@oxy.so/core 1.18.1 → 3.0.0

package/src/session/accountDialogController.ts

@@ -20,8 +20,8 @@
  *     account` pair) and the two removals an account id cannot name —
  *     `signOutContext` and `signOutPrincipal`;
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
- *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *     `oxy.auth.signInWithSharedIdentity`, else the cross-device QR handoff
+ *     via `oxy.auth.commons.start` → poll → `oxy.auth.claimSession`);
  *   - AUTOMATIC delivery selection for that flow (issue #691): the user presses
  *     ONE primary action and the controller — not the user — picks how the
  *     request reaches their Commons identity, by gathering the facts
@@ -37,10 +37,10 @@
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
- * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
- * password, social login, and 2FA were removed ecosystem-wide. Account
- * creation (`signup` view) is the same two identity backends: a passkey
- * ceremony on web, or a Commons-created identity.
+ * Sign-in is by email (a code or a link), an optional password and an
+ * optional authenticator, or the Commons QR / shared-keychain handoff. Account
+ * creation (`signup` view) is a username and a confirmed email, or a
+ * Commons-created identity.
  *
  * The controller owns NO surface PRESENTATION: whether the account dialog is
  * mounted, visible, or dismissed is the job of the shared surface stack
@@ -59,7 +59,7 @@ import { extractErrorStatus } from '../utils/errorUtils';
 import type { SessionClient } from './SessionClient';
 import { getSocketIO, type MinimalSocket, type SocketIOFactory } from './socketLoader';
 import { resolveActiveContext, type DeviceContext } from './deviceDirectory';
-import type { CommonsSignInHandle } from '../mixins/OxyServices.auth';
+import type { CommonsSignInHandle } from '../api/auth';
 import {
   pushTargetsFromDelivery,
   selectCommonsDelivery,
@@ -606,9 +606,9 @@ export class AccountDialogController {
     // has returned; `ensureActiveToken` plants it async later), so the
     // device-state subscription alone cannot observe the signed-out → signed-in
     // edge. Observe the SDK-canonical readiness signal directly — a change to
-    // `oxyServices.getAccessToken()`, the `hasAccessToken` term of
+    // `oxy.session.accessToken`, the `hasAccessToken` term of
     // `OxyContext.canUsePrivateApi`.
-    this.unsubscribeTokens = this.oxyServices.onTokensChanged(() => {
+    this.unsubscribeTokens = this.oxyServices.session.onChange(() => {
       this.reconcileAuth();
     });
     // Initial projection is device-only. `refresh()` fetches the graph IFF a
@@ -652,7 +652,7 @@ export class AccountDialogController {
    * Whether a PRIVATE endpoint may be called right now. Mirrors the
    * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
    * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
-   * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+   * `hasAccessToken = Boolean(oxy.session.accessToken)`): a planted bearer
    * is the only term that decides whether a request carries auth — the other
    * three are provider render-lifecycle gates with no headless equivalent.
    *
@@ -663,7 +663,7 @@ export class AccountDialogController {
    * on this.
    */
   private isAuthenticated(): boolean {
-    return Boolean(this.oxyServices.getAccessToken());
+    return Boolean(this.oxyServices.session.accessToken);
   }
 
   /**
@@ -755,7 +755,7 @@ export class AccountDialogController {
     this.setView('add');
   }
 
