@oxyhq/services 23.0.2 → 23.0.3

package/lib/commonjs/ui/context/OxyContext.js

@@ -0,0 +1,1235 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.useOxy = exports.OxyProvider = exports.OxyContextProvider = void 0;
+var _react = require("react");
+var _reactNative = require("react-native");
+var _socket = require("socket.io-client");
+var _core = require("@oxyhq/core");
+var _accountDialogManager = require("../navigation/accountDialogManager.js");
+var _oauthNavigation = require("../components/oauthNavigation.js");
+var _passkeyHubPopup = require("../components/passkeyHubPopup.js");
+var _browserAuthTransport = require("../oauth/browserAuthTransport.js");
+var _isWebBrowser = require("../utils/isWebBrowser.js");
+var _deliveryPlatform = require("../utils/deliveryPlatform.js");
+var _runProviderColdBoot = require("../boot/runProviderColdBoot.js");
+var _deviceCredential = require("../utils/deviceCredential.js");
+var _authStore = require("../stores/authStore.js");
+var _shallow = require("zustand/react/shallow");
+var _useLanguageManagement = require("../hooks/useLanguageManagement.js");
+var _useSessionManagement = require("../hooks/useSessionManagement.js");
+var _useAuthOperations = require("./hooks/useAuthOperations.js");
+var _useDeviceManagement = require("../hooks/useDeviceManagement.js");
+var _storageHelpers = require("../utils/storageHelpers.js");
+var _bottomSheetManager = require("../navigation/bottomSheetManager.js");
+var _surfaces = require("../navigation/surfaces.js");
+var _reactQuery = require("@tanstack/react-query");
+var _queryClient = require("../hooks/queryClient.js");
+var _useAvatarPicker = require("../hooks/useAvatarPicker.js");
+var _accountStore = require("../stores/accountStore.js");
+var _index = require("../session/index.js");
+var _oxyContextHelpers = require("./oxyContextHelpers.js");
+var _commitSessionFlow = require("./commitSessionFlow.js");
+var _passkeyFlow = require("./passkeyFlow.js");
+var _passkeyClient = require("../../webauthn/passkeyClient");
+var _queryKeys = require("../hooks/queries/queryKeys.js");
+var _useOxyAccountGraph = require("./useOxyAccountGraph.js");
+var _jsxRuntime = require("react/jsx-runtime");
+const OxyContext = /*#__PURE__*/(0, _react.createContext)(null);
+const OxyProvider = ({
+  children,
+  oxyServices: providedOxyServices,
+  baseURL,
+  authWebUrl,
+  authRedirectUri,
+  authorizeBaseUrl,
+  storageKeyPrefix = 'oxy_session',
+  clientId: clientIdProp,
+  sessionMode = 'account',
+  webAuthMode = 'popup',
+  onAuthStateChange,
+  onError
+}) => {
+  const oxyServicesRef = (0, _react.useRef)(null);
+  if (!oxyServicesRef.current) {
+    if (providedOxyServices) {
+      oxyServicesRef.current = providedOxyServices;
+    } else if (baseURL) {
+      // `authWebUrl` now only points the OAuth "Sign in with Oxy" third-party
+      // link builder at the central auth host; there is no cold-boot redirect.
+      oxyServicesRef.current = new _core.OxyServices({
+        baseURL,
+        authWebUrl,
+        authRedirectUri
+      });
+    } else {
+      throw new Error('Either oxyServices or baseURL must be provided to OxyContextProvider');
+    }
+  }
+  const oxyServices = oxyServicesRef.current;
+
+  // The device-first persisted auth-state store (per-origin zero-cookie device
+  // credential on web; SecureStore session blob on native). Built ONCE per
+  // provider mount.
+  const authStoreRef = (0, _react.useRef)(null);
+  if (!authStoreRef.current) {
+    authStoreRef.current = (0, _index.createPlatformAuthStateStore)();
+  }
+  const authStore = authStoreRef.current;
+
+  // Identity-bound session binding (`sessionMode: 'identity'`) — the platform pin
+  // store plus the memoised pinned account id every lane below binds to. Built
+  // ONCE per provider mount and ONLY in identity mode: an account-mode provider
+  // never constructs one, so `identity` is `null` there and every branch keyed on
+  // it collapses to today's behaviour.
+  //
+  // Like `oxyServices` / `baseURL`, `sessionMode` is mount-time configuration: it
+  // is read once and a later change does not re-bind the provider. Latching it
+  // this way also fails SAFE — a provider that started identity-bound can never
+  // be downgraded mid-flight into following the device's active account.
+  const identityRef = (0, _react.useRef)(null);
+  if (sessionMode === 'identity' && !identityRef.current) {
+    identityRef.current = (0, _index.createIdentitySessionBinding)();
+  }
+  const identity = identityRef.current;
+  const isIdentityBound = identity !== null;
+  const {
+    user,
+    isAuthenticated,
+    isLoading,
+    error,
+    loginSuccess,
+    loginFailure,
+    logoutStore
+  } = (0, _authStore.useAuthStore)((0, _shallow.useShallow)(state => ({
+    user: state.user,
+    isAuthenticated: state.isAuthenticated,
+    isLoading: state.isLoading,
+    error: state.error,
+    loginSuccess: state.loginSuccess,
+    loginFailure: state.loginFailure,
+    logoutStore: state.logout
+  })));
+  const [tokenReady, setTokenReady] = (0, _react.useState)(true);
+  const [hasAccessToken, setHasAccessToken] = (0, _react.useState)(() => Boolean(oxyServices.getAccessToken()));
+  const [authResolved, setAuthResolved] = (0, _react.useState)(false);
+  const authResolvedRef = (0, _react.useRef)(false);
+  const userRef = (0, _react.useRef)(user);
+  const isAuthenticatedRef = (0, _react.useRef)(isAuthenticated);
+  userRef.current = user;
+  isAuthenticatedRef.current = isAuthenticated;
+  const [initialized, setInitialized] = (0, _react.useState)(false);
+  const [accountDialogOpen, setAccountDialogOpen] = (0, _react.useState)(false);
+  const setAuthState = _authStore.useAuthStore.setState;
+
+  // Keep the shared `oxyClient` singleton's token store in lockstep with the
+  // session owned by THIS provider's instance (many apps build API clients
+  // against the exported singleton while passing only `baseURL` here). Skipped
+  // when the app passed the singleton itself as `oxyServices`.
