@oxyhq/services 6.10.5 → 6.10.6

package/README.md

@@ -2,7 +2,7 @@
 
 A comprehensive TypeScript UI library for the Oxy API providing authentication, user management, and UI components for React Native and Expo applications.
 
-**Current published version: 6.10.4**
+**Current published version: 6.10.5**
 
 > **For web apps (Vite, Next.js, CRA):** Use [`@oxyhq/auth`](../auth) for authentication and [`@oxyhq/core`](../core) for types and services.
 >
@@ -747,11 +747,11 @@ Typed returns are defined in `ui/hooks/queries/paymentTypes.ts` (`Subscription`,
 
 ## Sign-In Token Planting
 
-`useAuthOperations.performSignIn` plants the `accessToken` returned directly by `verifyChallenge` via `oxyServices.setTokens(...)`. It falls back to the bearer-protected `getTokenBySession` only when the verify response omits the token. Without this, a brand-new identity 401s on the session sync step.
+`@oxyhq/core` `OxyServices.verifyChallenge()` plants `setTokens(accessToken, refreshToken ?? '')` internally before returning. `useAuthOperations.performSignIn` no longer needs to hand-plant the token or fall back to `getTokenBySession` — just await `verifyChallenge` and proceed.
 
 ## Silent SSO Run-Once Guard
 
-`useWebSSO` contains a module-level `silentSSOAttempted` Set keyed on `origin+baseURL`. Silent FedCM sign-in fires exactly once per page load regardless of unmount/remount or StrictMode double-invoke.
+The cross-page-load deduplication guard for `navigator.credentials.get({mediation:'silent'})` lives in `@oxyhq/core` `OxyServices.silentSignInWithFedCM()` (module-level memo keyed on `origin+baseURL`). `useWebSSO` in this package keeps only a per-instance `hasCheckedRef` fast-path — no cross-mount guard.
 
 ## Requirements
 

package/lib/commonjs/ui/hooks/useWebSSO.js

@@ -23,6 +23,36 @@ var _react = require("react");
  * @see https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API
  */
 
+/**
+ * Module-level guard tracking which (origin + API) signatures have already
+ * had a silent SSO attempt this page load.
+ *
+ * A per-component `useRef` guard resets whenever the provider remounts (route
+ * churn, StrictMode double-invoke, error-boundary recovery), which previously
+ * allowed silent SSO to re-fire and — combined with a routing redirect loop —
+ * produced an accelerating `navigator.credentials.get` retry storm. Keying the
+ * guard on a stable signature instead of the component instance makes silent
+ * SSO fire EXACTLY ONCE per page load regardless of how many times the
+ * provider mounts. The set is intentionally never cleared: a fresh page load
+ * (the only thing that can change the answer) starts a fresh module scope.
+ */
+const silentSSOAttempted = new Set();
+
+/**
+ * Build a stable signature for the silent-SSO run-once guard. Two providers
+ * pointed at the same API from the same origin share one attempt.
+ */
+function ssoSignature(oxyServices) {
+  const origin = typeof window !== 'undefined' ? window.location.origin : 'no-origin';
+  let baseURL = '';
+  try {
+    baseURL = oxyServices.getBaseURL?.() ?? '';
+  } catch {
+    baseURL = '';
+  }
+  return `${origin}|${baseURL}`;
+}
+
 /**
  * Check if we're running in a web browser environment (not React Native)
  */
@@ -140,12 +170,12 @@ function useWebSSO({
 
   // Auto-check SSO on mount (web only, FedCM only, not on auth domain).
   //
-  // `hasCheckedRef` is a cheap per-instance fast-path so effect re-runs (from
-  // changing deps) within one mount never re-fire. The page-load run-once
-  // guarantee — silent SSO invoking `navigator.credentials.get` AT MOST ONCE
-  // per page load across remounts / StrictMode / multiple consumers — lives in
-  // `@oxyhq/core`'s `silentSignInWithFedCM`, which memoizes the first silent
-  // attempt's result for this origin + API. The hook therefore calls it freely.
+  // Run-once is enforced by TWO guards:
+  //   1. `hasCheckedRef` — cheap per-instance fast-path so effect re-runs
+  //      (from changing deps) within one mount never re-fire.
+  //   2. `silentSSOAttempted` — module-level, survives remounts/StrictMode so
+  //      silent SSO fires exactly once per page load even if the provider
+  //      unmounts and remounts.
   (0, _react.useEffect)(() => {
     if (!enabled || !isWebBrowser() || hasCheckedRef.current || isIdentityProvider(authWebUrl)) {
       if (isIdentityProvider(authWebUrl)) {
@@ -153,13 +183,21 @@ function useWebSSO({
       }
       return;
     }
+    const signature = ssoSignature(oxyServices);
+    if (silentSSOAttempted.has(signature)) {
+      // Already attempted this page load (e.g. before a remount) — do not
+      // re-fire. Mark the local fast-path too so subsequent re-renders skip.
+      hasCheckedRef.current = true;
+      return;
+    }
     hasCheckedRef.current = true;
+    silentSSOAttempted.add(signature);
     if (fedCMSupported) {
       checkSSO();
     } else {
       onSSOUnavailable?.();
     }
-  }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable, authWebUrl]);
+  }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable, oxyServices, authWebUrl]);
   return {
     checkSSO,
     signInWithFedCM,

