@oxyhq/services 19.1.1 → 19.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "19.1.1",
+  "version": "19.1.3",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -118,11 +118,11 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "0.13.1",
+    "@oxyhq/contracts": "0.13.2",
     "color": "^4.2.3"
   },
   "devDependencies": {
-    "@oxyhq/core": "9.2.0",
+    "@oxyhq/core": "9.2.3",
     "nativewind": "5.0.0-preview.3",
     "react-native-css": "^3.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
@@ -147,16 +147,16 @@
     "@types/color": "^4.2.1",
     "@types/jest": "^29.5.14",
     "@types/node": "^20.19.9",
-    "expo-file-system": "~56.0.7",
-    "expo-font": "~56.0.5",
-    "expo-haptics": "~56.0.3",
-    "expo-image": "~56.0.8",
-    "expo-linear-gradient": "~56.0.4",
+    "expo-file-system": "~57.0.0",
+    "expo-font": "~57.0.0",
+    "expo-haptics": "~57.0.0",
+    "expo-image": "~57.0.0",
+    "expo-linear-gradient": "~57.0.0",
     "husky": "^4.3.8",
     "jest": "~29.7.0",
     "lint-staged": "^15.2.4",
     "react-native-builder-bob": "^0.43.0",
-    "react-native-gesture-handler": "~2.31.2",
+    "react-native-gesture-handler": "~2.32.0",
     "react-native-reanimated": "4.5.0",
     "react-native-safe-area-context": "~5.8.0",
     "react-native-svg": "15.15.5",
@@ -166,7 +166,7 @@
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxyhq/bloom": ">=0.16.0",
-    "@oxyhq/core": "^9.2.0",
+    "@oxyhq/core": "^9.2.3",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",
@@ -176,16 +176,16 @@
     "@types/react": "*",
     "@types/react-native": "*",
     "expo": ">=56.0.0",
-    "expo-document-picker": "~56.0.4",
-    "expo-file-system": "~56.0.7",
+    "expo-document-picker": ">=56.0.0",
+    "expo-file-system": ">=56.0.0",
     "expo-font": ">=13.0.0",
-    "expo-haptics": "~56.0.3",
+    "expo-haptics": ">=56.0.0",
     "expo-image": ">=2.0.0",
-    "expo-image-manipulator": "~56.0.3",
-    "expo-linear-gradient": "~56.0.4",
+    "expo-image-manipulator": ">=56.0.0",
+    "expo-linear-gradient": ">=56.0.0",
     "react": ">=18.0.0",
     "react-native": ">=0.85.0",
-    "react-native-gesture-handler": "~2.31.2",
+    "react-native-gesture-handler": "~2.32.0",
     "react-native-keyboard-controller": ">=1.21.0",
     "react-native-qrcode-svg": "^6.3.0",
     "react-native-reanimated": ">=4.3.0",

package/src/index.ts

@@ -172,6 +172,7 @@ export {
 export { useMutationStatus } from './ui/hooks/useMutationStatus';
 export type { MutationStatus } from './ui/hooks/useMutationStatus';
 export { useOnlineStatus } from './ui/hooks/useOnlineStatus';
+export { useOxyEvent } from './ui/hooks/useOxyEvent';
 
 // ---------------------------------------------------------------------------
 // Error handlers

package/src/ui/boot/runProviderColdBoot.ts

@@ -10,7 +10,7 @@ import {
   consumeSilentOAuthError,
   maybeStartSilentOAuthRestore,
 } from '../utils/crossOriginRestore';
-import { tryCompleteOAuthReturn } from '../utils/oauthReturn';
+import { tryCompleteOAuthReturn, consumeHubSyncFailure } from '../utils/oauthReturn';
 import { isWebBrowser } from '../utils/isWebBrowser';
 import type { CommitInput } from '../context/oxyContextTypes';
 
