@oxyhq/services 6.10.6 → 6.10.8

package/lib/typescript/commonjs/ui/hooks/queries/useSecurityQueries.d.ts

@@ -21,5 +21,5 @@ export declare const useInfiniteSecurityActivity: (options?: {
     limit?: number;
     eventType?: SecurityEventType;
     enabled?: boolean;
-}) => import("@tanstack/react-query").UseInfiniteQueryResult<import("@tanstack/react-query").InfiniteData<SecurityActivityResponse, unknown>, Error>;
+}) => import("@tanstack/react-query").UseInfiniteQueryResult<import("@tanstack/query-core").InfiniteData<SecurityActivityResponse, unknown>, Error>;
 //# sourceMappingURL=useSecurityQueries.d.ts.map

package/lib/typescript/commonjs/ui/hooks/queries/useSecurityQueries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSecurityQueries.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/useSecurityQueries.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjG;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,6FA2BF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAU,uFAgBnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GACtC,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,mJA4BF,CAAC"}
+{"version":3,"file":"useSecurityQueries.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/useSecurityQueries.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjG;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,6FA2BF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAU,uFAgBnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GACtC,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,kJA4BF,CAAC"}

package/lib/typescript/commonjs/ui/hooks/useSessionManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSessionManagement.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSessionManagement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,WAAW,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;IAC/C,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAKD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,+KAalC,2BAA2B,KAAG,0BA2VhC,CAAC"}
+{"version":3,"file":"useSessionManagement.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSessionManagement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,WAAW,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;IAC/C,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAKD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,+KAalC,2BAA2B,KAAG,0BAmWhC,CAAC"}

package/lib/typescript/module/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAStD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAgCD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAipBzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA0D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAStD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAyE/D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAgCD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA63BzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA0D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/lib/typescript/module/ui/hooks/queries/useSecurityQueries.d.ts

@@ -21,5 +21,5 @@ export declare const useInfiniteSecurityActivity: (options?: {
     limit?: number;
     eventType?: SecurityEventType;
     enabled?: boolean;
-}) => import("@tanstack/react-query").UseInfiniteQueryResult<import("@tanstack/react-query").InfiniteData<SecurityActivityResponse, unknown>, Error>;
+}) => import("@tanstack/react-query").UseInfiniteQueryResult<import("@tanstack/query-core").InfiniteData<SecurityActivityResponse, unknown>, Error>;
 //# sourceMappingURL=useSecurityQueries.d.ts.map

package/lib/typescript/module/ui/hooks/queries/useSecurityQueries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSecurityQueries.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/useSecurityQueries.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjG;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,6FA2BF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAU,uFAgBnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GACtC,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,mJA4BF,CAAC"}
+{"version":3,"file":"useSecurityQueries.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/queries/useSecurityQueries.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjG;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,6FA2BF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAU,uFAgBnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GACtC,UAAU;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,kJA4BF,CAAC"}

package/lib/typescript/module/ui/hooks/useSessionManagement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSessionManagement.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSessionManagement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,WAAW,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;IAC/C,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAKD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,+KAalC,2BAA2B,KAAG,0BA2VhC,CAAC"}
+{"version":3,"file":"useSessionManagement.d.ts","sourceRoot":"","sources":["../../../../../src/ui/hooks/useSessionManagement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACpD,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACzC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,WAAW,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;IAC/C,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAKD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,+KAalC,2BAA2B,KAAG,0BAmWhC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "6.10.6",
+  "version": "6.10.8",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/context/OxyContext.tsx