package/lib/commonjs/ui/hooks/useWebSSO.js.map

@@ -1 +1 @@
-{"version":3,"names":["_react","require","isWebBrowser","window","document","documentElement","isIdentityProvider","authWebUrl","hostname","location","idpHostname","URL","useWebSSO","oxyServices","onSessionFound","onSSOUnavailable","onError","enabled","isCheckingRef","useRef","hasCheckedRef","fedCMSupported","isFedCMSupported","config","checkSSO","useCallback","current","session","silentSignInWithFedCM","error","Error","String","signInWithFedCM","useEffect","isChecking"],"sourceRoot":"../../../../src","sources":["ui/hooks/useWebSSO.ts"],"mappings":";;;;;;;AAiBA,IAAAA,MAAA,GAAAC,OAAA;AAjBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAyBA;AACA;AACA;AACA,SAASC,YAAYA,CAAA,EAAY;EAC/B,OAAO,OAAOC,MAAM,KAAK,WAAW,IAC7B,OAAOC,QAAQ,KAAK,WAAW,IAC/B,OAAOA,QAAQ,CAACC,eAAe,KAAK,WAAW;AACxD;;AAEA;AACA;AACA;AACA;AACA,SAASC,kBAAkBA,CAACC,UAAmB,EAAW;EACxD,IAAI,CAACL,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMM,QAAQ,GAAGL,MAAM,CAACM,QAAQ,CAACD,QAAQ;EACzC,IAAIE,WAAW,GAAG,aAAa;EAC/B,IAAIH,UAAU,EAAE;IACd,IAAI;MAAEG,WAAW,GAAG,IAAIC,GAAG,CAACJ,UAAU,CAAC,CAACC,QAAQ;IAAE,CAAC,CAAC,MAAM,CAAE;EAC9D;EACA,OAAOA,QAAQ,KAAKE,WAAW;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,SAASA,CAAC;EACxBC,WAAW;EACXC,cAAc;EACdC,gBAAgB;EAChBC,OAAO;EACPC,OAAO,GAAG;AACM,CAAC,EAAmB;EACpC,MAAMC,aAAa,GAAG,IAAAC,aAAM,EAAC,KAAK,CAAC;EACnC,MAAMC,aAAa,GAAG,IAAAD,aAAM,EAAC,KAAK,CAAC;;EAEnC;EACA,MAAME,cAAc,GAAGnB,YAAY,CAAC,CAAC,IAAIW,WAAW,CAACS,gBAAgB,GAAG,CAAC;EACzE,MAAMf,UAAU,GAAGM,WAAW,CAACU,MAAM,EAAEhB,UAAU;EAEjD,MAAMiB,QAAQ,GAAG,IAAAC,kBAAW,EAAC,YAAkD;IAC7E,IAAI,CAACvB,YAAY,CAAC,CAAC,IAAIgB,aAAa,CAACQ,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;;IAEA;IACA,IAAIpB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAClCQ,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;;IAEA;IACA,IAAI,CAACM,cAAc,EAAE;MACnBN,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;IAEAG,aAAa,CAACQ,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAMd,WAAW,CAACe,qBAAqB,GAAG,CAAC;MAE3D,IAAID,OAAO,EAAE;QACX,MAAMb,cAAc,CAACa,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEAZ,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb,CAAC,CAAC,OAAOc,KAAK,EAAE;MACdd,gBAAgB,GAAG,CAAC;MACpBC,OAAO,GAAGa,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRX,aAAa,CAACQ,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAACb,WAAW,EAAEC,cAAc,EAAEC,gBAAgB,EAAEC,OAAO,EAAEK,cAAc,EAAEd,UAAU,CAAC,CAAC;;EAExF;AACF;AACA;AACA;AACA;EACE,MAAMyB,eAAe,GAAG,IAAAP,kBAAW,EAAC,YAAkD;IACpF,IAAI,CAACvB,YAAY,CAAC,CAAC,IAAIgB,aAAa,CAACQ,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;IAEA,IAAI,CAACL,cAAc,EAAE;MACnBL,OAAO,GAAG,IAAIc,KAAK,CAAC,wCAAwC,CAAC,CAAC;MAC9D,OAAO,IAAI;IACb;IAEAZ,aAAa,CAACQ,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAMd,WAAW,CAACmB,eAAe,GAAG,CAAC;MAErD,IAAIL,OAAO,EAAE;QACX,MAAMb,cAAc,CAACa,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEA,OAAO,IAAI;IACb,CAAC,CAAC,OAAOE,KAAK,EAAE;MACdb,OAAO,GAAGa,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRX,aAAa,CAACQ,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAACb,WAAW,EAAEC,cAAc,EAAEE,OAAO,EAAEK,cAAc,CAAC,CAAC;;EAE1D;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,IAAAY,gBAAS,EAAC,MAAM;IACd,IAAI,CAAChB,OAAO,IAAI,CAACf,YAAY,CAAC,CAAC,IAAIkB,aAAa,CAACM,OAAO,IAAIpB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAC1F,IAAID,kBAAkB,CAACC,UAAU,CAAC,EAAE;QAClCQ,gBAAgB,GAAG,CAAC;MACtB;MACA;IACF;IAEAK,aAAa,CAACM,OAAO,GAAG,IAAI;IAE5B,IAAIL,cAAc,EAAE;MAClBG,QAAQ,CAAC,CAAC;IACZ,CAAC,MAAM;MACLT,gBAAgB,GAAG,CAAC;IACtB;EACF,CAAC,EAAE,CAACE,OAAO,EAAEO,QAAQ,EAAEH,cAAc,EAAEN,gBAAgB,EAAER,UAAU,CAAC,CAAC;EAErE,OAAO;IACLiB,QAAQ;IACRQ,eAAe;IACfE,UAAU,EAAEhB,aAAa,CAACQ,OAAO;IACjCJ,gBAAgB,EAAED;EACpB,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["_react","require","silentSSOAttempted","Set","ssoSignature","oxyServices","origin","window","location","baseURL","getBaseURL","isWebBrowser","document","documentElement","isIdentityProvider","authWebUrl","hostname","idpHostname","URL","useWebSSO","onSessionFound","onSSOUnavailable","onError","enabled","isCheckingRef","useRef","hasCheckedRef","fedCMSupported","isFedCMSupported","config","checkSSO","useCallback","current","session","silentSignInWithFedCM","error","Error","String","signInWithFedCM","useEffect","signature","has","add","isChecking"],"sourceRoot":"../../../../src","sources":["ui/hooks/useWebSSO.ts"],"mappings":";;;;;;;AAiBA,IAAAA,MAAA,GAAAC,OAAA;AAjBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAyBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,kBAAkB,GAAG,IAAIC,GAAG,CAAS,CAAC;;AAE5C;AACA;AACA;AACA;AACA,SAASC,YAAYA,CAACC,WAAwB,EAAU;EACtD,MAAMC,MAAM,GAAG,OAAOC,MAAM,KAAK,WAAW,GAAGA,MAAM,CAACC,QAAQ,CAACF,MAAM,GAAG,WAAW;EACnF,IAAIG,OAAO,GAAG,EAAE;EAChB,IAAI;IACFA,OAAO,GAAGJ,WAAW,CAACK,UAAU,GAAG,CAAC,IAAI,EAAE;EAC5C,CAAC,CAAC,MAAM;IACND,OAAO,GAAG,EAAE;EACd;EACA,OAAO,GAAGH,MAAM,IAAIG,OAAO,EAAE;AAC/B;;AAEA;AACA;AACA;AACA,SAASE,YAAYA,CAAA,EAAY;EAC/B,OAAO,OAAOJ,MAAM,KAAK,WAAW,IAC7B,OAAOK,QAAQ,KAAK,WAAW,IAC/B,OAAOA,QAAQ,CAACC,eAAe,KAAK,WAAW;AACxD;;AAEA;AACA;AACA;AACA;AACA,SAASC,kBAAkBA,CAACC,UAAmB,EAAW;EACxD,IAAI,CAACJ,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMK,QAAQ,GAAGT,MAAM,CAACC,QAAQ,CAACQ,QAAQ;EACzC,IAAIC,WAAW,GAAG,aAAa;EAC/B,IAAIF,UAAU,EAAE;IACd,IAAI;MAAEE,WAAW,GAAG,IAAIC,GAAG,CAACH,UAAU,CAAC,CAACC,QAAQ;IAAE,CAAC,CAAC,MAAM,CAAE;EAC9D;EACA,OAAOA,QAAQ,KAAKC,WAAW;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,SAASA,CAAC;EACxBd,WAAW;EACXe,cAAc;EACdC,gBAAgB;EAChBC,OAAO;EACPC,OAAO,GAAG;AACM,CAAC,EAAmB;EACpC,MAAMC,aAAa,GAAG,IAAAC,aAAM,EAAC,KAAK,CAAC;EACnC,MAAMC,aAAa,GAAG,IAAAD,aAAM,EAAC,KAAK,CAAC;;EAEnC;EACA,MAAME,cAAc,GAAGhB,YAAY,CAAC,CAAC,IAAIN,WAAW,CAACuB,gBAAgB,GAAG,CAAC;EACzE,MAAMb,UAAU,GAAGV,WAAW,CAACwB,MAAM,EAAEd,UAAU;EAEjD,MAAMe,QAAQ,GAAG,IAAAC,kBAAW,EAAC,YAAkD;IAC7E,IAAI,CAACpB,YAAY,CAAC,CAAC,IAAIa,aAAa,CAACQ,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;;IAEA;IACA,IAAIlB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAClCM,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;;IAEA;IACA,IAAI,CAACM,cAAc,EAAE;MACnBN,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;IAEAG,aAAa,CAACQ,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM5B,WAAW,CAAC6B,qBAAqB,GAAG,CAAC;MAE3D,IAAID,OAAO,EAAE;QACX,MAAMb,cAAc,CAACa,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEAZ,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb,CAAC,CAAC,OAAOc,KAAK,EAAE;MACdd,gBAAgB,GAAG,CAAC;MACpBC,OAAO,GAAGa,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRX,aAAa,CAACQ,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAAC3B,WAAW,EAAEe,cAAc,EAAEC,gBAAgB,EAAEC,OAAO,EAAEK,cAAc,EAAEZ,UAAU,CAAC,CAAC;;EAExF;AACF;AACA;AACA;AACA;EACE,MAAMuB,eAAe,GAAG,IAAAP,kBAAW,EAAC,YAAkD;IACpF,IAAI,CAACpB,YAAY,CAAC,CAAC,IAAIa,aAAa,CAACQ,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;IAEA,IAAI,CAACL,cAAc,EAAE;MACnBL,OAAO,GAAG,IAAIc,KAAK,CAAC,wCAAwC,CAAC,CAAC;MAC9D,OAAO,IAAI;IACb;IAEAZ,aAAa,CAACQ,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM5B,WAAW,CAACiC,eAAe,GAAG,CAAC;MAErD,IAAIL,OAAO,EAAE;QACX,MAAMb,cAAc,CAACa,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEA,OAAO,IAAI;IACb,CAAC,CAAC,OAAOE,KAAK,EAAE;MACdb,OAAO,GAAGa,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRX,aAAa,CAACQ,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAAC3B,WAAW,EAAEe,cAAc,EAAEE,OAAO,EAAEK,cAAc,CAAC,CAAC;;EAE1D;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,IAAAY,gBAAS,EAAC,MAAM;IACd,IAAI,CAAChB,OAAO,IAAI,CAACZ,YAAY,CAAC,CAAC,IAAIe,aAAa,CAACM,OAAO,IAAIlB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAC1F,IAAID,kBAAkB,CAACC,UAAU,CAAC,EAAE;QAClCM,gBAAgB,GAAG,CAAC;MACtB;MACA;IACF;IAEA,MAAMmB,SAAS,GAAGpC,YAAY,CAACC,WAAW,CAAC;IAC3C,IAAIH,kBAAkB,CAACuC,GAAG,CAACD,SAAS,CAAC,EAAE;MACrC;MACA;MACAd,aAAa,CAACM,OAAO,GAAG,IAAI;MAC5B;IACF;IAEAN,aAAa,CAACM,OAAO,GAAG,IAAI;IAC5B9B,kBAAkB,CAACwC,GAAG,CAACF,SAAS,CAAC;IAEjC,IAAIb,cAAc,EAAE;MAClBG,QAAQ,CAAC,CAAC;IACZ,CAAC,MAAM;MACLT,gBAAgB,GAAG,CAAC;IACtB;EACF,CAAC,EAAE,CAACE,OAAO,EAAEO,QAAQ,EAAEH,cAAc,EAAEN,gBAAgB,EAAEhB,WAAW,EAAEU,UAAU,CAAC,CAAC;EAElF,OAAO;IACLe,QAAQ;IACRQ,eAAe;IACfK,UAAU,EAAEnB,aAAa,CAACQ,OAAO;IACjCJ,gBAAgB,EAAED;EACpB,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/hooks/useWebSSO.js