@@ -57,6 +57,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
 
   try {
     consumeSilentOAuthError();
+    consumeHubSyncFailure();
 
     const oauthCompleted = await tryCompleteOAuthReturn({
       oxyServices,
@@ -75,6 +76,9 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       store: authStore,
       platform: { isWeb: isWebBrowser(), isNative: !isWebBrowser() },
       onSession: async (session) => {
+        // Mint already persisted `{deviceId, deviceSecret}` to the store; sync the
+        // in-memory SessionClient host so sockets + tab-focus re-mint can use it.
+        await syncDeviceCredentialToHost();
         const handoff = commitSession(
           {
             sessionId: session.sessionId,

package/src/ui/components/OxyOAuthCallback.tsx

@@ -14,7 +14,7 @@ export interface OxyOAuthCallbackProps {
  * callback path for a Clerk-style loading shell while auth resolves.
  */
 export function OxyOAuthCallback({ redirectTo = '/' }: OxyOAuthCallbackProps) {
-  const { isAuthResolved, isAuthenticated } = useAuth();
+  const { isAuthResolved } = useAuth();
 
   useEffect(() => {
     if (!isAuthResolved) return;
@@ -24,11 +24,11 @@ export function OxyOAuthCallback({ redirectTo = '/' }: OxyOAuthCallbackProps) {
     const params = new URLSearchParams(location.search);
     if (!params.has('code') && !params.has('error')) return;
 
-    const target = isAuthenticated ? redirectTo : redirectTo;
+    const target = redirectTo;
     if (location.pathname + location.search !== target) {
       window.location.replace(target);
     }
-  }, [isAuthResolved, isAuthenticated, redirectTo]);
+  }, [isAuthResolved, redirectTo]);
 
   return (
     <View style={{ flex: 1, alignItems: 'center', justifyContent: 'center' }}>

package/src/ui/context/OxyContext.tsx

@@ -23,7 +23,6 @@ import {
   installAuthRefreshHandler,
   startTokenRefreshScheduler,
   createAccountDialogController,
-  refreshPersistedSession,
   logger as loggerUtil,
   syncHubAfterSignIn,
 } from '@oxyhq/core';
@@ -64,6 +63,7 @@ import {
   type CommitInput,
 } from './oxyContextTypes';
 import { DEFAULT_SESSION_VALIDITY_MS, loadUseFollowHook } from './oxyContextHelpers';
+import { commitDeviceSetAndResolve } from './commitSessionFlow';
 import { useOxyAccountGraph } from './useOxyAccountGraph';
 
 export type { OxyContextState, PasswordSignInResult, OxyContextProviderProps } from './oxyContextTypes';
@@ -281,9 +281,16 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   if (!sessionClientPairRef.current) {
     sessionClientPairRef.current = createSessionClient(
       oxyServices,
-      authStore,
-      () => {
-        clearPersistedAuthSafe(authStore, logger);
+      (origin) => {
+        // Erase the DURABLE device credential only on a `request`-origin verdict
+        // (a REST sign-out / revocation). A `push`-origin empty state is a socket
+        // broadcast that may be a transient reconnect artifact — clearing the
+        // credential on it would strand the user signed out with no way back, so
+        // we clear only the local UI session and keep the credential (a dead one
+        // re-mints to `no_active_session` and resolves signed-out on next boot).
+        if (origin === 'request') {
+          clearPersistedAuthSafe(authStore, logger);
+        }
         void clearSessionStateRef.current().catch((clearError) => {
           logger('Failed to clear local state on remote sign-out', clearError);
         });
@@ -301,8 +308,12 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       return;
     }
     if (state.accounts.length === 0) {
+      // Clear the LOCAL UI session on any applied empty state, but NEVER the
+      // durable device credential here: `syncFromClient` runs for socket-pushed
+      // (possibly transient) states too, and wiping the credential on one would
+      // strand the user signed out. The credential wipe is gated on a
+      // `request`-origin verdict in `onUnauthenticated` above.
       sessionClientHost.setCurrentAccountId(null);
-      clearPersistedAuthSafe(authStore, logger);
       await clearSessionState();
       return;
     }
@@ -333,7 +344,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     oxyServices,
     sessionClient,
     sessionClientHost,
-    authStore,
     updateSessions,
     setActiveSessionId,
     loginSuccess,
@@ -526,47 +536,27 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         setActiveSessionId(input.sessionId);
       }
 
