` primitive here makes EVERY primary participate in the
+    // set, re-plants the rotated token, and records the active `authuser` so the
+    // next cold boot's `cookie-restore-active` reconciles the persisted active
+    // (possibly switched) account instead of `fedcm-silent` clobbering it back to
+    // the primary. Best-effort: a `null` result (native / transient failure)
+    // leaves the in-session token untouched.
+    const primaryAuthuser = await oxyServices.establishDeviceRefreshSlot();
+    // A non-null slot is returned ONLY on first-party web (the helper gates on
+    // platform + same registrable apex), so recording the active slot here is safe
+    // and never writes a phantom authuser for a cross-apex RP or native.
+    if (typeof primaryAuthuser === 'number') {
+      writeActiveAuthuser(primaryAuthuser);
+    }
+
     const clientSession = {
       sessionId: session.sessionId,
       deviceId: session.deviceId || '',
@@ -1750,6 +1863,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       lastActive: new Date().toISOString(),
       userId: session.user.id?.toString() ?? '',
       isCurrent: true,
+      ...(typeof primaryAuthuser === 'number' ? { authuser: primaryAuthuser } : null),
     };
 
     updateSessions([clientSession], { merge: true });
@@ -2018,38 +2132,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   });
 
   // --- Account graph state ---
-  const [actingAs, setActingAsState] = useState<string | null>(null);
   const [accounts, setAccounts] = useState<AccountNode[]>([]);
 
-  // Latest `actingAs`, mirrored into a ref so `refreshAccounts` can reconcile a
-  // stale switch without taking `actingAs` as a dependency (which would re-run
-  // the account load on every switch). See the reconciliation block below.
-  const actingAsRef = useRef(actingAs);
-  actingAsRef.current = actingAs;
-  // `setActingAs` is declared after `refreshAccounts`; route the reconciliation
-  // clear through a ref so the load callback can call the latest implementation.
-  const setActingAsRef = useRef<((accountId: string | null) => void) | null>(null);
-
-  // Restore actingAs from storage on startup
-  useEffect(() => {
-    if (!storage || !initialized) return;
-    let mounted = true;
-    (async () => {
-      try {
-        const stored = await storage.getItem(`${storageKeyPrefix}_acting_as`);
-        if (mounted && stored) {
-          setActingAsState(stored);
-          oxyServices.setActingAs(stored);
-        }
-      } catch (err) {
-        if (__DEV__) {
-          loggerUtil.debug('Failed to restore actingAs from storage', { component: 'OxyContext' }, err as unknown);
-        }
-      }
-    })();
-    return () => { mounted = false; };
-  }, [storage, initialized, storageKeyPrefix, oxyServices]);
-
   // Load the unified account graph when authenticated
   const refreshAccounts = useCallback(async (): Promise<void> => {
     if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
@@ -2060,15 +2144,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     try {
       const list = await oxyServices.listAccounts();
       setAccounts(list);
-      // Reconcile a stale switch: if the active account was switched INTO an id
-      // that is no longer accessible (account removed/archived, or it belonged
-      // to a now-inactive sign-in), drop back to the personal account so the
-      // app never keeps sending a dead `X-Acting-As` header. `list` is the
-      // authoritative accessible set on a successful fetch.
-      const current = actingAsRef.current;
-      if (current && !list.some((node) => node.accountId === current)) {
-        setActingAsRef.current?.(null);
-      }
     } catch (err) {
       if (isUnauthorizedStatus(err)) {
         setAccounts([]);
@@ -2087,47 +2162,68 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
   }, [isAuthenticated, initialized, tokenReady, refreshAccounts]);
 