@@ -18,6 +18,36 @@
  */
 
 import { useEffect, useRef, useCallback } from 'react';
+/**
+ * Module-level guard tracking which (origin + API) signatures have already
+ * had a silent SSO attempt this page load.
+ *
+ * A per-component `useRef` guard resets whenever the provider remounts (route
+ * churn, StrictMode double-invoke, error-boundary recovery), which previously
+ * allowed silent SSO to re-fire and — combined with a routing redirect loop —
+ * produced an accelerating `navigator.credentials.get` retry storm. Keying the
+ * guard on a stable signature instead of the component instance makes silent
+ * SSO fire EXACTLY ONCE per page load regardless of how many times the
+ * provider mounts. The set is intentionally never cleared: a fresh page load
+ * (the only thing that can change the answer) starts a fresh module scope.
+ */
+const silentSSOAttempted = new Set();
+
+/**
+ * Build a stable signature for the silent-SSO run-once guard. Two providers
+ * pointed at the same API from the same origin share one attempt.
+ */
+function ssoSignature(oxyServices) {
+  const origin = typeof window !== 'undefined' ? window.location.origin : 'no-origin';
+  let baseURL = '';
+  try {
+    baseURL = oxyServices.getBaseURL?.() ?? '';
+  } catch {
+    baseURL = '';
+  }
+  return `${origin}|${baseURL}`;
+}
+
 /**
  * Check if we're running in a web browser environment (not React Native)
  */
@@ -135,12 +165,12 @@ export function useWebSSO({
 
