@oxyhq/services 25.0.1 → 26.0.1

package/src/ui/components/authChooser/AccountsMenuView.tsx

@@ -25,7 +25,7 @@
 
 import type React from 'react';
 import { Fragment, useCallback, useState } from 'react';
-import { Pressable, View } from 'react-native';
+import { Pressable, View } from 'react-native-css/components';
 import Animated, {
   Extrapolation,
   interpolate,
@@ -99,6 +99,11 @@ const FACEPILE_AVATAR_SIZE = 32;
  */
 const FACEPILE_OVERLAP = 4;
 
+// Vite/RN-Web does not install NativeWind's Metro global className polyfill.
+// Use react-native-css components explicitly so this className markup also
+// works in Vite web hosts.
+const AnimatedCssView = Animated.createAnimatedComponent(View);
+
 /**
  * The hero's address line, shown under the "Hi, <name>!" greeting: the account's
  * canonical `@oxy.so` email when it has one, else its normalized `@handle`. Never
@@ -381,7 +386,7 @@ const AccountsMenuView: React.FC<AccountsMenuViewProps> = ({
       {/* SWITCH ACCOUNT — own NativeWind card, NOT a Bloom grouped section: it
           is a disclosure header over an animated list, not a list of settings
           rows, and the grouped section is not a bare card container. */}
-      <Animated.View className="bg-fill overflow-hidden mb-space-16" style={switchCardStyle}>
+      <AnimatedCssView className="bg-fill overflow-hidden mb-space-16" style={switchCardStyle}>
         <HoverPressable
           baseClassName={`flex-row items-center gap-space-12 px-space-12 py-[10px] min-h-[44px]${
             switchingDisabled ? ' opacity-60' : ''
@@ -424,7 +429,7 @@ const AccountsMenuView: React.FC<AccountsMenuViewProps> = ({
         {/* Animated reveal: an overflow-clipped container whose height + opacity
             are driven by `listProgress`; the inner style-based wrapper measures
             the natural content height via `onLayout`. */}
-        <Animated.View
+        <AnimatedCssView
           style={[styles.collapse, listStyle]}
           pointerEvents={expanded ? 'auto' : 'none'}
         >
@@ -434,8 +439,8 @@ const AccountsMenuView: React.FC<AccountsMenuViewProps> = ({
           >
             <View>{listItems}</View>
           </View>
-        </Animated.View>
-      </Animated.View>
+        </AnimatedCssView>
+      </AnimatedCssView>
 
       {/* OXY STORAGE — own NativeWind card for the same reason: a title, a meter
           and two chips are not settings rows. Its cloud sits in the same 20px

package/src/ui/components/authChooser/primitives.tsx

@@ -6,7 +6,7 @@
 
 import type React from 'react';
 import { useState } from 'react';
-import { Pressable, View } from 'react-native';
+import { Pressable, View } from 'react-native-css/components';
 import MaterialCommunityIcons from '@expo/vector-icons/MaterialCommunityIcons';
 import { Avatar } from '@oxyhq/bloom/avatar';
 import { Text } from '@oxyhq/bloom/typography';

package/src/ui/components/authChooser/useUsernameAvailability.ts

@@ -8,7 +8,7 @@
  */
 
 import { useCallback, useRef, useState } from 'react';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import type { OxyServices } from '@oxyhq/core';
 import type { Translate } from './types';
 

package/src/ui/components/fileManagement/UploadPreview.tsx

@@ -2,7 +2,7 @@ import type React from 'react';
 import { View, Text, TouchableOpacity, ScrollView, StyleSheet } from 'react-native';
 import { Image as ExpoImage } from 'expo-image';
 import Ionicons from '@expo/vector-icons/Ionicons';
-import { Dialog, type DialogControlProps } from '@oxyhq/bloom/dialog';
+import { Dialog, type DialogControlProps } from '@oxyhq/bloom';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { formatFileSize, getFileIcon } from '../../utils/fileManagement';
 import type { PendingUploadFile } from '../../screens/fileManagement/shared';