-  /** Switch to the "create account" view (passkey / Commons signup entry). */
+  /** Switch to the "create account" view (email / Commons signup entry). */
   startSignup(): void {
     this.setView('signup');
   }
@@ -1030,7 +1030,7 @@ export class AccountDialogController {
     try {
       // Minted WITHOUT planting the bearer: `completeSignIn` installs it only if
       // this attempt is still the current one when the mint returns.
-      const session = await this.oxyServices.signInWithSharedIdentity({ plantTokens: false });
+      const session = await this.oxyServices.auth.signInWithSharedIdentity({ plantTokens: false });
       if (!this.isCurrentAttempt(attempt)) return;
       if (session) {
         await this.completeSignIn(attempt, session, session.user);
@@ -1132,7 +1132,7 @@ export class AccountDialogController {
     this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'starting' });
     let handle: CommonsSignInHandle;
     try {
-      handle = await this.oxyServices.startCommonsSignIn({ clientId: this.clientId });
+      handle = await this.oxyServices.auth.commons.start({ clientId: this.clientId });
     } catch (error) {
       if (!this.isCurrentAttempt(attempt)) return null;
       this.failSignIn(requestFailureReason(error), errorMessage(error));
@@ -1241,7 +1241,7 @@ export class AccountDialogController {
     if (this.platform === 'mobile' && commonsAvailable) return 0;
     if (!this.isAuthenticated()) return 0;
     try {
-      const result = await this.oxyServices.deliverCommonsSignIn(authorizeCode);
+      const result = await this.oxyServices.auth.commons.deliver(authorizeCode);
       // `delivered: false` with `targets > 0` is a transport failure, not a
       // reachable install — the shared helper owns that rule so the surface
       // can never park a user on "check your phone" for a push that failed.
@@ -1350,7 +1350,7 @@ export class AccountDialogController {
    */
   private async withdrawRequest(authorizeCode: string): Promise<void> {
     try {
-      await this.oxyServices.denyCommonsSignIn(authorizeCode);
+      await this.oxyServices.auth.commons.deny(authorizeCode);
     } catch (error) {
       logger.debug(
         '[AccountDialogController] request withdrawal failed',
@@ -1390,7 +1390,7 @@ export class AccountDialogController {
         return;
       }
       try {
-        const status = await this.oxyServices.pollCommonsSignIn(sessionToken);
+        const status = await this.oxyServices.auth.commons.poll(sessionToken);
         if (this.signInToken !== sessionToken) return; // cancelled mid-request
         // Delivery PROGRESS first: it is reported alongside every status, and
         // recording it before the terminal branches means a poll that also
@@ -1457,7 +1457,7 @@ export class AccountDialogController {
     try {
       // Claimed WITHOUT planting the bearer — `completeSignIn` installs it only
       // if the user is still waiting for this attempt when the claim returns.
-      claimed = await this.oxyServices.claimSessionByToken(sessionToken, { plantTokens: false });
+      claimed = await this.oxyServices.auth.claimSession(sessionToken, { plantTokens: false });
     } catch (error) {
       if (!this.isCurrentAttempt(attempt)) return;
       this.failSignIn('claim-failed', errorMessage(error));
@@ -1525,14 +1525,14 @@ export class AccountDialogController {
     user: MinimalUserData,
   ): Promise<void> {
     if (!this.isCurrentAttempt(attempt)) return;
-    const previousToken = this.oxyServices.getAccessToken();
+    const previousToken = this.oxyServices.session.accessToken;
     try {
-      if (session.accessToken) this.oxyServices.setTokens(session.accessToken);
+      if (session.accessToken) this.oxyServices.session.setAccessToken(session.accessToken);
       await this.commitAuthorizedSession(session, user);
     } catch (error) {
-      if (session.accessToken && this.oxyServices.getAccessToken() === session.accessToken) {
-        if (previousToken) this.oxyServices.setTokens(previousToken);
-        else this.oxyServices.clearTokens();
+      if (session.accessToken && this.oxyServices.session.accessToken === session.accessToken) {
+        if (previousToken) this.oxyServices.session.setAccessToken(previousToken);
+        else this.oxyServices.session.clear();
       }
       throw error;
     }
@@ -1606,7 +1606,7 @@ export class AccountDialogController {
     if (!socketFactory || this.signInToken !== sessionToken) return;
     let socket: MinimalSocket;
     try {
-      socket = socketFactory(`${this.oxyServices.getBaseURL()}${AUTH_SESSION_NAMESPACE}`, {
+      socket = socketFactory(`${this.oxyServices.baseURL}${AUTH_SESSION_NAMESPACE}`, {
         transports: ['websocket'],
         autoConnect: true,
         reconnection: true,

package/src/session/accountSwitchTargets.ts

@@ -21,7 +21,7 @@ import type {
   AccountRelationship,
   AccountKind,
   AccountMember,
-} from '../mixins/OxyServices.accounts';
+} from '../api/accounts';
 