   // Auto-check SSO on mount (web only, FedCM only, not on auth domain).
   //
-  // `hasCheckedRef` is a cheap per-instance fast-path so effect re-runs (from
-  // changing deps) within one mount never re-fire. The page-load run-once
-  // guarantee — silent SSO invoking `navigator.credentials.get` AT MOST ONCE
-  // per page load across remounts / StrictMode / multiple consumers — lives in
-  // `@oxyhq/core`'s `silentSignInWithFedCM`, which memoizes the first silent
-  // attempt's result for this origin + API. The hook therefore calls it freely.
+  // Run-once is enforced by TWO guards:
+  //   1. `hasCheckedRef` — cheap per-instance fast-path so effect re-runs
+  //      (from changing deps) within one mount never re-fire.
+  //   2. `silentSSOAttempted` — module-level, survives remounts/StrictMode so
+  //      silent SSO fires exactly once per page load even if the provider
+  //      unmounts and remounts.
   useEffect(() => {
     if (!enabled || !isWebBrowser() || hasCheckedRef.current || isIdentityProvider(authWebUrl)) {
       if (isIdentityProvider(authWebUrl)) {
@@ -148,13 +178,21 @@ export function useWebSSO({
       }
       return;
     }
+    const signature = ssoSignature(oxyServices);
+    if (silentSSOAttempted.has(signature)) {
+      // Already attempted this page load (e.g. before a remount) — do not
+      // re-fire. Mark the local fast-path too so subsequent re-renders skip.
+      hasCheckedRef.current = true;
+      return;
+    }
     hasCheckedRef.current = true;
+    silentSSOAttempted.add(signature);
     if (fedCMSupported) {
       checkSSO();
     } else {
       onSSOUnavailable?.();
     }
-  }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable, authWebUrl]);
+  }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable, oxyServices, authWebUrl]);
   return {
     checkSSO,
     signInWithFedCM,