package/src/ui/components/internal/PinInput.tsx

@@ -64,7 +64,6 @@ const PinInput = forwardRef<PinInputHandle, PinInputProps>(({ value, onChange, l
         <View style={styles.pinContainer}>
             {Array.from({ length }).map((_, idx) => (
                 <TextInput
-                    // biome-ignore lint/suspicious/noArrayIndexKey: fixed-position PIN cells, order never changes
                     key={`pin-input-${idx}`}
                     ref={(ref) => { inputs.current[idx] = ref; }}
                     style={[

package/src/ui/components/logo/LogoText.tsx

@@ -55,13 +55,13 @@ export const LogoText: React.FC<LogoTextProps> = ({
   return (
     <Svg viewBox={`0 0 ${VIEW_BOX_WIDTH} ${VIEW_BOX_HEIGHT}`} width={width} height={height} style={style}>
       <G>
-        {OUTER_PATHS.map((d) => (
-          <Path key={d} d={d} fill={resolvedColor} />
+        {OUTER_PATHS.map((d, i) => (
+          <Path key={`outer-${i}`} d={d} fill={resolvedColor} />
         ))}
       </G>
       <G transform="translate(10.316 2.495)">
-        {INNER_LETTER_PATHS.map((d) => (
-          <Path key={d} d={d} fill={resolvedLetterColor} />
+        {INNER_LETTER_PATHS.map((d, i) => (
+          <Path key={`inner-${i}`} d={d} fill={resolvedLetterColor} />
         ))}
       </G>
     </Svg>

package/src/ui/components/payment/PaymentDetailsStep.tsx

@@ -6,7 +6,7 @@ import { Button } from '@oxyhq/bloom/button';
 import { TextField, TextFieldInput } from '@oxyhq/bloom/text-field';
 import FAIRWalletIcon from '../icon/FAIRWalletIcon';
 import { createPaymentStyles } from './paymentStyles';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import type { CardDetails, PaymentColors, PaymentStepAnimations } from './types';
 import { useI18n } from '../../hooks/useI18n';
 

package/src/ui/components/payment/PaymentSummaryStep.tsx

@@ -85,9 +85,9 @@ const PaymentSummaryStep: React.FC<PaymentSummaryStepProps> = ({
                             <>
                                 <View style={styles.summaryCardItems}>
                                     <SettingsListGroup>
-                                        {paymentItems.map((item) => (
+                                        {paymentItems.map((item, idx) => (
                                             <SettingsListItem
-                                                key={`${item.type}-${item.name}-${item.price}-${item.period ?? ''}`}
+                                                key={`item-${idx}`}
                                                 icon={<Ionicons name={getItemTypeIcon(item.type)} size={20} color={colors.primary} />}
                                                 title={`${item.type === 'product' && item.quantity ? `${item.quantity} \u00d7 ` : ''}${item.name}${item.type === 'subscription' && item.period ? ` (${item.period})` : ''}`}
                                                 description={item.description || `${item.currency ? (CURRENCY_SYMBOLS[item.currency.toUpperCase()] || item.currency) : currencySymbol} ${item.price * (item.quantity ?? 1)}`}

package/src/ui/components/payment/types.ts

@@ -1,41 +1,41 @@
-import type Ionicons from "@expo/vector-icons/Ionicons";
-import type { ThemeColors } from "@oxyhq/bloom/theme";
-import type React from "react";
-import type { Animated } from "react-native";
+import type React from 'react';
+import type { Animated } from 'react-native';
+import type Ionicons from '@expo/vector-icons/Ionicons';
+import type { ThemeColors } from '@oxyhq/bloom/theme';
 
 export type PaymentItem = {
-	type: "product" | "subscription" | "service" | "fee" | string;
-	name: string;
-	description?: string;
-	quantity?: number;
-	period?: string;
-	price: number;
-	currency?: string;
+    type: 'product' | 'subscription' | 'service' | 'fee' | string;
+    name: string;
+    description?: string;
+    quantity?: number;
+    period?: string;
+    price: number;
+    currency?: string;
 };
 
