@oxyhq/services 26.0.1 → 26.0.4

package/src/types/expo-image-picker.d.ts

@@ -0,0 +1,35 @@
+declare module 'expo-image-picker' {
+    export interface ImagePickerAsset {
+        uri: string;
+        width: number;
+        height: number;
+    }
+
+    export interface ImagePickerSuccessResult {
+        canceled: false;
+        assets: ImagePickerAsset[];
+    }
+
+    export interface ImagePickerCanceledResult {
+        canceled: true;
+        assets: null;
+    }
+
+    export type ImagePickerResult = ImagePickerSuccessResult | ImagePickerCanceledResult;
+
+    export interface ImagePickerPermission {
+        granted: boolean;
+        canAskAgain: boolean;
+    }
+
+    export interface ImagePickerOptions {
+        mediaTypes?: 'images'[];
+        allowsMultipleSelection?: boolean;
+        quality?: number;
+    }
+
+    export function launchImageLibraryAsync(options?: ImagePickerOptions): Promise<ImagePickerResult>;
+    export function launchCameraAsync(options?: ImagePickerOptions): Promise<ImagePickerResult>;
+    export function requestMediaLibraryPermissionsAsync(): Promise<ImagePickerPermission>;
+    export function requestCameraPermissionsAsync(): Promise<ImagePickerPermission>;
+}

