@oxyhq/services 21.0.1 → 22.1.0

package/src/ui/components/OxyProvider.tsx

@@ -114,6 +114,7 @@ const OxyProvider: FC<OxyProviderProps> = ({
     baseURL,
     authWebUrl,
     authRedirectUri,
+    authorizeBaseUrl,
     queryClient: providedQueryClient,
     requireAuth = 'off',
     hubSync = true,
@@ -309,6 +310,7 @@ const OxyProvider: FC<OxyProviderProps> = ({
                     baseURL={baseURL}
                     authWebUrl={authWebUrl}
                     authRedirectUri={authRedirectUri}
+                    authorizeBaseUrl={authorizeBaseUrl}
                     storageKeyPrefix={storageKeyPrefix}
                     clientId={clientId}
                     hubSync={hubSync}

package/src/ui/components/oxyAuthChooserStyles.ts

@@ -0,0 +1,152 @@
+import { StyleSheet } from 'react-native';
+
+/** High-contrast QR plate background — kept in sync with `OxyAuthChooser`'s QR colors. */
+const QR_PLATE_BG = '#FFFFFF';
+
+/**
+ * Shared styles for `OxyAuthChooser`'s views. Extracted from `OxyAccountDialog`
+ * so both the Dialog-wrapped host and any bare host (e.g. a future
+ * auth.oxy.so hub page) render identically without duplicating a StyleSheet.
+ */
+export const authChooserStyles = StyleSheet.create({
+  rows: {
+    width: '100%',
+    gap: 8,
+  },
+  accountRow: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: 12,
+    borderWidth: StyleSheet.hairlineWidth,
+    borderRadius: 16,
+    paddingVertical: 10,
+    paddingHorizontal: 12,
+  },
+  rowDisabled: {
+    opacity: 0.6,
+  },
+  avatarRing: {
+    borderRadius: 9999,
+    borderWidth: 2,
+    padding: 1,
+  },
+  rowMeta: {
+    flex: 1,
+    minWidth: 0,
+  },
+  rowName: {
+    fontSize: 15,
+    fontWeight: '600',
+  },
+  rowHandle: {
+    fontSize: 12.5,
+    marginTop: 1,
+  },
+  addRow: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: 12,
+    borderWidth: StyleSheet.hairlineWidth,
+    borderStyle: 'dashed',
+    borderRadius: 16,
+    paddingVertical: 10,
+    paddingHorizontal: 12,
+    marginTop: 8,
+  },
+  addBadge: {
+    width: 40,
+    height: 40,
+    borderRadius: 9999,
+    borderWidth: StyleSheet.hairlineWidth,
+    alignItems: 'center',
+    justifyContent: 'center',
+  },
+  footerLinks: {
+    alignItems: 'center',
+    marginTop: 16,
+  },
+  footerLink: {
+    alignSelf: 'center',
+    paddingVertical: 10,
+    marginTop: 12,
+  },
+  linkText: {
+    fontSize: 14,
+    fontWeight: '600',
+  },
+  signInBlock: {
+    width: '100%',
+  },
+  primaryButton: {
+    width: '100%',
+    borderRadius: 14,
+    marginTop: 8,
+  },
+  secondaryButton: {
+    width: '100%',
+    borderRadius: 14,
+    marginTop: 10,
+  },
+  usernameInput: {
+    width: '100%',
+    borderWidth: StyleSheet.hairlineWidth,
+    borderRadius: 14,
+    paddingVertical: 12,
+    paddingHorizontal: 14,
+    fontSize: 16,
+    marginTop: 8,
+  },
+  dividerRow: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    width: '100%',
+    marginVertical: 14,
+  },
+  dividerLine: {
+    flex: 1,
+    height: StyleSheet.hairlineWidth,
+  },
+  dividerText: {
+    marginHorizontal: 12,
+    fontSize: 13,
+  },
+  centeredBlock: {
+    alignItems: 'center',
+    justifyContent: 'center',
+    gap: 12,
+    paddingVertical: 24,
+  },
+  mutedText: {
+    fontSize: 14,
+    textAlign: 'center',
+  },
+  qrHeadline: {
+    fontSize: 16,
+    fontWeight: '700',
+    textAlign: 'center',
+  },
+  errorText: {
+    fontSize: 14,
+    textAlign: 'center',
+  },
+  errorBanner: {
+    flexDirection: 'row',
+    alignItems: 'center',
+    gap: 8,
+    width: '100%',
+    borderRadius: 12,
+    paddingVertical: 10,
+    paddingHorizontal: 12,
+    marginBottom: 12,
+  },
+  errorBannerText: {
+    flex: 1,
+    fontSize: 13.5,
+    lineHeight: 18,
+  },
+  qrPlate: {
+    padding: 16,
+    borderRadius: 16,
+    backgroundColor: QR_PLATE_BG,
+  },
+});