package/lib/module/ui/hooks/useWebSSO.js.map

@@ -1 +1 @@
-{"version":3,"names":["useEffect","useRef","useCallback","isWebBrowser","window","document","documentElement","isIdentityProvider","authWebUrl","hostname","location","idpHostname","URL","useWebSSO","oxyServices","onSessionFound","onSSOUnavailable","onError","enabled","isCheckingRef","hasCheckedRef","fedCMSupported","isFedCMSupported","config","checkSSO","current","session","silentSignInWithFedCM","error","Error","String","signInWithFedCM","isChecking"],"sourceRoot":"../../../../src","sources":["ui/hooks/useWebSSO.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,SAAS,EAAEC,MAAM,EAAEC,WAAW,QAAQ,OAAO;AAuBtD;AACA;AACA;AACA,SAASC,YAAYA,CAAA,EAAY;EAC/B,OAAO,OAAOC,MAAM,KAAK,WAAW,IAC7B,OAAOC,QAAQ,KAAK,WAAW,IAC/B,OAAOA,QAAQ,CAACC,eAAe,KAAK,WAAW;AACxD;;AAEA;AACA;AACA;AACA;AACA,SAASC,kBAAkBA,CAACC,UAAmB,EAAW;EACxD,IAAI,CAACL,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMM,QAAQ,GAAGL,MAAM,CAACM,QAAQ,CAACD,QAAQ;EACzC,IAAIE,WAAW,GAAG,aAAa;EAC/B,IAAIH,UAAU,EAAE;IACd,IAAI;MAAEG,WAAW,GAAG,IAAIC,GAAG,CAACJ,UAAU,CAAC,CAACC,QAAQ;IAAE,CAAC,CAAC,MAAM,CAAE;EAC9D;EACA,OAAOA,QAAQ,KAAKE,WAAW;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,SAASA,CAAC;EACxBC,WAAW;EACXC,cAAc;EACdC,gBAAgB;EAChBC,OAAO;EACPC,OAAO,GAAG;AACM,CAAC,EAAmB;EACpC,MAAMC,aAAa,GAAGlB,MAAM,CAAC,KAAK,CAAC;EACnC,MAAMmB,aAAa,GAAGnB,MAAM,CAAC,KAAK,CAAC;;EAEnC;EACA,MAAMoB,cAAc,GAAGlB,YAAY,CAAC,CAAC,IAAIW,WAAW,CAACQ,gBAAgB,GAAG,CAAC;EACzE,MAAMd,UAAU,GAAGM,WAAW,CAACS,MAAM,EAAEf,UAAU;EAEjD,MAAMgB,QAAQ,GAAGtB,WAAW,CAAC,YAAkD;IAC7E,IAAI,CAACC,YAAY,CAAC,CAAC,IAAIgB,aAAa,CAACM,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;;IAEA;IACA,IAAIlB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAClCQ,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;;IAEA;IACA,IAAI,CAACK,cAAc,EAAE;MACnBL,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;IAEAG,aAAa,CAACM,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAMZ,WAAW,CAACa,qBAAqB,GAAG,CAAC;MAE3D,IAAID,OAAO,EAAE;QACX,MAAMX,cAAc,CAACW,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEAV,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb,CAAC,CAAC,OAAOY,KAAK,EAAE;MACdZ,gBAAgB,GAAG,CAAC;MACpBC,OAAO,GAAGW,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRT,aAAa,CAACM,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAACX,WAAW,EAAEC,cAAc,EAAEC,gBAAgB,EAAEC,OAAO,EAAEI,cAAc,EAAEb,UAAU,CAAC,CAAC;;EAExF;AACF;AACA;AACA;AACA;EACE,MAAMuB,eAAe,GAAG7B,WAAW,CAAC,YAAkD;IACpF,IAAI,CAACC,YAAY,CAAC,CAAC,IAAIgB,aAAa,CAACM,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;IAEA,IAAI,CAACJ,cAAc,EAAE;MACnBJ,OAAO,GAAG,IAAIY,KAAK,CAAC,wCAAwC,CAAC,CAAC;MAC9D,OAAO,IAAI;IACb;IAEAV,aAAa,CAACM,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAMZ,WAAW,CAACiB,eAAe,GAAG,CAAC;MAErD,IAAIL,OAAO,EAAE;QACX,MAAMX,cAAc,CAACW,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEA,OAAO,IAAI;IACb,CAAC,CAAC,OAAOE,KAAK,EAAE;MACdX,OAAO,GAAGW,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRT,aAAa,CAACM,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAACX,WAAW,EAAEC,cAAc,EAAEE,OAAO,EAAEI,cAAc,CAAC,CAAC;;EAE1D;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACArB,SAAS,CAAC,MAAM;IACd,IAAI,CAACkB,OAAO,IAAI,CAACf,YAAY,CAAC,CAAC,IAAIiB,aAAa,CAACK,OAAO,IAAIlB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAC1F,IAAID,kBAAkB,CAACC,UAAU,CAAC,EAAE;QAClCQ,gBAAgB,GAAG,CAAC;MACtB;MACA;IACF;IAEAI,aAAa,CAACK,OAAO,GAAG,IAAI;IAE5B,IAAIJ,cAAc,EAAE;MAClBG,QAAQ,CAAC,CAAC;IACZ,CAAC,MAAM;MACLR,gBAAgB,GAAG,CAAC;IACtB;EACF,CAAC,EAAE,CAACE,OAAO,EAAEM,QAAQ,EAAEH,cAAc,EAAEL,gBAAgB,EAAER,UAAU,CAAC,CAAC;EAErE,OAAO;IACLgB,QAAQ;IACRO,eAAe;IACfC,UAAU,EAAEb,aAAa,CAACM,OAAO;IACjCH,gBAAgB,EAAED;EACpB,CAAC;AACH;AAEA,SAASlB,YAAY","ignoreList":[]}