package/src/ui/boot/__tests__/coldBootNoIdpRedirect.test.ts

@@ -0,0 +1,215 @@
+/**
+ * `runProviderColdBoot` — the boot NEVER navigates the top-level window (#691
+ * phase 7b).
+ *
+ * Phase 7b deleted the two SDK-initiated, gesture-less full-page hops to the
+ * IdP: the cold-boot `prompt=none` silent restore and the post-sign-in hub sync.
+ * A web origin with no local device credential now resolves SIGNED OUT and waits
+ * for the user's next explicit "Continue with Oxy".
+ *
+ * What must still work — and is asserted here — is everything the user actually
+ * asked for: an authorization code ALREADY on the URL is completed, which is how
+ * a browser-BLOCKED sign-in popup finishes after `startWebOAuthSignIn` falls
+ * back to a full-page redirect.
+ *
+ * Unlike `__tests__/boot/runProviderColdBoot.test.ts` (deadline + connectivity
+ * wiring), this suite keeps the real navigation primitive in view: every
+ * assertion below reaches `redirectToAuthorize`, the ONLY top-level-window
+ * navigation the boot could ever have performed.
+ */
+
+import type { AuthStateStore, PersistedAuthState, SessionClient } from '@oxyhq/core';
+
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    runSessionColdBoot: jest.fn(),
+  };
+});
+
+// The ONLY top-level-window navigation primitive the SDK has.
+jest.mock('../../components/oauthNavigation', () => ({
+  redirectToAuthorize: jest.fn(),
+}));
+
+jest.mock('../../utils/oauthReturn', () => {
+  const actual = jest.requireActual('../../utils/oauthReturn');
+  return {
+    __esModule: true,
+    ...actual,
+    tryCompleteOAuthReturn: jest.fn(async () => false),
+  };
+});
+
+import { runSessionColdBoot } from '@oxyhq/core';
+import { redirectToAuthorize } from '../../components/oauthNavigation';
+import { tryCompleteOAuthReturn } from '../../utils/oauthReturn';
+import { runProviderColdBoot, type RunProviderColdBootOptions } from '../runProviderColdBoot';
+
+const mockRunSessionColdBoot = runSessionColdBoot as jest.Mock;
+const mockRedirectToAuthorize = redirectToAuthorize as jest.Mock;
+const mockTryCompleteOAuthReturn = tryCompleteOAuthReturn as jest.Mock;
+
+const CLIENT_ID = 'oxy_dk_test';
+
+/** An auth store holding no device credential — the signed-out domain case. */
+function makeEmptyAuthStore(): AuthStateStore {
+  return {
+    load: jest.fn(async (): Promise<PersistedAuthState | null> => null),
+    save: jest.fn(async () => undefined),
+    clear: jest.fn(async () => undefined),
+  } as unknown as AuthStateStore;
+}
+
+interface Harness {
+  options: RunProviderColdBootOptions;
+  commitSession: jest.Mock;
+  markAuthResolved: jest.Mock;
+  setTokenReady: jest.Mock;
+  sessionClientStart: jest.Mock;
+}
+
+function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harness {
+  const commitSession = jest.fn(async () => undefined);
+  const markAuthResolved = jest.fn();
+  const setTokenReady = jest.fn();
+  const sessionClientStart = jest.fn(async () => undefined);
+
+  const options: RunProviderColdBootOptions = {
+    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
+    authStore: makeEmptyAuthStore(),
+    clientId: CLIENT_ID,
+    sessionClient: { start: sessionClientStart } as unknown as SessionClient,
+    syncDeviceCredentialToHost: jest.fn(async () => undefined),
+    commitSession,
+    markAuthResolved,
+    setTokenReady,
+    ...overrides,
+  };
+
+  return { options, commitSession, markAuthResolved, setTokenReady, sessionClientStart };
+}
+
+/** `runSessionColdBoot` finding no session at all — the signed-out domain. */
+function stubSignedOutBoot(): void {
+  mockRunSessionColdBoot.mockImplementation(
+    async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+      await opts.onSignedOut?.('no_session');
+      return { kind: 'unauthenticated' } as const;
+    },
+  );
+}
+
+describe('runProviderColdBoot — no SDK-initiated IdP navigation (#691 phase 7b)', () => {
+  beforeEach(() => {
+    mockRunSessionColdBoot.mockReset();
+    mockRedirectToAuthorize.mockClear();
+    mockTryCompleteOAuthReturn.mockClear();
+    mockTryCompleteOAuthReturn.mockImplementation(async () => false);
+    globalThis.sessionStorage?.clear();
+  });
+
+  it('resolves a domain with no local credential SIGNED OUT instead of bouncing to the IdP', async () => {
+    stubSignedOutBoot();
+    const { options, markAuthResolved, commitSession, sessionClientStart } = makeHarness();
+
+    await runProviderColdBoot(options);
+
+    // Auth resolution concluded (routing can settle), nothing was committed,
+    // and with no persisted credential the device socket is not started.
+    expect(markAuthResolved).toHaveBeenCalled();
+    expect(commitSession).not.toHaveBeenCalled();
+    expect(sessionClientStart).not.toHaveBeenCalled();
+    expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+  });
+
+  it('does not navigate even with a clientId configured and the mint finding nothing', async () => {
+    // The deleted silent-restore lane needed exactly this shape: a registered
+    // client id plus a signed-out mint outcome. It must now be inert.
+    stubSignedOutBoot();
+    const { options } = makeHarness({ clientId: CLIENT_ID, authRedirectUri: 'https://app.oxy.so' });
+
+    await runProviderColdBoot(options);
+
+    expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+  });
+
+  it('does not navigate when the mint already resolved a session', async () => {
+    mockRunSessionColdBoot.mockImplementation(
+      async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+        const session = {
+          sessionId: 's1',
+          userId: 'u1',
+          accessToken: 'at',
+          via: 'device-secret-mint',
+        };
+        await opts.onSession?.(session);
+        return { kind: 'session', via: session.via, session } as const;
+      },
+    );
+    const { options, commitSession } = makeHarness();
+
+    await runProviderColdBoot(options);
+
+    expect(commitSession).toHaveBeenCalledWith(
+      { sessionId: 's1', accessToken: 'at', userId: 'u1' },
+      { activate: false },
+    );
+    expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+  });
+
+  describe('the blocked-popup redirect fallback still completes', () => {
+    it('completes an authorization code already on the URL', async () => {
+      // A popup-mode app lands here whenever the browser blocked the popup and
+      // `startWebOAuthSignIn` fell back to a full-page redirect.
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options, markAuthResolved, setTokenReady } = makeHarness();
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      expect(setTokenReady).toHaveBeenLastCalledWith(true);
+      expect(markAuthResolved).toHaveBeenCalled();
+      // The device mint is short-circuited by the completed return leg.
+      expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('runs the return leg even on a boot that finds no session', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness();
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+    });
+
+    it('commits the OAuth return as a deliberate sign-in', async () => {
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options } = makeHarness();
+
+      await runProviderColdBoot(options);
+
+      const commit = mockTryCompleteOAuthReturn.mock.calls[0][0] as {
+        commitSession: (input: unknown) => Promise<void>;
+      };
+      await commit.commitSession({ sessionId: 's1', userId: 'u1' });
+      expect(options.commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', userId: 'u1' },
+        { activate: true },
+      );
+    });
+  });
+
+  it('identity mode skips the web OAuth return leg entirely', async () => {
+    stubSignedOutBoot();
+    const { options } = makeHarness({ sessionMode: 'identity' });
+
+    await runProviderColdBoot(options);
+
+    expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+    expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+  });
+});