 export interface PaymentGatewayResult {
-	success: boolean;
-	details?: Record<string, string | number | boolean | null>;
-	error?: string;
+    success: boolean;
+    details?: Record<string, string | number | boolean | null>;
+    error?: string;
 }
 
 export interface CardDetails {
-	number: string;
-	expiry: string;
-	cvv: string;
+    number: string;
+    expiry: string;
+    cvv: string;
 }
 
 export interface PaymentMethod {
-	key: string;
-	label: string;
-	icon: React.ComponentProps<typeof Ionicons>["name"];
-	description: string;
+    key: string;
+    label: string;
+    icon: React.ComponentProps<typeof Ionicons>['name'];
+    description: string;
 }
 
 export interface PaymentStepAnimations {
-	fadeAnim: Animated.Value;
-	slideAnim: Animated.Value;
-	scaleAnim: Animated.Value;
+    fadeAnim: Animated.Value;
+    slideAnim: Animated.Value;
+    scaleAnim: Animated.Value;
 }
 
 /**

package/src/ui/components/styles/shadow.tsx

@@ -48,8 +48,8 @@ function v2Shadow(elevation: number | Animated.Value = 0): ViewStyle | ShadowSty
       return {};
     }
 
-    let height: number;
-    let radius: number;
+    let height;
+    let radius;
     switch (elevation) {
       case 1:
         height = 0.5;

package/src/ui/context/OxyContext.tsx

@@ -26,6 +26,7 @@ import {
   startTokenRefreshScheduler,
   createAccountDialogController,
   logger as loggerUtil,
+  syncHubAfterSignIn,
 } from '@oxyhq/core';
 import {
   registerAccountDialogControls,
@@ -70,7 +71,6 @@ import {
   activeUserOf,
   accountIdsOf,
   IdentityBoundSessionError,
-  useBackgroundSessionSync,
   type IdentitySessionBinding,
 } from '../session';
 import type {
@@ -79,7 +79,7 @@ import type {
   CommitInput,
 } from './oxyContextTypes';
 import { DEFAULT_SESSION_VALIDITY_MS, loadUseFollowHook } from './oxyContextHelpers';
-import { commitDeviceSetAndResolve } from './commitSessionFlow';
+import { commitDeviceSetAndResolve, maybeSyncHubAfterCommit } from './commitSessionFlow';
 import { runPasskeyLogin, runPasskeyRegister, runPasskeyAdd } from './passkeyFlow';
 import {
   isPasskeySupported,
@@ -103,8 +103,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   storageKeyPrefix = 'oxy_session',
   clientId: clientIdProp,
   sessionMode = 'account',
-  webAuthMode = 'popup',
-  backgroundSession = false,
+  webAuthMode = 'redirect',
+  hubSync = true,
   onAuthStateChange,
   onError,
 }) => {
@@ -501,12 +501,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     logoutStore,
     setAuthState,
     logger,
-    ...(identity
-      ? {
-          identityBinding: identity.binding,
-          refreshPinnedAccountId: () => identity.refreshPinnedAccountId(),
-        }
-      : {}),
   });
 
   // "That wasn't me": repudiating a flagged sign-in IS revoking the device
@@ -586,7 +580,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     };
     handleTokenChange(oxyServices.getAccessToken());
     return oxyServices.onTokensChanged(handleTokenChange);
-  }, [logger, oxyServices, sessionClient]);
+  }, [logger, oxyServices]);
 