-  const setActingAs = useCallback((accountId: string | null) => {
-    oxyServices.setActingAs(accountId);
-    setActingAsState(accountId);
-    // Switching the acting-as identity changes every server response, but React
-    // Query keys are not namespaced by the acting-as target, so the cache would
-    // otherwise keep serving the previous account's data. Invalidate everything
-    // so each query refetches under the new identity (the next request carries
-    // the updated `X-Acting-As` header). `invalidateQueries` (not `clear`) keeps
-    // the account list/switcher populated mid-switch instead of blanking out.
-    queryClient.invalidateQueries();
-    // Persist to storage
-    if (storage) {
-      if (accountId) {
-        storage.setItem(`${storageKeyPrefix}_acting_as`, accountId).catch((persistError) => {
-          loggerUtil.debug('Failed to persist acting-as account', { component: 'OxyContext' }, persistError as unknown);
-        });
-      } else {
-        storage.removeItem(`${storageKeyPrefix}_acting_as`).catch((persistError) => {
-          loggerUtil.debug('Failed to clear acting-as account', { component: 'OxyContext' }, persistError as unknown);
-        });
+  // Switch the active session INTO an account from the unified graph. In the
+  // REAL-SESSION model this is identical to switching device sign-ins: mint a
+  // real session for the target and make the whole app that account. The removed
+  // `X-Acting-As` delegation header is gone — `oxyServices.switchToAccount`
+  // plants the minted access token (the refresh token is the server-set httpOnly
+  // `oxy_rt_<authuser>` cookie, so the session joins the device multi-account set
+  // and survives reload / `refresh-all`). We then commit the session into context
+  // state the SAME way sign-in / `switchSession` do, refresh the account graph,
+  // and invalidate every query so all data reloads as the new account.
+  const switchToAccount = useCallback(async (accountId: string): Promise<void> => {
+    const result = await oxyServices.switchToAccount(accountId);
+    if (!result?.user || !result?.sessionId) {
+      throw new Error('Account switch did not return a valid session');
+    }
+
+    // A switch is a deliberate sign-in into an account: re-enable automatic silent
+    // restore by clearing any prior "deliberately signed out" flag.
+    clearSignedOut();
+
+    // `oxyServices.switchToAccount` already planted `result.accessToken` as the
+    // active token; mirror the minted session into the multi-account store and
+    // mark it current, recording the device `authuser` slot so web silent-switch
+    // and the device account chooser can address it.
+    const now = new Date();
+    const clientSession: ClientSession = {
+      sessionId: result.sessionId,
+      deviceId: result.deviceId || '',
+      expiresAt: result.expiresAt || new Date(now.getTime() + DEFAULT_SESSION_VALIDITY_MS).toISOString(),
+      lastActive: now.toISOString(),
+      userId: result.user.id?.toString() ?? '',
+      isCurrent: true,
+      ...(typeof result.authuser === 'number' ? { authuser: result.authuser } : null),
+    };
+    updateSessions([clientSession], { merge: true });
+    setActiveSessionId(result.sessionId);
+    if (isWebBrowser() && typeof result.authuser === 'number') {
+      writeActiveAuthuser(result.authuser);
+    }
+    await persistSessionDurably(result.sessionId);
+
+    // Fetch the canonical User for the new account (the switch result carries
+    // only MinimalUserData); fall back to that minimal shape if the profile
+    // fetch fails so the app still reflects the switched identity.
+    let fullUser: User;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user after account switch; using switch result user', { component: 'OxyContext', method: 'switchToAccount' }, profileError as unknown);
       }
+      fullUser = result.user as unknown as User;
     }
-  }, [oxyServices, storage, storageKeyPrefix, queryClient]);
-  setActingAsRef.current = setActingAs;
-
-  // The account switched into, resolved from the loaded graph.
-  const actingAsAccount = useMemo<AccountNode | null>(() => {
-    if (!actingAs) return null;
-    return accounts.find((node) => node.accountId === actingAs) ?? null;
-  }, [actingAs, accounts]);
-
-  // The effective ACTIVE account presented across the app: the switched-into
-  // account's user when a switch is set and resolved, otherwise the signed-in
-  // user's own personal account. Derived (no effect) so identity surfaces always
-  // render the current account without separate syncing. Falls back to `user`
-  // while a just-set switch has not yet resolved in `accounts`, so the header
-  // never flashes empty mid-switch.
-  const activeAccount = useMemo<User | null>(
-    () => (actingAs && actingAsAccount ? actingAsAccount.account : user),
-    [actingAs, actingAsAccount, user],
-  );
+    loginSuccess(fullUser);
+    onAuthStateChange?.(fullUser);
+
+    // Reload the switchable account graph (the new active account's relationships
+    // differ) and invalidate every query so all data refetches as the new
+    // account — the deviceAccounts probe re-enumerates the multi-account set so
+    // the switched account now appears as a device session.
+    await refreshAccounts();
+    queryClient.invalidateQueries();
+  }, [oxyServices, updateSessions, setActiveSessionId, persistSessionDurably, loginSuccess, onAuthStateChange, refreshAccounts, queryClient]);
 
   const createAccountFn = useCallback(async (data: CreateAccountInput): Promise<AccountNode> => {
     const account = await oxyServices.createAccount(data);
@@ -2177,11 +2273,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     useFollow: useFollowHook,
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn,
   }), [
@@ -2224,11 +2317,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     user,
     showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccountFn,
   ]);
@@ -2297,11 +2387,8 @@ const LOADING_STATE: OxyContextState = {
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
   openAvatarPicker: () => {},
-  actingAs: null,
   accounts: [],
-  actingAsAccount: null,
-  activeAccount: null,
-  setActingAs: () => {},
+  switchToAccount: () => rejectMissingProvider<void>(),
   refreshAccounts: () => rejectMissingProvider<void>(),
   createAccount: () => rejectMissingProvider<AccountNode>(),
 };