@@ -9,7 +9,7 @@ import {
   useState,
   type ReactNode,
 } from 'react';
-import { OxyServices } from '@oxyhq/core';
+import { OxyServices, oxyClient } from '@oxyhq/core';
 import type { User, ApiError, SessionLoginResponse } from '@oxyhq/core';
 import type { ManagedAccount, CreateManagedAccountInput } from '@oxyhq/core';
 import { KeyManager } from '@oxyhq/core';
@@ -97,6 +97,77 @@ export interface OxyContextState {
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
+/**
+ * Minimal, decode-only shape of the session access-token JWT claims the
+ * `POST /auth/refresh` endpoint returns. We only read `sessionId` (and `userId`
+ * as a fallback). The token is already signed and verified server-side; the
+ * client decodes the payload purely to recover the session id — it does NOT and
+ * MUST NOT verify the signature.
+ */
+interface RefreshAccessTokenClaims {
+  sessionId?: string;
+  userId?: string;
+  id?: string;
+}
+
+/**
+ * Decode the payload of a JWT WITHOUT verifying its signature.
+ *
+ * The server (`POST /auth/refresh`) has already minted and signed this access
+ * token; we only need to recover the `sessionId` claim from it on cold boot.
+ * Returns `null` for any malformed input rather than throwing, so a bad token
+ * simply falls through to the unauthenticated path.
+ *
+ * Implemented with manual base64url decoding (no `jwt-decode` dependency added
+ * to `@oxyhq/services`). Works on web (where this cold-boot path runs) via
+ * `atob`; if `atob` is unavailable (non-browser runtime) it is treated as
+ * undecodable and returns `null`.
+ */
+function decodeAccessTokenClaims(token: string): RefreshAccessTokenClaims | null {
+  if (!token || typeof token !== 'string') {
+    return null;
+  }
+  const segments = token.split('.');
+  if (segments.length !== 3) {
+    return null;
+  }
+  const payloadSegment = segments[1];
+  if (!payloadSegment) {
+    return null;
+  }
+  try {
+    const base64 = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
+    if (typeof atob !== 'function') {
+      return null;
+    }
+    const json = decodeURIComponent(
+      atob(padded)
+        .split('')
+        .map((char) => `%${`00${char.charCodeAt(0).toString(16)}`.slice(-2)}`)
+        .join(''),
+    );
+    const parsed: unknown = JSON.parse(json);
+    if (parsed === null || typeof parsed !== 'object') {
+      return null;
+    }
+    const claims = parsed as Record<string, unknown>;
+    return {
+      sessionId: typeof claims.sessionId === 'string' ? claims.sessionId : undefined,
+      userId: typeof claims.userId === 'string' ? claims.userId : undefined,
+      id: typeof claims.id === 'string' ? claims.id : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Server response shape of `POST /auth/refresh`. */
+interface RefreshCookieResponse {
+  accessToken?: string;
+  sessionId?: string;
+}
+
 export interface OxyContextProviderProps {
   children: ReactNode;
   oxyServices?: OxyServices;
@@ -190,6 +261,43 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const [initialized, setInitialized] = useState(false);
   const setAuthState = useAuthStore.setState;
 
+  // Keep the shared `oxyClient` singleton's token store in lockstep with the
+  // session owned by THIS provider's instance. Many apps construct their api
+  // clients against the exported `oxyClient` singleton (reading
+  // `oxyClient.getAccessToken()` to build Authorization headers) while passing
+  // only `baseURL` to OxyProvider — in which case the provider owns a DIFFERENT
+  // `OxyServices` instance and the singleton would otherwise never receive the
+  // token, producing `Authorization: Bearer null`.
+  //
+  // Subscribing to `onTokensChanged` mirrors EVERY token mutation — sign-in,
+  // session restore, switch, silent refresh, and sign-out/clear — onto the
+  // singleton at the single source of truth in @oxyhq/core, with no per-app
+  // plumbing and regardless of which auth code path fired.
+  //
+  // When the app passed the singleton itself as `oxyServices` (Mention's
+  // pattern), `oxyServices === oxyClient`, so we skip the redundant self-write
+  // and the subscription is a no-op mirror — fully backward compatible.
+  useEffect(() => {
+    if (oxyServices === oxyClient) {
+      return;
+    }
+
+    const applyToSingleton = (accessToken: string | null) => {
+      if (accessToken) {
+        oxyClient.setTokens(accessToken);
+      } else {
+        oxyClient.clearTokens();
+      }
+    };
+
+    // Seed the singleton with whatever token the instance already holds (it may
+    // have been planted synchronously before this effect ran — e.g. a token set
+    // during the same tick as mount), then keep it in sync going forward.
+    applyToSingleton(oxyServices.getAccessToken());
+
+    return oxyServices.onTokensChanged(applyToSingleton);
+  }, [oxyServices]);
+
   const logger = useCallback((message: string, err?: unknown) => {
     if (__DEV__) {
       console.warn(`[OxyContext] ${message}`, err);
@@ -198,16 +306,58 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   const storageKeys = useMemo(() => getStorageKeys(storageKeyPrefix), [storageKeyPrefix]);
 
