@oxyhq/services 13.0.3 → 13.1.0

package/lib/commonjs/ui/components/ProfileMenu.js

@@ -0,0 +1,374 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+var _react = require("react");
+var _reactNative = require("react-native");
+var _vectorIcons = require("@expo/vector-icons");
+var _avatar = require("@oxyhq/bloom/avatar");
+var _typography = require("@oxyhq/bloom/typography");
+var _theme = require("@oxyhq/bloom/theme");
+var _bloom = require("@oxyhq/bloom");
+var _divider = require("@oxyhq/bloom/divider");
+var _core = require("@oxyhq/core");
+var _OxyContext = require("../context/OxyContext.js");
+var _useI18n = require("../hooks/useI18n.js");
+var _useDeviceAccounts = require("../hooks/useDeviceAccounts.js");
+var _jsxRuntime = require("react/jsx-runtime");
+const isWeb = _reactNative.Platform.OS === 'web';
+
+/** Fixed popover width on web. `ProfileButton` mirrors this when anchoring. */
+const MENU_WIDTH = 300;
+
+/**
+ * Web-only anchor. `ProfileButton` measures its trigger and anchors the panel's
+ * BOTTOM-LEFT corner so the menu opens UPWARD from the sidebar footer. Native
+ * ignores the anchor and docks the panel to the bottom as a sheet.
+ */
+
+/**
+ * Clean device-account switcher, modeled on the inbox `AccountMenu` but written
+ * fresh with NativeWind classNames + Bloom primitives. Lists every account
+ * signed in on this device (from {@link useDeviceAccounts}); tapping a row
+ * switches, and each inactive row carries a sign-out icon. Below the list:
+ * Add account, Manage account, optional View profile, and Sign out of all.
+ *
+ * Renders as an upward-opening popover anchored to the trigger on web, and a
+ * bottom-sheet style modal on native.
+ */
+const ProfileMenu = ({
+  open,
+  onClose,
+  anchor,
+  onNavigateManage,
+  onAddAccount,
+  onNavigateProfile,
+  onBeforeSessionChange
+}) => {
+  const {
+    activeSessionId,
+    switchSession,
+    logoutAll,
+    removeSession
+  } = (0, _OxyContext.useOxy)();
+  const {
+    t
+  } = (0, _useI18n.useI18n)();
+  const {
+    colors
+  } = (0, _theme.useTheme)();
+  const {
+    accounts
+  } = (0, _useDeviceAccounts.useDeviceAccounts)();
+  const [busySessionId, setBusySessionId] = (0, _react.useState)(null);
+  const [removingSessionId, setRemovingSessionId] = (0, _react.useState)(null);
+  const [signingOutAll, setSigningOutAll] = (0, _react.useState)(false);
+  const signOutAllDialog = (0, _bloom.useDialogControl)();
+  const isSwitching = busySessionId !== null;
+  const actionDisabled = isSwitching || removingSessionId !== null || signingOutAll;
+
+  // Switch to a non-active account through the SDK's canonical switch path.
+  const handleSwitch = (0, _react.useCallback)(async sessionId => {
+    if (sessionId === activeSessionId || busySessionId) {
+      return;
+    }
+    setBusySessionId(sessionId);
+    try {
+      await onBeforeSessionChange?.();
+      await switchSession(sessionId);
+      _bloom.toast.success(t('accountSwitcher.toasts.switchSuccess') || 'Switched account');
+      onClose();
+    } catch (error) {
+      if (!(0, _core.isDev)()) {
+        _core.logger.warn('Switch account failed', {
+          component: 'ProfileMenu'
+        }, error);
+      }
+      _bloom.toast.error(t('accountSwitcher.toasts.switchFailed') || 'Failed to switch account');
+    } finally {
+      setBusySessionId(null);
+    }
+  }, [activeSessionId, busySessionId, switchSession, t, onClose, onBeforeSessionChange]);
+
+  // Sign out a specific inactive account without switching/clearing the active
+  // one. The menu stays open so the user can keep managing accounts.
+  const handleRemove = (0, _react.useCallback)(async sessionId => {
+    if (sessionId === activeSessionId || removingSessionId) {
+      return;
+    }
+    setRemovingSessionId(sessionId);
+    try {
+      await removeSession(sessionId);
+      _bloom.toast.success(t('common.actions.signedOut') || 'Signed out');
+    } catch (error) {
+      _core.logger.warn('Remove account failed', {
+        component: 'ProfileMenu'
+      }, error);
+      _bloom.toast.error(t('common.errors.signOutFailed') || 'Failed to sign out');
+    } finally {
+      setRemovingSessionId(null);
+    }
+  }, [activeSessionId, removingSessionId, removeSession, t]);
+  const performSignOutAll = (0, _react.useCallback)(async () => {
+    if (signingOutAll) {
+      return;
+    }
+    setSigningOutAll(true);
+    try {
+      await onBeforeSessionChange?.();
+      await logoutAll();
+      _bloom.toast.success(t('accountSwitcher.toasts.signOutAllSuccess') || 'Signed out of all accounts');
+      onClose();
+    } catch (error) {
+      _core.logger.warn('Sign out all failed', {
+        component: 'ProfileMenu'
+      }, error);
+      _bloom.toast.error(t('common.errors.signOutAllFailed') || 'Failed to sign out of all accounts');
+    } finally {
+      setSigningOutAll(false);
+    }
+  }, [signingOutAll, logoutAll, t, onClose, onBeforeSessionChange]);
+
+  // Escape-to-close (web only).
+  (0, _react.useEffect)(() => {
+    if (!open || !isWeb || typeof document === 'undefined') {
+      return undefined;
+    }
+    const onKey = event => {
+      if (event.key === 'Escape') {
+        event.stopPropagation();
+        onClose();
+      }
+    };
+    document.addEventListener('keydown', onKey, true);
+    return () => document.removeEventListener('keydown', onKey, true);
+  }, [open, onClose]);
+  if (!open) {
+    return null;
+  }
+
+  // Web: anchor the panel's bottom-left corner to the measured trigger, falling
+  // back to a bottom-left placement when no anchor was captured. Native ignores
+  // this (the panel docks to the bottom via the overlay's flex-end).
+  const panelAnchorStyle = isWeb ? {
+    position: 'absolute',
+    width: MENU_WIDTH,
+    left: anchor?.left ?? 8,
+    bottom: anchor?.bottom ?? 8
+  } : undefined;
+  const content = /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Pressable
+  // Swallow taps inside the panel so they never reach the overlay's
+  // outside-tap-to-close handler.