package/src/ui/boot/runProviderColdBoot.ts

@@ -8,15 +8,9 @@ import {
 } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
 import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
-import {
-  consumeSilentOAuthError,
-  isSilentRestoreEligibleOrigin,
-  maybeStartSilentOAuthRestore,
-} from '../utils/crossOriginRestore';
-import { tryCompleteOAuthReturn, consumeHubSyncFailure } from '../utils/oauthReturn';
+import { tryCompleteOAuthReturn } from '../utils/oauthReturn';
 import { isWebBrowser } from '../utils/isWebBrowser';
-import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
-import type { WebAuthMode } from '../oauth/types';
+import { isNetConnectivityExplicitlyOffline } from '../utils/netConnectivity';
 import type { CommitInput } from '../context/oxyContextTypes';
 
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
@@ -67,8 +61,8 @@ async function detectOfflineHint(): Promise<boolean> {
       }),
     ]);
     // `null` ⇒ the probe timed out (unknown → assume online). Only an explicit
-    // `isConnected === false` disables the network steps.
-    return state?.isConnected === false;
+    // disconnected / unreachable verdict disables the network steps.
+    return isNetConnectivityExplicitlyOffline(state);
   } catch {
     // NetInfo missing / probe threw — never block sign-in on a probe failure.
     return false;
@@ -80,39 +74,19 @@ export interface RunProviderColdBootOptions {
   authStore: AuthStateStore;
   clientId?: string;
   authRedirectUri?: string;
-  /**
-   * Authorize endpoint override for silent cross-origin restore. Defaults to
-   * the production Oxy IdP when unset; a local/staging deployment sets it so the
-   * silent-restore redirect targets its own IdP, never production.
-   */
-  authorizeBaseUrl?: string;
   /**
    * Who owns the session this boot resolves. `'account'` (the default) is the
    * device's active account — every ordinary Oxy app. `'identity'` binds the
    * boot to the owner of this device's PRIMARY identity key and REQUIRES
-   * {@link identity}; it also disables the two web OAuth lanes below, which
-   * commit whatever account the IdP hands back.
+   * {@link identity}; it also disables the web OAuth return leg below, which
+   * commits whatever account the IdP hands back.
    */
   sessionMode?: SessionMode;
   /** The identity binding required by `sessionMode: 'identity'`. */
   identity?: IdentityBinding;
-  /**
-   * How this provider's WEB sign-in reaches the IdP
-   * (`OxyProviderProps.webAuthMode`).
-   *
-   * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
-   * the automatic full-page `prompt=none` restore in step 3, so a domain with no
-   * local credential resolves SIGNED OUT instead of bouncing the top-level
-   * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
-   * @default 'redirect'
-   */
-  webAuthMode?: WebAuthMode;
   sessionClient: SessionClient;
   syncDeviceCredentialToHost: () => Promise<void>;
-  commitSession: (
-    input: CommitInput,
-    options: { activate: boolean; hubSync?: boolean },
-  ) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
   markAuthResolved: () => void;
   setTokenReady: (ready: boolean) => void;
 }
@@ -121,19 +95,19 @@ export interface RunProviderColdBootOptions {
  * Device-first cold boot for `@oxyhq/services` providers.
  *
  * Ordered pipeline:
- * 1. Complete OAuth authorization-code return (web)
+ * 1. Complete an OAuth authorization-code return already on the URL (web)
  * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
  *    primary-identity-key lane in `sessionMode: 'identity'`)
- * 3. Silent OAuth for all web apps when mint finds no session
  *
- * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
- * resolves, which for an identity-bound client is somebody else's account by
- * construction. In `'identity'` mode the boot is exactly step 2.
+ * Step 1 is ACCOUNT-MODE ONLY: it commits whichever account the IdP resolves,
+ * which for an identity-bound client is somebody else's account by construction.
+ * In `'identity'` mode the boot is exactly step 2.
  *
- * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
- * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
- * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
- * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
+ * The boot NEVER navigates the top-level window. There is no automatic
+ * `prompt=none` bounce to the IdP: a web origin with no local device credential
+ * resolves SIGNED OUT and waits for the user's next explicit "Continue with
+ * Oxy", which opens a popup from a real gesture (#691 phase 7b). Step 1 is not a
+ * navigation — it only consumes a code that is already in the address bar.
  */
 export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void> {
   const {
@@ -141,10 +115,8 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     authStore,
     clientId,
     authRedirectUri,
-    authorizeBaseUrl,
     sessionMode = 'account',
     identity,
-    webAuthMode = 'redirect',
     sessionClient,
     syncDeviceCredentialToHost,
     commitSession,
@@ -157,28 +129,19 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
   setTokenReady(false);
 