+{"version":3,"names":["useEffect","useRef","useCallback","silentSSOAttempted","Set","ssoSignature","oxyServices","origin","window","location","baseURL","getBaseURL","isWebBrowser","document","documentElement","isIdentityProvider","authWebUrl","hostname","idpHostname","URL","useWebSSO","onSessionFound","onSSOUnavailable","onError","enabled","isCheckingRef","hasCheckedRef","fedCMSupported","isFedCMSupported","config","checkSSO","current","session","silentSignInWithFedCM","error","Error","String","signInWithFedCM","signature","has","add","isChecking"],"sourceRoot":"../../../../src","sources":["ui/hooks/useWebSSO.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,SAAS,EAAEC,MAAM,EAAEC,WAAW,QAAQ,OAAO;AAuBtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,kBAAkB,GAAG,IAAIC,GAAG,CAAS,CAAC;;AAE5C;AACA;AACA;AACA;AACA,SAASC,YAAYA,CAACC,WAAwB,EAAU;EACtD,MAAMC,MAAM,GAAG,OAAOC,MAAM,KAAK,WAAW,GAAGA,MAAM,CAACC,QAAQ,CAACF,MAAM,GAAG,WAAW;EACnF,IAAIG,OAAO,GAAG,EAAE;EAChB,IAAI;IACFA,OAAO,GAAGJ,WAAW,CAACK,UAAU,GAAG,CAAC,IAAI,EAAE;EAC5C,CAAC,CAAC,MAAM;IACND,OAAO,GAAG,EAAE;EACd;EACA,OAAO,GAAGH,MAAM,IAAIG,OAAO,EAAE;AAC/B;;AAEA;AACA;AACA;AACA,SAASE,YAAYA,CAAA,EAAY;EAC/B,OAAO,OAAOJ,MAAM,KAAK,WAAW,IAC7B,OAAOK,QAAQ,KAAK,WAAW,IAC/B,OAAOA,QAAQ,CAACC,eAAe,KAAK,WAAW;AACxD;;AAEA;AACA;AACA;AACA;AACA,SAASC,kBAAkBA,CAACC,UAAmB,EAAW;EACxD,IAAI,CAACJ,YAAY,CAAC,CAAC,EAAE,OAAO,KAAK;EACjC,MAAMK,QAAQ,GAAGT,MAAM,CAACC,QAAQ,CAACQ,QAAQ;EACzC,IAAIC,WAAW,GAAG,aAAa;EAC/B,IAAIF,UAAU,EAAE;IACd,IAAI;MAAEE,WAAW,GAAG,IAAIC,GAAG,CAACH,UAAU,CAAC,CAACC,QAAQ;IAAE,CAAC,CAAC,MAAM,CAAE;EAC9D;EACA,OAAOA,QAAQ,KAAKC,WAAW;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,SAASA,CAAC;EACxBd,WAAW;EACXe,cAAc;EACdC,gBAAgB;EAChBC,OAAO;EACPC,OAAO,GAAG;AACM,CAAC,EAAmB;EACpC,MAAMC,aAAa,GAAGxB,MAAM,CAAC,KAAK,CAAC;EACnC,MAAMyB,aAAa,GAAGzB,MAAM,CAAC,KAAK,CAAC;;EAEnC;EACA,MAAM0B,cAAc,GAAGf,YAAY,CAAC,CAAC,IAAIN,WAAW,CAACsB,gBAAgB,GAAG,CAAC;EACzE,MAAMZ,UAAU,GAAGV,WAAW,CAACuB,MAAM,EAAEb,UAAU;EAEjD,MAAMc,QAAQ,GAAG5B,WAAW,CAAC,YAAkD;IAC7E,IAAI,CAACU,YAAY,CAAC,CAAC,IAAIa,aAAa,CAACM,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;;IAEA;IACA,IAAIhB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAClCM,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;;IAEA;IACA,IAAI,CAACK,cAAc,EAAE;MACnBL,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb;IAEAG,aAAa,CAACM,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM1B,WAAW,CAAC2B,qBAAqB,GAAG,CAAC;MAE3D,IAAID,OAAO,EAAE;QACX,MAAMX,cAAc,CAACW,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEAV,gBAAgB,GAAG,CAAC;MACpB,OAAO,IAAI;IACb,CAAC,CAAC,OAAOY,KAAK,EAAE;MACdZ,gBAAgB,GAAG,CAAC;MACpBC,OAAO,GAAGW,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRT,aAAa,CAACM,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAACzB,WAAW,EAAEe,cAAc,EAAEC,gBAAgB,EAAEC,OAAO,EAAEI,cAAc,EAAEX,UAAU,CAAC,CAAC;;EAExF;AACF;AACA;AACA;AACA;EACE,MAAMqB,eAAe,GAAGnC,WAAW,CAAC,YAAkD;IACpF,IAAI,CAACU,YAAY,CAAC,CAAC,IAAIa,aAAa,CAACM,OAAO,EAAE;MAC5C,OAAO,IAAI;IACb;IAEA,IAAI,CAACJ,cAAc,EAAE;MACnBJ,OAAO,GAAG,IAAIY,KAAK,CAAC,wCAAwC,CAAC,CAAC;MAC9D,OAAO,IAAI;IACb;IAEAV,aAAa,CAACM,OAAO,GAAG,IAAI;IAE5B,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM1B,WAAW,CAAC+B,eAAe,GAAG,CAAC;MAErD,IAAIL,OAAO,EAAE;QACX,MAAMX,cAAc,CAACW,OAAO,CAAC;QAC7B,OAAOA,OAAO;MAChB;MAEA,OAAO,IAAI;IACb,CAAC,CAAC,OAAOE,KAAK,EAAE;MACdX,OAAO,GAAGW,KAAK,YAAYC,KAAK,GAAGD,KAAK,GAAG,IAAIC,KAAK,CAACC,MAAM,CAACF,KAAK,CAAC,CAAC,CAAC;MACpE,OAAO,IAAI;IACb,CAAC,SAAS;MACRT,aAAa,CAACM,OAAO,GAAG,KAAK;IAC/B;EACF,CAAC,EAAE,CAACzB,WAAW,EAAEe,cAAc,EAAEE,OAAO,EAAEI,cAAc,CAAC,CAAC;;EAE1D;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA3B,SAAS,CAAC,MAAM;IACd,IAAI,CAACwB,OAAO,IAAI,CAACZ,YAAY,CAAC,CAAC,IAAIc,aAAa,CAACK,OAAO,IAAIhB,kBAAkB,CAACC,UAAU,CAAC,EAAE;MAC1F,IAAID,kBAAkB,CAACC,UAAU,CAAC,EAAE;QAClCM,gBAAgB,GAAG,CAAC;MACtB;MACA;IACF;IAEA,MAAMgB,SAAS,GAAGjC,YAAY,CAACC,WAAW,CAAC;IAC3C,IAAIH,kBAAkB,CAACoC,GAAG,CAACD,SAAS,CAAC,EAAE;MACrC;MACA;MACAZ,aAAa,CAACK,OAAO,GAAG,IAAI;MAC5B;IACF;IAEAL,aAAa,CAACK,OAAO,GAAG,IAAI;IAC5B5B,kBAAkB,CAACqC,GAAG,CAACF,SAAS,CAAC;IAEjC,IAAIX,cAAc,EAAE;MAClBG,QAAQ,CAAC,CAAC;IACZ,CAAC,MAAM;MACLR,gBAAgB,GAAG,CAAC;IACtB;EACF,CAAC,EAAE,CAACE,OAAO,EAAEM,QAAQ,EAAEH,cAAc,EAAEL,gBAAgB,EAAEhB,WAAW,EAAEU,UAAU,CAAC,CAAC;EAElF,OAAO;IACLc,QAAQ;IACRO,eAAe;IACfI,UAAU,EAAEhB,aAAa,CAACM,OAAO;IACjCH,gBAAgB,EAAED;EACpB,CAAC;AACH;AAEA,SAASf,YAAY","ignoreList":[]}

