@stigmer/react 3.14.1 → 3.15.1

package/src/identity-account/__tests__/useIdentityAccountGate.test.tsx

@@ -0,0 +1,236 @@
+/**
+ * Pins the behaviour of `useIdentityAccountGate` — the console's first-sign-in
+ * gate — so the hook can delegate its whoAmI → NOT_FOUND → provisionMyAccount
+ * machine to `@stigmer/sdk`'s `ensureMyIdentityAccount` (20260911.11 A3)
+ * without changing what any consumer observes. Written green against the
+ * hook as it stood before the delegation; it must stay green after.
+ *
+ * The states and transitions it holds to:
+ *
+ *   checking ─ whoAmI answers ────────────────────────────▶ ready(account)
+ *   checking ─ whoAmI NOT_FOUND ─▶ provisioning ─ answers ─▶ ready(account)
+ *   checking ─ whoAmI other error ────────────────────────▶ error(message)
+ *   provisioning ─ provisionMyAccount fails ──────────────▶ error(message)
+ *   error ─ retry() ──────────────────────────────────────▶ checking (again)
+ *   isEnabled: false ─────────────────────────────────────▶ ready (bypassed)
+ *
+ * and one invariant a delegation could silently break: a `retry()` issued
+ * while an earlier attempt is in flight discards that attempt's outcome,
+ * whichever RPC it was waiting on.
+ */
+import { Code } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import {
+  IdentityAccountSchema,
+  type IdentityAccount,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { StigmerError } from "@stigmer/sdk";
+import {
+  act,
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { StigmerContext } from "../../context";
+import { useIdentityAccountGate } from "../useIdentityAccountGate";
+
+const EXISTING: IdentityAccount = create(IdentityAccountSchema, {
+  metadata: { id: "ida_existing" },
+  spec: { idpId: "auth0|existing" },
+});
+const CREATED: IdentityAccount = create(IdentityAccountSchema, {
+  metadata: { id: "ida_created" },
+  spec: { idpId: "auth0|created" },
+});
+
+const notFound = () =>
+  new StigmerError(
+    "not-found",
+    "Identity account not found for the authenticated user",
+    Code.NotFound,
+  );
+
+/** A promise whose settlement the test controls. */
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+/** Renders the gate and exposes its state via data attributes; click = retry. */
+function GateProbe({ isEnabled }: { isEnabled: boolean }) {
+  const { state, retry } = useIdentityAccountGate({ isEnabled });
+  return (
+    <button
+      type="button"
+      data-testid="probe"
+      data-status={state.status}
+      data-account={
+        state.status === "ready" ? (state.account?.metadata?.id ?? "") : ""
+      }
+      data-message={state.status === "error" ? state.message : ""}
+      onClick={retry}
+    />
+  );
+}
+
+function withClient(client: unknown, isEnabled = true) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      <GateProbe isEnabled={isEnabled} />
+    </StigmerContext.Provider>,
+  );
+}
+
+const probe = () => screen.getByTestId("probe");
+const status = () => probe().getAttribute("data-status");
+
+afterEach(cleanup);
+
+describe("useIdentityAccountGate", () => {
+  it("checking → ready when whoAmI answers; provisionMyAccount is never called", async () => {
+    const whoAmI = vi.fn(async () => EXISTING);
+    const provisionMyAccount = vi.fn();
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    expect(status()).toBe("checking");
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+    expect(whoAmI).toHaveBeenCalledTimes(1);
+    expect(provisionMyAccount).not.toHaveBeenCalled();
+  });
+
+  it("checking → provisioning → ready on NOT_FOUND (the first sign-in)", async () => {
+    const provision = deferred<IdentityAccount>();
+    const whoAmI = vi.fn(async () => {
+      throw notFound();
+    });
+    const provisionMyAccount = vi.fn(() => provision.promise);
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("provisioning"));
+    expect(provisionMyAccount).toHaveBeenCalledTimes(1);
+
+    provision.resolve(CREATED);
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_created");
+  });
+
+  it("any other whoAmI error is the error state with its message; no provisioning", async () => {
+    const whoAmI = vi.fn(async () => {
+      throw new StigmerError(
+        "unauthenticated",
+        "token expired",
+        Code.Unauthenticated,
+      );
+    });
+    const provisionMyAccount = vi.fn();
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("error"));
+    expect(probe().getAttribute("data-message")).toBe("token expired");