+  , {
+    onPress: () => undefined,
+    className: isWeb ? 'overflow-hidden rounded-2xl border border-border bg-background' : 'overflow-hidden rounded-t-3xl bg-background pb-3',
+    style: [panelAnchorStyle, !isWeb ? {
+      maxHeight: '85%'
+    } : {
+      maxHeight: '85%'
+    }, styles.shadow],
+    accessibilityRole: "menu",
+    accessibilityLabel: t('accountMenu.label') || 'Account menu',
+    children: /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.ScrollView, {
+      className: "grow-0",
+      contentContainerClassName: "py-1",
+      showsVerticalScrollIndicator: false,
+      children: [accounts.map(account => {
+        const isActive = account.isCurrent;
+        const isBusy = busySessionId === account.sessionId;
+        const isRemoving = removingSessionId === account.sessionId;
+        return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.Pressable, {
+          accessibilityRole: "menuitem",
+          accessibilityLabel: account.displayName,
+          accessibilityState: {
+            selected: isActive
+          },
+          onPress: () => handleSwitch(account.sessionId),
+          disabled: isActive || isBusy || isSwitching,
+          className: `flex-row items-center gap-3 px-4 py-2.5 ${isActive ? 'bg-secondary' : ''} ${isSwitching && !isActive ? 'opacity-40' : ''}`,
+          children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_avatar.Avatar, {
+            source: account.user.avatar ?? undefined,
+            uri: account.avatarUrl,
+            variant: "thumb",
+            name: account.displayName,
+            size: isActive ? 40 : 32
+          }), /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
+            className: "min-w-0 flex-1",
+            children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+              className: `text-foreground ${isActive ? 'font-semibold' : 'font-medium'}`,
+              numberOfLines: 1,
+              children: account.displayName
+            }), account.email ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+              className: "text-xs text-muted-foreground",
+              numberOfLines: 1,
+              children: account.email
+            }) : null]
+          }), isBusy ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+            color: colors.primary,
+            size: "small"
+          }) : isActive ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_vectorIcons.MaterialCommunityIcons, {
+            name: "check",
+            size: 20,
+            color: colors.primary
+          }) : isRemoving ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+            color: colors.textSecondary,
+            size: "small"
+          }) : /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Pressable, {
+            accessibilityRole: "button",
+            accessibilityLabel: t('accountMenu.signOutAccount', {
+              name: account.displayName
+            }) || `Sign out ${account.displayName}`,
+            onPress: () => handleRemove(account.sessionId),
+            disabled: actionDisabled,
+            hitSlop: {
+              top: 8,
+              bottom: 8,
+              left: 8,
+              right: 8
+            },
+            className: "h-7 w-7 items-center justify-center rounded-full opacity-60",
+            children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_vectorIcons.MaterialCommunityIcons, {
+              name: "logout",
+              size: 18,
+              color: colors.textSecondary
+            })
+          })]
+        }, `account-${account.sessionId}`);
+      }), isSwitching ? /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
+        className: "flex-row items-center justify-center gap-2 py-2",
+        children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+          color: colors.textSecondary,
+          size: "small"
+        }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+          className: "text-xs font-medium text-muted-foreground",
+          children: t('accountMenu.switching') || 'Switching account…'
+        })]
+      }) : null, /*#__PURE__*/(0, _jsxRuntime.jsx)(_divider.Divider, {
+        color: colors.border,
+        spacing: 4
+      }), /*#__PURE__*/(0, _jsxRuntime.jsx)(ActionRow, {
+        icon: "account-plus-outline",
+        iconColor: colors.icon,
+        label: t('accountMenu.addAnother') || 'Add another account',
+        disabled: actionDisabled,
+        onPress: () => {
+          onClose();
+          onAddAccount();
+        }
+      }), /*#__PURE__*/(0, _jsxRuntime.jsx)(ActionRow, {
+        icon: "cog-outline",
+        iconColor: colors.icon,
+        label: t('accountMenu.manage') || 'Manage your Oxy Account',
+        disabled: actionDisabled,
+        onPress: () => {
+          onClose();
+          onNavigateManage();
+        }
+      }), onNavigateProfile ? /*#__PURE__*/(0, _jsxRuntime.jsx)(ActionRow, {
+        icon: "account-outline",
+        iconColor: colors.icon,
+        label: t('accountMenu.viewProfile') || 'View profile',
+        disabled: actionDisabled,
+        onPress: () => {
+          onClose();
+          onNavigateProfile();
+        }
+      }) : null, /*#__PURE__*/(0, _jsxRuntime.jsx)(_divider.Divider, {
+        color: colors.border,
+        spacing: 4
+      }), /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.Pressable, {
+        accessibilityRole: "menuitem",
+        accessibilityLabel: t('accountMenu.signOutAll') || 'Sign out of all accounts',
+        onPress: () => signOutAllDialog.open(),
+        disabled: actionDisabled,
+        className: `flex-row items-center gap-3 px-4 py-3 ${actionDisabled ? 'opacity-40' : ''}`,
+        children: [signingOutAll ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+          color: colors.error,
+          size: "small"
+        }) : /*#__PURE__*/(0, _jsxRuntime.jsx)(_vectorIcons.MaterialCommunityIcons, {
+          name: "logout",
+          size: 18,
+          color: colors.error
+        }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+          className: "font-medium",
+          style: {
+            color: colors.error
+          },
+          children: t('accountMenu.signOutAll') || 'Sign out of all accounts'
+        })]
+      })]
+    })
+  });
+  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.Modal, {
+    visible: open,
+    transparent: true,
+    animationType: isWeb ? 'fade' : 'slide',
+    onRequestClose: onClose,
+    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Pressable, {
+      accessibilityRole: "button",
+      accessibilityLabel: t('common.actions.close') || 'Close',
+      onPress: onClose,
+      className: isWeb ? 'flex-1 relative' : 'flex-1 justify-end',
+      style: !isWeb ? styles.nativeScrim : undefined,
+      children: content
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_bloom.Dialog, {
+      control: signOutAllDialog,
+      title: t('accountMenu.signOutAll') || 'Sign out of all accounts',
+      description: t('common.confirms.signOutAll') || 'Are you sure you want to sign out of all accounts?',
+      actions: [{
+        label: t('accountMenu.signOutAll') || 'Sign out of all accounts',
+        color: 'destructive',
+        onPress: performSignOutAll
+      }, {
+        label: t('common.cancel') || 'Cancel',
+        color: 'cancel'
+      }]
+    })]
+  });
+};
+
+/** Bottom-section action row (Add account / Manage / View profile). */
+const ActionRow = ({
+  icon,
+  iconColor,
+  label,
+  disabled,
+  onPress
+}) => /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.Pressable, {
+  accessibilityRole: "menuitem",
+  accessibilityLabel: label,
+  onPress: onPress,
+  disabled: disabled,
+  className: `flex-row items-center gap-3 px-4 py-3 ${disabled ? 'opacity-40' : ''}`,
+  children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_vectorIcons.MaterialCommunityIcons, {
+    name: icon,
+    size: 20,
+    color: iconColor
+  }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
+    className: "font-medium text-foreground",
+    children: label
+  })]
+});
+
+// The panel's drop shadow and the native scrim are the only values with no
+// NativeWind class equivalent in this package (dynamic elevation + rgba scrim),
+// so they stay as small inline objects rather than raw class-replaceable styles.