 /**
  * Whether the caller can BECOME this account — the one question every account

package/src/session/authStateStore.ts

@@ -25,9 +25,10 @@ import { logger } from '../logger';
  * `sessionId` + `userId` identify the owning device session and active account.
  * `deviceId` + `deviceSecret` are the zero-cookie mint credential: the client
  * presents BOTH at `POST /session/device/token` — the secret is the proof, the
- * deviceId selects the device doc. The secret is rotated in-use: the mint returns
- * `nextDeviceSecret`, which the cold boot / re-mint handler persist BEFORE
- * planting the minted access token (multi-tab anti-loss).
+ * deviceId selects the device doc. The mint returns `nextDeviceSecret` (today the
+ * presented secret, unchanged — the server never rotates a holder's
+ * credential), which the cold boot / re-mint handler persist BEFORE planting
+ * the minted access token.
  *
  * `accessToken` + `expiresAt` are OPTIONAL warm-boot fields. Persisting them lets
  * the cold boot plant a still-valid access token on the very first paint WITHOUT
@@ -49,9 +50,9 @@ export interface PersistedAuthState {
    */
   deviceId?: string;
   /**
-   * The rotating device secret (zero-cookie transport). Possession of it mints a
-   * short access token for the device's active account via
-   * `POST /session/device/token`. Rotated in-use.
+   * This holder's device secret (zero-cookie transport). Possession of it mints
+   * a short access token for the device's active account via
+   * `POST /session/device/token`. Stable: the server never rotates it.
    */
   deviceSecret?: string;
   /** Optional warm-boot access token (short-lived; see interface docs). */
@@ -263,8 +264,8 @@ function composeState(durableRaw: string | null, warmRaw: string | null): Persis
     // New split layout: the warm key is authoritative for the token fields.
     // Drop anything the durable blob may have carried, then overlay the warm
     // values (a warm key with no token → the session simply has no warm token).
-    delete state.accessToken;
-    delete state.expiresAt;
+    Reflect.deleteProperty(state, 'accessToken');
+    Reflect.deleteProperty(state, 'expiresAt');
     const warm = parseWarmToken(warmRaw);
     if (warm?.accessToken) {
       state.accessToken = warm.accessToken;

package/src/session/identitySession.ts

@@ -154,7 +154,7 @@ export async function establishIdentitySession(args: {
     return null;
   }
 
-  const { challenge } = await oxy.requestChallenge(publicKey, requestOptions);
+  const { challenge } = await oxy.auth.requestChallenge(publicKey, requestOptions);
   const signed = await signChallengeOf(binding)(challenge);
   if (signed.publicKey.toLowerCase() !== publicKey.toLowerCase()) {
     // The signer disagrees with the key we resolved a challenge for — the
@@ -164,7 +164,7 @@ export async function establishIdentitySession(args: {
   }
 
   // `signed.challenge` carries the SIGNATURE (mirrors `signChallengeWithSharedKey`).
-  const session = await oxy.verifyChallenge(
+  const session = await oxy.auth.verifyChallenge(
     signed.publicKey,
     challenge,
     signed.challenge,
@@ -177,7 +177,7 @@ export async function establishIdentitySession(args: {
     return null;
   }
 
-  // Persist the rotating device credential so later boots re-mint through the
+  // Persist the device credential so later boots re-mint through the
   // fast `POST /session/device/token` lane instead of re-signing a challenge.
   if (session.deviceId && session.deviceSecret) {
     await store.save({