+  (0, _react.useEffect)(() => {
+    if (oxyServices === _core.oxyClient) {
+      return;
+    }
+    const applyToSingleton = accessToken => {
+      if (accessToken) {
+        _core.oxyClient.setTokens(accessToken);
+      } else {
+        _core.oxyClient.clearTokens();
+      }
+    };
+    applyToSingleton(oxyServices.getAccessToken());
+    return oxyServices.onTokensChanged(applyToSingleton);
+  }, [oxyServices]);
+  const logger = (0, _react.useCallback)((message, err) => {
+    if (__DEV__) {
+      _core.logger.warn(message, {
+        component: 'OxyContext'
+      }, err);
+    }
+  }, []);
+  const storageKeys = (0, _react.useMemo)(() => (0, _storageHelpers.getStorageKeys)(storageKeyPrefix), [storageKeyPrefix]);
+  const clientId = (0, _react.useMemo)(() => {
+    const trimmed = clientIdProp?.trim();
+    return trimmed ? trimmed : null;
+  }, [clientIdProp]);
+
+  // Local display/bookkeeping storage (session id list, language). Distinct
+  // from `authStore` (the durable credential blob). Exposed as an awaitable so
+  // a persistence write is never dropped because it raced storage init.
+  const storageRef = (0, _react.useRef)(null);
+  const [storage, setStorage] = (0, _react.useState)(null);
+  const buildStorageDeferred = () => {
+    let resolve = () => undefined;
+    const promise = new Promise(res => {
+      resolve = res;
+    });
+    return {
+      promise,
+      resolve
+    };
+  };
+  const storageReadyRef = (0, _react.useRef)(null);
+  if (storageReadyRef.current === null) {
+    storageReadyRef.current = buildStorageDeferred();
+  }
+  const storageReady = storageReadyRef.current;
+  (0, _react.useEffect)(() => {
+    let mounted = true;
+    (0, _storageHelpers.createPlatformStorage)().then(storageInstance => {
+      storageRef.current = storageInstance;
+      storageReady.resolve(storageInstance);
+      if (mounted) {
+        setStorage(storageInstance);
+      }
+    }).catch(err => {
+      if (mounted) {
+        logger('Failed to initialize storage', err);
+        onError?.({
+          message: 'Failed to initialize storage',
+          code: 'STORAGE_INIT_ERROR',
+          status: 500
+        });
+      }
+    });
+    return () => {
+      mounted = false;
+    };
+  }, [logger, onError, storageReady]);
+  const {
+    currentLanguage,
+    languages: currentLanguages,
+    metadata: currentLanguageMetadata,
+    languageName: currentLanguageName,
+    nativeLanguageName: currentNativeLanguageName,
+    setLanguage
+  } = (0, _useLanguageManagement.useLanguageManagement)({
+    storage,
+    languageKey: storageKeys.language,
+    user,
+    onError,
+    logger
+  });
+  const queryClient = (0, _reactQuery.useQueryClient)();
+  const {
+    sessions,
+    activeSessionId,
+    setActiveSessionId,
+    updateSessions,
+    switchSession,
+    clearSessionState,
+    saveActiveSessionId
+  } = (0, _useSessionManagement.useSessionManagement)({
+    oxyServices,
+    storage,
+    storageKeyPrefix,
+    loginSuccess,
+    logoutStore,
+    onAuthStateChange,
+    onError,
+    setAuthError: message => setAuthState({
+      error: message
+    }),
+    logger,
+    setTokenReady,
+    queryClient
+  });
+
+  // Refs so callbacks below can invoke the latest session-management functions
+  // without widening dependency arrays.
+  const switchSessionRef = (0, _react.useRef)(switchSession);
+  switchSessionRef.current = switchSession;
+  const clearSessionStateRef = (0, _react.useRef)(clearSessionState);
+  clearSessionStateRef.current = clearSessionState;
+  const setActiveSessionIdRef = (0, _react.useRef)(setActiveSessionId);
+  setActiveSessionIdRef.current = setActiveSessionId;
+  const loginSuccessRef = (0, _react.useRef)(loginSuccess);
+  loginSuccessRef.current = loginSuccess;
+  const onAuthStateChangeRef = (0, _react.useRef)(onAuthStateChange);
+  onAuthStateChangeRef.current = onAuthStateChange;
+
+  // Flip the auth-resolution gate (`authResolved` + `tokenReady`) the moment a
+  // session commits or the boot concludes signed out. Idempotent + monotonic.
+  const markAuthResolved = (0, _react.useCallback)(() => {
+    if (authResolvedRef.current) {
+      return;
+    }
+    authResolvedRef.current = true;
+    setTokenReady(true);
+    setAuthResolved(true);
+  }, []);
+  const markAuthResolvedRef = (0, _react.useRef)(markAuthResolved);
+  markAuthResolvedRef.current = markAuthResolved;
+
+  // Server-authoritative device session client. Built ONCE per `oxyServices`
+  // instance. Device-scoped sockets connect with deviceId+deviceSecret when no
+  // bearer is planted yet, so cross-origin apps sync via `session_state` after
+  // the one-shot join redirect.
+  const sessionClientPairRef = (0, _react.useRef)(null);
+  if (!sessionClientPairRef.current) {
+    sessionClientPairRef.current = (0, _index.createSessionClient)(oxyServices, origin => {
+      // Erase the DURABLE device credential only on a `request`-origin verdict
+      // (a REST sign-out / revocation). A `push`-origin empty state is a socket
+      // broadcast that may be a transient reconnect artifact — clearing the
+      // credential on it would strand the user signed out with no way back, so
+      // we clear only the local UI session and keep the credential (a dead one
+      // re-mints to `no_active_session` and resolves signed-out on next boot).
+      if (origin === 'request') {
+        (0, _useAuthOperations.clearPersistedAuthSafe)(authStore, logger);
+      }
+      void clearSessionStateRef.current().catch(clearError => {
+        logger('Failed to clear local state on remote sign-out', clearError);
+      });
+    },
+    // `null` for every account-mode provider — identical to omitting the
+    // option — and the pinned account id once an identity-bound provider has
+    // resolved its pin. Read through the ref so the resolver stays stable for
+    // the client's lifetime while still seeing later resolutions.
+    () => identityRef.current?.getPinnedAccountId() ?? null);
+  }
+  const {
+    client: sessionClient,
+    host: sessionClientHost
+  } = sessionClientPairRef.current;
+
+  // Re-establishment lane for an identity-bound provider whose pin is missing or
+  // whose pinned account is no longer part of this device's session set (another
+  // app signed it out, or the device was re-provisioned). Adopting whichever
+  // account the device is currently switched to is exactly the drift
+  // `sessionMode: 'identity'` exists to prevent, so the only correct answer is to
+  // re-derive the session from the local identity key.
+  //
+  // Bounded on purpose: at most ONE attempt per applied device revision, and
+  // never two concurrently — a repeated failure (locked keychain, offline, no
+  // local identity) must never spin a sign-in loop against the server. Nothing
+  // awaits it, so it can never deadlock against the projection that triggers it;
+  // the `bootstrap()` below re-applies device state, whose notify re-runs the
+  // projection with the pin now resolved.