   try {
-    // MODE-INDEPENDENT URL cleanup, deliberately so: both consume query params a
-    // PREVIOUS redirect-mode session left in the address bar (`?error=login_required`
-    // from a silent authorize, `?hub_sync=failed` from the hub) and restore the
-    // page the visit started on. Flipping an app to popup mode must not strand
-    // those params, so neither is gated on `webAuthMode`. Neither starts a
-    // navigation — they only rewrite the URL via `history.replaceState`.
-    consumeSilentOAuthError();
-    consumeHubSyncFailure();
-
-    // The redirect transport's RETURN leg — also NOT gated on `webAuthMode`. A
-    // popup-mode app legitimately lands here with `?code=` whenever the browser
-    // blocked the popup and `startWebOAuthSignIn` fell back to a full-page
-    // redirect (`popup-blocked` / `popup-navigation-failed`), and an app that
-    // switched modes mid-flight must not be stranded with a dead `?code=`
-    // either. It consumes a code already on the URL; it never starts one.
+    // The redirect transport's RETURN leg. An app reaches it whenever the browser
+    // BLOCKED the sign-in popup and `startWebOAuthSignIn` fell back to a
+    // full-page redirect (`popup-blocked` / `popup-navigation-failed`), so it is
+    // load-bearing even though nothing here ever starts a redirect. It consumes a
+    // code (or a stale OAuth `error`) already in the address bar and rewrites the
+    // URL via `history.replaceState`; it never begins a navigation.
     const oauthCompleted = identityBound
       ? false
       : await tryCompleteOAuthReturn({
           oxyServices,
           clientId,
           authRedirectUri,
-          commitSession: (input) => commitSession(input, { activate: true, hubSync: false }),
+          commitSession: (input) => commitSession(input, { activate: true }),
         });
     if (oauthCompleted) {
       setTokenReady(true);
@@ -192,7 +155,7 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     // resolves to "online" — the network steps still run.
     const offline = await detectOfflineHint();
 