+const styles = {
+  shadow: {
+    shadowColor: '#000',
+    shadowOpacity: 0.18,
+    shadowRadius: 24,
+    shadowOffset: {
+      width: 0,
+      height: 8
+    },
+    elevation: 12
+  },
+  nativeScrim: {
+    backgroundColor: 'rgba(0,0,0,0.32)'
+  }
+};
+var _default = exports.default = ProfileMenu;
+//# sourceMappingURL=ProfileMenu.js.map

package/lib/commonjs/ui/components/ProfileMenu.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","require","_reactNative","_vectorIcons","_avatar","_typography","_theme","_bloom","_divider","_core","_OxyContext","_useI18n","_useDeviceAccounts","_jsxRuntime","isWeb","Platform","OS","MENU_WIDTH","ProfileMenu","open","onClose","anchor","onNavigateManage","onAddAccount","onNavigateProfile","onBeforeSessionChange","activeSessionId","switchSession","logoutAll","removeSession","useOxy","t","useI18n","colors","useTheme","accounts","useDeviceAccounts","busySessionId","setBusySessionId","useState","removingSessionId","setRemovingSessionId","signingOutAll","setSigningOutAll","signOutAllDialog","useDialogControl","isSwitching","actionDisabled","handleSwitch","useCallback","sessionId","toast","success","error","isDev","loggerUtil","warn","component","handleRemove","performSignOutAll","useEffect","document","undefined","onKey","event","key","stopPropagation","addEventListener","removeEventListener","panelAnchorStyle","position","width","left","bottom","content","jsx","Pressable","onPress","className","style","maxHeight","styles","shadow","accessibilityRole","accessibilityLabel","children","jsxs","ScrollView","contentContainerClassName","showsVerticalScrollIndicator","map","account","isActive","isCurrent","isBusy","isRemoving","displayName","accessibilityState","selected","disabled","Avatar","source","user","avatar","uri","avatarUrl","variant","name","size","View","Text","numberOfLines","email","ActivityIndicator","color","primary","MaterialCommunityIcons","textSecondary","hitSlop","top","right","Divider","border","spacing","ActionRow","icon","iconColor","label","Modal","visible","transparent","animationType","onRequestClose","nativeScrim","Dialog","control","title","description","actions","shadowColor","shadowOpacity","shadowRadius","shadowOffset","height","elevation","backgroundColor","_default","exports","default"],"sourceRoot":"../../../../src","sources":["ui/components/ProfileMenu.tsx"],"mappings":";;;;;;AACA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AASA,IAAAE,YAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AACA,IAAAK,MAAA,GAAAL,OAAA;AACA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA;AACA,IAAAQ,KAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AACA,IAAAW,kBAAA,GAAAX,OAAA;AAA+D,IAAAY,WAAA,GAAAZ,OAAA;AAE/D,MAAMa,KAAK,GAAGC,qBAAQ,CAACC,EAAE,KAAK,KAAK;;AAEnC;AACA,MAAMC,UAAU,GAAG,GAAG;;AAEtB;AACA;AACA;AACA;AACA;;AAuBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,WAAuC,GAAGA,CAAC;EAC7CC,IAAI;EACJC,OAAO;EACPC,MAAM;EACNC,gBAAgB;EAChBC,YAAY;EACZC,iBAAiB;EACjBC;AACJ,CAAC,KAAK;EACF,MAAM;IACFC,eAAe;IACfC,aAAa;IACbC,SAAS;IACTC;EACJ,CAAC,GAAG,IAAAC,kBAAM,EAAC,CAAC;EACZ,MAAM;IAAEC;EAAE,CAAC,GAAG,IAAAC,gBAAO,EAAC,CAAC;EACvB,MAAM;IAAEC;EAAO,CAAC,GAAG,IAAAC,eAAQ,EAAC,CAAC;EAE7B,MAAM;IAAEC;EAAS,CAAC,GAAG,IAAAC,oCAAiB,EAAC,CAAC;EAExC,MAAM,CAACC,aAAa,EAAEC,gBAAgB,CAAC,GAAG,IAAAC,eAAQ,EAAgB,IAAI,CAAC;EACvE,MAAM,CAACC,iBAAiB,EAAEC,oBAAoB,CAAC,GAAG,IAAAF,eAAQ,EAAgB,IAAI,CAAC;EAC/E,MAAM,