+    expect(provisionMyAccount).not.toHaveBeenCalled();
+  });
+
+  it("a provisioning failure is the error state with the provisioner's message", async () => {
+    const whoAmI = vi.fn(async () => {
+      throw notFound();
+    });
+    const provisionMyAccount = vi.fn(async () => {
+      throw new StigmerError(
+        "unavailable",
+        "userinfo answered 503",
+        Code.Unavailable,
+      );
+    });
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("error"));
+    expect(probe().getAttribute("data-message")).toBe("userinfo answered 503");
+  });
+
+  it("retry() from error restarts at checking and can reach ready", async () => {
+    let calls = 0;
+    const whoAmI = vi.fn(async () => {
+      calls += 1;
+      if (calls === 1)
+        throw new StigmerError("unavailable", "warming up", Code.Unavailable);
+      return EXISTING;
+    });
+    withClient({ identityAccount: { whoAmI } });
+
+    await waitFor(() => expect(status()).toBe("error"));
+    fireEvent.click(probe());
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+    expect(whoAmI).toHaveBeenCalledTimes(2);
+  });
+
+  it("a retry while whoAmI is in flight discards the earlier attempt's answer", async () => {
+    const first = deferred<IdentityAccount>();
+    const second = deferred<IdentityAccount>();
+    const answers = [first.promise, second.promise];
+    const whoAmI = vi.fn(() => answers.shift()!);
+    withClient({ identityAccount: { whoAmI } });
+
+    await waitFor(() => expect(whoAmI).toHaveBeenCalledTimes(1));
+    fireEvent.click(probe());
+    await waitFor(() => expect(whoAmI).toHaveBeenCalledTimes(2));
+
+    // `act` flushes React's work, so a stale setState would be visible here.
+    await act(async () => {
+      first.resolve(EXISTING);
+    });
+    expect(status(), "the stale attempt must not settle the gate").toBe(
+      "checking",
+    );
+
+    second.resolve(CREATED);
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_created");
+  });
+
+  it("a retry while provisioning is in flight discards the earlier attempt's outcome", async () => {
+    const provision = deferred<IdentityAccount>();
+    let whoAmICalls = 0;
+    const whoAmI = vi.fn(async () => {
+      whoAmICalls += 1;
+      if (whoAmICalls === 1) throw notFound();
+      return EXISTING;
+    });
+    const provisionMyAccount = vi.fn(() => provision.promise);
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("provisioning"));
+    fireEvent.click(probe());
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+
+    // The abandoned provisioning settles late; the gate keeps the second
+    // attempt's answer.
+    await act(async () => {
+      provision.reject(
+        new StigmerError("unavailable", "late failure", Code.Unavailable),
+      );
+    });
+    expect(status()).toBe("ready");
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+  });
+
+  it("isEnabled: false bypasses the gate — ready at once, no RPC", async () => {
+    const whoAmI = vi.fn(async () => EXISTING);
+    withClient({ identityAccount: { whoAmI } }, false);
+
+    expect(status()).toBe("ready");
+    await act(async () => {});
+    expect(whoAmI).not.toHaveBeenCalled();
+  });
+});

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -2,7 +2,6 @@
 
 import { useMemo } from "react";
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
-import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
 import type { HarnessOption } from "../models/harness.js";
 
 /**
@@ -30,10 +29,12 @@ export interface AccountExecutionDefaults {
  * (`IdentityAccountSpec.preferences.default_*`) for seeding new-session
  * composers.
  *
- * Returns `undefined` in local mode (no IdentityAccount), while loading,
- * on error, and when no default is declared — every one of those cases
- * degrades to the platform's existing defaults, so consumers wire the
- * result straight through:
+ * Returns `undefined` while loading, on error (including a server that
+ * cannot answer `whoAmI`), and when no default is declared — every one of
+ * those cases degrades to the platform's existing defaults, so consumers
+ * wire the result straight through. Served in every edition: a
+ * trusted-local server answers with the operator account it creates at
+ * boot, so a laptop's saved defaults seed the composer too.
  *
  * @example
  * ```tsx
@@ -47,8 +48,7 @@ export interface AccountExecutionDefaults {
  * synchronously on every visit after the first.