   // Unified in-session refresh (SDK-owned; every RP inherits it). Installs the
   // ONE core refresh handler (re-mint from the persisted zero-cookie device
@@ -616,7 +610,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // Used by the QR device flow (`handleWebSession`), password sign-in, 2FA
   // completion, and the cold boot.
   const commitSession = useCallback(
-    async (input: CommitInput, options: { activate: boolean }): Promise<void> => {
+    async (
+      input: CommitInput,
+      options: { activate: boolean; hubSync?: boolean },
+    ): Promise<void> => {
       if (input.accessToken) {
         oxyServices.setTokens(input.accessToken);
       }
@@ -684,8 +681,21 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         onAuthStateChange: onAuthStateChangeRef.current,
         markAuthResolved: markAuthResolvedRef.current,
       });
+
+      // Post-sign-in hub sync — a full-page redirect to auth.oxy.so. Gated HERE,
+      // inside the ONE commit funnel, so NO commit path (QR device flow,
+      // password/2FA through the account dialog, passkey, popup OAuth, cold
+      // boot) can bounce a `webAuthMode: 'popup'` tab to the IdP. See
+      // `maybeSyncHubAfterCommit` for the full gate list.
+      await maybeSyncHubAfterCommit({
+        activate: options.activate,
+        hubSyncRequested: options.hubSync === true,
+        hubSyncEnabled: hubSync,
+        webAuthMode,
+        syncHub: () => syncHubAfterSignIn(oxyServices, { enabled: hubSync }),
+      });
     },
-    [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, sessionClientHost, syncFromClient, loginSuccess, logger],
+    [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, sessionClientHost, syncFromClient, loginSuccess, logger, hubSync, webAuthMode],
   );
   const commitSessionRef = useRef(commitSession);
   commitSessionRef.current = commitSession;
@@ -707,16 +717,16 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           userId: session.user.id,
           user: session.user,
         },
-        { activate: true },
+        { activate: true, hubSync: true },
       );
     },
     [commitSession],
   );
 
-  // Commit a minted graph-SWITCH session through the same funnel as
-  // `handleWebSession`. Nothing extra to do IN-PLACE: the switch already
-  // propagates across tabs/apps via the server's `session_state` socket
-  // broadcast.
+  // Commit a minted graph-SWITCH session. Same funnel as `handleWebSession` but
+  // IN-PLACE: `hubSync: false` so switching accounts never triggers the
+  // cross-origin hub-sync full-page redirect. The switch already propagates
+  // across tabs/apps via the server's `session_state` socket broadcast.
   const commitSwitchedSession = useCallback(
     async (session: SessionLoginResponse): Promise<void> => {
       if (!session?.user || !session?.sessionId || !session.accessToken) {
@@ -732,7 +742,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           userId: session.user.id,
           user: session.user,
         },
-        { activate: true },
+        { activate: true, hubSync: false },
       );
     },
     [commitSession],
@@ -743,6 +753,11 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // to, so no consumer ever writes popup listeners or a token exchange. The
   // transport picks popup vs redirect from `webAuthMode`; both lanes land on the
   // SAME completion path (`completeOAuthCode`) and the same commit funnel here.
+  //
+  // `hubSync: false` is deliberate: hub sync is a full-page redirect to
+  // auth.oxy.so, which would undo the one thing popup mode exists to guarantee —
+  // that the relying party never leaves its route. It matches how the redirect
+  // lane's return leg commits (see `runProviderColdBoot`).
   const startWebOAuthSignInForContext = useCallback(
     (options: StartWebOAuthSignInOptions): Promise<WebOAuthSignInResult> =>
       startWebOAuthSignIn(
@@ -752,7 +767,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           clientId,
           authorizeBaseUrl,
           identityBound: isIdentityBound,
-          commitSession: (input) => commitSessionRef.current(input, { activate: true }),
+          commitSession: (input) =>
+            commitSessionRef.current(input, { activate: true, hubSync: false }),
         },
         options,
       ),
@@ -951,7 +967,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         getLoginOptions: (username) => oxyServices.webauthnLoginOptions(username),
         runCeremony: runAuthenticationCeremony,
         loginVerify: (response, envelope) => oxyServices.webauthnLoginVerify(response, envelope),
-        commit: (input) => commitSession(input, { activate: true }),
+        commit: (input) => commitSession(input, { activate: true, hubSync: true }),
         username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
@@ -969,7 +985,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         getRegisterOptions: (username) => oxyServices.webauthnRegisterOptions(username),
         runCeremony: runRegistrationCeremony,
         registerVerify: (response, envelope) => oxyServices.webauthnRegisterVerify(response, envelope),
-        commit: (input) => commitSession(input, { activate: true }),
+        commit: (input) => commitSession(input, { activate: true, hubSync: true }),
         username: params.username,
         deviceName: params.deviceName,
       });
@@ -1021,8 +1037,13 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       authStore,
       clientId: clientIdProp,
       authRedirectUri,
+      authorizeBaseUrl,
       sessionMode,
       identity: identity?.binding,
+      // Popup mode forbids the boot's automatic full-page `prompt=none` restore:
+      // a domain with no local credential resolves signed out instead of
+      // navigating the tab to the IdP (see `allowsAutomaticIdpRedirect`).
+      webAuthMode,
       sessionClient,
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
@@ -1040,8 +1061,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     authStore,
     clientIdProp,
     authRedirectUri,
+    authorizeBaseUrl,
     sessionMode,
     identity,
+    webAuthMode,
     syncDeviceCredentialToHost,
     sessionClient,
   ]);
@@ -1197,18 +1220,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const canUsePrivateApi = authResolved && isAuthenticated && tokenReady && hasAccessToken;
   const isPrivateApiPending = !authResolved || (isAuthenticated && (!tokenReady || !hasAccessToken));
 