-    const outcome = await runSessionColdBoot({
+    await runSessionColdBoot({
       oxy: oxyServices,
       store: authStore,
       platform: { isWeb: isWebBrowser(), isNative: !isWebBrowser() },
@@ -259,46 +222,6 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
         }
       },
     });
-
-    // Silent cross-origin OAuth restore (web cross-app SSO): a full-page
-    // `prompt=none` bounce to the IdP when the mint found no local session.
-    //
-    // TRANSPORT gate (`allowsAutomaticIdpRedirect`): `webAuthMode: 'popup'`
-    // FORBIDS this lane. It navigates the top-level window with no user gesture
-    // behind it, which is precisely what popup mode exists to eliminate — a
-    // popup-mode domain without a local credential resolves signed out right
-    // here and waits for the user's next explicit "Continue with Oxy" (issue
-    // #691, "Cold boot and cross-domain behavior"). `'redirect'` — still the
-    // default and the compatibility path — reaches this lane unchanged, and this
-    // whole block disappears with the transport in phase 7b.
-    //
-    // ORIGIN gate: same as the hub-sync WRITE side (`syncHubAfterSignIn`) —
-    // official web origins only, never the IdP hub itself, and — unlike the
-    // write side — never a loopback / local-dev origin (which must not be
-    // bounced to a hosted IdP on cold boot). The authorize endpoint is
-    // env-configurable so a local/staging app targets its own IdP instead of
-    // production.
-    const webOrigin = isWebBrowser()
-      ? (globalThis as { location?: Location }).location?.origin
-      : undefined;
-    if (
-      !identityBound &&
-      allowsAutomaticIdpRedirect(webAuthMode) &&
-      clientId &&
-      outcome.kind !== 'session' &&
-      webOrigin &&
-      isSilentRestoreEligibleOrigin(webOrigin)
-    ) {
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices,
-        clientId,
-        redirectUri: authRedirectUri,
-        authorizeBaseUrl,
-      });
-      if (redirected) {
-        return;
-      }
-    }
   } catch (error) {
     if (__DEV__) {
       loggerUtil.error(

package/src/ui/components/AvatarCameraBadge.tsx

@@ -1,5 +1,6 @@
 import type React from 'react';
-import { View, type ViewStyle } from 'react-native';
+import type { ViewStyle } from 'react-native';
+import { View } from 'react-native-css/components';
 import Ionicons from '@expo/vector-icons/Ionicons';
 import { useTheme } from '@oxyhq/bloom/theme';
 

package/src/ui/components/FollowButton.tsx

@@ -6,7 +6,7 @@ import type {
   StyleProp,
 } from 'react-native';
 import { useOxy } from '../context/OxyContext';
-import { toast } from '@oxyhq/bloom';
+import { toast } from '@oxyhq/bloom/toast';
 import { Button } from '@oxyhq/bloom/button';
 import { Loading } from '@oxyhq/bloom/loading';
 import { useFollow, useFollowForButton } from '../hooks/useFollow';

package/src/ui/components/OxyAccountDialogScreen.tsx

@@ -75,7 +75,19 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
   const { view } = snapshot;
   const showBack =
     view === 'qr' || view === 'signup' || (view === 'add' && snapshot.accounts.length > 0);
-  const goToAccounts = useCallback(() => controller?.setView('accounts'), [controller]);
+  const goToAccounts = useCallback(() => {
+    if (!controller) return;
+    const { view: currentView, signIn } = controller.getSnapshot();
+    // Backing out of an active request must withdraw it — otherwise the
+    // authorizeCode stays approvable until expiry (issue #691 phase 5).
+    if (
+      (currentView === 'qr' || currentView === 'add') &&
+      (signIn.phase === 'starting' || signIn.phase === 'waiting')
+    ) {
+      controller.cancelSignIn();
+    }
+    controller.setView('accounts');
+  }, [controller]);
   // An ENTRY view (accounts / signin — no in-dialog back of its own) that is
   // MORPHED into a host surface (ManageAccount → switcher) has a frame beneath it,
   // so its back CLOSES the dialog and reshapes back to the host — routed through