package/src/ui/context/OxyContext.tsx

@@ -27,7 +27,6 @@ import {
   logger as loggerUtil,
   syncHubAfterSignIn,
 } from '@oxyhq/core';
-import type { SecurityAlert } from '@oxyhq/contracts';
 import {
   registerAccountDialogControls,
   notifyAccountDialogVisibility,
@@ -59,7 +58,6 @@ import {
 } from '../session';
 import type {
   OxyContextState,
-  PasswordSignInResult,
   OxyContextProviderProps,
   CommitInput,
 } from './oxyContextTypes';
@@ -74,7 +72,7 @@ import {
 import { queryKeys } from '../hooks/queries/queryKeys';
 import { useOxyAccountGraph } from './useOxyAccountGraph';
 
-export type { OxyContextState, PasswordSignInResult, OxyContextProviderProps } from './oxyContextTypes';
+export type { OxyContextState, OxyContextProviderProps } from './oxyContextTypes';
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
@@ -84,6 +82,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   baseURL,
   authWebUrl,
   authRedirectUri,
+  authorizeBaseUrl,
   storageKeyPrefix = 'oxy_session',
   clientId: clientIdProp,
   hubSync = true,
@@ -607,14 +606,41 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     [commitSession],
   );
 
+  // Commit a minted graph-SWITCH session. Same funnel as `handleWebSession` but
+  // IN-PLACE: `hubSync: false` so switching accounts never triggers the
+  // cross-origin hub-sync full-page redirect. The switch already propagates
+  // across tabs/apps via the server's `session_state` socket broadcast.
+  const commitSwitchedSession = useCallback(
+    async (session: SessionLoginResponse): Promise<void> => {
+      if (!session?.user || !session?.sessionId || !session.accessToken) {
+        throw new Error('Session response did not include a usable session');
+      }
+      await commitSession(
+        {
+          sessionId: session.sessionId,
+          accessToken: session.accessToken,
+          deviceSecret: session.deviceSecret,
+          deviceId: session.deviceId,
+          expiresAt: session.expiresAt,
+          userId: session.user.id,
+          user: session.user,
+        },
+        { activate: true, hubSync: false },
+      );
+    },
+    [commitSession],
+  );
+
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
-  // `handleWebSession` commit funnel. `handleWebSession` is threaded through a ref
-  // so the controller keeps a STABLE `commitSession` (rebuilding the controller
-  // on every commit-identity change would drop its subscription + state).
+  // commit funnels. Both funnels are threaded through refs so the controller
+  // keeps STABLE commit callbacks (rebuilding the controller on every
+  // commit-identity change would drop its subscription + state).
   const handleWebSessionRef = useRef(handleWebSession);
   handleWebSessionRef.current = handleWebSession;
+  const commitSwitchedSessionRef = useRef(commitSwitchedSession);
+  commitSwitchedSessionRef.current = commitSwitchedSession;
 
   const accountDialogControllerRef = useRef<AccountDialogController | null>(null);
   if (!accountDialogControllerRef.current) {
@@ -622,12 +648,12 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       oxyServices,
       sessionClient,
       clientId,
-      authRedirectUri,
       locale: currentLanguage,
       // Same statically-injected `io` as the SessionClient: gives the QR flow an
       // instant `/auth-session` `auth_update` wake instead of a slow poll.
       socketFactory: io,
       commitSession: (session) => handleWebSessionRef.current(session),
+      commitSwitchedSession: (session) => commitSwitchedSessionRef.current(session),
       onSignedIn: () => setAccountDialogOpen(false),
       openUrl: (url) => {
         if (isWebBrowser()) {
@@ -676,72 +702,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     notifyAccountDialogVisibility(accountDialogOpen);
   }, [accountDialogOpen]);
 