+  const identityEstablishRef = (0, _react.useRef)({
+    revision: null,
+    inFlight: false
+  });
+  const reestablishIdentitySession = (0, _react.useCallback)((binding, revision) => {
+    const tracker = identityEstablishRef.current;
+    if (tracker.inFlight || tracker.revision === revision) {
+      return;
+    }
+    tracker.revision = revision;
+    tracker.inFlight = true;
+    void (async () => {
+      const established = await (0, _core.establishIdentitySession)({
+        oxy: oxyServices,
+        store: authStore,
+        binding: binding.binding
+      });
+      if (!established) {
+        return;
+      }
+      // The verify wrote a fresh pin; adopt it before re-reading device state
+      // so the notify that follows projects against the new binding.
+      await binding.refreshPinnedAccountId();
+      await sessionClient.bootstrap();
+    })().catch(establishError => {
+      logger('Failed to re-establish the identity-bound session', establishError);
+    }).finally(() => {
+      tracker.inFlight = false;
+    });
+  }, [oxyServices, authStore, sessionClient, logger]);
+
+  // Projects `client.getState()` onto the exposed `sessions`/`activeSessionId`/
+  // `user`. Sole authority for both locally-initiated mutations (switch/logout)
+  // AND remotely-pushed `session_state` over the `device:<deviceId>` socket.
+  const syncFromClient = (0, _react.useCallback)(async () => {
+    const state = sessionClient.getState();
+    if (state === null) {
+      return;
+    }
+    if (state.accounts.length === 0) {
+      // Clear the LOCAL UI session on any applied empty state, but NEVER the
+      // durable device credential here: `syncFromClient` runs for socket-pushed
+      // (possibly transient) states too, and wiping the credential on one would
+      // strand the user signed out. The credential wipe is gated on a
+      // `request`-origin verdict in `onUnauthenticated` above.
+      sessionClientHost.setCurrentAccountId(null);
+      await clearSessionState();
+      return;
+    }
+    // Last-write-wins guard: capture the revision this projection is for, then
+    // after the async profile fetch bail if a fresher state has landed.
+    const capturedRevision = state.revision;
+    // Resolve the pin BEFORE the profile fetch (memoised: one storage + keychain
+    // read per boot) so every projection below is bound on the FIRST pass over a
+    // freshly applied state. Deferring it would let a sibling app's switch render
+    // once as this client's user before the pin corrected it. `null` for every
+    // account-mode provider, where each projection falls back to the device's
+    // active account exactly as before.
+    const pinnedAccountId = identity ? await identity.ensurePinnedAccountId() : null;
+    const ids = (0, _index.accountIdsOf)(state);
+    let users = [];
+    try {
+      users = ids.length > 0 ? await oxyServices.getUsersByIds(ids) : [];
+    } catch (fetchError) {
+      logger('Failed to resolve account profiles during syncFromClient', fetchError);
+      return;
+    }
+    const latest = sessionClient.getState();
+    if (!latest || latest.revision !== capturedRevision) {
+      return;
+    }
+    if (identity && (pinnedAccountId === null || (0, _index.activeSessionIdOf)(latest, pinnedAccountId) === null)) {
+      // Either no verified pin, or the pinned account left this device's session
+      // set. Projecting anything here would mean projecting SOMEBODY ELSE's
+      // account, so leave the current projection untouched and re-derive the
+      // session from the local identity key instead.
+      reestablishIdentitySession(identity, latest.revision);
+      return;
+    }
+    const usersById = new Map(users.map(resolvedUser => [resolvedUser.id, resolvedUser]));
+    updateSessions((0, _index.deviceStateToClientSessions)(latest, usersById, pinnedAccountId));
+    setActiveSessionId((0, _index.activeSessionIdOf)(latest, pinnedAccountId));
+    const activeUser = (0, _index.activeUserOf)(latest, usersById, pinnedAccountId);
+    if (activeUser) {
+      loginSuccess(activeUser);
+    }
+    // The host's current account feeds the socket handshake and the bearer's
+    // token-account comparisons, so it tracks the PIN — never the account another
+    // app switched the device to.
+    sessionClientHost.setCurrentAccountId(pinnedAccountId ?? latest.activeAccountId);
+  }, [identity, oxyServices, reestablishIdentitySession, sessionClient, sessionClientHost, updateSessions, setActiveSessionId, loginSuccess, clearSessionState, logger]);
+  const syncFromClientRef = (0, _react.useRef)(syncFromClient);
+  syncFromClientRef.current = syncFromClient;
+  const syncDeviceCredentialToHost = (0, _react.useCallback)(async () => {
+    const cred = await (0, _deviceCredential.loadPersistedDeviceCredential)(authStore);
+    sessionClientHost.setDeviceCredential(cred);
+  }, [authStore, sessionClientHost]);
+  (0, _react.useEffect)(() => {
+    return sessionClient.subscribe(() => {
+      void syncFromClient();
+    });
+  }, [sessionClient, syncFromClient]);
+  const {
+    signIn,
+    logout,
+    logoutAll
+  } = (0, _useAuthOperations.useAuthOperations)({
+    oxyServices,
+    store: authStore,
+    storage,
+    activeSessionId,
+    setActiveSessionId,
+    updateSessions,
+    saveActiveSessionId,
+    clearSessionState,
+    switchSession,
+    sessionClient,
+    syncFromClient,
+    onAuthStateChange,
+    onError,
+    loginSuccess,
+    loginFailure,
+    logoutStore,
+    setAuthState,
+    logger,
+    ...(identity ? {
+      identityBinding: identity.binding,
+      refreshPinnedAccountId: () => identity.refreshPinnedAccountId()
+    } : {})
+  });
+
+  // "That wasn't me": repudiating a flagged sign-in IS revoking the device
+  // session that just committed — the same server-authoritative
+  // `sessionClient.signOut(...)` path `logout` uses, which also clears the
+  // persisted device credential + local state when no sibling account remains.
+  // No dedicated "report suspicious" API endpoint exists (or is needed).
+  const revokeSuspiciousSignIn = (0, _react.useCallback)(async () => {
+    await logout();
+  }, [logout]);
+  const clearAllAccountData = (0, _react.useCallback)(async () => {
+    queryClient.clear();
+    if (storage) {
+      try {
+        await (0, _queryClient.clearQueryCache)(storage);
+      } catch (error) {
+        logger('Failed to clear persisted query cache', error);
+      }
+    }
+    await clearSessionState();
+    // Explicit FULL wipe: also drop the persisted device credential so a reload
+    // finds nothing to restore.
+    await authStore.clear();
+    _accountStore.useAccountStore.getState().reset();
+    oxyServices.clearCache();
+  }, [queryClient, storage, clearSessionState, authStore, logger, oxyServices]);
+  const {
+    getDeviceSessions,
+    logoutAllDeviceSessions,
+    updateDeviceName
+  } = (0, _useDeviceManagement.useDeviceManagement)({
+    oxyServices,
+    activeSessionId,
+    onError,
+    clearSessionState,
+    logger
+  });
+  const useFollowHook = (0, _oxyContextHelpers.loadUseFollowHook)();
+
+  // Token-change side effects: an invalidated bearer (HttpService clears tokens
+  // on an unrecoverable 401 and emits `null`) must locally sign out an
+  // authenticated user so `isAuthenticated` never lingers true with no token.