  */
 export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefined {
-  const available = useResourceAvailable(ApiResourceKind.identity_account);
-  const { account } = useMyIdentityAccount({ enabled: available });
+  const { account } = useMyIdentityAccount();
 
   return useMemo(() => {
     const prefs = account?.spec?.preferences;

package/src/identity-account/useIdentityAccountGate.ts

@@ -2,7 +2,7 @@
 
 import { useCallback, useEffect, useRef, useState } from "react";
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-import { isNotFound } from "@stigmer/sdk";
+import { ensureMyIdentityAccount } from "@stigmer/sdk";
 import { useStigmer } from "../hooks.js";
 import { toError } from "../internal/toError.js";
 
@@ -65,12 +65,18 @@ export interface UseIdentityAccountGateReturn {
  * Headless behavior hook that ensures the authenticated caller has an
  * identity account before the application renders.
  *
+ * The flow itself is `@stigmer/sdk`'s {@link ensureMyIdentityAccount} — the
+ * same one the `stigmer` CLI runs on `auth login` and `auth whoami`, and the
+ * one a platform builder without React calls directly. This hook adds the
+ * React lifecycle around it: a state machine, a `retry`, and the discipline
+ * that a retry issued mid-flight discards the earlier attempt's outcome.
+ *
  * The hook drives the following lifecycle:
  *
- * 1. **`checking`** — calls `whoAmI()` to look up the caller's account.
+ * 1. **`checking`** — `whoAmI()` looks up the caller's account.
  * 2. **`provisioning`** — `whoAmI` returned NOT_FOUND (first login after
- *    signup); the hook calls `provisionMyAccount()` to create the account
- *    and personal organization.
+ *    signup); `provisionMyAccount()` creates the account (and, on Stigmer
+ *    Cloud, the personal organization).
  * 3. **`ready`** — an identity account is available (either pre-existing
  *    or freshly provisioned).
  * 4. **`error`** — a non-recoverable failure occurred; `message` carries
@@ -109,31 +115,24 @@ export function useIdentityAccountGate(options: {
   const attemptRef = useRef(0);
 
   const resolve = useCallback(async () => {
+    // Every setState below is guarded by `attempt`: a retry() issued while
+    // this attempt is in flight bumps the counter, and this attempt's
+    // outcome — whichever RPC it was waiting on — is discarded.
     const attempt = ++attemptRef.current;
     setState({ status: "checking" });
 
     try {
-      const account = await stigmer.identityAccount.whoAmI();
+      const { account } = await ensureMyIdentityAccount(stigmer, {
+        onProvisioning: () => {
+          if (attempt === attemptRef.current)
+            setState({ status: "provisioning" });
+        },
+      });
       if (attempt !== attemptRef.current) return;
       setState({ status: "ready", account });
-    } catch (whoAmIErr: unknown) {
+    } catch (err: unknown) {
       if (attempt !== attemptRef.current) return;
-
-      if (!isNotFound(whoAmIErr)) {
-        setState({ status: "error", message: toError(whoAmIErr).message });
-        return;
-      }
-
-      setState({ status: "provisioning" });
-
-      try {
-        const account = await stigmer.identityAccount.provisionMyAccount();
-        if (attempt !== attemptRef.current) return;
-        setState({ status: "ready", account });
-      } catch (provisionErr: unknown) {
-        if (attempt !== attemptRef.current) return;
-        setState({ status: "error", message: toError(provisionErr).message });
-      }
+      setState({ status: "error", message: toError(err).message });
     }
   }, [stigmer]);
 

package/src/identity-account/useMyIdentityAccount.ts

@@ -8,9 +8,9 @@ import { useFetch } from "../internal/useFetch.js";
 export interface UseMyIdentityAccountOptions {
   /**
    * When `false`, the hook is idle: no RPC is issued and `account` stays
-   * `null`. Lets always-called hooks (React's rules) skip the doomed
-   * whoAmI against a local server — pass
-   * `useResourceAvailable(ApiResourceKind.identity_account)` here.
+   * `null`. Lets always-called hooks (React's rules) stay silent on a
+   * surface that must not fetch identity — the guest and embed audiences,
+   * or a caller who has not signed in yet.
    *
    * @default true
    */
@@ -41,10 +41,11 @@ export interface UseMyIdentityAccountReturn {
  * `whoAmI()` returns the complete resource, so no follow-up `get()` is
  * needed.