-  // Keyless password sign-in: username/email + password.
-  const signInWithPassword = useCallback(
-    async (
-      identifier: string,
-      password: string,
-      opts?: { deviceName?: string; deviceFingerprint?: string },
-    ): Promise<PasswordSignInResult> => {
-      const persisted = await authStore.load();
-      const result = await oxyServices.passwordSignIn(identifier, password, {
-        deviceName: opts?.deviceName,
-        deviceFingerprint: opts?.deviceFingerprint,
-        deviceId: persisted?.deviceId,
-      });
-      if ('twoFactorRequired' in result) {
-        return { status: '2fa_required', loginToken: result.loginToken };
-      }
-      // `passwordSignIn` already planted the access token on the session arm.
-      await commitSession(
-        {
-          sessionId: result.sessionId,
-          accessToken: result.accessToken,
-          deviceSecret: result.deviceSecret,
-          deviceId: result.deviceId,
-          expiresAt: result.expiresAt,
-          userId: result.user.id,
-          user: result.user,
-        },
-        { activate: true, hubSync: true },
-      );
-      return { status: 'ok', ...(result.securityAlert ? { securityAlert: result.securityAlert } : {}) };
-    },
-    [oxyServices, commitSession],
-  );
-
-  const completeTwoFactorSignIn = useCallback(
-    async (params: {
-      loginToken: string;
-      token?: string;
-      backupCode?: string;
-      deviceName?: string;
-    }): Promise<{ securityAlert?: SecurityAlert }> => {
-      const persisted = await authStore.load();
-      const result = await oxyServices.completeTwoFactorSignIn({
-        loginToken: params.loginToken,
-        token: params.token,
-        backupCode: params.backupCode,
-        deviceName: params.deviceName,
-        deviceId: persisted?.deviceId,
-      });
-      await commitSession(
-        {
-          sessionId: result.sessionId,
-          accessToken: result.accessToken,
-          deviceSecret: result.deviceSecret,
-          deviceId: result.deviceId,
-          expiresAt: result.expiresAt,
-          userId: result.user.id,
-          user: result.user,
-        },
-        { activate: true, hubSync: true },
-      );
-      return { securityAlert: result.securityAlert };
-    },
-    [oxyServices, commitSession],
-  );
-
   // ── Passkey (WebAuthn) ─────────────────────────────────────────────────────
   // Web-only sign-in / registration via the browser WebAuthn ceremony. The fixed
   // `options → ceremony → verify → commit` ordering lives in the pure
@@ -750,16 +710,20 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // `commitSession` funnel). All three GATE on `isPasskeySupported()` so a native
   // / unsupported surface throws loudly instead of stalling in a ceremony.
 
-  // Usernameless (discoverable) passkey sign-in.
+  // Passkey sign-in. No `username` → usernameless (discoverable) flow. With a
+  // `username` → username-first: the server scopes `allowCredentials` to that
+  // user's passkeys so a non-discoverable hardware key (U2F/security key) can
+  // be selected.
   const signInWithPasskey = useCallback(
-    async (opts?: { deviceName?: string; deviceFingerprint?: string }): Promise<void> => {
+    async (opts?: { username?: string; deviceName?: string; deviceFingerprint?: string }): Promise<void> => {
       const persisted = await authStore.load();
       await runPasskeyLogin({
         isSupported: isPasskeySupported,
-        getLoginOptions: () => oxyServices.webauthnLoginOptions(),
+        getLoginOptions: (username) => oxyServices.webauthnLoginOptions(username),
         runCeremony: runAuthenticationCeremony,
         loginVerify: (response, envelope) => oxyServices.webauthnLoginVerify(response, envelope),
         commit: (input) => commitSession(input, { activate: true, hubSync: true }),
+        username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
         deviceFingerprint: opts?.deviceFingerprint,
@@ -802,6 +766,17 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     [oxyServices, queryClient],
   );
 