package/src/ui/components/OxyAuthChooser.tsx

@@ -36,7 +36,7 @@
 import type React from 'react';
 import { useCallback, useMemo, useState, useSyncExternalStore } from 'react';
 import { Linking, Platform } from 'react-native';
-import { toast } from '@oxyhq/bloom';
+import { toast } from '@oxyhq/bloom/toast';
 import { useTheme } from '@oxyhq/bloom/theme';
 import type { AccountDialogSnapshot } from '@oxyhq/core';
 import { isOxyRpOrigin } from '@oxyhq/core';
@@ -72,6 +72,13 @@ const ACCOUNTS_APP_URL = 'https://accounts.oxy.so';
 export interface OxyAuthChooserProps {
   /** Called after a completed switch, sign-in, or sign-up. */
   onComplete?: () => void;
+  /**
+   * When false, the web sign-in entry does not auto-start a device-flow
+   * session on mount. Use for hosts (e.g. the cross-origin passkey hub) that
+   * already have a pending `authorizeCode` and must not spawn a second one.
+   * @default true
+   */
+  autoStartSignIn?: boolean;
 }
 
 /**
@@ -79,7 +86,10 @@ export interface OxyAuthChooserProps {
  * (wrapped in Bloom's `<Dialog>`) today; mountable bare by any future host that
  * supplies its own `onComplete`.
  */
-const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
+const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({
+  onComplete,
+  autoStartSignIn: autoStartSignInEnabled = true,
+}) => {
   const {
     accountDialogController: controller,
     showBottomSheet,
@@ -161,11 +171,11 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
   // a no-op on native (button-driven). Reads the live snapshot at call time (an
   // event callback, not render), so it is stable across renders.
   const autoStartSignIn = useCallback(() => {
-    if (!controller || !isWebBrowser()) return;
+    if (!autoStartSignInEnabled || !controller || !isWebBrowser()) return;
     const { view: currentView, signIn } = controller.getSnapshot();
     if ((currentView !== 'signin' && currentView !== 'add') || signIn.phase !== 'idle') return;
     void controller.signInWithOxy();
-  }, [controller]);
+  }, [autoStartSignInEnabled, controller]);
 
   // Bind the headless controller. `getSnapshot` returns a stable reference
   // between changes, so it is `useSyncExternalStore`-safe. Guard the no-provider
@@ -210,25 +220,19 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
   const snapshot = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
   const { view } = snapshot;
 
-  const [switching, setSwitching] = useState(false);
-
   const handleSwitch = useCallback(
     async (accountId: string) => {
-      if (!controller || switching) return;
-      if (accountId === snapshot.activeAccountId) {
+      if (!controller) return;
+      if (controller.getSnapshot().switchingAccountId) return;
+      if (accountId === controller.getSnapshot().activeAccountId) {
         onComplete?.();
         return;
       }
-      setSwitching(true);
       try {
         await controller.switchTo(accountId);
-        // `switchTo` never throws — it records a failure on the controller's
-        // snapshot. Read it back at the point the switch settles and surface it
-        // as a toast (event-driven, at the failure site — NOT an inline banner
-        // and NOT a snapshot-reaction). On success reload the app's account
-        // graph and drop cached account-scoped data so the new active identity
-        // re-fetches — the same side effects the context's own
-        // `switchToAccount` performs.
+        // `switchTo` records failures on the controller snapshot. Read that
+        // state after the operation so the same path works with both the real
+        // controller and framework test doubles that return void.
         if (controller.getSnapshot().error) {
           toast.error(t('accountSwitcher.toasts.switchFailed'));
           return;
@@ -236,11 +240,11 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
         void refreshAccounts();
         queryClient.invalidateQueries();
         onComplete?.();
-      } finally {
-        setSwitching(false);
+      } catch {
+        // `switchTo` is documented as non-throwing; guard against regressions.
       }
     },
-    [controller, switching, snapshot.activeAccountId, onComplete, refreshAccounts, queryClient, t],
+    [controller, onComplete, refreshAccounts, queryClient, t],
   );
 