package/src/session/index.ts

@@ -0,0 +1,210 @@
+/**
+ * `@oxy.so/core/session` — the device-first session machinery.
+ *
+ * The multi-account `SessionClient`, the headless account dialog, the persisted
+ * auth-state stores, the token re-mint handler and scheduler, and the cold
+ * boot. `@oxy.so/services` builds `OxyProvider` on it; an app that only calls
+ * the API with a token it already has never needs it.
+ */
+
+// Session code reaches the identity key (identity-bound sessions), so the
+// crypto shim goes first — see `../crypto/polyfill`.
+import '../crypto/polyfill';
+
+export { DeviceManager } from '../utils/deviceManager';
+export type { DeviceFingerprint, StoredDeviceInfo } from '../utils/deviceManager';
+
+// ---------------------------------------------------------------------------
+// Session sync (device-scoped multi-account session client)
+// ---------------------------------------------------------------------------
+export { SessionClient } from './SessionClient';
+export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './SessionClient';
+// Injectable for tests/specialized hosts; ordinary consumers use core's lazy
+// transport and do not pull socket.io-client into their initial module graph.
+export type { SocketIOFactory, MinimalSocket } from './socketLoader';
+
+// Shared SessionClient integration layer: the host adapter, the pure
+// DeviceSessionState projection helpers, and the client factory are defined
+// ONCE here so every `@oxy.so/services` platform variant reuses them instead of
+// duplicating a local copy. Each consumer supplies its own `TokenTransport`
+// (native vs. web mint strategies differ) to `createSessionClient`.
+export { createSessionClientHost } from './sessionClientHost';
+export { createSessionClient } from './createSessionClient';
+export {
+    deviceStateToClientSessions,
+    activeSessionIdOf,
+    activeUserOf,
+    accountIdsOf,
+} from './projectSessionState';
+
+// Pure projections over the device DIRECTORY (`GET /session/device/directory`,
+// ADR 0002) — the read model that keeps the actor (the human who authenticated)
+// and the subject (the account being acted as) apart. The flat
+// `DeviceSessionState` collapses them into one row, so it can neither tell
+// "signed in as an org" from "a person operating that org" nor hold two people
+// reaching the same org on one device.
+// `canActivateContext` is the switchability question — `available` alone, never
+// composed with `onDevice`, which is a different fact in both directions.
+// `projectDevicePrincipals` is the switcher's shape: people, each with what
+// they may become. Grouped rather than flat because the same organization
+// reached through two people is TWO rows under two humans, which a list keyed
+// by account cannot say.
+export {
+    canActivateContext,
+    directoryDisplayName,
+    directoryHandle,
+    projectDevicePrincipals,
+    resolveActiveContext,
+    resolveDeviceContext,
+} from './deviceDirectory';
+export type {
+    DeviceContext,
+    DeviceContextActor,
+    DeviceContextSubject,
+    DevicePrincipalGroup,
+} from './deviceDirectory';
+
+// The switcher's RENDER model over that projection — names, handles and avatar
+// URLs resolved once. Shared by `@oxy.so/services`' account dialog and the
+// auth.oxy.so chooser so the two cannot drift, the same reason the flat
+// projection lived here before it.
+export { buildSwitcherRows, showsPrincipalHeaders } from './deviceSwitcherRows';
+export type {
+    ResolveAvatarUrl,
+    SwitcherContextRow,
+    SwitcherPrincipalRow,
+} from './deviceSwitcherRows';
+
+// The switch-target predicates over the account GRAPH — a list of accounts to
+// manage, not the device's list of identities to become (that is the directory
+// above). `isSwitchTargetAccount` is the structural half ("is this kind
+// switchable at all?"); `canSwitchIntoAccount` adds the caller's
+// `account:act_as` permission. Exported so the surfaces that render
+// `AccountNode`s — the Console workspace switcher, managed-accounts rows — ask
+// the SAME questions instead of testing a kind literal.
+export {
+    isSwitchTargetAccount,
+    canSwitchIntoAccount,
+} from './accountSwitchTargets';
+
+// The service/agent counterpart to the human switch predicates above. Kept on