-      // Register into the device set. A deliberate sign-in ACTIVATES the account
-      // (`registerAndActivate`); the cold boot only ensures membership and lets
-      // the server's own `activeAccountId` win (`addCurrentAccount`). Both then
-      // start the socket + project. Best-effort — a failure never fails the
-      // sign-in (cold boot re-registers on the next load).
-      try {
-        if (options.activate) {
-          await sessionClient.registerAndActivate(input.userId);
-        } else {
-          await sessionClient.addCurrentAccount();
-        }
-        await sessionClient.start();
-        await syncFromClient();
-      } catch (registrationError) {
-        loggerUtil.warn(
-          'commitSession: device-set registration failed',
-          { component: 'OxyContext', method: 'commitSession' },
-          registrationError as unknown,
-        );
-      }
-
-      // Hydrate the full user (the commit input carries only minimal data). Fall
-      // back to the minimal shape if the profile fetch fails.
-      let fullUser: User | null = null;
-      try {
-        fullUser = await oxyServices.getCurrentUser();
-      } catch (profileError) {
-        if (__DEV__) {
-          loggerUtil.debug(
-            'Failed to fetch full user on commit; using minimal fallback',
-            { component: 'OxyContext', method: 'commitSession' },
-            profileError as unknown,
-          );
-        }
-        fullUser = (input.user as unknown as User) ?? null;
-      }
-      if (fullUser) {
-        loginSuccess(fullUser);
-        onAuthStateChangeRef.current?.(fullUser);
-      }
-      markAuthResolvedRef.current();
+      // Register into the device set, hydrate the full user, and flip the
+      // auth-resolution gate. A deliberate sign-in ACTIVATES the account and
+      // BLOCKS on the reconcile (register + socket + sessions projection) before
+      // resolving — unchanged ordering. The cold boot resolves auth from the
+      // profile fetch FIRST and reconciles the device set in the background, so
+      // first paint is not held behind those extra round-trips. Reconcile is
+      // best-effort — a failure never fails the sign-in (cold boot re-registers
+      // on the next load).
+      await commitDeviceSetAndResolve({
+        activate: options.activate,
+        userId: input.userId,
+        fallbackUser: (input.user as unknown as User) ?? null,
+        registerAndActivate: (userId) => sessionClient.registerAndActivate(userId),
+        addCurrentAccount: () => sessionClient.addCurrentAccount(),
+        startSocket: () => sessionClient.start(),
+        syncFromClient,
+        getCurrentUser: () => oxyServices.getCurrentUser(),
+        loginSuccess,
+        onAuthStateChange: onAuthStateChangeRef.current,
+        markAuthResolved: markAuthResolvedRef.current,
+      });
 
       if (options.activate && options.hubSync && hubSync && isWebBrowser()) {
         try {
@@ -598,9 +588,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         {
           sessionId: session.sessionId,
           accessToken: session.accessToken,
-          // deviceFlow threads the rotating deviceSecret on the runtime object
-          // even though `SessionLoginResponse` does not type it.
-          deviceSecret: (session as { deviceSecret?: string }).deviceSecret,
+          deviceSecret: session.deviceSecret,
           deviceId: session.deviceId,
           expiresAt: session.expiresAt,
           userId: session.user.id,
@@ -638,6 +626,12 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         }
         void Linking.openURL(url);
       },
+      // Native-only probe so the controller can detect an installed Commons and
+      // deep-link straight into its approve screen (keeping the QR/polling live
+      // as fallback). `undefined` on web mirrors the `openUrl` split — the
+      // controller short-circuits, so `redirectToAuthorize` never runs for the
+      // `oxycommons://` payload.
+      canOpenApp: isWebBrowser() ? undefined : (url) => Linking.canOpenURL(url),
     });
   }
   const accountDialogController = accountDialogControllerRef.current;
@@ -784,7 +778,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       if (document.visibilityState !== 'visible') return;
       const reconcile = async (): Promise<void> => {
         if (!oxyServices.getAccessToken() && sessionClientHost.getDeviceCredential()) {
-          await refreshPersistedSession({ oxy: oxyServices, store: authStore });
+          // Route through the ONE shared single-flight the scheduler/preflight/401
+          // use — never a private mint lane — so a tab-focus reconcile can't
+          // double-rotate the device secret against them.
+          await oxyServices.httpService.refreshAccessToken('preflight');
         }
         if (!oxyServices.getAccessToken() && !sessionClientHost.getDeviceCredential()) {
           return;
@@ -796,7 +793,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     };
     document.addEventListener('visibilitychange', onVisibility);
     return () => document.removeEventListener('visibilitychange', onVisibility);
-  }, [oxyServices, sessionClient, sessionClientHost, authStore, syncFromClient]);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
@@ -900,6 +897,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       storageKeyPrefix,
       clientId,
       oxyServices,
+      sessionClient,
       useFollow: useFollowHook,
       showBottomSheet: showBottomSheetForContext,
       openAvatarPicker,
@@ -949,6 +947,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       storageKeyPrefix,
       clientId,
       oxyServices,
+      sessionClient,
       useFollowHook,
       showBottomSheetForContext,
       openAvatarPicker,
@@ -1018,6 +1017,7 @@ const LOADING_STATE: OxyContextState = {
   storageKeyPrefix: 'oxy_session',
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
+  sessionClient: null,
   openAvatarPicker: () => {},
   accountDialogController: null,
   isAccountDialogOpen: false,