package/lib/typescript/commonjs/ui/hooks/useWebSSO.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,UAAU,gBAAgB;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrD,2DAA2D;IAC3D,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC5D,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,iBAAS,YAAY,IAAI,OAAO,CAI/B;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,EACxB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,OAAc,GACf,EAAE,gBAAgB,GAAG,eAAe,CA+GpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,UAAU,gBAAgB;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrD,2DAA2D;IAC3D,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC5D,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAgCD;;GAEG;AACH,iBAAS,YAAY,IAAI,OAAO,CAI/B;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,EACxB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,OAAc,GACf,EAAE,gBAAgB,GAAG,eAAe,CAwHpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/lib/typescript/module/ui/hooks/useWebSSO.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,UAAU,gBAAgB;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrD,2DAA2D;IAC3D,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC5D,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,iBAAS,YAAY,IAAI,OAAO,CAI/B;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,EACxB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,OAAc,GACf,EAAE,gBAAgB,GAAG,eAAe,CA+GpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"useWebSSO.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useWebSSO.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,UAAU,gBAAgB;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,eAAe;IACvB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrD,2DAA2D;IAC3D,eAAe,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC5D,uCAAuC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,iDAAiD;IACjD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAgCD;;GAEG;AACH,iBAAS,YAAY,IAAI,OAAO,CAI/B;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,EACxB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,OAAc,GACf,EAAE,gBAAgB,GAAG,eAAe,CAwHpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "6.10.5",
+  "version": "6.10.6",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/hooks/useWebSSO.ts