+  // Remove a passkey from the already-signed-in account by credential id. Not a
+  // ceremony — a plain unlink — so it needs no `isPasskeySupported` gate; it just
+  // refreshes the linked auth-methods list on success.
+  const removePasskey = useCallback(
+    async (credentialId: string): Promise<void> => {
+      await oxyServices.removePasskey(credentialId);
+      void queryClient.invalidateQueries({ queryKey: queryKeys.authMethods.all });
+    },
+    [oxyServices, queryClient],
+  );
+
   // ── Cold boot ────────────────────────────────────────────────────────────
   // Device-first session restore via `runProviderColdBoot` (see boot/runProviderColdBoot.ts).
   const runColdBoot = useCallback(async (): Promise<void> => {
@@ -810,6 +785,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       authStore,
       clientId: clientIdProp,
       authRedirectUri,
+      authorizeBaseUrl,
       sessionClient,
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
@@ -821,6 +797,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     authStore,
     clientIdProp,
     authRedirectUri,
+    authorizeBaseUrl,
     syncDeviceCredentialToHost,
     sessionClient,
   ]);
@@ -950,11 +927,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       hasIdentity,
       getPublicKey,
       signIn,
-      signInWithPassword,
-      completeTwoFactorSignIn,
       signInWithPasskey,
       registerWithPasskey,
       addPasskey,
+      removePasskey,
       revokeSuspiciousSignIn,
       handleWebSession,
       logout,
@@ -1005,11 +981,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       hasIdentity,
       getPublicKey,
       signIn,
-      signInWithPassword,
-      completeTwoFactorSignIn,
       signInWithPasskey,
       registerWithPasskey,
       addPasskey,
+      removePasskey,
       revokeSuspiciousSignIn,
       handleWebSession,
       logout,
@@ -1078,11 +1053,10 @@ const LOADING_STATE: OxyContextState = {
   hasIdentity: () => Promise.resolve(false),
   getPublicKey: () => Promise.resolve(null),
   signIn: () => rejectMissingProvider<User>(),
-  signInWithPassword: () => rejectMissingProvider<PasswordSignInResult>(),
-  completeTwoFactorSignIn: () => rejectMissingProvider<{ securityAlert?: SecurityAlert }>(),
   signInWithPasskey: () => rejectMissingProvider<void>(),
   registerWithPasskey: () => rejectMissingProvider<void>(),
   addPasskey: () => rejectMissingProvider<void>(),
+  removePasskey: () => rejectMissingProvider<void>(),
   revokeSuspiciousSignIn: () => rejectMissingProvider<void>(),
   handleWebSession: () => rejectMissingProvider<void>(),
   logout: () => rejectMissingProvider<void>(),

package/src/ui/context/__tests__/passkeyFlow.test.ts

@@ -9,7 +9,7 @@
  * deps-injection style `commitSessionFlow.test.ts` uses.
  */
 
-import type { LoginResult, LoginSessionResult } from '@oxyhq/contracts';
+import type { LoginSessionResult } from '@oxyhq/contracts';
 import {
   runPasskeyLogin,
   runPasskeyRegister,
@@ -45,7 +45,6 @@ const expectedCommitInput: CommitInput = {
   user: { id: SESSION_USER_ID, username: 'pkuser' },
 };
 
-const twoFactorResult: LoginResult = { twoFactorRequired: true, loginToken: 'lt_should_not_happen' };
 const linkResult: PasskeyRegisterVerifyResult = { success: true, message: 'Passkey added' };
 
 describe('runPasskeyLogin', () => {
@@ -92,25 +91,33 @@ describe('runPasskeyLogin', () => {
     expect(deps.commit).toHaveBeenCalledWith(expectedCommitInput);
   });
 
-  it('throws and touches nothing when passkeys are unsupported', async () => {
+  it('forwards the username to getLoginOptions for the username-first (hardware-key) path', async () => {
     const order: string[] = [];
-    const deps = buildDeps(order, { isSupported: jest.fn(() => false) });
+    const deps = buildDeps(order, { username: 'alice' });
 
-    await expect(runPasskeyLogin(deps)).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
-    expect(deps.getLoginOptions).not.toHaveBeenCalled();
-    expect(deps.commit).not.toHaveBeenCalled();
+    await runPasskeyLogin(deps);
+
+    // The username scopes login options to that user's passkeys — the path a
+    // non-discoverable U2F/security key needs.
+    expect(deps.getLoginOptions).toHaveBeenCalledWith('alice');
   });
 
-  it('refuses a 2FA arm (a passkey assertion is the strong factor) and never commits', async () => {
+  it('passes undefined to getLoginOptions for the usernameless (discoverable) path', async () => {
     const order: string[] = [];
-    const deps = buildDeps(order, {
-      loginVerify: jest.fn(async () => {
-        order.push('loginVerify');
-        return twoFactorResult;
-      }),
-    });
+    const deps = buildDeps(order);
 