+  // The persisted store is NOT cleared here — the refresh handler already
+  // cleared it if the family was revoked; a transient null leaves it intact so a
+  // later reload can still restore.
+  const clearingInvalidTokenRef = (0, _react.useRef)(false);
+  (0, _react.useEffect)(() => {
+    const handleTokenChange = accessToken => {
+      setHasAccessToken(Boolean(accessToken));
+      if (accessToken) {
+        setTokenReady(true);
+        if (sessionClient.getState()?.accounts.length) {
+          void syncFromClientRef.current();
+        }
+        return;
+      }
+      if (userRef.current || isAuthenticatedRef.current) {
+        setTokenReady(false);
+        if (clearingInvalidTokenRef.current) {
+          return;
+        }
+        clearingInvalidTokenRef.current = true;
+        clearSessionStateRef.current().catch(clearError => {
+          logger('Failed to clear invalidated auth session', clearError);
+        }).finally(() => {
+          clearingInvalidTokenRef.current = false;
+          if (authResolvedRef.current) {
+            setTokenReady(true);
+          }
+        });
+        return;
+      }
+      if (authResolvedRef.current) {
+        setTokenReady(true);
+      }
+    };
+    handleTokenChange(oxyServices.getAccessToken());
+    return oxyServices.onTokensChanged(handleTokenChange);
+  }, [logger, oxyServices, sessionClient]);
+
+  // Unified in-session refresh (SDK-owned; every RP inherits it). Installs the
+  // ONE core refresh handler (re-mint from the persisted zero-cookie device
+  // credential via `POST /session/device/token`) plus the proactive scheduler
+  // that refreshes ~60s before expiry and on tab-focus. Replaces the deleted
+  // services-local `inSessionTokenRefresh` module.
+  // An identity binding turns every re-mint pinned: it targets the pinned
+  // account instead of the device's active one, and its recovery arm becomes the
+  // PRIMARY-key identity sign-in rather than the cross-app shared keychain.
+  (0, _react.useEffect)(() => {
+    const dispose = (0, _core.installAuthRefreshHandler)({
+      oxy: oxyServices,
+      store: authStore,
+      ...(identity ? {
+        identity: identity.binding
+      } : {})
+    });
+    const scheduler = (0, _core.startTokenRefreshScheduler)(oxyServices);
+    return () => {
+      scheduler.dispose();
+      dispose();
+    };
+  }, [oxyServices, authStore, identity]);
+
+  // ── Session commit funnel ────────────────────────────────────────────────
+  // The single place a session becomes committed: plant tokens, persist the
+  // zero-cookie device credential (`deviceId` + `deviceSecret`), register the
+  // account into the server-authoritative device set, and hydrate the full user.
+  // Used by the QR device flow (`handleWebSession`), password sign-in, 2FA
+  // completion, and the cold boot.
+  const commitSession = (0, _react.useCallback)(async (input, options) => {
+    if (input.accessToken) {
+      oxyServices.setTokens(input.accessToken);
+    }
+
+    // Persist the durable blob when the zero-cookie device credential is present.
+    if (input.deviceId && input.deviceSecret) {
+      try {
+        const prior = await authStore.load();
+        const next = {
+          sessionId: input.sessionId || prior?.sessionId || '',
+          userId: input.userId || prior?.userId || '',
+          deviceId: input.deviceId,
+          deviceSecret: input.deviceSecret,
+          ...(input.accessToken ? {
+            accessToken: input.accessToken
+          } : {}),
+          ...(input.expiresAt ? {
+            expiresAt: input.expiresAt
+          } : {})
+        };
+        await authStore.save(next);
+        sessionClientHost.setDeviceCredential({
+          deviceId: input.deviceId,
+          deviceSecret: input.deviceSecret
+        });
+      } catch (persistError) {
+        logger('Failed to persist auth state on commit', persistError);
+      }
+    }
+
+    // Fast local mirror so the UI updates before the server round-trip; the
+    // SessionClient projection below overwrites it with server truth.
+    if (input.userId) {
+      const now = new Date();
+      updateSessions([{
+        sessionId: input.sessionId,
+        deviceId: input.deviceId ?? '',
+        expiresAt: input.expiresAt || new Date(now.getTime() + _oxyContextHelpers.DEFAULT_SESSION_VALIDITY_MS).toISOString(),
+        lastActive: now.toISOString(),
+        userId: input.userId,
+        isCurrent: true
+      }], {
+        merge: true
+      });
+      setActiveSessionId(input.sessionId);
+    }
+
+    // Register into the device set, hydrate the full user, and flip the
+    // auth-resolution gate. A deliberate sign-in ACTIVATES the account and
+    // BLOCKS on the reconcile (register + socket + sessions projection) before
+    // resolving — unchanged ordering. The cold boot resolves auth from the
+    // profile fetch FIRST and reconciles the device set in the background, so
+    // first paint is not held behind those extra round-trips. Reconcile is
+    // best-effort — a failure never fails the sign-in (cold boot re-registers
+    // on the next load).
+    await (0, _commitSessionFlow.commitDeviceSetAndResolve)({
+      activate: options.activate,
+      userId: input.userId,
+      fallbackUser: input.user ?? null,
+      registerAndActivate: userId => sessionClient.registerAndActivate(userId),
+      addCurrentAccount: () => sessionClient.addCurrentAccount(),
+      startSocket: () => sessionClient.start(),
+      syncFromClient,
+      getCurrentUser: () => oxyServices.getCurrentUser(),
+      loginSuccess,
+      onAuthStateChange: onAuthStateChangeRef.current,
+      markAuthResolved: markAuthResolvedRef.current
+    });
+  }, [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, sessionClientHost, syncFromClient, loginSuccess, logger]);
+  const commitSessionRef = (0, _react.useRef)(commitSession);
+  commitSessionRef.current = commitSession;
+
+  // Public `handleWebSession`: commit a session from the QR device flow. It is a
+  // deliberate sign-in on THIS device, so it activates the account.
+  const handleWebSession = (0, _react.useCallback)(async session => {
+    if (!session?.user || !session?.sessionId || !session.accessToken) {
+      throw new Error('Session response did not include a usable session');
+    }
+    await commitSession({
+      sessionId: session.sessionId,
+      accessToken: session.accessToken,
+      deviceSecret: session.deviceSecret,
+      deviceId: session.deviceId,
+      expiresAt: session.expiresAt,
+      userId: session.user.id,
+      user: session.user
+    }, {
+      activate: true
+    });
+  }, [commitSession]);
+
+  // Commit a minted graph-SWITCH session through the same funnel as
+  // `handleWebSession`. Nothing extra to do IN-PLACE: the switch already
+  // propagates across tabs/apps via the server's `session_state` socket
+  // broadcast.