@@ -38,6 +38,36 @@ interface UseWebSSOResult {
   isFedCMSupported: boolean;
 }
 
+/**
+ * Module-level guard tracking which (origin + API) signatures have already
+ * had a silent SSO attempt this page load.
+ *
+ * A per-component `useRef` guard resets whenever the provider remounts (route
+ * churn, StrictMode double-invoke, error-boundary recovery), which previously
+ * allowed silent SSO to re-fire and — combined with a routing redirect loop —
+ * produced an accelerating `navigator.credentials.get` retry storm. Keying the
+ * guard on a stable signature instead of the component instance makes silent
+ * SSO fire EXACTLY ONCE per page load regardless of how many times the
+ * provider mounts. The set is intentionally never cleared: a fresh page load
+ * (the only thing that can change the answer) starts a fresh module scope.
+ */
+const silentSSOAttempted = new Set<string>();
+
+/**
+ * Build a stable signature for the silent-SSO run-once guard. Two providers
+ * pointed at the same API from the same origin share one attempt.
+ */
+function ssoSignature(oxyServices: OxyServices): string {
+  const origin = typeof window !== 'undefined' ? window.location.origin : 'no-origin';
+  let baseURL = '';
+  try {
+    baseURL = oxyServices.getBaseURL?.() ?? '';
+  } catch {
+    baseURL = '';
+  }
+  return `${origin}|${baseURL}`;
+}
+
 /**
  * Check if we're running in a web browser environment (not React Native)
  */
@@ -165,12 +195,12 @@ export function useWebSSO({
 
   // Auto-check SSO on mount (web only, FedCM only, not on auth domain).
   //
-  // `hasCheckedRef` is a cheap per-instance fast-path so effect re-runs (from
-  // changing deps) within one mount never re-fire. The page-load run-once
-  // guarantee — silent SSO invoking `navigator.credentials.get` AT MOST ONCE
-  // per page load across remounts / StrictMode / multiple consumers — lives in
-  // `@oxyhq/core`'s `silentSignInWithFedCM`, which memoizes the first silent
-  // attempt's result for this origin + API. The hook therefore calls it freely.
+  // Run-once is enforced by TWO guards:
+  //   1. `hasCheckedRef` — cheap per-instance fast-path so effect re-runs
+  //      (from changing deps) within one mount never re-fire.
+  //   2. `silentSSOAttempted` — module-level, survives remounts/StrictMode so
+  //      silent SSO fires exactly once per page load even if the provider
+  //      unmounts and remounts.
   useEffect(() => {
     if (!enabled || !isWebBrowser() || hasCheckedRef.current || isIdentityProvider(authWebUrl)) {
       if (isIdentityProvider(authWebUrl)) {
@@ -179,14 +209,23 @@ export function useWebSSO({
       return;
     }
 
+    const signature = ssoSignature(oxyServices);
+    if (silentSSOAttempted.has(signature)) {
+      // Already attempted this page load (e.g. before a remount) — do not
+      // re-fire. Mark the local fast-path too so subsequent re-renders skip.
+      hasCheckedRef.current = true;
+      return;
+    }
+
     hasCheckedRef.current = true;
+    silentSSOAttempted.add(signature);
 
     if (fedCMSupported) {
       checkSSO();
     } else {
       onSSOUnavailable?.();
     }
-  }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable, authWebUrl]);
+  }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable, oxyServices, authWebUrl]);
 
   return {
     checkSSO,