  *
- * Cloud-only by nature: the OSS local server does not implement
- * IdentityAccount. Gate consumers with
- * `useResourceAvailable(ApiResourceKind.identity_account)` — either by
- * conditional mounting or via {@link UseMyIdentityAccountOptions.enabled}.
+ * Served by every edition: on Stigmer Cloud and an authenticated self-host
+ * the account is the signed-in user's; on a trusted-local server it is the
+ * operator account the server creates at boot. A caller with no account yet
+ * gets NOT_FOUND — the first-sign-in flow (`ensureMyIdentityAccount`, run by
+ * {@link useIdentityAccountGate} and the CLI) is what creates one.
  *
  * Cached across mounts under a {@link FetchCacheProvider} (DD-014): a
  * revisit renders the previous result immediately and refetches in the

package/src/index.ts

@@ -29,8 +29,15 @@ export {
   useDeploymentMode,
   useResourceAvailable,
 } from "./deployment-mode.js";
-export { type DeploymentMode, isResourceAvailable, ApiResourceKind } from "@stigmer/sdk";
-export { CloudFeatureNotice, type CloudFeatureNoticeProps } from "./internal/CloudFeatureNotice.js";
+export {
+  type DeploymentMode,
+  isResourceAvailable,
+  ApiResourceKind,
+} from "@stigmer/sdk";
+export {
+  CloudFeatureNotice,
+  type CloudFeatureNoticeProps,
+} from "./internal/CloudFeatureNotice.js";
 
 // Models — data hook, styled components, and registry data
 export {
@@ -864,6 +871,14 @@ export type {
   UseUpdateIdentityAccountReturn,
   AccountPreferencesPanelProps,
 } from "./identity-account/index.js";
+// The first-sign-in flow the gate hook delegates to, for consumers who want
+// it without the hook (the `isResourceAvailable` re-export is the precedent).
+export {
+  ensureMyIdentityAccount,
+  type EnsuredIdentityAccount,
+  type EnsureMyIdentityAccountOptions,
+  type IdentityAccountLane,
+} from "@stigmer/sdk";
 
 // Memory — agent-proposed, user-confirmed facts: data hook, decision
 // hooks (confirm/reject/delete/edit), grouping helpers, and the list panel
@@ -1454,8 +1469,15 @@ export type {
 } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/conversation_io_pb";
 
 // Error — structured error display with classification, retry, and contextual guidance
-export { ErrorMessage, SecretFlowErrorGuide, isSecretFlowError } from "./error/index.js";
-export type { ErrorMessageProps, SecretFlowErrorGuideProps } from "./error/index.js";
+export {
+  ErrorMessage,
+  SecretFlowErrorGuide,
+  isSecretFlowError,
+} from "./error/index.js";
+export type {
+  ErrorMessageProps,
+  SecretFlowErrorGuideProps,
+} from "./error/index.js";
 
 // Library — cross-resource UI components, resource detection, apply flow, browsing, and visibility management
 export {
@@ -1695,7 +1717,10 @@ export type {
 } from "./resource-creation/index.js";
 
 // Dependency Graph — visual tree of agent dependencies (MCP servers, skills, sub-agents)
-export { DependencyGraph, useDependencyGraph } from "./dependency-graph/index.js";
+export {
+  DependencyGraph,
+  useDependencyGraph,
+} from "./dependency-graph/index.js";
 export type {
   NodeKind,
   DependencyNode,

package/src/organization/__tests__/useOrgGate.test.tsx

@@ -0,0 +1,84 @@
+// Pins useOrgGate as a pure derivation over useOrg() (20260913.02,
+// sp.console-login Q-CL-5). The hook once carried a "provisioning" arm that
+// polled for a personal organization the server was "still creating"; the
+// cloud has created that organization synchronously inside
+// provisionMyAccount since 20260911.11, and the step is best-effort, so by
+// the time the identity gate is ready the organization list is final in
+// every edition. Zero organizations is therefore `no-orgs` at once — no
+// timers, no options beyond the route bypass — and the arms below fail if
+// a wait ever comes back.