-    await expect(runPasskeyLogin(deps)).rejects.toThrow(/second factor/i);
+    await runPasskeyLogin(deps);
+
+    // No username → discoverable-credential ceremony (server returns an empty allow-list).
+    expect(deps.getLoginOptions).toHaveBeenCalledWith(undefined);
+  });
+
+  it('throws and touches nothing when passkeys are unsupported', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order, { isSupported: jest.fn(() => false) });
+
+    await expect(runPasskeyLogin(deps)).rejects.toThrow(PASSKEY_UNSUPPORTED_MESSAGE);
+    expect(deps.getLoginOptions).not.toHaveBeenCalled();
     expect(deps.commit).not.toHaveBeenCalled();
   });
 });

package/src/ui/context/oxyContextTypes.ts

@@ -1,6 +1,5 @@
 import type { ReactNode } from 'react';
 import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient } from '@oxyhq/core';
-import type { SecurityAlert } from '@oxyhq/contracts';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -41,26 +40,20 @@ export interface OxyContextState {
 
   signIn: (publicKey: string, deviceName?: string) => Promise<User>;
 
-  signInWithPassword: (
-    identifier: string,
-    password: string,
-    opts?: { deviceName?: string; deviceFingerprint?: string },
-  ) => Promise<PasswordSignInResult>;
-
-  completeTwoFactorSignIn: (params: {
-    loginToken: string;
-    token?: string;
-    backupCode?: string;
-    deviceName?: string;
-  }) => Promise<{ securityAlert?: SecurityAlert }>;
-
   /**
-   * Sign in with a passkey (WebAuthn). Usernameless / discoverable-credential
-   * flow: the browser prompts for any resident Oxy passkey. WEB-ONLY — throws on
-   * native or an unsupported browser (native passkeys are Commons' job). On
-   * `useOxy()`, NOT re-exposed on `useAuth()`.
+   * Sign in with a passkey (WebAuthn). With no `username` this is the
+   * usernameless / discoverable-credential flow: the browser prompts for any
+   * resident Oxy passkey. Pass `username` for the username-first flow — the
+   * server scopes `allowCredentials` to that user's passkeys so a
+   * NON-discoverable hardware key (e.g. a U2F/security key) can be used.
+   * WEB-ONLY — throws on native or an unsupported browser (native passkeys are
+   * Commons' job). On `useOxy()`, NOT re-exposed on `useAuth()`.
    */
-  signInWithPasskey: (opts?: { deviceName?: string; deviceFingerprint?: string }) => Promise<void>;
+  signInWithPasskey: (opts?: {
+    username?: string;
+    deviceName?: string;
+    deviceFingerprint?: string;
+  }) => Promise<void>;
 
   /**
    * Create a brand-new account whose first authentication method is a passkey.
@@ -75,6 +68,14 @@ export interface OxyContextState {
    */
   addPasskey: (params?: { deviceName?: string }) => Promise<void>;
 
+  /**
+   * Remove a passkey from the current account by its credential id
+   * (`AuthMethodEntry.credentialId`). Refreshes the linked auth-methods list on
+   * success. Works on any platform (it is a plain unlink, not a WebAuthn
+   * ceremony) but is only reachable from surfaces that list passkeys.
+   */
+  removePasskey: (credentialId: string) => Promise<void>;
+
   revokeSuspiciousSignIn: () => Promise<void>;
   handleWebSession: (session: SessionLoginResponse) => Promise<void>;
 
@@ -117,19 +118,19 @@ export interface OxyContextState {
   createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
 }
 
-/**
- * Result of {@link OxyContextState.signInWithPassword}.
- */
-export type PasswordSignInResult =
-  | { status: 'ok'; securityAlert?: SecurityAlert }
-  | { status: '2fa_required'; loginToken: string };
-
 export interface OxyContextProviderProps {
   children: ReactNode;
   oxyServices?: OxyServices;
   baseURL?: string;
   authWebUrl?: string;
   authRedirectUri?: string;
+  /**
+   * Authorize endpoint override for silent cross-origin session restore
+   * (web cross-app SSO). Defaults to the production Oxy IdP when unset; a
+   * local/staging deployment points it at its own IdP so cold boot never
+   * bounces the tab to production `auth.oxy.so`.
+   */
+  authorizeBaseUrl?: string;
   storageKeyPrefix?: string;
   clientId?: string;
   /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */

package/src/ui/context/passkeyFlow.ts

@@ -42,37 +42,45 @@ function toCommitInput(result: LoginSessionResult): CommitInput {
 /** Injected dependencies for {@link runPasskeyLogin}. */
 export interface RunPasskeyLoginDeps {
   isSupported: () => boolean;
-  getLoginOptions: () => Promise<unknown>;
+  getLoginOptions: (username?: string) => Promise<unknown>;
   runCeremony: (optionsJSON: unknown) => Promise<unknown>;
   loginVerify: (
     response: unknown,
     envelope: { deviceName?: string; deviceFingerprint?: string; deviceId?: string },
   ) => Promise<LoginResult>;
   commit: (input: CommitInput) => Promise<void>;
+  /**
+   * When present, scopes login options to that user's registered passkeys
+   * (username-first) — the path a NON-discoverable hardware key (e.g. a U2F
+   * security key) needs, since it can't be found by a usernameless ceremony.
+   * Omit for the discoverable / resident-credential path.
+   */
+  username?: string;
   deviceId?: string;
   deviceName?: string;
   deviceFingerprint?: string;
 }
 