-  // Simple storage initialization - no complex hook needed
+  // Storage initialization.
+  //
+  // `storage` (state) drives render-time gating (`isStorageReady`) and the
+  // hooks below. But it is `null` for a brief window after mount while
+  // `createPlatformStorage()` resolves (a microtask on web; a dynamic
+  // `import()` on native). Any persistence path that fires during that window
+  // — e.g. an interactive FedCM sign-in the instant the screen mounts — would
+  // read `storage === null` and SILENTLY skip writing the session, leaving the
+  // user signed-in in-memory but with nothing to restore on reload.
+  //
+  // To make persistence robust regardless of timing we ALSO expose the storage
+  // as an awaitable promise (`getReadyStorage`). Persistence code awaits the
+  // ready instance instead of branching on the possibly-null state, so a write
+  // is never silently dropped just because it raced storage init.
   const storageRef = useRef<StorageInterface | null>(null);
   const [storage, setStorage] = useState<StorageInterface | null>(null);
 
+  // A single, stable deferred that resolves with the initialized storage. Built
+  // lazily via a ref initializer so the resolver is captured exactly once and
+  // the promise identity is stable across renders.
+  const buildStorageDeferred = () => {
+    let resolve: (storage: StorageInterface) => void = () => undefined;
+    const promise = new Promise<StorageInterface>((res) => {
+      resolve = res;
+    });
+    return { promise, resolve };
+  };
+  const storageReadyRef = useRef<ReturnType<typeof buildStorageDeferred> | null>(null);
+  if (storageReadyRef.current === null) {
+    storageReadyRef.current = buildStorageDeferred();
+  }
+  const storageReady = storageReadyRef.current;
+
+  // Resolve the storage instance that is guaranteed to be ready. Returns the
+  // already-initialized instance synchronously when available, otherwise awaits
+  // the init promise. Never resolves to `null`.
+  const getReadyStorage = useCallback((): Promise<StorageInterface> => {
+    if (storageRef.current) {
+      return Promise.resolve(storageRef.current);
+    }
+    return storageReady.promise;
+  }, [storageReady]);
+
   useEffect(() => {
     let mounted = true;
     createPlatformStorage()
       .then((storageInstance) => {
+        // Resolve the ready-promise even if the component unmounted: in-flight
+        // persistence awaiting it must still complete against a real store.
+        storageRef.current = storageInstance;
+        storageReady.resolve(storageInstance);
         if (mounted) {
-          storageRef.current = storageInstance;
           setStorage(storageInstance);
         }
       })
@@ -225,7 +375,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     return () => {
       mounted = false;
     };
-  }, [logger, onError]);
+  }, [logger, onError, storageReady]);
 
 
   // Offline queuing is now handled by TanStack Query mutations
@@ -338,6 +488,148 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const clearSessionStateRef = useRef(clearSessionState);
   clearSessionStateRef.current = clearSessionState;
 