-  // Keep the native background credential in step with this session, so native
-  // background code (a widget worker) can authenticate with no JS runtime. Inert
-  // unless the app opted in. Placed AFTER `canUsePrivateApi` because provisioning
-  // needs a bearer, and keyed on the signed-in account so a sign-out or an
-  // account switch revokes the credential before anything else happens.
-  useBackgroundSessionSync({
-    enabled: backgroundSession,
-    oxyServices,
-    userId: user?.id ?? null,
-    canUsePrivateApi,
-  });
-
   const contextValue: OxyContextState = useMemo(
     () => ({
       user,
@@ -1355,7 +1366,7 @@ const LOADING_STATE: OxyContextState = {
   isAuthResolved: false,
   isStorageReady: false,
   sessionMode: 'account',
-  webAuthMode: 'popup',
+  webAuthMode: 'redirect',
   error: null,
   currentLanguage: 'en-US',
   currentLanguages: [],

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -1,8 +1,11 @@
 import type { User } from '@oxyhq/core';
 import { logger } from '@oxyhq/core';
+import type { WebAuthMode } from '../../oauth/types';
 import {
   commitDeviceSetAndResolve,
+  maybeSyncHubAfterCommit,
   type CommitDeviceSetAndResolveDeps,
+  type MaybeSyncHubAfterCommitDeps,
 } from '../commitSessionFlow';
 
 // A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
@@ -129,19 +132,6 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
     expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
   });
 
-  it('falls back to the minimal commit-input user when getCurrentUser returns null', async () => {
-    const order: string[] = [];
-    const deps = buildDeps(order, {
-      getCurrentUser: jest.fn(async () => null),
-    });
-
-    await commitDeviceSetAndResolve(deps);
-    await flush();
-
-    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('fallback'));
-    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
-  });
-
   it('logs (never swallows) a failing background reconcile and still resolves', async () => {
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
     const order: string[] = [];
@@ -191,6 +181,92 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
   });
 });
 