+  const commitSwitchedSession = (0, _react.useCallback)(async session => {
+    if (!session?.user || !session?.sessionId || !session.accessToken) {
+      throw new Error('Session response did not include a usable session');
+    }
+    await commitSession({
+      sessionId: session.sessionId,
+      accessToken: session.accessToken,
+      deviceSecret: session.deviceSecret,
+      deviceId: session.deviceId,
+      expiresAt: session.expiresAt,
+      userId: session.user.id,
+      user: session.user
+    }, {
+      activate: true
+    });
+  }, [commitSession]);
+
+  // ── Web third-party OAuth sign-in ──────────────────────────────────────────
+  // The shared operation `OxySignInButton` (and any RP-owned button) delegates
+  // to, so no consumer ever writes popup listeners or a token exchange. The
+  // transport picks popup vs redirect from `webAuthMode`; both lanes land on the
+  // SAME completion path (`completeOAuthCode`) and the same commit funnel here.
+  const startWebOAuthSignInForContext = (0, _react.useCallback)(options => (0, _browserAuthTransport.startWebOAuthSignIn)({
+    mode: webAuthMode,
+    oxyServices,
+    clientId,
+    authorizeBaseUrl,
+    identityBound: isIdentityBound,
+    commitSession: input => commitSessionRef.current(input, {
+      activate: true
+    })
+  }, options), [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound]);
+
+  // ── Unified account dialog ─────────────────────────────────────────────────
+  // The single account-chooser + sign-in surface. Built ONCE per provider mount
+  // and bound to the live `oxyServices` + `sessionClient` + this provider's
+  // commit funnels. Both funnels are threaded through refs so the controller
+  // keeps STABLE commit callbacks (rebuilding the controller on every
+  // commit-identity change would drop its subscription + state).
+  const handleWebSessionRef = (0, _react.useRef)(handleWebSession);
+  handleWebSessionRef.current = handleWebSession;
+  const commitSwitchedSessionRef = (0, _react.useRef)(commitSwitchedSession);
+  commitSwitchedSessionRef.current = commitSwitchedSession;
+
+  // The live AccountDialog surface (a stacked Bloom surface), while open — the
+  // SINGLE source of truth for "is the account dialog open". Held so
+  // `openAccountDialog` can no-op when already open and `closeAccountDialog` /
+  // `onSignedIn` can dismiss it. Its present→settle lifecycle is what drives the
+  // reactive `accountDialogOpen` mirror below: presenting flips it true, the
+  // surface settling (`result.finally`) flips it false — no other write site.
+  const accountDialogSurfaceRef = (0, _react.useRef)(null);
+
+  // When the account dialog is shown by MORPHING an already-open route surface
+  // (e.g. ManageAccount → the account switcher) it is pushed as a frame ONTO that
+  // surface rather than presented as its own. This holds that host surface so the
+  // close path can pop the AccountDialog frame back to it. `null` when the dialog
+  // is its OWN detached surface (opened cold, with no surface underneath).
+  const accountDialogHostRef = (0, _react.useRef)(null);
+
+  // The single teardown for the account dialog wherever it lives: pop the morphed
+  // frame back to its host surface (reshaping Manage ← switcher), or dismiss the
+  // detached surface (whose settle then flips `accountDialogOpen`). Reads only
+  // stable refs + `setAccountDialogOpen`, so its identity never changes.
+  const dismissAccountDialogSurface = (0, _react.useCallback)(() => {
+    const host = accountDialogHostRef.current;
+    if (host) {
+      accountDialogHostRef.current = null;
+      setAccountDialogOpen(false);
+      host.goBack();
+      return;
+    }
+    accountDialogSurfaceRef.current?.dismiss();
+  }, []);
+
+  // Never built while identity-bound: the dialog exists to CHOOSE an account,
+  // and an identity-bound client has exactly one — the owner of the local
+  // identity key. Leaving it `null` (the same shape consumers see with no
+  // provider mounted) keeps its QR/polling machinery off entirely instead of
+  // relying on UI-level filtering to hide it.
+  const accountDialogControllerRef = (0, _react.useRef)(null);
+  if (!isIdentityBound && !accountDialogControllerRef.current) {
+    accountDialogControllerRef.current = (0, _core.createAccountDialogController)({
+      oxyServices,
+      sessionClient,
+      clientId,
+      locale: currentLanguage,
+      // Same statically-injected `io` as the SessionClient: gives the QR flow an
+      // instant `/auth-session` `auth_update` wake instead of a slow poll.
+      socketFactory: _socket.io,
+      commitSession: session => handleWebSessionRef.current(session),
+      commitSwitchedSession: session => commitSwitchedSessionRef.current(session),
+      onSignedIn: () => {
+        // Close the dialog: pop the morphed frame back to its host surface, or
+        // dismiss the detached surface (whose settle flips `accountDialogOpen`).
+        dismissAccountDialogSurface();
+      },
+      openUrl: url => {
+        if ((0, _isWebBrowser.isWebBrowser)()) {
+          (0, _oauthNavigation.redirectToAuthorize)(url);
+          return;
+        }
+        void _reactNative.Linking.openURL(url);
+      },
+      // Native-only probe so the controller can detect an installed Commons and
+      // deep-link straight into its approve screen (keeping the QR/polling live
+      // as fallback). `undefined` on web mirrors the `openUrl` split — the
+      // controller short-circuits, so `redirectToAuthorize` never runs for the
+      // `oxycommons://` payload.
+      canOpenApp: (0, _isWebBrowser.isWebBrowser)() ? undefined : url => _reactNative.Linking.canOpenURL(url),
+      // Web-only: lets `startPasskeyHubSignIn` open the auth.oxy.so passkey hub
+      // popup (b2) for a non-Oxy origin. `undefined` on native — there is no
+      // popup concept there, and off-origin passkey sign-in isn't reachable
+      // (Commons owns the native flow).
+      openPopup: (0, _isWebBrowser.isWebBrowser)() ? _passkeyHubPopup.openPasskeyHubPopup : undefined,
+      // Which surface a sign-in starts from — a FACT only this consumer can
+      // supply (headless core never touches a platform global). It decides
+      // whether automatic delivery may take the same-device Commons deep link;
+      // without it the controller stays `'unknown'` and that route never fires.
+      platform: (0, _deliveryPlatform.resolveDeliveryPlatform)()
+    });
+  }
+  const accountDialogController = accountDialogControllerRef.current;
+  const openAccountDialog = (0, _react.useCallback)(view => {
+    if (isIdentityBound) {
+      // No controller was built, and there is nothing to choose: this app's user
+      // is fixed to the owner of the local identity key.