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -0,0 +1,192 @@
+import type { User } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
+import {
+  commitDeviceSetAndResolve,
+  type CommitDeviceSetAndResolveDeps,
+} from '../commitSessionFlow';
+
+// A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
+// entirely within the microtask queue, which is fully drained before a macrotask
+// (`setTimeout`) runs — so one tick flushes a detached reconcile task.
+const flush = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
+
+const makeUser = (id: string): User => ({ id, username: id } as unknown as User);
+
+interface Deferred<T> {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (reason?: unknown) => void;
+}
+
+const deferred = <T,>(): Deferred<T> => {
+  let resolve: (value: T) => void = () => undefined;
+  let reject: (reason?: unknown) => void = () => undefined;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+};
+
+/**
+ * Build a deps object whose every step appends to a shared `order` log, so tests
+ * can assert both WHICH steps ran and the RELATIVE ordering between the
+ * auth-resolution gate and the device-set reconcile.
+ */
+const buildDeps = (
+  order: string[],
+  overrides: Partial<CommitDeviceSetAndResolveDeps> = {},
+): CommitDeviceSetAndResolveDeps => ({
+  activate: false,
+  userId: 'u1',
+  fallbackUser: makeUser('fallback'),
+  registerAndActivate: jest.fn(async () => {
+    order.push('registerAndActivate');
+  }),
+  addCurrentAccount: jest.fn(async () => {
+    order.push('addCurrentAccount');
+  }),
+  startSocket: jest.fn(async () => {
+    order.push('startSocket');
+  }),
+  syncFromClient: jest.fn(async () => {
+    order.push('syncFromClient');
+  }),
+  getCurrentUser: jest.fn(async () => {
+    order.push('getCurrentUser');
+    return makeUser('u1');
+  }),
+  loginSuccess: jest.fn(() => {
+    order.push('loginSuccess');
+  }),
+  onAuthStateChange: jest.fn(() => {
+    order.push('onAuthStateChange');
+  }),
+  markAuthResolved: jest.fn(() => {
+    order.push('markAuthResolved');
+  }),
+  ...overrides,
+});
+
+describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
+  it('resolves auth from getCurrentUser BEFORE the device-set reconcile', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order);
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    // loginSuccess + onAuthStateChange + markAuthResolved fire after getCurrentUser.
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.onAuthStateChange).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+
+    expect(order.indexOf('getCurrentUser')).toBeLessThan(order.indexOf('loginSuccess'));
+    expect(order.indexOf('loginSuccess')).toBeLessThan(order.indexOf('markAuthResolved'));
+
+    // The reconcile ran (via addCurrentAccount, NOT registerAndActivate) but only
+    // AFTER the auth gate flipped — proving it did not block the resolve.
+    expect(deps.addCurrentAccount).toHaveBeenCalledTimes(1);
+    expect(deps.registerAndActivate).not.toHaveBeenCalled();
+    expect(order.indexOf('markAuthResolved')).toBeLessThan(order.indexOf('addCurrentAccount'));