CAACG,aAAa,EAAEC,gBAAgB,CAAC,GAAG,IAAAJ,eAAQ,EAAC,KAAK,CAAC;EAEzD,MAAMK,gBAAgB,GAAG,IAAAC,uBAAgB,EAAC,CAAC;EAE3C,MAAMC,WAAW,GAAGT,aAAa,KAAK,IAAI;EAC1C,MAAMU,cAAc,GAAGD,WAAW,IAAIN,iBAAiB,KAAK,IAAI,IAAIE,aAAa;;EAEjF;EACA,MAAMM,YAAY,GAAG,IAAAC,kBAAW,EAAC,MAAOC,SAAiB,IAAK;IAC1D,IAAIA,SAAS,KAAKxB,eAAe,IAAIW,aAAa,EAAE;MAChD;IACJ;IACAC,gBAAgB,CAACY,SAAS,CAAC;IAC3B,IAAI;MACA,MAAMzB,qBAAqB,GAAG,CAAC;MAC/B,MAAME,aAAa,CAACuB,SAAS,CAAC;MAC9BC,YAAK,CAACC,OAAO,CAACrB,CAAC,CAAC,sCAAsC,CAAC,IAAI,kBAAkB,CAAC;MAC9EX,OAAO,CAAC,CAAC;IACb,CAAC,CAAC,OAAOiC,KAAK,EAAE;MACZ,IAAI,CAAC,IAAAC,WAAK,EAAC,CAAC,EAAE;QACVC,YAAU,CAACC,IAAI,CAAC,uBAAuB,EAAE;UAAEC,SAAS,EAAE;QAAc,CAAC,EAAEJ,KAAgB,CAAC;MAC5F;MACAF,YAAK,CAACE,KAAK,CAACtB,CAAC,CAAC,qCAAqC,CAAC,IAAI,0BAA0B,CAAC;IACvF,CAAC,SAAS;MACNO,gBAAgB,CAAC,IAAI,CAAC;IAC1B;EACJ,CAAC,EAAE,CAACZ,eAAe,EAAEW,aAAa,EAAEV,aAAa,EAAEI,CAAC,EAAEX,OAAO,EAAEK,qBAAqB,CAAC,CAAC;;EAEtF;EACA;EACA,MAAMiC,YAAY,GAAG,IAAAT,kBAAW,EAAC,MAAOC,SAAiB,IAAK;IAC1D,IAAIA,SAAS,KAAKxB,eAAe,IAAIc,iBAAiB,EAAE;MACpD;IACJ;IACAC,oBAAoB,CAACS,SAAS,CAAC;IAC/B,IAAI;MACA,MAAMrB,aAAa,CAACqB,SAAS,CAAC;MAC9BC,YAAK,CAACC,OAAO,CAACrB,CAAC,CAAC,0BAA0B,CAAC,IAAI,YAAY,CAAC;IAChE,CAAC,CAAC,OAAOsB,KAAK,EAAE;MACZE,YAAU,CAACC,IAAI,CAAC,uBAAuB,EAAE;QAAEC,SAAS,EAAE;MAAc,CAAC,EAAEJ,KAAgB,CAAC;MACxFF,YAAK,CAACE,KAAK,CAACtB,CAAC,CAAC,6BAA6B,CAAC,IAAI,oBAAoB,CAAC;IACzE,CAAC,SAAS;MACNU,oBAAoB,CAAC,IAAI,CAAC;IAC9B;EACJ,CAAC,EAAE,CAACf,eAAe,EAAEc,iBAAiB,EAAEX,aAAa,EAAEE,CAAC,CAAC,CAAC;EAE1D,MAAM4B,iBAAiB,GAAG,IAAAV,kBAAW,EAAC,YAAY;IAC9C,IAAIP,aAAa,EAAE;MACf;IACJ;IACAC,gBAAgB,CAAC,IAAI,CAAC;IACtB,IAAI;MACA,MAAMlB,qBAAqB,GAAG,CAAC;MAC/B,MAAMG,SAAS,CAAC,CAAC;MACjBuB,YAAK,CAACC,OAAO,CAACrB,CAAC,CAAC,0CAA0C,CAAC,IAAI,4BAA4B,CAAC;MAC5FX,OAAO,CAAC,CAAC;IACb,CAAC,CAAC,OAAOiC,KAAK,EAAE;MACZE,YAAU,CAACC,IAAI,CAAC,qBAAqB,EAAE;QAAEC,SAAS,EAAE;MAAc,CAAC,EAAEJ,KAAgB,CAAC;MACtFF,YAAK,CAACE,KAAK,CAACtB,CAAC,CAAC,gCAAgC,CAAC,IAAI,oCAAoC,CAAC;IAC5F,CAAC,SAAS;MACNY,gBAAgB,CAAC,KAAK,CAAC;IAC3B;EACJ,CAAC,EAAE,CAACD,aAAa,EAAEd,SAAS,EAAEG,CAAC,EAAEX,OAAO,EAAEK,qBAAqB,CAAC,CAAC;;EAEjE;EACA,IAAAmC,gBAAS,EAAC,MAAM;IACZ,IAAI,CAACzC,IAAI,IAAI,CAACL,KAAK,IAAI,OAAO+C,QAAQ,KAAK,WAAW,EAAE;MACpD,OAAOC,SAAS;IACpB;IACA,MAAMC,KAAK,GAAIC,KAAoB,IAAK;MACpC,IAAIA,KAAK,CAACC,GAAG,KAAK,QAAQ,EAAE;QACxBD,KAAK,CAACE,eAAe,CAAC,CAAC;QACvB9C,OAAO,CAAC,CAAC;MACb;IACJ,CAAC;IACDyC,QAAQ,CAACM,gBAAgB,CAAC,SAAS,EAAEJ,KAAK,EAAE,IAAI,CAAC;IACjD,OAAO,MAAMF,QAAQ,CAACO,mBAAmB,CAAC,SAAS,EAAEL,KAAK,EAAE,IAAI,CAAC;EACrE,CAAC,EAAE,CAAC5C,IAAI,EAAEC,OAAO,CAAC,CAAC;EAEnB,IAAI,CAACD,IAAI,EAAE;IACP,OAAO,IAAI;EACf;;EAEA;EACA;EACA;EACA,MAAMkD,gBAAuC,GAAGvD,KAAK,GAC/C;IACEwD,QAAQ,EAAE,UAAU;IACpBC,KAAK,EAAEtD,UAAU;IACjBuD,IAAI,EAAEnD,MAAM,EAAEmD,IAAI,IAAI,CAAC;IACvBC,MAAM,EAAEpD,MAAM,EAAEoD,MAAM,IAAI;EAC9B,CAAC,GACCX,SAAS;EAEf,MAAMY,OAAO,gBACT,IAAA7D,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA0E;EACG;EACA;EAAA;IACAC,OAAO,EAAEA,CAAA,KAAMf,SAAU;IACzBgB,SAAS,EACLhE,KAAK,GACC,gEAAgE,GAChE,kDACT;IACDiE,KAAK,EAAE,CACHV,gBAAgB,EAChB,CAACvD,KAAK,GAAG;MAAEkE,SAAS,EAAE;IAAM,CAAC,GAAG;MAAEA,SAAS,EAAE;IAAM,CAAC,EACpDC,MAAM,CAACC,MAAM,CACf;IACFC,iBAAiB,EAAC,MAAM;IACxBC,kBAAkB,EAAErD,CAAC,CAAC,mBAAmB,CAAC,IAAI,cAAe;IAAAsD,QAAA,eAE7D,IAAAxE,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAAqF,UAAU;MACPT,SAAS,EAAC,QAAQ;MAClBU,yBAAyB,EAAC,MAAM;MAChCC,4BAA4B,EAAE,KAAM;MAAAJ,QAAA,GAGnClD,QAAQ,CAACuD,GAAG,CAAEC,OAAO,IAAK;QACvB,MAAMC,QAAQ,GAAGD,OAAO,CAACE,SAAS