+      if (__DEV__) {
+        _core.logger.warn('openAccountDialog ignored: the session is identity-bound (sessionMode: "identity")', {
+          component: 'OxyContext',
+          method: 'openAccountDialog'
+        });
+      }
+      return;
+    }
+    const nextView = view ?? 'accounts';
+    accountDialogControllerRef.current?.setView(nextView);
+
+    // Its own detached surface is already open → just re-point the view above.
+    if (accountDialogSurfaceRef.current) {
+      setAccountDialogOpen(true);
+      return;
+    }
+
+    // When a route surface (e.g. ManageAccount) is already open, MORPH it in
+    // place: push the AccountDialog as a frame ONTO that surface, so the panel
+    // reshapes from that surface to the switcher and a back returns to it. With no
+    // surface open (opened cold from a sign-in button), present the dialog as its
+    // OWN detached surface — kept OUT of the `showBottomSheet` route-surface
+    // lineage so closing the bottom-sheet session never touches it and vice-versa.
+    // `navigate` is idempotent for the top frame (it replaces rather than
+    // duplicates), so calling this while already morphed in just re-points the
+    // view, and calling it after a back re-pushes the frame — no stale guard.
+    const host = (0, _surfaces.topRouteSurface)();
+    if (host) {
+      accountDialogHostRef.current = host;
+      host.navigate('AccountDialog', {
+        initialView: nextView
+      });
+      setAccountDialogOpen(true);
+      return;
+    }
+    const instance = (0, _surfaces.presentDetached)('AccountDialog', {
+      initialView: nextView
+    }, {
+      placement: {
+        base: 'bottom',
+        md: 'center'
+      },
+      dismissOnBackdrop: false,
+      maxWidth: 420
+    });
+    accountDialogSurfaceRef.current = instance;
+    // The surface settling is the ONE place `accountDialogOpen` flips false for
+    // the detached path — covering every dismiss (close button, `onSignedIn`,
+    // programmatic `closeAccountDialog`, host unmount). The morphed path clears
+    // its own state in `dismissAccountDialogSurface`.
+    instance.result.finally(() => {
+      if (accountDialogSurfaceRef.current === instance) {
+        accountDialogSurfaceRef.current = null;
+        setAccountDialogOpen(false);
+      }
+    });
+    setAccountDialogOpen(true);
+  }, [isIdentityBound]);
+  const closeAccountDialog = (0, _react.useCallback)(() => {
+    accountDialogControllerRef.current?.cancelSignIn();
+    dismissAccountDialogSurface();
+  }, [dismissAccountDialogSurface]);
+
+  // Start driving the dialog on mount; tear it down on unmount.
+  (0, _react.useEffect)(() => {
+    const controller = accountDialogControllerRef.current;
+    controller?.start();
+    return () => controller?.destroy();
+  }, []);
+
+  // Expose the live open/close controls to the imperative manager so
+  // Imperative `openAccountDialog('signin')` (and app-level sign-in handlers) works.
+  (0, _react.useEffect)(() => (0, _accountDialogManager.registerAccountDialogControls)({
+    open: openAccountDialog,
+    close: closeAccountDialog
+  }), [openAccountDialog, closeAccountDialog]);
+
+  // Broadcast visibility so `OxySignInButton`'s "Signing in…" affordance stays
+  // accurate regardless of what opened or dismissed the dialog.
+  (0, _react.useEffect)(() => {
+    (0, _accountDialogManager.notifyAccountDialogVisibility)(accountDialogOpen);
+  }, [accountDialogOpen]);
+
+  // ── Passkey (WebAuthn) ─────────────────────────────────────────────────────
+  // Web-only sign-in / registration via the browser WebAuthn ceremony. The fixed
+  // `options → ceremony → verify → commit` ordering lives in the pure
+  // `passkeyFlow` helpers (deps-injected, unit-tested); these wrappers supply the
+  // real deps (core `webauthn*` methods, the platform ceremony client, and the
+  // `commitSession` funnel). All three GATE on `isPasskeySupported()` so a native
+  // / unsupported surface throws loudly instead of stalling in a ceremony.
+
+  // Passkey sign-in. No `username` → usernameless (discoverable) flow. With a
+  // `username` → username-first: the server scopes `allowCredentials` to that
+  // user's passkeys so a non-discoverable hardware key (U2F/security key) can
+  // be selected.
+  const signInWithPasskey = (0, _react.useCallback)(async opts => {
+    const persisted = await authStore.load();
+    await (0, _passkeyFlow.runPasskeyLogin)({
+      isSupported: _passkeyClient.isPasskeySupported,
+      getLoginOptions: username => oxyServices.webauthnLoginOptions(username),
+      runCeremony: _passkeyClient.runAuthenticationCeremony,
+      loginVerify: (response, envelope) => oxyServices.webauthnLoginVerify(response, envelope),
+      commit: input => commitSession(input, {
+        activate: true
+      }),
+      username: opts?.username,
+      deviceId: persisted?.deviceId,
+      deviceName: opts?.deviceName,
+      deviceFingerprint: opts?.deviceFingerprint
+    });
+  }, [oxyServices, authStore, commitSession]);
+
+  // Create a brand-new account whose first auth method is a passkey.
+  const registerWithPasskey = (0, _react.useCallback)(async params => {
+    await (0, _passkeyFlow.runPasskeyRegister)({
+      isSupported: _passkeyClient.isPasskeySupported,
+      getRegisterOptions: username => oxyServices.webauthnRegisterOptions(username),
+      runCeremony: _passkeyClient.runRegistrationCeremony,
+      registerVerify: (response, envelope) => oxyServices.webauthnRegisterVerify(response, envelope),
+      commit: input => commitSession(input, {
+        activate: true
+      }),
+      username: params.username,
+      deviceName: params.deviceName
+    });
+  }, [oxyServices, commitSession]);
+
+  // Add a passkey to the already-signed-in account (bearer present). No new
+  // session is committed — just refresh the linked auth-methods list.
+  const addPasskey = (0, _react.useCallback)(async params => {
+    await (0, _passkeyFlow.runPasskeyAdd)({
+      isSupported: _passkeyClient.isPasskeySupported,
+      getRegisterOptions: () => oxyServices.webauthnRegisterOptions(),
+      runCeremony: _passkeyClient.runRegistrationCeremony,
+      registerVerify: (response, envelope) => oxyServices.webauthnRegisterVerify(response, envelope),
+      onLinked: () => {
+        void queryClient.invalidateQueries({
+          queryKey: _queryKeys.queryKeys.authMethods.all
+        });
+      },
+      deviceName: params?.deviceName
+    });
+  }, [oxyServices, queryClient]);
+
+  // Remove a passkey from the already-signed-in account by credential id. Not a
+  // ceremony — a plain unlink — so it needs no `isPasskeySupported` gate; it just
+  // refreshes the linked auth-methods list on success.