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { renderHook } from "@testing-library/react";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+
+import type { OrgContextValue } from "../OrgProvider";
+
+const mocks = vi.hoisted(() => ({
+  org: null as OrgContextValue | null,
+}));
+
+vi.mock("../OrgProvider.js", () => ({
+  useOrg: () => mocks.org,
+}));
+
+import { useOrgGate } from "../useOrgGate";
+
+const acme = {
+  metadata: { id: "acme", slug: "acme", name: "Acme" },
+} as Organization;
+
+function orgContext(overrides: Partial<OrgContextValue>): OrgContextValue {
+  return {
+    orgs: [],
+    isLoading: false,
+    error: null,
+    retry: vi.fn(),
+    refresh: vi.fn(),
+    ...overrides,
+  } as OrgContextValue;
+}
+
+describe("useOrgGate is a derivation, not a state machine", () => {
+  afterEach(() => vi.useRealTimers());
+
+  it("zero organizations is no-orgs immediately — no provisioning wait in any edition", () => {
+    vi.useFakeTimers();
+    mocks.org = orgContext({ orgs: [] });
+    const { result } = renderHook(() => useOrgGate({ isBypassed: false }));
+    expect(result.current.state).toEqual({ status: "no-orgs" });
+    expect(vi.getTimerCount()).toBe(0);
+  });
+
+  it("the initial fetch is loading", () => {
+    mocks.org = orgContext({ isLoading: true });
+    const { result } = renderHook(() => useOrgGate({ isBypassed: false }));
+    expect(result.current.state).toEqual({ status: "loading" });
+  });
+
+  it("a failed fetch is error with its message", () => {
+    mocks.org = orgContext({ error: "boom" });
+    const { result } = renderHook(() => useOrgGate({ isBypassed: false }));
+    expect(result.current.state).toEqual({ status: "error", message: "boom" });
+  });
+
+  it("at least one organization is ready", () => {
+    mocks.org = orgContext({ orgs: [acme] });
+    const { result } = renderHook(() => useOrgGate({ isBypassed: false }));
+    expect(result.current.state).toEqual({ status: "ready" });
+  });
+
+  it("a bypassed route is bypassed whatever the list says", () => {
+    mocks.org = orgContext({ orgs: [], isLoading: true });
+    const { result } = renderHook(() => useOrgGate({ isBypassed: true }));
+    expect(result.current.state).toEqual({ status: "bypassed" });
+  });
+
+  it("hands the consumer useOrg's own retry and refresh", () => {
+    const retry = vi.fn();
+    const refresh = vi.fn();
+    mocks.org = orgContext({ retry, refresh });
+    const { result } = renderHook(() => useOrgGate({ isBypassed: false }));
+    expect(result.current.retry).toBe(retry);
+    expect(result.current.refresh).toBe(refresh);
+  });
+});

package/src/organization/useOrgGate.ts

@@ -1,11 +1,7 @@
 "use client";
 
-import { useEffect, useState } from "react";
 import { useOrg } from "./OrgProvider.js";
 
-const PROVISIONING_POLL_MS = 2_000;
-const PROVISIONING_TIMEOUT_MS = 10_000;
-
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -13,15 +9,13 @@ const PROVISIONING_TIMEOUT_MS = 10_000;
 /**
  * Options passed to {@link useOrgGate} by the host application.
  *
- * Both values are computed by the consumer using framework-specific APIs
+ * `isBypassed` is computed by the consumer using framework-specific APIs
  * (e.g. `usePathname()` in Next.js, `useLocation()` in react-router) so
  * that the hook itself has zero framework dependencies.
  */
 export interface UseOrgGateOptions {
   /** True when the current route should bypass the gate (e.g. `/invite/` links). */
   readonly isBypassed: boolean;
-  /** True when the auth mode supports server-side personal org provisioning. */
-  readonly isOidcMode: boolean;
 }
 
 /**
@@ -44,10 +38,6 @@ export type OrgGateState =
       /** Initial organization list fetch is in progress. */
       readonly status: "loading";
     }
-  | {
-      /** Personal organization provisioning is in progress. */
-      readonly status: "provisioning";
-    }
   | {
       /** Organization fetch failed and user action is required. */
       readonly status: "error";
@@ -84,28 +74,31 @@ export interface UseOrgGateReturn {
 // ---------------------------------------------------------------------------
 
 /**
- * Headless behavior hook that encapsulates the org-gate provisioning
- * state machine.
- *
- * The hook observes the organization context from {@link useOrg} and
- * drives the following lifecycle:
+ * Headless behavior hook that derives the org-gate state from
+ * {@link useOrg}.