;QAClC,MAAMC,MAAM,GAAGzD,aAAa,KAAKsD,OAAO,CAACzC,SAAS;QAClD,MAAM6C,UAAU,GAAGvD,iBAAiB,KAAKmD,OAAO,CAACzC,SAAS;QAC1D,oBACI,IAAArC,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAA0E,SAAS;UAENO,iBAAiB,EAAC,UAAU;UAC5BC,kBAAkB,EAAEO,OAAO,CAACK,WAAY;UACxCC,kBAAkB,EAAE;YAAEC,QAAQ,EAAEN;UAAS,CAAE;UAC3Cf,OAAO,EAAEA,CAAA,KAAM7B,YAAY,CAAC2C,OAAO,CAACzC,SAAS,CAAE;UAC/CiD,QAAQ,EAAEP,QAAQ,IAAIE,MAAM,IAAIhD,WAAY;UAC5CgC,SAAS,EAAE,2CACPc,QAAQ,GAAG,cAAc,GAAG,EAAE,IAC9B9C,WAAW,IAAI,CAAC8C,QAAQ,GAAG,YAAY,GAAG,EAAE,EAAG;UAAAP,QAAA,gBAEnD,IAAAxE,WAAA,CAAA8D,GAAA,EAACvE,OAAA,CAAAgG,MAAM;YACHC,MAAM,EAAEV,OAAO,CAACW,IAAI,CAACC,MAAM,IAAIzC,SAAU;YACzC0C,GAAG,EAAEb,OAAO,CAACc,SAAU;YACvBC,OAAO,EAAC,OAAO;YACfC,IAAI,EAAEhB,OAAO,CAACK,WAAY;YAC1BY,IAAI,EAAEhB,QAAQ,GAAG,EAAE,GAAG;UAAG,CAC5B,CAAC,eACF,IAAA/E,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAA2G,IAAI;YAAC/B,SAAS,EAAC,gBAAgB;YAAAO,QAAA,gBAC5B,IAAAxE,WAAA,CAAA8D,GAAA,EAACtE,WAAA,CAAAyG,IAAI;cACDhC,SAAS,EAAE,mBAAmBc,QAAQ,GAAG,eAAe,GAAG,aAAa,EAAG;cAC3EmB,aAAa,EAAE,CAAE;cAAA1B,QAAA,EAEhBM,OAAO,CAACK;YAAW,CAClB,CAAC,EACNL,OAAO,CAACqB,KAAK,gBACV,IAAAnG,WAAA,CAAA8D,GAAA,EAACtE,WAAA,CAAAyG,IAAI;cACDhC,SAAS,EAAC,+BAA+B;cACzCiC,aAAa,EAAE,CAAE;cAAA1B,QAAA,EAEhBM,OAAO,CAACqB;YAAK,CACZ,CAAC,GACP,IAAI;UAAA,CACN,CAAC,EACNlB,MAAM,gBACH,IAAAjF,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA+G,iBAAiB;YAACC,KAAK,EAAEjF,MAAM,CAACkF,OAAQ;YAACP,IAAI,EAAC;UAAO,CAAE,CAAC,GACzDhB,QAAQ,gBACR,IAAA/E,WAAA,CAAA8D,GAAA,EAACxE,YAAA,CAAAiH,sBAAsB;YAACT,IAAI,EAAC,OAAO;YAACC,IAAI,EAAE,EAAG;YAACM,KAAK,EAAEjF,MAAM,CAACkF;UAAQ,CAAE,CAAC,GACxEpB,UAAU,gBACV,IAAAlF,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA+G,iBAAiB;YAACC,KAAK,EAAEjF,MAAM,CAACoF,aAAc;YAACT,IAAI,EAAC;UAAO,CAAE,CAAC,gBAE/D,IAAA/F,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA0E,SAAS;YACNO,iBAAiB,EAAC,QAAQ;YAC1BC,kBAAkB,EACdrD,CAAC,CAAC,4BAA4B,EAAE;cAAE4E,IAAI,EAAEhB,OAAO,CAACK;YAAY,CAAC,CAAC,IAC3D,YAAYL,OAAO,CAACK,WAAW,EACrC;YACDnB,OAAO,EAAEA,CAAA,KAAMnB,YAAY,CAACiC,OAAO,CAACzC,SAAS,CAAE;YAC/CiD,QAAQ,EAAEpD,cAAe;YACzBuE,OAAO,EAAE;cAAEC,GAAG,EAAE,CAAC;cAAE9C,MAAM,EAAE,CAAC;cAAED,IAAI,EAAE,CAAC;cAAEgD,KAAK,EAAE;YAAE,CAAE;YAClD1C,SAAS,EAAC,6DAA6D;YAAAO,QAAA,eAEvE,IAAAxE,WAAA,CAAA8D,GAAA,EAACxE,YAAA,CAAAiH,sBAAsB;cACnBT,IAAI,EAAC,QAAQ;cACbC,IAAI,EAAE,EAAG;cACTM,KAAK,EAAEjF,MAAM,CAACoF;YAAc,CAC/B;UAAC,CACK,CACd;QAAA,GAzDI,WAAW1B,OAAO,CAACzC,SAAS,EA0D1B,CAAC;MAEpB,CAAC,CAAC,EAGDJ,WAAW,gBACR,IAAAjC,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAA2G,IAAI;QAAC/B,SAAS,EAAC,iDAAiD;QAAAO,QAAA,gBAC7D,IAAAxE,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA+G,iBAAiB;UAACC,KAAK,EAAEjF,MAAM,CAACoF,aAAc;UAACT,IAAI,EAAC;QAAO,CAAE,CAAC,eAC/D,IAAA/F,WAAA,CAAA8D,GAAA,EAACtE,WAAA,CAAAyG,IAAI;UAAChC,SAAS,EAAC,2CAA2C;UAAAO,QAAA,EACtDtD,CAAC,CAAC,uBAAuB,CAAC,IAAI;QAAoB,CACjD,CAAC;MAAA,CACL,CAAC,GACP,IAAI,eAER,IAAAlB,WAAA,CAAA8D,GAAA,EAACnE,QAAA,CAAAiH,OAAO;QAACP,KAAK,EAAEjF,MAAM,CAACyF,MAAO;QAACC,OAAO,EAAE;MAAE,CAAE,CAAC,eAG7C,IAAA9G,WAAA,CAAA8D,GAAA,EAACiD,SAAS;QACNC,IAAI,EAAC,sBAAsB;QAC3BC,SAAS,EAAE7F,MAAM,CAAC4F,IAAK;QACvBE,KAAK,EAAEhG,CAAC,CAAC,wBAAwB,CAAC,IAAI,qBAAsB;QAC5DoE,QAAQ,EAAEpD,cAAe;QACzB8B,OAAO,EAAEA,CAAA,KAAM;UACXzD,OAAO,CAAC,CAAC;UACTG,YAAY,CAAC,CAAC;QAClB;MAAE,CACL,CAAC,eAGF,IAAAV,WAAA,CAAA8D,GAAA,EAACiD,SAAS;QACNC,IAAI,EAAC,aAAa;QAClBC,SAAS,EAAE7F,MAAM,CAAC4F,IAAK;QACvBE,KAAK,EAAEhG,CAAC,CAAC,oBAAoB,CAAC,IAAI,yBAA0B;QAC5DoE,QAAQ,EAAEpD,cAAe