package/src/ui/context/hooks/useAuthOperations.ts

@@ -9,7 +9,13 @@ import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxyhq/core';
 import { SignatureService } from '@oxyhq/core';
 import { isWebBrowser } from '../../hooks/useWebSSO';
-import { clearActiveAuthuser, clearSsoBounceState } from '../../utils/activeAuthuser';
+import {
+  clearActiveAuthuser,
+  clearSsoBounceState,
+  writeActiveAuthuser,
+  markSignedOut,
+  clearSignedOut,
+} from '../../utils/activeAuthuser';
 import { isCrossApexWeb, CrossApexDirectSignInError } from '../../../utils/crossApex';
 
 export interface UseAuthOperationsOptions {
@@ -133,6 +139,23 @@ export const useAuthOperations = ({
         deviceFingerprint,
       );
 
+      // Deliberate sign-in re-enables automatic silent restore: clear the durable
+      // "deliberately signed out" flag so a prior sign-out no longer suppresses
+      // the `fedcm-silent` / per-apex iframe cold-boot steps.
+      clearSignedOut();
+
+      // Register this primary session in the device's first-party multi-account
+      // refresh-cookie set so a web key-based sign-in survives reload via
+      // `refresh-all` and coexists with switched accounts. `/auth/verify` mints the
+      // session but (unlike `/auth/login` / `/fedcm/exchange`) does NOT plant an
+      // `oxy_rt_<authuser>` slot, so we establish it here through the shared
+      // `POST /auth/session` primitive. No-op on native and cross-apex (returns
+      // `null`); records the active slot when one is genuinely allocated.
+      const verifyAuthuser = await oxyServices.establishDeviceRefreshSlot();
+      if (typeof verifyAuthuser === 'number') {
+        writeActiveAuthuser(verifyAuthuser);
+      }
+
       // Get full user data
       fullUser = await oxyServices.getUserBySession(sessionResponse.sessionId);
 
@@ -260,7 +283,14 @@ export const useAuthOperations = ({
             await switchSession(filteredSessions[0].sessionId);
           } else {
             // Genuine FULL sign-out (no sessions remain): clear the per-origin
-            // SSO bounce state so a fresh deliberate sign-in can re-probe.
+            // SSO bounce state so a fresh deliberate sign-in can re-probe, drop
+            // the persisted active device slot so the next cold boot does not
+            // prioritize a now-signed-out `oxy_active_authuser`, and SET the
+            // deliberately-signed-out flag so the silent cold-boot steps
+            // (`fedcm-silent` / per-apex iframe) do not re-mint a session from a
+            // still-live IdP session on the next reload (mirrors `logoutAll`).
+            markSignedOut();
+            clearActiveAuthuser();
             clearSsoBounceState();
             clearPriorSessionHintSafe(clearPriorSessionHint, logger);
             await clearSessionState();
@@ -322,6 +352,9 @@ export const useAuthOperations = ({
       if (isWebBrowser()) {
         await oxyServices.logoutAllSessionsViaCookie();
         clearActiveAuthuser();
+        // Deliberate full sign-out: suppress automatic silent restore on the next
+        // cold boot so a still-live IdP session does not re-mint a session.
+        markSignedOut();
       }
       // logoutAll is ALWAYS a full sign-out: clear the per-origin SSO bounce
       // state (web-guarded internally) so a fresh sign-in can re-probe, and drop

package/src/ui/hooks/queries/useAccountQueries.ts

@@ -232,11 +232,11 @@ export const useAuthorizedApps = (options?: { enabled?: boolean }) => {
  * Get privacy settings for a user
  */
 export const usePrivacySettings = (userId?: string, options?: { enabled?: boolean }) => {
-  const { oxyServices, activeSessionId, activeAccount } = useOxy();
+  const { oxyServices, activeSessionId, user } = useOxy();
   // When no explicit user id is supplied, target the ACTIVE account (the
   // account switched into) so "my privacy settings" reflects the current
   // account, matching the imperative PrivacySettingsScreen.
-  const targetUserId = userId || activeAccount?.id;
+  const targetUserId = userId || user?.id;
 
   return useQuery({
     queryKey: queryKeys.privacy.settings(targetUserId),

package/src/ui/hooks/queries/usePaymentQueries.ts

@@ -34,10 +34,10 @@ import type {
  * API's `{ plan: 'basic' }` fallback when the user has never subscribed.
  */
 export const useUserSubscription = (options?: { enabled?: boolean }) => {
-  const { oxyServices, isAuthenticated, activeSessionId, activeAccount } = useOxy();
+  const { oxyServices, isAuthenticated, activeSessionId, user } = useOxy();
 