+/**
+ * Post-sign-in hub sync is a FULL-PAGE redirect to auth.oxy.so. It runs from the
+ * ONE commit funnel, so gating it here gates every commit path at once —
+ * `webAuthMode: 'popup'` must never bounce the tab, whichever path signed the
+ * user in (#691 phase 7).
+ */
+describe('maybeSyncHubAfterCommit — webAuthMode transport gate (#691 phase 7)', () => {
+  const buildHubDeps = (
+    overrides: Partial<MaybeSyncHubAfterCommitDeps> = {},
+  ): MaybeSyncHubAfterCommitDeps => ({
+    activate: true,
+    hubSyncRequested: true,
+    hubSyncEnabled: true,
+    webAuthMode: 'redirect',
+    syncHub: jest.fn(async () => true),
+    ...overrides,
+  });
+
+  it("redirect mode: syncs the hub after a deliberate sign-in (unchanged)", async () => {
+    const deps = buildHubDeps();
+
+    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(true);
+
+    expect(deps.syncHub).toHaveBeenCalledTimes(1);
+  });
+
+  it('popup mode: NEVER syncs the hub, even on an otherwise-eligible sign-in', async () => {
+    const deps = buildHubDeps({ webAuthMode: 'popup' });
+
+    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
+
+    expect(deps.syncHub).not.toHaveBeenCalled();
+  });
+
+  it('popup mode: no commit path can opt back in', async () => {
+    // Every commit path differs only in `activate` / `hubSyncRequested`; the
+    // transport gate outranks all of them.
+    for (const activate of [true, false]) {
+      for (const hubSyncRequested of [true, false]) {
+        const deps = buildHubDeps({ webAuthMode: 'popup', activate, hubSyncRequested });
+        await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
+        expect(deps.syncHub).not.toHaveBeenCalled();
+      }
+    }
+  });
+
+  it.each(['popup', 'redirect'] as const)(
+    'never syncs on a cold-boot restore, in either mode (%s)',
+    async (webAuthMode: WebAuthMode) => {
+      const deps = buildHubDeps({ webAuthMode, activate: false });
+
+      await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
+
+      expect(deps.syncHub).not.toHaveBeenCalled();
+    },
+  );
+
+  it('redirect mode: honours the per-commit opt-out (account switch / popup OAuth lanes)', async () => {
+    const deps = buildHubDeps({ hubSyncRequested: false });
+
+    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
+
+    expect(deps.syncHub).not.toHaveBeenCalled();
+  });
+
+  it('redirect mode: honours the provider-level hubSync opt-out', async () => {
+    const deps = buildHubDeps({ hubSyncEnabled: false });
+
+    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
+
+    expect(deps.syncHub).not.toHaveBeenCalled();
+  });
+
+  it('redirect mode: a failing hub sync is non-fatal and never rejects', async () => {
+    const deps = buildHubDeps({
+      syncHub: jest.fn(async () => {
+        throw new Error('hub ticket failed');
+      }),
+    });
+
+    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
+
+    expect(deps.syncHub).toHaveBeenCalledTimes(1);
+  });
+});
+
 describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
   it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
     const order: string[] = [];

package/src/ui/context/commitSessionFlow.ts

@@ -1,5 +1,8 @@
 import type { User } from '@oxyhq/core';
 import { logger as loggerUtil } from '@oxyhq/core';
+import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
+import type { WebAuthMode } from '../oauth/types';
+import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -98,9 +101,6 @@ export async function commitDeviceSetAndResolve(
       }
       fullUser = fallbackUser;
     }
-    if (!fullUser) {
-      fullUser = fallbackUser;
-    }
     if (fullUser) {
       loginSuccess(fullUser);
       onAuthStateChange?.(fullUser);
@@ -126,3 +126,61 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
+
+export interface MaybeSyncHubAfterCommitDeps {
+  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
+  activate: boolean;
+  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
+  hubSyncRequested: boolean;
+  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
+  hubSyncEnabled: boolean;
+  /**
+   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
+   * A first-class input: `'popup'` forbids the redirect outright.
+   */
+  webAuthMode: WebAuthMode;
+  /**
+   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
+   * navigation was actually started.
+   */
+  syncHub: () => Promise<boolean>;
+}
+
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+export async function maybeSyncHubAfterCommit(
+  deps: MaybeSyncHubAfterCommitDeps,
+): Promise<boolean> {
+  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
+
+  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
+  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
+  if (!isWebBrowser()) return false;
+
+  try {
+    return await syncHub();
+  } catch (hubError) {
+    if (__DEV__) {
+      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
+    }
+    return false;
+  }
+}