;QACzB8B,OAAO,EAAEA,CAAA,KAAM;UACXzD,OAAO,CAAC,CAAC;UACTE,gBAAgB,CAAC,CAAC;QACtB;MAAE,CACL,CAAC,EAGDE,iBAAiB,gBACd,IAAAX,WAAA,CAAA8D,GAAA,EAACiD,SAAS;QACNC,IAAI,EAAC,iBAAiB;QACtBC,SAAS,EAAE7F,MAAM,CAAC4F,IAAK;QACvBE,KAAK,EAAEhG,CAAC,CAAC,yBAAyB,CAAC,IAAI,cAAe;QACtDoE,QAAQ,EAAEpD,cAAe;QACzB8B,OAAO,EAAEA,CAAA,KAAM;UACXzD,OAAO,CAAC,CAAC;UACTI,iBAAiB,CAAC,CAAC;QACvB;MAAE,CACL,CAAC,GACF,IAAI,eAGR,IAAAX,WAAA,CAAA8D,GAAA,EAACnE,QAAA,CAAAiH,OAAO;QAACP,KAAK,EAAEjF,MAAM,CAACyF,MAAO;QAACC,OAAO,EAAE;MAAE,CAAE,CAAC,eAC7C,IAAA9G,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAA0E,SAAS;QACNO,iBAAiB,EAAC,UAAU;QAC5BC,kBAAkB,EAAErD,CAAC,CAAC,wBAAwB,CAAC,IAAI,0BAA2B;QAC9E8C,OAAO,EAAEA,CAAA,KAAMjC,gBAAgB,CAACzB,IAAI,CAAC,CAAE;QACvCgF,QAAQ,EAAEpD,cAAe;QACzB+B,SAAS,EAAE,yCAAyC/B,cAAc,GAAG,YAAY,GAAG,EAAE,EAAG;QAAAsC,QAAA,GAExF3C,aAAa,gBACV,IAAA7B,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA+G,iBAAiB;UAACC,KAAK,EAAEjF,MAAM,CAACoB,KAAM;UAACuD,IAAI,EAAC;QAAO,CAAE,CAAC,gBAEvD,IAAA/F,WAAA,CAAA8D,GAAA,EAACxE,YAAA,CAAAiH,sBAAsB;UAACT,IAAI,EAAC,QAAQ;UAACC,IAAI,EAAE,EAAG;UAACM,KAAK,EAAEjF,MAAM,CAACoB;QAAM,CAAE,CACzE,eACD,IAAAxC,WAAA,CAAA8D,GAAA,EAACtE,WAAA,CAAAyG,IAAI;UAAChC,SAAS,EAAC,aAAa;UAACC,KAAK,EAAE;YAAEmC,KAAK,EAAEjF,MAAM,CAACoB;UAAM,CAAE;UAAAgC,QAAA,EACxDtD,CAAC,CAAC,wBAAwB,CAAC,IAAI;QAA0B,CACxD,CAAC;MAAA,CACA,CAAC;IAAA,CACJ;EAAC,CACN,CACd;EAED,oBACI,IAAAlB,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAA8H,KAAK;IACFC,OAAO,EAAE9G,IAAK;IACd+G,WAAW;IACXC,aAAa,EAAErH,KAAK,GAAG,MAAM,GAAG,OAAQ;IACxCsH,cAAc,EAAEhH,OAAQ;IAAAiE,QAAA,gBAExB,IAAAxE,WAAA,CAAA8D,GAAA,EAACzE,YAAA,CAAA0E,SAAS;MACNO,iBAAiB,EAAC,QAAQ;MAC1BC,kBAAkB,EAAErD,CAAC,CAAC,sBAAsB,CAAC,IAAI,OAAQ;MACzD8C,OAAO,EAAEzD,OAAQ;MACjB0D,SAAS,EAAEhE,KAAK,GAAG,iBAAiB,GAAG,oBAAqB;MAC5DiE,KAAK,EAAE,CAACjE,KAAK,GAAGmE,MAAM,CAACoD,WAAW,GAAGvE,SAAU;MAAAuB,QAAA,EAE9CX;IAAO,CACD,CAAC,eAEZ,IAAA7D,WAAA,CAAA8D,GAAA,EAACpE,MAAA,CAAA+H,MAAM;MACHC,OAAO,EAAE3F,gBAAiB;MAC1B4F,KAAK,EAAEzG,CAAC,CAAC,wBAAwB,CAAC,IAAI,0BAA2B;MACjE0G,WAAW,EAAE1G,CAAC,CAAC,4BAA4B,CAAC,IAAI,oDAAqD;MACrG2G,OAAO,EAAE,CACL;QACIX,KAAK,EAAEhG,CAAC,CAAC,wBAAwB,CAAC,IAAI,0BAA0B;QAChEmF,KAAK,EAAE,aAAa;QACpBrC,OAAO,EAAElB;MACb,CAAC,EACD;QAAEoE,KAAK,EAAEhG,CAAC,CAAC,eAAe,CAAC,IAAI,QAAQ;QAAEmF,KAAK,EAAE;MAAS,CAAC;IAC5D,CACL,CAAC;EAAA,CACC,CAAC;AAEhB,CAAC;;AAED;AACA,MAAMU,SAMJ,GAAGA,CAAC;EAAEC,IAAI;EAAEC,SAAS;EAAEC,KAAK;EAAE5B,QAAQ;EAAEtB;AAAQ,CAAC,kBAC/C,IAAAhE,WAAA,CAAAyE,IAAA,EAACpF,YAAA,CAAA0E,SAAS;EACNO,iBAAiB,EAAC,UAAU;EAC5BC,kBAAkB,EAAE2C,KAAM;EAC1BlD,OAAO,EAAEA,OAAQ;EACjBsB,QAAQ,EAAEA,QAAS;EACnBrB,SAAS,EAAE,yCAAyCqB,QAAQ,GAAG,YAAY,GAAG,EAAE,EAAG;EAAAd,QAAA,gBAEnF,IAAAxE,WAAA,CAAA8D,GAAA,EAACxE,YAAA,CAAAiH,sBAAsB;IAACT,IAAI,EAAEkB,IAAK;IAACjB,IAAI,EAAE,EAAG;IAACM,KAAK,EAAEY;EAAU,CAAE,CAAC,eAClE,IAAAjH,WAAA,CAAA8D,GAAA,EAACtE,WAAA,CAAAyG,IAAI;IAAChC,SAAS,EAAC,6BAA6B;IAAAO,QAAA,EAAE0C;EAAK,CAAO,CAAC;AAAA,CACrD,CACd;;AAED;AACA;AACA;AACA,MAAM9C,MAAM,GAAG;EACXC,MAAM,EAAE;IACJyD,WAAW,EAAE,MAAM;IACnBC,aAAa,EAAE,IAAI;IACnBC,YAAY,EAAE,EAAE;IAChBC,YAAY,EAAE;MAAEvE,KAAK,EAAE,CAAC;MAAEwE,MAAM,EAAE;IAAE,CAAC;IACrCC,SAAS,EAAE;EACf,CAAqB;EACrBX,WAAW,EAAE;IACTY,eAAe,EAAE;EACrB;AACJ,CAAC;AAAC,IAAAC,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAEalI,WAAW","ignoreList":[]}

package/lib/commonjs/ui/context/OxyContext.js

@@ -1106,15 +1106,40 @@ const OxyProvider = ({
     // run cookie-restore BEFORE those probes (and disable the later duplicate).