+// its own semantic seam because `bot` is delegable but never human-switchable.
+export { resolveAccountDelegationAccess } from './accountDelegationAccess';
+export type {
+    AccountDelegationAccess,
+    AccountDelegationNode,
+} from './accountDelegationAccess';
+
+// Headless controller for the unified account dialog. Framework-agnostic
+// state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
+// — sign-in runs through `oxy.auth` (email, password, authenticator, the
+// Commons QR / shared-keychain handoff). Reuses `SessionClient.switchAccount` /
+// `oxy.accounts.actAs` for the uniform switch.
+export {
+    AccountDialogController,
+    createAccountDialogController,
+} from './accountDialogController';
+export type {
+    AccountDialogControllerOptions,
+    AccountDialogSnapshot,
+    AccountDialogView,
+    CommonsAvailability,
+    ContextChoiceOutcome,
+    SignInFailureReason,
+    SignInFlowPhase,
+    SignInFlowState,
+    SignInProgress,
+} from './accountDialogController';
+
+// ---------------------------------------------------------------------------
+// Device-first session machinery (zero-cookie transport).
+// Persisted auth-state store, the unified re-mint handler + scheduler, and the
+// cold-boot runner. Built ON the `runColdBoot` primitive + `SessionClient`. The
+// device credential is `deviceId` + `deviceSecret`; the access token is re-minted
+// via `POST /session/device/token`.
+// ---------------------------------------------------------------------------
+export {
+    createWebAuthStateStore,
+    createNativeAuthStateStore,
+    createMemoryAuthStateStore,
+    AUTH_STATE_STORAGE_KEY,
+} from './authStateStore';
+export type {
+    PersistedAuthState,
+    AuthStateStore,
+    NativeKeyValueStorage,
+} from './authStateStore';
+
+// The shared NATIVE DeviceSession credential — how several official apps on one
+// device end up on ONE `DeviceSession` and therefore one active context. It is an
+// ordinary revocable `deviceId` + `deviceSecret`, deliberately NOT the
+// Commons private identity key: an app that only needs a session must never be
+// handed the key that signs identity approvals.
+export {
+    createSharedMirroringAuthStateStore,
+    decideSharedDeviceJoin,
+    decideSharedDevicePublish,
+    normalizeSharedDeviceSessionRead,
+    publishProvenDeviceCredential,
+    readLocalDeviceCredential,
+} from './sharedDeviceCredential';
+export type {
+    SharedDeviceCredential,
+    SharedDeviceCredentialRead,
+    SharedDeviceCredentialStore,
+    SharedDeviceJoinDecision,
+    SharedDeviceJoinSkipReason,
+    SharedDevicePublishDecision,
+    SharedDevicePublishOutcome,
+    SharedDevicePublishSkipReason,
+} from './sharedDeviceCredential';
+
+// Identity-bound sessions (the identity vault). The pin is the durable
+// `{publicKey, accountId}` binding between this device's PRIMARY identity key
+// and the account it authenticates as; it is what keeps such a client from
+// following the device's mutable `activeAccountId`.
+export {
+    createWebIdentityPinStore,
+    createNativeIdentityPinStore,
+    createMemoryIdentityPinStore,
+    identityPinMatches,
+    IDENTITY_PIN_STORAGE_KEY,
+} from './identityPin';
+export type { IdentityPin, IdentityPinStore } from './identityPin';
+export {
+    resolveIdentityPin,
+    establishIdentitySession,
+} from './identitySession';
+export type {
+    IdentityBinding,
+    IdentityRequestOptions,
+    EstablishedIdentitySession,
+} from './identitySession';
+export {
+    refreshPersistedSession,
+    refreshDeviceSecretArm,
+    createAuthRefreshHandler,
+    installAuthRefreshHandler,
+    startTokenRefreshScheduler,
+    TOKEN_REFRESH_LEAD_MS,
+} from './refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle, DeviceSecretMintOutcome } from './refresh';
+
+export { runSessionColdBoot } from '../boot/sessionColdBoot';
+export type {
+    RunSessionColdBootOptions,
+    SessionMode,
+    SignedOutReason,
+    DeviceBootSession,
+} from '../boot/sessionColdBoot';
+
+export { runColdBoot } from '../utils/coldBoot';
+export type {
+    ColdBootStep,
+    ColdBootStepResult,
+    ColdBootSession,
+    ColdBootSkip,
+    ColdBootOutcome,
+    RunColdBootOptions,
+} from '../utils/coldBoot';
+