+    expect(order.indexOf('addCurrentAccount')).toBeLessThan(order.indexOf('startSocket'));
+    expect(order.indexOf('startSocket')).toBeLessThan(order.indexOf('syncFromClient'));
+  });
+
+  it('still resolves auth even when the device-set reconcile hangs forever', async () => {
+    const order: string[] = [];
+    const hang = deferred<void>(); // addCurrentAccount never settles
+    const deps = buildDeps(order, {
+      addCurrentAccount: jest.fn(() => {
+        order.push('addCurrentAccount');
+        return hang.promise;
+      }),
+    });
+
+    // Must resolve without waiting on the hung reconcile.
+    await commitDeviceSetAndResolve(deps);
+
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('u1'));
+    expect(deps.addCurrentAccount).toHaveBeenCalledTimes(1);
+    // The hung step gates the rest of the chain — never reached.
+    expect(deps.startSocket).not.toHaveBeenCalled();
+    expect(deps.syncFromClient).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the minimal commit-input user when the profile fetch fails', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order, {
+      getCurrentUser: jest.fn(async () => {
+        throw new Error('offline');
+      }),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('fallback'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+  });
+
+  it('logs (never swallows) a failing background reconcile and still resolves', async () => {
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    const order: string[] = [];
+    const failure = new Error('device-set boom');
+    const deps = buildDeps(order, {
+      addCurrentAccount: jest.fn(async () => {
+        throw failure;
+      }),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenCalledWith(
+      'commitSession: device-set registration failed',
+      { component: 'OxyContext', method: 'commitSession' },
+      failure,
+    );
+  });
+});
+
+describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
+  it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
+    const order: string[] = [];
+    const gate = deferred<void>(); // registerAndActivate stays pending
+    const deps = buildDeps(order, {
+      activate: true,
+      registerAndActivate: jest.fn(() => {
+        order.push('registerAndActivate');
+        return gate.promise;
+      }),
+    });
+
+    const settled = jest.fn();
+    const pending = commitDeviceSetAndResolve(deps).then(settled);
+
+    // While the reconcile is pending, auth must NOT resolve yet.
+    await flush();
+    expect(deps.registerAndActivate).toHaveBeenCalledTimes(1);
+    expect(deps.addCurrentAccount).not.toHaveBeenCalled();
+    expect(deps.getCurrentUser).not.toHaveBeenCalled();
+    expect(deps.markAuthResolved).not.toHaveBeenCalled();
+    expect(settled).not.toHaveBeenCalled();
+
+    // Complete the reconcile → hydrate + resolve now runs.
+    gate.resolve();
+    await pending;
+
+    expect(order).toEqual([
+      'registerAndActivate',
+      'startSocket',
+      'syncFromClient',
+      'getCurrentUser',
+      'loginSuccess',
+      'onAuthStateChange',
+      'markAuthResolved',
+    ]);
+    expect(settled).toHaveBeenCalledTimes(1);
+  });
+});