     //
     // Read ONCE here (synchronously usable by the step `enabled` gates below).
-    // It is non-null ONLY on first-party `*.oxy.so` web apps that persist the
-    // slot — a cross-apex RP never writes it (its restore funnels through
-    // `handleWebSSOSession`, which does not touch the authuser), and native has
-    // no localStorage, so both keep their existing order untouched. The
-    // earlier `stored-session` step still runs first (FIX-A latency), and when
-    // a slot exists but its cookies have all lapsed, cookie-restore simply
-    // returns no accounts and the chain falls through to the cross-domain
-    // fallbacks exactly as before.
+    // It is non-null ONLY on first-party web apps that persist the slot. Both the
+    // device sign-in/switch paths AND `handleWebSSOSession` (FedCM/SSO/credentials
+    // commit funnel) now persist it — but only when the session genuinely joined
+    // the device set: `establishDeviceRefreshSlot` returns an `authuser` ONLY on
+    // first-party web (same registrable apex as the API), so a cross-apex RP never
+    // writes a phantom slot and native has no localStorage. Both therefore keep
+    // their existing order untouched. The earlier `stored-session` step still runs
+    // first (FIX-A latency), and when a slot exists but its cookies have all
+    // lapsed, cookie-restore simply returns no accounts and the chain falls through
+    // to the cross-domain fallbacks exactly as before.
     const prioritizeMultiAccount = (0, _useWebSSO.isWebBrowser)() && (0, _activeAuthuser.readActiveAuthuser)() !== null;
+
+    // DELIBERATELY-SIGNED-OUT gate (web): when the user pressed "Sign out", any
+    // credential that can silently re-mint a session may still be live on the
+    // next reload — the central IdP session (FedCM credential association /
+    // per-apex `fedcm_session` cookie) AND the device refresh cookies. Since
+    // PR #455 the PRIMARY web session also joins the `oxy_rt_<authuser>` device
+    // set, so the un-gated cookie-restore steps would `refresh-all` that still-
+    // present cookie and sign the user back in without intent — exactly the
+    // "sign-out is silently undone" regression. So this flag gates EVERY
+    // AUTOMATIC silent-restore cold-boot step: `stored-session`,
+    // `cookie-restore-active`, `fedcm-silent`, `silent-iframe`, and
+    // `cookie-restore`. The gate — not a cookie wipe — is the authority: the
+    // account may stay "known" for a fast deliberate re-sign-in, but no step
+    // restores it silently while the flag is set. Read the durable flag ONCE here
+    // (synchronously usable by every step `enabled` gate). Any deliberate sign-in
+    // (password, FedCM, account switch, device claim) clears it, so there is no
+    // "stuck signed out" state. The `sso-bounce` step needs no extra gate: it is
+    // already self-suppressed after sign-out (its `hasPriorSession` hint is
+    // cleared). `sso-return` is NOT gated — it commits the result of a deliberate
+    // top-level `/sso` bounce the user just initiated. `shared-key-signin` is
+    // native-only and the flag never sets on native (`markSignedOut` no-ops
+    // off-web), so its gate would be moot; it is left untouched.
+    const silentRestoreBlocked = (0, _activeAuthuser.isSilentRestoreSuppressed)();
     try {
       const outcome = await (0, _core.runColdBoot)({
         steps: [{
@@ -1135,12 +1160,17 @@ const OxyProvider = ({
             };
           }
         }, {
-          // 2) Stored-session bearer restore. NO `enabled` gate — runs on ALL
-          // platforms. This is native's ONLY restore path (every web-only step
-          // is disabled off-browser, so native reaches exactly this) AND the
-          // common WEB reload winner.
+          // 2) Stored-session bearer restore. Runs on ALL platforms EXCEPT when
+          // the deliberately-signed-out flag is set (web only — it never sets on
+          // native, so native still always reaches exactly this step, its ONLY
+          // restore path). This is also the common WEB reload winner.
+          //
+          // SIGNED-OUT GATE: after a deliberate full sign-out the stored session
+          // state is cleared, so this would normally skip anyway — but the gate
+          // makes that authoritative rather than incidental, so no residual
+          // stored token can silently restore while the user is signed out.
           //
-          // ORDERING (FIX A): this step now runs BEFORE the slow web-only
+          // ORDERING (FIX A): this step runs BEFORE the slow web-only
           // probes (`fedcm-silent`, `silent-iframe`, `cookie-restore`). On a
           // normal reload the local bearer validates in one round-trip and
           // wins; `runColdBoot` then short-circuits and never even evaluates
@@ -1151,6 +1181,7 @@ const OxyProvider = ({
           // local session this step skips and the cross-domain fallback chain
           // (fedcm → iframe → cookie → sso-bounce) runs exactly as before.
           id: 'stored-session',
+          enabled: () => !silentRestoreBlocked,
           run: async () => {
             const restored = await restoreStoredSession();
             if (restored) {
@@ -1234,8 +1265,14 @@ const OxyProvider = ({
           // When no slot is persisted this is disabled and the original order is
           // unchanged; when the slot's cookies have lapsed it returns no accounts
           // and the chain falls through to the cross-domain fallbacks below.