 /**
- * Usernameless (discoverable-credential) passkey SIGN-IN: request login options,
- * run the authentication ceremony, verify, then commit the session. A passkey
- * assertion is itself the strong factor, so a 2FA arm here is a protocol error.
+ * Passkey SIGN-IN. With no `username` this is the usernameless
+ * (discoverable-credential) flow; with a `username` it is username-first —
+ * the server scopes `allowCredentials` to that user's passkeys so a
+ * non-discoverable hardware key (U2F/security key) can be selected. Either way:
+ * request login options, run the authentication ceremony, verify, then commit
+ * the session. A passkey assertion is itself the strong factor — sign-in always
+ * resolves to a completed session.
  */
 export async function runPasskeyLogin(deps: RunPasskeyLoginDeps): Promise<void> {
   if (!deps.isSupported()) {
     throw new Error(PASSKEY_UNSUPPORTED_MESSAGE);
   }
-  const options = await deps.getLoginOptions();
+  const options = await deps.getLoginOptions(deps.username);
   const response = await deps.runCeremony(options);
   const result = await deps.loginVerify(response, {
     deviceName: deps.deviceName,
     deviceFingerprint: deps.deviceFingerprint,
     deviceId: deps.deviceId,
   });
-  if ('twoFactorRequired' in result) {
-    throw new Error('Passkey sign-in unexpectedly required a second factor.');
-  }
   await deps.commit(toCommitInput(result));
 }
 
@@ -106,7 +114,7 @@ export async function runPasskeyRegister(deps: RunPasskeyRegisterDeps): Promise<
     deviceName: deps.deviceName,
   });
   // Only the signup session arm carries `sessionId`; the link branch
-  // (`{ success, message }`) and any 2FA arm do not.
+  // (`{ success, message }`) does not.
   if (!('sessionId' in result)) {
     throw new Error('Passkey registration did not establish a session.');
   }

package/src/ui/context/useOxyAccountGraph.ts

@@ -13,7 +13,7 @@ interface UseOxyAccountGraphParams {
   oxyServices: OxyServices;
   sessionClient: SessionClient;
   syncFromClient: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean; hubSync?: boolean }) => Promise<void>;
   queryClient: QueryClient;
   accountDialogControllerRef: RefObject<AccountDialogController | null>;
   clearSessionStateRef: RefObject<() => Promise<void>>;
@@ -89,7 +89,9 @@ export function useOxyAccountGraph({
           userId: result.user.id,
           user: result.user,
         },
-        { activate: true },
+        // A switch is IN-PLACE: never run the cross-origin hub-sync full-page
+        // redirect. Cross-tab/app propagation rides the `session_state` socket.
+        { activate: true, hubSync: false },
       );
       await runPostAccountSwitchSideEffects();
     },

package/src/ui/hooks/useSwitchableAccounts.ts

@@ -23,6 +23,7 @@ const EMPTY_SNAPSHOT: AccountDialogSnapshot = {
     error: null,
     switchingAccountId: null,
     signIn: { phase: 'idle', authorizeCode: null, qrPayload: null, expiresAt: null, error: null },
+    commonsAvailability: 'unknown',
 };
 
 /**

package/src/ui/types/navigation.ts

@@ -62,6 +62,14 @@ export interface OxyProviderProps {
     baseURL?: string;
     authWebUrl?: string;
     authRedirectUri?: string;
+    /**
+     * Authorize endpoint override for silent cross-origin session restore
+     * (web cross-app SSO on cold boot). Defaults to the production Oxy IdP
+     * (`https://auth.oxy.so/authorize`) when unset. Set this from an env var
+     * (e.g. Vite `VITE_OXY_AUTHORIZE_URL`, Expo `EXPO_PUBLIC_OXY_AUTHORIZE_URL`)
+     * so a local/staging deployment targets its own IdP instead of production.
+     */
+    authorizeBaseUrl?: string;
     queryClient?: QueryClient;
     /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
     hubSync?: boolean;