+  const removePasskey = (0, _react.useCallback)(async credentialId => {
+    await oxyServices.removePasskey(credentialId);
+    void queryClient.invalidateQueries({
+      queryKey: _queryKeys.queryKeys.authMethods.all
+    });
+  }, [oxyServices, queryClient]);
+
+  // ── Cold boot ────────────────────────────────────────────────────────────
+  // Device-first session restore via `runProviderColdBoot` (see boot/runProviderColdBoot.ts).
+  const runColdBoot = (0, _react.useCallback)(async () => {
+    // Resolve the pin BEFORE any boot lane runs: `getPinnedAccountId()` is a
+    // SYNCHRONOUS read on `SessionClient`'s apply path, and a stale `null` there
+    // would let a pinned client behave like an account-mode one for the first
+    // state it applies (including re-electing the device's active account).
+    if (identity) {
+      await identity.ensurePinnedAccountId();
+    }
+    await (0, _runProviderColdBoot.runProviderColdBoot)({
+      oxyServices,
+      authStore,
+      clientId: clientIdProp,
+      authRedirectUri,
+      sessionMode,
+      identity: identity?.binding,
+      sessionClient,
+      syncDeviceCredentialToHost,
+      commitSession: (input, options) => commitSessionRef.current(input, options),
+      markAuthResolved: () => markAuthResolvedRef.current(),
+      setTokenReady
+    });
+    // The boot may have (re-)established the identity session or cleared a pin
+    // whose key no longer exists, so re-resolve rather than trusting the memo
+    // taken before it ran.
+    if (identity) {
+      await identity.refreshPinnedAccountId();
+    }
+  }, [oxyServices, authStore, clientIdProp, authRedirectUri, sessionMode, identity, syncDeviceCredentialToHost, sessionClient]);
+  (0, _react.useEffect)(() => {
+    if (initialized) {
+      return;
+    }
+    if (!storage) {
+      return;
+    }
+    setInitialized(true);
+    runColdBoot().catch(error => {
+      if (__DEV__) {
+        logger('Cold boot failed', error);
+      }
+    });
+  }, [runColdBoot, storage, initialized, logger]);
+
+  // Reconcile device state when the tab returns to foreground (background tabs may
+  // miss socket pushes or have stale bearer tokens).
+  (0, _react.useEffect)(() => {
+    if (!(0, _isWebBrowser.isWebBrowser)()) return;
+    const onVisibility = () => {
+      if (document.visibilityState !== 'visible') return;
+      const reconcile = async () => {
+        if (!oxyServices.getAccessToken() && sessionClientHost.getDeviceCredential()) {
+          // Route through the ONE shared single-flight the scheduler/preflight/401
+          // use — never a private mint lane — so a tab-focus reconcile can't
+          // double-rotate the device secret against them.
+          await oxyServices.httpService.refreshAccessToken('preflight');
+        }
+        if (!oxyServices.getAccessToken() && !sessionClientHost.getDeviceCredential()) {
+          return;
+        }
+        await sessionClient.bootstrap();
+        await syncFromClient();
+      };
+      void reconcile().catch(() => undefined);
+    };
+    document.addEventListener('visibilitychange', onVisibility);
+    return () => document.removeEventListener('visibilitychange', onVisibility);
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
+
+  // Reconnect heal: when connectivity transitions offline→online while there is
+  // no live access token but a persisted device credential exists, re-mint ONCE
+  // through the SAME shared single-flight lane the scheduler / tab-focus
+  // reconcile / 401 path use — never a private mint lane, so this can't
+  // double-rotate the device secret against them. A device that cold-booted
+  // OFFLINE skipped the network mint step, so its session is otherwise only
+  // recovered by the next scheduled re-mint; healing on the reconnect edge makes
+  // recovery immediate. `onlineManager` is fed by OxyProvider's existing NetInfo
+  // (native) / `navigator.onLine` (web) listener, so this reuses the one
+  // connectivity signal instead of opening a second NetInfo subscription. Works
+  // on native and web alike.
+  (0, _react.useEffect)(() => {
+    // Seed from the current verdict so the first callback heals only on a
+    // genuine offline→online edge, never an initial subscribe fan-out.
+    let previousOnline = _reactQuery.onlineManager.isOnline();
+    return _reactQuery.onlineManager.subscribe(online => {
+      const wasOffline = previousOnline === false;
+      previousOnline = online;
+      if (!online || !wasOffline) {
+        return;
+      }
+      void (async () => {
+        if (oxyServices.getAccessToken() || !sessionClientHost.getDeviceCredential()) {
+          return;
+        }
+        await oxyServices.httpService.refreshAccessToken('preflight');
+        if (!oxyServices.getAccessToken()) {
+          return;
+        }
+        await sessionClient.bootstrap();
+        await syncFromClient();
+      })().catch(() => undefined);
+    });
+  }, [oxyServices, sessionClient, sessionClientHost, syncFromClient]);
+
+  // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
+  // state and reproject — the manual counterpart to the realtime socket.
+  const refreshSessionsForContext = (0, _react.useCallback)(async () => {
+    await sessionClient.bootstrap();
+    await syncFromClient();
+  }, [sessionClient, syncFromClient]);
+
+  // Exposed `switchSession`: route through the server-authoritative
+  // `SessionClient`. Resolve the target account from the current device state,
+  // ask the server to switch, reproject, and return the now-active user.
+  //
+  // Identity-bound providers reject: this is the session-keyed twin of
+  // `switchToAccount`, so leaving it live would be a bypass around the same rule.
+  const switchSessionForContext = (0, _react.useCallback)(async sessionId => {
+    if (isIdentityBound) {
+      throw new _index.IdentityBoundSessionError('switchSession');
+    }
+    const targetAccountId = sessionClient.getState()?.accounts.find(account => account.sessionId === sessionId)?.accountId;
+    if (!targetAccountId) {
+      throw new Error(`No device account found for session "${sessionId}"`);
+    }
+    await sessionClient.switchAccount(targetAccountId);
+    await syncFromClient();
+    const activeUser = _authStore.useAuthStore.getState().user;
+    if (!activeUser) {
+      throw new Error('Active account profile could not be resolved after switch');
+    }
+    return activeUser;
+  }, [isIdentityBound, sessionClient, syncFromClient]);
+
+  // Thin passthroughs to the platform-agnostic KeyManager. NOTE: both now THROW
+  // `IdentityUnavailableError` (from `@oxyhq/core`) when identity storage is
+  // locked/unreadable, instead of flattening that into `false`/`null`. We keep
+  // the signatures and deliberately let the typed error PROPAGATE to the caller
+  // — a locked keychain must never be misreported as "no identity". `hasIdentity`
+  // still resolves `false` and `getPublicKey` still resolves `null` for a genuine
+  // absence.