   return useQuery({
-    queryKey: queryKeys.payments.subscription(activeAccount?.id),
+    queryKey: queryKeys.payments.subscription(user?.id),
     queryFn: async () => {
       return authenticatedApiCall<Subscription>(
         oxyServices,
@@ -45,7 +45,7 @@ export const useUserSubscription = (options?: { enabled?: boolean }) => {
         () => oxyServices.getCurrentUserSubscription(),
       );
     },
-    enabled: (options?.enabled !== false) && isAuthenticated && !!activeAccount?.id,
+    enabled: (options?.enabled !== false) && isAuthenticated && !!user?.id,
     // Subscription state changes rarely; tolerate a longer fresh window.
     staleTime: 5 * 60 * 1000, // 5 minutes
     gcTime: 30 * 60 * 1000, // 30 minutes
@@ -59,10 +59,10 @@ export const useUserSubscription = (options?: { enabled?: boolean }) => {
  * returns the user's `deposit` and `purchase` transactions newest-first.
  */
 export const useUserPayments = (options?: { enabled?: boolean }) => {
-  const { oxyServices, isAuthenticated, activeSessionId, activeAccount } = useOxy();
+  const { oxyServices, isAuthenticated, activeSessionId, user } = useOxy();
 
   return useQuery({
-    queryKey: queryKeys.payments.history(activeAccount?.id),
+    queryKey: queryKeys.payments.history(user?.id),
     queryFn: async () => {
       return authenticatedApiCall<Payment[]>(
         oxyServices,
@@ -70,7 +70,7 @@ export const useUserPayments = (options?: { enabled?: boolean }) => {
         () => oxyServices.getUserPayments(),
       );
     },
-    enabled: (options?.enabled !== false) && isAuthenticated && !!activeAccount?.id,
+    enabled: (options?.enabled !== false) && isAuthenticated && !!user?.id,
     // Billing history is append-mostly; a short fresh window is fine.
     staleTime: 2 * 60 * 1000, // 2 minutes
     gcTime: 30 * 60 * 1000, // 30 minutes
@@ -84,10 +84,10 @@ export const useUserPayments = (options?: { enabled?: boolean }) => {
  * Balance changes frequently, so the fresh window is intentionally short.
  */
 export const useUserWallet = (options?: { enabled?: boolean }) => {
-  const { oxyServices, isAuthenticated, activeSessionId, activeAccount } = useOxy();
+  const { oxyServices, isAuthenticated, activeSessionId, user } = useOxy();
 
   return useQuery({
-    queryKey: queryKeys.payments.wallet(activeAccount?.id),
+    queryKey: queryKeys.payments.wallet(user?.id),
     queryFn: async () => {
       return authenticatedApiCall<Wallet>(
         oxyServices,
@@ -95,7 +95,7 @@ export const useUserWallet = (options?: { enabled?: boolean }) => {
         () => oxyServices.getCurrentUserWallet(),
       );
     },
-    enabled: (options?.enabled !== false) && isAuthenticated && !!activeAccount?.id,
+    enabled: (options?.enabled !== false) && isAuthenticated && !!user?.id,
     staleTime: 60 * 1000, // 1 minute (balance moves often)
     gcTime: 10 * 60 * 1000, // 10 minutes
   });
@@ -116,12 +116,12 @@ export const useUserWalletTransactions = (
   params?: { limit?: number; offset?: number },
   options?: { enabled?: boolean },
 ) => {
-  const { oxyServices, isAuthenticated, activeSessionId, activeAccount } = useOxy();
+  const { oxyServices, isAuthenticated, activeSessionId, user } = useOxy();
   const limit = params?.limit;
   const offset = params?.offset;
 
   return useQuery({
-    queryKey: queryKeys.payments.walletTransactions(limit, offset, activeAccount?.id),
+    queryKey: queryKeys.payments.walletTransactions(limit, offset, user?.id),
     queryFn: async () => {
       return authenticatedApiCall<WalletTransactionsResponse>(
         oxyServices,
@@ -129,7 +129,7 @@ export const useUserWalletTransactions = (
         () => oxyServices.getCurrentUserWalletTransactions({ limit, offset }),
       );
     },
-    enabled: (options?.enabled !== false) && isAuthenticated && !!activeAccount?.id,
+    enabled: (options?.enabled !== false) && isAuthenticated && !!user?.id,
     staleTime: 60 * 1000, // 1 minute (ledger updates frequently)
     gcTime: 10 * 60 * 1000, // 10 minutes
   });