+  // Durable, navigation-safe session persistence.
+  //
+  // Writes the active-session id and appends the session id to the durable
+  // `session_ids` list, awaiting the READY storage instance (never the possibly
+  // -null `storage` state) so a write is never dropped because it raced storage
+  // init. Callers MUST invoke this BEFORE any work that can trigger a route
+  // navigation (`onAuthStateChange`) — navigation can interrupt a still-pending
+  // async write, which is exactly what once left `session_ids` empty after a
+  // successful sign-in. Shared by the FedCM/popup path and the cold-boot
+  // refresh-cookie restore so both land the same durable record.
+  const persistSessionDurably = useCallback(async (sessionId: string): Promise<void> => {
+    const readyStorage = await getReadyStorage();
+    await readyStorage.setItem(storageKeys.activeSessionId, sessionId);
+    const existingIds = await readyStorage.getItem(storageKeys.sessionIds);
+    let sessionIds: string[] = [];
+    try { sessionIds = existingIds ? JSON.parse(existingIds) : []; } catch { /* corrupted storage */ }
+    if (!sessionIds.includes(sessionId)) {
+      sessionIds.push(sessionId);
+      await readyStorage.setItem(storageKeys.sessionIds, JSON.stringify(sessionIds));
+    }
+  }, [getReadyStorage, storageKeys.activeSessionId, storageKeys.sessionIds]);
+
+  // Refs so the cold-boot restore can plant session state without widening its
+  // dependency array (mirrors the existing ref pattern above).
+  const setActiveSessionIdRef = useRef(setActiveSessionId);
+  setActiveSessionIdRef.current = setActiveSessionId;
+  const loginSuccessRef = useRef(loginSuccess);
+  loginSuccessRef.current = loginSuccess;
+  const onAuthStateChangeRef = useRef(onAuthStateChange);
+  onAuthStateChangeRef.current = onAuthStateChange;
+
+  // Cold-boot session restore via the secure refresh cookie (web only).
+  //
+  // On a hard reload the in-app, bearer-protected token fetch
+  // (`getTokenBySession` → `/session/token/:id`) 401s because there is no token
+  // in memory yet, which previously cleared the session and bounced the user to
+  // sign-in. Instead we call `POST {apiBaseUrl}/auth/refresh` with
+  // `credentials: 'include'` and NO Authorization header: the browser
+  // automatically attaches the first-party httpOnly `oxy_rt` cookie (set at
+  // login/signup/fedcm-exchange), the server validates + rotates it and returns
+  // a fresh session access token. JS never sees the refresh cookie (httpOnly) —
+  // that is the security property.
+  //
+  // Returns `true` when the session was restored (caller short-circuits the
+  // bearer path); `false` on 401 / no durable cookie / any failure (caller
+  // proceeds unauthenticated through the existing flow — nothing is cleared).
+  const restoreViaRefreshCookie = useCallback(async (): Promise<boolean> => {
+    if (!isWebBrowser()) {
+      return false;
+    }
+
+    const apiBaseUrl = oxyServices.getBaseURL();
+    if (!apiBaseUrl) {
+      return false;
+    }
+
+    let response: Response;
+    try {
+      // Direct credentialed, no-auth POST. We deliberately bypass the SDK's
+      // HttpService here: it would attach the (absent) bearer and does not send
+      // cookies. The refresh cookie is scoped to `Path=/auth/refresh` and sent
+      // automatically same-site.
+      response = await fetch(`${apiBaseUrl.replace(/\/$/, '')}/auth/refresh`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+      });
+    } catch (fetchError) {
+      // Offline / network error — fall through to the cached/stored-session flow.
+      if (__DEV__) {
+        loggerUtil.debug('Refresh-cookie restore network error (expected when offline)', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, fetchError as unknown);
+      }
+      return false;
+    }
+
+    // 401 (no/expired/reused cookie) and any non-2xx → no durable session.
+    if (!response.ok) {
+      return false;
+    }
+
+    let payload: RefreshCookieResponse;
+    try {
+      payload = (await response.json()) as RefreshCookieResponse;
+    } catch {
+      return false;
+    }
+
+    const accessToken = payload.accessToken;
+    if (!accessToken) {
+      return false;
+    }
+
+    // Recover the session id from the (server-signed) access-token claims, or
+    // from the response body if the server included it. Decode-only; the server
+    // already verified the signature.
+    const claims = decodeAccessTokenClaims(accessToken);
+    const sessionId = payload.sessionId ?? claims?.sessionId;
+    if (!sessionId) {
+      // A token with no resolvable session id cannot drive multi-session state.
+      return false;
+    }
+
+    // Plant the fresh access token. The refresh token stays in the httpOnly
+    // cookie and is never touched by JS.
+    oxyServices.httpService.setTokens(accessToken);
+
+    // Fetch the full user with the freshly planted token.
+    let fullUser: User;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (userError) {
+      // Token planted but profile fetch failed (e.g. transient network). Do not
+      // claim a restored session; fall through so the stored-session flow can
+      // retry. Leave the planted token in place — it is valid and harmless.
+      if (__DEV__) {
+        loggerUtil.debug('Refresh-cookie restore: getCurrentUser failed', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, userError as unknown);
+      }
+      return false;
+    }
+
+    const userId = fullUser.id?.toString() ?? claims?.userId ?? '';
+    const now = new Date();
+    const clientSession: ClientSession = {
+      sessionId,
+      deviceId: '',
+      expiresAt: new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+      lastActive: now.toISOString(),
+      userId,
+      isCurrent: true,
+    };
+
+    // Restore the active session into the multi-session store (merge: keep any
+    // other sessions intact) and durably persist BEFORE notifying listeners.
+    updateSessionsRef.current([clientSession], { merge: true });
+    setActiveSessionIdRef.current(sessionId);
+    await persistSessionDurably(sessionId);
+
+    loginSuccessRef.current(fullUser);
+    onAuthStateChangeRef.current?.(fullUser);
+    return true;
+  }, [oxyServices, persistSessionDurably]);
+
   const restoreSessionsFromStorage = useCallback(async (): Promise<void> => {
     if (!storage) {
       return;
@@ -346,6 +638,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     setTokenReady(false);
 