+  const hasIdentity = (0, _react.useCallback)(async () => _core.KeyManager.hasIdentity(), []);
+  const getPublicKey = (0, _react.useCallback)(async () => _core.KeyManager.getPublicKey(), []);
+  const showBottomSheetForContext = (0, _react.useCallback)(screenOrConfig => {
+    (0, _bottomSheetManager.showBottomSheet)(screenOrConfig);
+  }, []);
+  const {
+    openAvatarPicker
+  } = (0, _useAvatarPicker.useAvatarPicker)({
+    oxyServices,
+    currentLanguage,
+    activeSessionId,
+    queryClient
+  });
+  const {
+    accounts,
+    refreshAccounts,
+    switchToAccount,
+    createAccount: createAccountFn
+  } = (0, _useOxyAccountGraph.useOxyAccountGraph)({
+    isAuthenticated,
+    tokenReady,
+    initialized,
+    identityBound: isIdentityBound,
+    oxyServices,
+    sessionClient,
+    syncFromClient,
+    commitSession,
+    queryClient,
+    accountDialogControllerRef,
+    clearSessionStateRef
+  });
+  const canUsePrivateApi = authResolved && isAuthenticated && tokenReady && hasAccessToken;
+  const isPrivateApiPending = !authResolved || isAuthenticated && (!tokenReady || !hasAccessToken);
+  const contextValue = (0, _react.useMemo)(() => ({
+    user,
+    sessions,
+    activeSessionId,
+    isAuthenticated,
+    isLoading,
+    isTokenReady: tokenReady,
+    hasAccessToken,
+    canUsePrivateApi,
+    isPrivateApiPending,
+    isAuthResolved: authResolved,
+    isStorageReady: storage !== null,
+    sessionMode: isIdentityBound ? 'identity' : 'account',
+    webAuthMode,
+    error,
+    currentLanguage,
+    currentLanguages,
+    currentLanguageMetadata,
+    currentLanguageName,
+    currentNativeLanguageName,
+    hasIdentity,
+    getPublicKey,
+    signIn,
+    signInWithPasskey,
+    registerWithPasskey,
+    addPasskey,
+    removePasskey,
+    revokeSuspiciousSignIn,
+    handleWebSession,
+    startWebOAuthSignIn: startWebOAuthSignInForContext,
+    logout,
+    logoutAll,
+    switchSession: switchSessionForContext,
+    removeSession: logout,
+    refreshSessions: refreshSessionsForContext,
+    setLanguage,
+    getDeviceSessions,
+    logoutAllDeviceSessions,
+    updateDeviceName,
+    clearSessionState,
+    clearAllAccountData,
+    storageKeyPrefix,
+    clientId,
+    oxyServices,
+    sessionClient,
+    useFollow: useFollowHook,
+    showBottomSheet: showBottomSheetForContext,
+    openAvatarPicker,
+    accountDialogController,
+    isAccountDialogOpen: accountDialogOpen,
+    openAccountDialog,
+    closeAccountDialog,
+    accounts,
+    switchToAccount,
+    refreshAccounts,
+    createAccount: createAccountFn
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, storage, isIdentityBound, webAuthMode, error, currentLanguage, currentLanguages, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPasskey, registerWithPasskey, addPasskey, removePasskey, revokeSuspiciousSignIn, handleWebSession, startWebOAuthSignInForContext, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, sessionClient, useFollowHook, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(OxyContext.Provider, {
+    value: contextValue,
+    children: children
+  });
+};
+exports.OxyProvider = OxyProvider;
+const OxyContextProvider = exports.OxyContextProvider = OxyProvider;
+
+/**
+ * Loading-state stub used when `useOxy()` is called outside an OxyProvider.
+ * All async methods reject with a clear error so misuse is caught early.
+ */
+const PROVIDER_MISSING_ERROR_MESSAGE = 'OxyProvider is not mounted. Wrap your app in <OxyProvider> before calling useOxy() methods.';
+const rejectMissingProvider = () => Promise.reject(new Error(PROVIDER_MISSING_ERROR_MESSAGE));
+const LOADING_STATE_OXY_SERVICES = new _core.OxyServices({
+  baseURL: 'about:blank'
+});
+const LOADING_STATE = {
+  user: null,
+  sessions: [],
+  activeSessionId: null,
+  isAuthenticated: false,
+  isLoading: true,
+  isTokenReady: false,
+  hasAccessToken: false,
+  canUsePrivateApi: false,
+  isPrivateApiPending: true,
+  isAuthResolved: false,
+  isStorageReady: false,
+  sessionMode: 'account',
+  webAuthMode: 'popup',
+  error: null,
+  currentLanguage: 'en-US',
+  currentLanguages: [],
+  currentLanguageMetadata: null,
+  currentLanguageName: 'English (United States)',
+  currentNativeLanguageName: 'English (United States)',
+  hasIdentity: () => Promise.resolve(false),
+  getPublicKey: () => Promise.resolve(null),
+  signIn: () => rejectMissingProvider(),
+  signInWithPasskey: () => rejectMissingProvider(),
+  registerWithPasskey: () => rejectMissingProvider(),
+  addPasskey: () => rejectMissingProvider(),
+  removePasskey: () => rejectMissingProvider(),
+  revokeSuspiciousSignIn: () => rejectMissingProvider(),
+  handleWebSession: () => rejectMissingProvider(),
+  startWebOAuthSignIn: () => rejectMissingProvider(),
+  logout: () => rejectMissingProvider(),
+  logoutAll: () => rejectMissingProvider(),
+  switchSession: () => rejectMissingProvider(),
+  removeSession: () => rejectMissingProvider(),
+  refreshSessions: () => rejectMissingProvider(),
+  setLanguage: () => rejectMissingProvider(),
+  getDeviceSessions: () => Promise.resolve([]),
+  logoutAllDeviceSessions: () => rejectMissingProvider(),
+  updateDeviceName: () => rejectMissingProvider(),
+  clearSessionState: () => rejectMissingProvider(),
+  clearAllAccountData: () => rejectMissingProvider(),
+  storageKeyPrefix: 'oxy_session',
+  clientId: null,
+  oxyServices: LOADING_STATE_OXY_SERVICES,
+  sessionClient: null,
+  openAvatarPicker: () => {},
+  accountDialogController: null,
+  isAccountDialogOpen: false,
+  openAccountDialog: () => {},
+  closeAccountDialog: () => {},
+  accounts: [],
+  switchToAccount: () => rejectMissingProvider(),
+  refreshAccounts: () => rejectMissingProvider(),
+  createAccount: () => rejectMissingProvider()
+};
+const useOxy = () => {
+  const context = (0, _react.useContext)(OxyContext);
+  if (!context) {
+    return LOADING_STATE;
+  }
+  return context;
+};
+exports.useOxy = useOxy;
+//# sourceMappingURL=OxyContext.js.map