  *
  * 1. **`bypassed`** — `isBypassed` is true; the gate is inactive.
  * 2. **`loading`** — the initial org list fetch is in flight.
- * 3. **`provisioning`** — OIDC mode, zero orgs: the server is creating
- *    the personal org. The hook polls every 2 s and times out after 10 s.
- * 4. **`error`** — the org fetch failed; `message` carries the reason.
- * 5. **`no-orgs`** — no organizations exist (or provisioning timed out);
- *    the consumer should show an onboarding form.
- * 6. **`ready`** — at least one org exists; render the app.
+ * 3. **`error`** — the org fetch failed; `message` carries the reason.
+ * 4. **`no-orgs`** — no organizations exist; the consumer should show an
+ *    onboarding form.
+ * 5. **`ready`** — at least one org exists; render the app.
  *
- * The consumer computes `isBypassed` and `isOidcMode` using
- * framework-specific APIs and passes them in, keeping this hook free of
- * routing or auth-framework dependencies (DD-004).
+ * A pure derivation, deliberately: the organization list is final by the
+ * time this hook runs. Where a server creates a personal organization on
+ * first sign-in (Stigmer Cloud), it does so inside `provisionMyAccount`,
+ * before the identity gate ahead of this one reports ready — so there is
+ * nothing to wait for, and an empty list means the person creates their
+ * first organization now. (The hook once polled for that organization for
+ * ten seconds, a relic of an earlier asynchronous provisioner; on a server
+ * that never provisions one, every first sign-in paid the full wait.)
+ *
+ * The consumer computes `isBypassed` using framework-specific APIs and
+ * passes it in, keeping this hook free of routing dependencies (DD-004).
  *
  * @example
  * ```tsx
- * const { state, retry, refresh } = useOrgGate({ isBypassed, isOidcMode });
+ * const { state, retry, refresh } = useOrgGate({ isBypassed });
  *
  * switch (state.status) {
  *   case "bypassed":
@@ -113,8 +106,6 @@ export interface UseOrgGateReturn {
  *     return <>{children}</>;
  *   case "loading":
  *     return <Spinner />;
- *   case "provisioning":
- *     return <WelcomeScreen />;
  *   case "error":
  *     return <ErrorScreen message={state.message} onRetry={retry} />;
  *   case "no-orgs":
@@ -123,52 +114,12 @@ export interface UseOrgGateReturn {
  * ```
  */
 export function useOrgGate(options: UseOrgGateOptions): UseOrgGateReturn {
-  const { isBypassed, isOidcMode } = options;
+  const { isBypassed } = options;
   const { orgs, isLoading, error, retry, refresh } = useOrg();
 
-  const [provisioningStarted, setProvisioningStarted] = useState(false);
-  const [provisioningTimedOut, setProvisioningTimedOut] = useState(false);
-
-  // React-sanctioned "adjust state during render" pattern: the guard on
-  // `!provisioningStarted` prevents infinite re-render loops.
-  if (
-    !isBypassed &&
-    !provisioningStarted &&
-    !isLoading &&
-    orgs.length === 0 &&
-    !error &&
-    isOidcMode
-  ) {
-    setProvisioningStarted(true);
-  }
-
-  const isProvisioning =
-    provisioningStarted && orgs.length === 0 && !provisioningTimedOut;
-
-  // Poll for the personal org while provisioning is in progress.
-  // Errors from refresh() are absorbed — transient failures (identity not
-  // yet created) are expected during the provisioning window.
-  useEffect(() => {
-    if (!isProvisioning) return;
-
-    const interval = setInterval(() => refresh(), PROVISIONING_POLL_MS);
-    const timeout = setTimeout(
-      () => setProvisioningTimedOut(true),
-      PROVISIONING_TIMEOUT_MS,
-    );
-
-    return () => {
-      clearInterval(interval);
-      clearTimeout(timeout);
-    };
-  }, [isProvisioning, refresh]);
-
-  // Resolve state — order matters: bypass and provisioning take priority.
   let state: OrgGateState;
   if (isBypassed) {
     state = { status: "bypassed" };
-  } else if (isProvisioning) {
-    state = { status: "provisioning" };
   } else if (isLoading) {
     state = { status: "loading" };
   } else if (error) {