   const handleManage = useCallback(() => {
@@ -307,7 +311,7 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
   // Real storage usage for the account menu's "Oxy storage" block. Disabled
   // (no fetch) until a private-API session exists, so it is inert on the
   // sign-in/request/sign-up views; when present the block shows live used/total.
-  const storageQuery = useAccountStorageUsage();
+  const storageQuery = useAccountStorageUsage({ enabled: view === 'accounts' });
   const storage = useMemo<AccountStorageModel | null>(
     () =>
       storageQuery.data
@@ -344,6 +348,13 @@ const OxyAuthChooser: React.FC<OxyAuthChooserProps> = ({ onComplete }) => {
         void logout();
         onComplete?.();
       },
+      customItems: (getAccountDialogConsumerHooks()?.menuItems ?? []).map((item) => ({
+        ...item,
+        onPress: () => {
+          onComplete?.();
+          item.onPress();
+        },
+      })),
     };
   }, [onComplete, showBottomSheet, logout]);
 

package/src/ui/components/OxyProvider.tsx

@@ -5,13 +5,14 @@ import { SafeAreaProvider } from 'react-native-safe-area-context';
 import type { OxyProviderProps } from '../types/navigation';
 import { OxyContextProvider, type OxyContextProviderProps } from '../context/OxyContext';
 import { QueryClientProvider, focusManager, onlineManager } from '@tanstack/react-query';
-import { BloomDialogProvider } from '@oxyhq/bloom';
+import { BloomDialogProvider } from '@oxyhq/bloom/dialog';
 import { SurfaceProvider } from '@oxyhq/bloom/surfaces';
 import { ToastOutlet } from '@oxyhq/bloom/toast';
 import { logger as loggerUtil } from '@oxyhq/core';
 import { RequireOxyAuth } from './RequireOxyAuth';
 import { attachQueryPersistence, createQueryClient } from '../hooks/queryClient';
 import { createPlatformStorage, type StorageInterface } from '../utils/storageHelpers';
+import { isNetConnectivityOnline } from '../utils/netConnectivity';
 
 /**
  * Background color shown for the brief window between mount and the
@@ -92,10 +93,10 @@ const OxyProvider: FC<OxyProviderProps> = ({
     authRedirectUri,
     authorizeBaseUrl,
     sessionMode = 'account',
-    webAuthMode = 'redirect',
+    webAuthMode = 'popup',
     queryClient: providedQueryClient,
     requireAuth = 'off',
-    hubSync = true,
+    backgroundSession = false,
 }) => {
 
     // Dynamic KeyboardProvider for native. Uses variable indirection
@@ -230,10 +231,10 @@ const OxyProvider: FC<OxyProviderProps> = ({
                     try {
                         const NetInfo = await import('@react-native-community/netinfo');
                         const state = await NetInfo.default.fetch();
-                        onlineManager.setOnline(state.isConnected ?? true);
+                        onlineManager.setOnline(isNetConnectivityOnline(state));
 
-                        const unsubscribe = NetInfo.default.addEventListener((state: { isConnected: boolean | null }) => {
-                            onlineManager.setOnline(state.isConnected ?? true);
+                        const unsubscribe = NetInfo.default.addEventListener((state: { isConnected: boolean | null; isInternetReachable?: boolean | null }) => {
+                            onlineManager.setOnline(isNetConnectivityOnline(state));
                         });
 
                         cleanup = () => unsubscribe();
@@ -293,7 +294,7 @@ const OxyProvider: FC<OxyProviderProps> = ({
                     clientId={clientId}
                     sessionMode={sessionMode}
                     webAuthMode={webAuthMode}
-                    hubSync={hubSync}
+                    backgroundSession={backgroundSession}
                     onAuthStateChange={onAuthStateChange as OxyContextProviderProps['onAuthStateChange']}
                 >
                     <SurfaceProvider>