package/src/session/refresh.ts

@@ -164,8 +164,8 @@ export async function refreshDeviceSecretArm(deps: {
 }): Promise<DeviceSecretMintOutcome> {
   const { oxy, store } = deps;
   const pin = deps.pin ?? null;
-  return oxy.httpService.runSingleFlightDeviceSecretMint(async () => {
-    const epoch = oxy.httpService.getSessionEpoch();
+  return oxy.http.runSingleFlightDeviceSecretMint(async () => {
+    const epoch = oxy.http.getSessionEpoch();
     const persisted = await store.load();
     if (!persisted?.deviceId || !persisted?.deviceSecret) {
       return { status: 'no-secret' };
@@ -176,10 +176,10 @@ export async function refreshDeviceSecretArm(deps: {
       // Unpinned callers pass NO third argument at all, so the account-mode call
       // shape (and therefore the request body) is untouched by this feature.
       mint = pin
-        ? await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret, {
+        ? await oxy.devices.mintToken(persisted.deviceId, persisted.deviceSecret, {
             accountId: pin.accountId,
           })
-        : await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret);
+        : await oxy.devices.mintToken(persisted.deviceId, persisted.deviceSecret);
     } catch (error) {
       // 429 keeps the credential like any other transient failure — the secret
       // was never judged — but it must NOT retry on the transient cadence. The
@@ -190,7 +190,7 @@ export async function refreshDeviceSecretArm(deps: {
       // requests. Telling HttpService lengthens the next cooldown to one attempt
       // per limiter window, which lets the budget drain and the session heal.
       if (extractErrorStatus(error) === 429) {
-        oxy.httpService.noteRefreshRateLimited();
+        oxy.http.noteRefreshRateLimited();
         return { status: 'transient' };
       }
       if (extractErrorStatus(error) === 401) {
@@ -229,11 +229,11 @@ export async function refreshDeviceSecretArm(deps: {
       expiresAt: mint.expiresAt,
       ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
     };
-    if (oxy.httpService.getSessionEpoch() !== epoch) {
-      // Signed out while minting. The server has rotated the secret, so a store
-      // that still holds the presented one must learn the rotation (the
-      // token-null lane keeps the store so a reload can restore); a store the
-      // sign-out cleared must NOT be refilled. Either way, plant nothing.
+    if (oxy.http.getSessionEpoch() !== epoch) {
+      // Signed out while minting. A store that still holds the presented
+      // secret takes the server's `nextDeviceSecret` (the token-null lane keeps
+      // the store so a reload can restore); a store the sign-out cleared must
+      // NOT be refilled. Either way, plant nothing.
       const current = await store.load();
       if (current?.deviceId === persisted.deviceId && current.deviceSecret === persisted.deviceSecret) {
         await store.save(next);
@@ -246,10 +246,10 @@ export async function refreshDeviceSecretArm(deps: {
     if (!persistedOk) {
       return { status: 'persist-failed' };
     }
-    if (oxy.httpService.getSessionEpoch() !== epoch) {
+    if (oxy.http.getSessionEpoch() !== epoch) {
       return { status: 'session-ended' };
     }
-    oxy.setTokens(mint.accessToken);
+    oxy.session.setAccessToken(mint.accessToken);
     return {
       status: 'ok',
       token: mint.accessToken,
@@ -287,7 +287,7 @@ export async function refreshPersistedSession(deps: RefreshDeps): Promise<string
   const identity = deps.identity ?? null;
   // The shared keychain is never an identity-bound client's recovery path.
   const allowSharedKeyFallback = identity ? false : (deps.allowSharedKeyFallback ?? isNative());
-  const epoch = oxy.httpService.getSessionEpoch();
+  const epoch = oxy.http.getSessionEpoch();
   // Resolved per call: a re-established identity session can move the pin, and a
   // replaced/removed local key clears it (in which case arm 1 must NOT mint —
   // an unpinned mint would adopt whatever account the device switched to).
@@ -324,12 +324,18 @@ export async function refreshPersistedSession(deps: RefreshDeps): Promise<string
       // 401: secret diverged or no live session. When a key-based arm 2 can still
       // recover (native shared key, or an identity-bound client's own primary
       // key) drop ONLY the secret and keep the deviceId; otherwise (web) the
-      // session is over — clear the store.
+      // session is over.
       const persisted = await store.load();
       if (allowSharedKeyFallback || identity) {
         if (persisted) {
           await store.save({ ...persisted, deviceSecret: undefined });
         }
+      } else if (arm1.status === 'no-session' && persisted?.deviceId && persisted.deviceSecret) {
+        // Web, a credential the server still recognises: this origin stays a
+        // holder of the browser's device (ADR 0029 D2) — the next sign-in in any
+        // app lands on it, and this app follows without opening the bridge
+        // again. Only the session fields go.
+        await store.save({ sessionId: '', userId: '', deviceId: persisted.deviceId, deviceSecret: persisted.deviceSecret });
       } else {
         await store.clear();
       }
@@ -353,14 +359,14 @@ export async function refreshPersistedSession(deps: RefreshDeps): Promise<string
 