+          //
+          // SIGNED-OUT GATE: since PR #455 the primary's `oxy_rt` slot survives a
+          // deliberate sign-out, so without this gate `refresh-all` would re-mint
+          // and silently re-log-in the user on reload. The flag is cleared by any
+          // deliberate sign-in (including an account SWITCH, which also writes the
+          // new active slot), so the switch-survives-reload path is unaffected.
           id: 'cookie-restore-active',
-          enabled: () => prioritizeMultiAccount,
+          enabled: () => prioritizeMultiAccount && !silentRestoreBlocked,
           run: async () => {
             const restored = await restoreViaRefreshCookie();
             return restored ? {
@@ -1257,7 +1294,7 @@ const OxyProvider = ({
           // already recovered a local session — the probe cannot improve on a
           // valid local bearer, and skipping it avoids the silent round-trip.
           id: 'fedcm-silent',
-          enabled: () => !storedSessionRestored && fedcmSupported && !servicesSilentAttempted.has(silentKey),
+          enabled: () => !storedSessionRestored && !silentRestoreBlocked && fedcmSupported && !servicesSilentAttempted.has(silentKey),
           run: async () => {
             servicesSilentAttempted.add(silentKey);
             const session = await oxyServices.silentSignInWithFedCM?.();
@@ -1296,7 +1333,7 @@ const OxyProvider = ({
           // FIX-D: bounded by `SILENT_IFRAME_TIMEOUT` (plus `iframe.onerror`
           // fail-fast in core) so a no-message iframe cannot stall cold boot.
           id: 'silent-iframe',
-          enabled: () => !storedSessionRestored && (0, _useWebSSO.isWebBrowser)(),
+          enabled: () => !storedSessionRestored && !silentRestoreBlocked && (0, _useWebSSO.isWebBrowser)(),
           run: async () => {
             if (!commitWebSession) {
               return {
@@ -1335,8 +1372,13 @@ const OxyProvider = ({
           // would be a redundant second `refreshAllSessions`. It still runs in the
           // common no-persisted-slot case (e.g. first visit to a first-party app
           // whose central refresh cookies already exist).
+          //
+          // SIGNED-OUT GATE (same rationale as `cookie-restore-active`): the
+          // primary's `oxy_rt` slot survives a deliberate sign-out (PR #455), so
+          // this must be skipped while the signed-out flag is set or it would
+          // silently re-restore the primary on reload.
           id: 'cookie-restore',
-          enabled: () => (0, _useWebSSO.isWebBrowser)() && !prioritizeMultiAccount,
+          enabled: () => (0, _useWebSSO.isWebBrowser)() && !prioritizeMultiAccount && !silentRestoreBlocked,
           run: async () => {
             const restored = await restoreViaRefreshCookie();
             return restored ? {
@@ -1576,13 +1618,48 @@ const OxyProvider = ({
       throw new Error('Session response did not include an access token');
     }
     oxyServices.httpService.setTokens(session.accessToken);
+
+    // A committed web session re-enables automatic silent restore: clear the
+    // durable "deliberately signed out" flag. This funnel is reached by deliberate
+    // sign-ins (password, interactive FedCM, `/sso` return) AND by the silent
+    // cold-boot steps — but those are GATED on the flag, so when it is set they
+    // never run and never reach here; clearing is therefore only hit on a genuine
+    // (re-)sign-in or when restore was already permitted, both correct.
+    (0, _activeAuthuser.clearSignedOut)();
+
+    // Register this primary session in the device's first-party multi-account
+    // refresh-cookie set (web only). Every web primary-session restore funnels
+    // through here — FedCM silent (`/fedcm/exchange`), per-apex `/auth/silent`
+    // iframe, central `/sso` return, and keyless password sign-in. Of those, only
+    // a same-apex `/fedcm/exchange` plants an `oxy_rt_<authuser>` slot as a side
+    // effect; the cross-origin/credential-less restores (`/sso/exchange`,
+    // `/auth/silent` postMessage) cannot set an `api.oxy.so` cookie at all. So
+    // WITHOUT this call a web primary never joins the device set: `refresh-all`
+    // returns zero accounts, and account-switch persistence + the
+    // `cookie-restore-active` cold-boot step have no foundation. Calling the shared
+    // `POST /auth/session` primitive here makes EVERY primary participate in the
+    // set, re-plants the rotated token, and records the active `authuser` so the
+    // next cold boot's `cookie-restore-active` reconciles the persisted active
+    // (possibly switched) account instead of `fedcm-silent` clobbering it back to
+    // the primary. Best-effort: a `null` result (native / transient failure)
+    // leaves the in-session token untouched.
+    const primaryAuthuser = await oxyServices.establishDeviceRefreshSlot();
+    // A non-null slot is returned ONLY on first-party web (the helper gates on
+    // platform + same registrable apex), so recording the active slot here is safe
+    // and never writes a phantom authuser for a cross-apex RP or native.
+    if (typeof primaryAuthuser === 'number') {
+      (0, _activeAuthuser.writeActiveAuthuser)(primaryAuthuser);
+    }
     const clientSession = {
       sessionId: session.sessionId,
       deviceId: session.deviceId || '',
       expiresAt: session.expiresAt || new Date(Date.now() + DEFAULT_SESSION_VALIDITY_MS).toISOString(),
       lastActive: new Date().toISOString(),
       userId: session.user.id?.toString() ?? '',
-      isCurrent: true
+      isCurrent: true,
+      ...(typeof primaryAuthuser === 'number' ? {
+        authuser: primaryAuthuser
+      } : null)
     };
     updateSessions([clientSession], {
       merge: true
@@ -1862,6 +1939,10 @@ const OxyProvider = ({
       throw new Error('Account switch did not return a valid session');
     }
 
+    // A switch is a deliberate sign-in into an account: re-enable automatic silent
+    // restore by clearing any prior "deliberately signed out" flag.
+    (0, _activeAuthuser.clearSignedOut)();
+
     // `oxyServices.switchToAccount` already planted `result.accessToken` as the
     // active token; mirror the minted session into the multi-account store and
     // mark it current, recording the device `authuser` slot so web silent-switch