     try {
+      // Web cold-boot fast path: restore the active session from the secure
+      // httpOnly refresh cookie before the bearer-protected stored-session
+      // validation (which 401s on a hard reload). On success we are signed in
+      // from the cookie alone — no FedCM needed. On failure we fall through to
+      // the existing stored-session flow below; nothing is cleared.
+      if (await restoreViaRefreshCookie()) {
+        return;
+      }
+
       const storedSessionIdsJson = await storage.getItem(storageKeys.sessionIds);
       const storedSessionIds: string[] = storedSessionIdsJson ? JSON.parse(storedSessionIdsJson) : [];
       const storedActiveSessionId = await storage.getItem(storageKeys.activeSessionId);
@@ -436,6 +737,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     storage,
     storageKeys.activeSessionId,
     storageKeys.sessionIds,
+    restoreViaRefreshCookie,
   ]);
 
   useEffect(() => {
@@ -480,8 +782,25 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     updateSessions([clientSession], { merge: true });
     setActiveSessionId(session.sessionId);
 
-    // Fetch the full user profile now that we have a valid access token.
-    // The session only carries MinimalUserData; the store and callbacks expect a full User.
+    // Persist to storage BEFORE fetching the profile and BEFORE notifying the
+    // auth-state-change callback. The token is planted and the in-memory store
+    // is updated above; durably committing the session id here — ahead of
+    // `getCurrentUser()` / `loginSuccess` / `onAuthStateChange` — is critical
+    // because `onAuthStateChange` triggers a route navigation that can
+    // interrupt/supersede a still-pending async write. Persisting first
+    // guarantees the durable record lands; that is exactly what was missing
+    // when `oxy_session_session_ids` came back empty after a successful FedCM
+    // sign-in (the user appeared logged in until reload, then had no session to
+    // restore). `persistSessionDurably` awaits the READY storage instance rather
+    // than reading the possibly-null `storage` state, so a sign-in fired the
+    // instant the screen mounts (before storage-init populates state) is not
+    // silently dropped.
+    await persistSessionDurably(session.sessionId);
+
+    // Fetch the full user profile now that we have a valid access token and the
+    // session is durably persisted. The session only carries MinimalUserData;
+    // the store and callbacks expect a full User. The navigation kicked off by
+    // `onAuthStateChange` now happens only after the durable write is committed.
     let fullUser: User;
     try {
       fullUser = await oxyServices.getCurrentUser();
@@ -492,19 +811,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
     loginSuccess(fullUser);
     onAuthStateChange?.(fullUser);
-
-    // Persist to storage
-    if (storage) {
-      await storage.setItem(storageKeys.activeSessionId, session.sessionId);
-      const existingIds = await storage.getItem(storageKeys.sessionIds);
-      let sessionIds: string[] = [];
-      try { sessionIds = existingIds ? JSON.parse(existingIds) : []; } catch { /* corrupted storage */ }
-      if (!sessionIds.includes(session.sessionId)) {
-        sessionIds.push(session.sessionId);
-        await storage.setItem(storageKeys.sessionIds, JSON.stringify(sessionIds));
-      }
-    }
-  }, [oxyServices, updateSessions, setActiveSessionId, loginSuccess, onAuthStateChange, storage, storageKeys]);
+  }, [oxyServices, updateSessions, setActiveSessionId, loginSuccess, onAuthStateChange, persistSessionDurably]);
 
   // Enable web SSO only after local storage check completes and no user found
   const shouldTryWebSSO = isWebBrowser() && tokenReady && !user && initialized;

package/src/ui/hooks/useSessionManagement.ts

@@ -166,7 +166,15 @@ export const useSessionManagement = ({
     setSessions([]);
     setActiveSessionId(null);
     logoutStore();
-    
+
+    // Clear the access token on the client instance. Without this the
+    // TokenStore retained the stale bearer until the next 401, leaving the
+    // instance "logged in" at the HTTP layer and — via OxyProvider's
+    // token-change mirror — leaking that stale token onto the shared
+    // `oxyClient` singleton after sign-out. Clearing here fires
+    // `onTokensChanged(null)`, propagating the logged-out state everywhere.
+    oxyServices.clearTokens();
+
     // Clear TanStack Query cache (in-memory)
     if (queryClient) {
       queryClient.clear();
@@ -185,7 +193,7 @@ export const useSessionManagement = ({
     
     await clearSessionStorage();
     onAuthStateChange?.(null);
-  }, [clearSessionStorage, logoutStore, onAuthStateChange, queryClient, storage, logger]);
+  }, [clearSessionStorage, logoutStore, onAuthStateChange, oxyServices, queryClient, storage, logger]);
 
   const activateSession = useCallback(
     async (sessionId: string, user: User): Promise<void> => {