package/src/ui/context/commitSessionFlow.ts

@@ -0,0 +1,115 @@
+import type { User } from '@oxyhq/core';
+import { logger as loggerUtil } from '@oxyhq/core';
+
+const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
+
+export interface CommitDeviceSetAndResolveDeps {
+  /**
+   * Whether this commit is a deliberate sign-in on THIS device (activates the
+   * account and BLOCKS on the device-set reconcile before resolving) vs. a
+   * cold-boot restore (resolves auth from the profile fetch FIRST, then
+   * reconciles the device set in the background).
+   */
+  activate: boolean;
+  /** The committing account id (only used by `registerAndActivate`). */
+  userId?: string;
+  /** Minimal user carried by the commit input; used if the profile fetch fails. */
+  fallbackUser: User | null;
+  /** Deliberate sign-in: register + activate the account in the device set. */
+  registerAndActivate: (userId?: string) => Promise<void>;
+  /** Cold boot: ensure membership only; the server's `activeAccountId` wins. */
+  addCurrentAccount: () => Promise<void>;
+  /** Start the device-scoped socket. */
+  startSocket: () => Promise<void>;
+  /** Project the server-authoritative device state onto local sessions. */
+  syncFromClient: () => Promise<void>;
+  /** Hydrate the full profile (the commit input carries only minimal data). */
+  getCurrentUser: () => Promise<User | null>;
+  loginSuccess: (user: User) => void;
+  onAuthStateChange?: (user: User | null) => void;
+  markAuthResolved: () => void;
+}
+
+/**
+ * Device-set registration + full-user hydration + auth-resolution gate flip.
+ *
+ * On a deliberate sign-in (`activate: true`) the device-set reconcile is awaited
+ * BEFORE hydrating and resolving — unchanged legacy ordering. On a cold boot
+ * (`activate: false`) auth resolves from the profile fetch FIRST so the app can
+ * paint an authenticated shell without waiting on device-set registration, the
+ * socket connect, and the authoritative sessions projection — those reconcile in
+ * a DETACHED background task a moment later.
+ */
+export async function commitDeviceSetAndResolve(
+  deps: CommitDeviceSetAndResolveDeps,
+): Promise<void> {
+  const {
+    activate,
+    userId,
+    fallbackUser,
+    registerAndActivate,
+    addCurrentAccount,
+    startSocket,
+    syncFromClient,
+    getCurrentUser,
+    loginSuccess,
+    onAuthStateChange,
+    markAuthResolved,
+  } = deps;
+
+  // Register into the device set, start the socket, then project server truth. A
+  // deliberate sign-in ACTIVATES the account (`registerAndActivate`); the cold
+  // boot only ensures membership and lets the server's own `activeAccountId` win
+  // (`addCurrentAccount`).
+  const reconcileDeviceSet = async (): Promise<void> => {
+    if (activate) {
+      await registerAndActivate(userId);
+    } else {
+      await addCurrentAccount();
+    }
+    await startSocket();
+    await syncFromClient();
+  };
+
+  const logReconcileError = (registrationError: unknown): void => {
+    loggerUtil.warn('commitSession: device-set registration failed', LOG_CONTEXT, registrationError);
+  };
+
+  // Hydrate the full user then flip the auth-resolution gate. Falls back to the
+  // minimal commit-input shape if the profile fetch fails — never leaves auth
+  // unresolved.
+  const hydrateAndResolve = async (): Promise<void> => {
+    let fullUser: User | null = null;
+    try {
+      fullUser = await getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user on commit; using minimal fallback', LOG_CONTEXT, profileError);
+      }
+      fullUser = fallbackUser;
+    }
+    if (fullUser) {
+      loginSuccess(fullUser);
+      onAuthStateChange?.(fullUser);
+    }
+    markAuthResolved();
+  };
+
+  if (activate) {
+    // Deliberate sign-in: block on the device-set reconcile (unchanged ordering)
+    // before hydrating + resolving, so the account is fully registered/active.
+    try {
+      await reconcileDeviceSet();
+    } catch (registrationError) {
+      logReconcileError(registrationError);
+    }
+    await hydrateAndResolve();
+    return;
+  }
+
+  // Cold boot: resolve auth from the profile fetch FIRST; reconcile the device
+  // set (membership + socket + sessions projection) in a DETACHED background
+  // task so first paint is not blocked behind those round-trips.
+  await hydrateAndResolve();
+  void reconcileDeviceSet().catch(logReconcileError);
+}

package/src/ui/context/hooks/useAuthOperations.ts

@@ -140,9 +140,8 @@ export const useAuthOperations = ({
       // internally; when the response also carries the zero-cookie device
       // credential (`deviceId` + `deviceSecret`), persist the durable blob so the
       // next cold boot re-mints an access token from it. Best-effort — a failed
-      // persist never fails the sign-in. `SessionLoginResponse` does not type
-      // `deviceSecret`; read it defensively from the runtime payload.
-      const deviceSecret = (sessionResponse as { deviceSecret?: string }).deviceSecret;
+      // persist never fails the sign-in.
+      const deviceSecret = sessionResponse.deviceSecret;
       if (sessionResponse.deviceId && deviceSecret) {
         try {
           await store.save({

package/src/ui/context/oxyContextTypes.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError } from '@oxyhq/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient } from '@oxyhq/core';
 import type { SecurityAlert } from '@oxyhq/contracts';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
@@ -76,6 +76,8 @@ export interface OxyContextState {
   storageKeyPrefix: string;
   clientId: string | null;
   oxyServices: OxyServices;
+  /** Server-authoritative device session client. `null` before an `OxyProvider` is mounted. */
+  sessionClient: SessionClient | null;
   useFollow?: UseFollowHook;
   showBottomSheet?: (screenOrConfig: RouteName | { screen: RouteName; props?: Record<string, unknown> }) => void;
   openAvatarPicker: () => void;