   // Never after a sign-out: the shared keychain holds an identity KEY, not a
   // session, and using it here would sign the user straight back in.
-  if (allowSharedKeyFallback && !oxy.httpService.hasSessionEnded()) {
+  if (allowSharedKeyFallback && !oxy.http.hasSessionEnded()) {
     try {
       // Planted here, not by the sign-in: a sign-out that lands while the
       // challenge round-trips must win, or the shared keychain signs the user
       // straight back in.
-      const session = await oxy.signInWithSharedIdentity({ plantTokens: false });
+      const session = await oxy.auth.signInWithSharedIdentity({ plantTokens: false });
       if (session?.accessToken) {
-        if (oxy.httpService.getSessionEpoch() !== epoch) {
+        if (oxy.http.getSessionEpoch() !== epoch) {
           return null;
         }
         // Repopulate the fast device-secret lane from the shared-key re-mint.
@@ -374,10 +380,10 @@ export async function refreshPersistedSession(deps: RefreshDeps): Promise<string
             expiresAt: session.expiresAt,
           });
         }
-        if (oxy.httpService.getSessionEpoch() !== epoch) {
+        if (oxy.http.getSessionEpoch() !== epoch) {
           return null;
         }
-        oxy.setTokens(session.accessToken);
+        oxy.session.setAccessToken(session.accessToken);
         return session.accessToken;
       }
     } catch (error) {
@@ -438,9 +444,9 @@ export function createAuthRefreshHandler(deps: RefreshDeps): AuthRefreshHandler
  * Returns a disposer that removes it.
  */
 export function installAuthRefreshHandler(deps: RefreshDeps): () => void {
-  deps.oxy.httpService.setAuthRefreshHandler(createAuthRefreshHandler(deps));
+  deps.oxy.http.setAuthRefreshHandler(createAuthRefreshHandler(deps));
   return () => {
-    deps.oxy.httpService.setAuthRefreshHandler(null);
+    deps.oxy.http.setAuthRefreshHandler(null);
   };
 }
 
@@ -491,10 +497,10 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
   /** Schedule the next re-mint from the current token's expiry (the healthy path). */
   const scheduleFromExpiry = (): void => {
     clearTimer();
-    if (disposed || !oxy.getAccessToken()) {
+    if (disposed || !oxy.session.accessToken) {
       return;
     }
-    const expSeconds = oxy.getAccessTokenExpiry();
+    const expSeconds = oxy.session.accessTokenExpiry;
     if (expSeconds === null) {
       return;
     }
@@ -502,7 +508,7 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
     // The server already answered this token's refresh with this very token:
     // asking again before `exp` only gets it back again. Ask just after expiry,
     // when the server rotates (see REMINT_AFTER_EXPIRY_MS).
-    if (untilExpiryMs > 0 && oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+    if (untilExpiryMs > 0 && oxy.http.isAwaitingCurrentTokenExpiry?.()) {
       armTimer(untilExpiryMs + REMINT_AFTER_EXPIRY_MS);
       return;
     }
@@ -515,11 +521,11 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
     clearTimer();
     // Another lane (a request-time preflight) already asked, and the server
     // answered with this same token: re-arm for just past expiry instead.
-    if (oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+    if (oxy.http.isAwaitingCurrentTokenExpiry?.()) {
       scheduleFromExpiry();
       return;
     }
-    void oxy.httpService.refreshAccessToken('preflight')
+    void oxy.http.refreshAccessToken('preflight')
       .then((token) => Boolean(token))
       .catch(() => false)
       .then((ok) => {
@@ -548,10 +554,10 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
   };
 
   const onFocus = (): void => {
-    if (disposed || !oxy.getAccessToken()) {
+    if (disposed || !oxy.session.accessToken) {
       return;
     }
-    const expSeconds = oxy.getAccessTokenExpiry();
+    const expSeconds = oxy.session.accessTokenExpiry;
     if (expSeconds === null) {
       return;
     }
@@ -566,8 +572,8 @@ export function startTokenRefreshScheduler(oxy: OxyServices): TokenRefreshSchedu
   // Re-arm only on a token that actually CHANGED. The mint plants the token it
   // returns even when that is the token already held, and treating the repeat
   // as new re-armed from an in-lead-window expiry, i.e. at the 1s floor.
-  let lastSeenToken = oxy.getAccessToken();
-  const unsubscribeTokens = oxy.onTokensChanged((token) => {
+  let lastSeenToken = oxy.session.accessToken;
+  const unsubscribeTokens = oxy.session.onChange((token) => {
     if (disposed || token === lastSeenToken) {
       return;
     }

package/src/session/sessionClientHost.ts

@@ -22,12 +22,12 @@ export function createSessionClientHost(
   let currentAccountId: string | null = null;
   let deviceCredential: DeviceCredential | null = null;
   return {
-    makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
-    getBaseURL: () => oxyServices.getBaseURL(),
-    getAccessToken: () => oxyServices.getAccessToken(),
+    makeRequest: (method, url, data, options) => oxyServices.request(method, url, data, options),
+    getBaseURL: () => oxyServices.baseURL,
+    getAccessToken: () => oxyServices.session.accessToken,
     getDeviceCredential: () => deviceCredential,
-    onTokensChanged: (listener) => oxyServices.onTokensChanged(listener),
-    setTokens: (accessToken) => oxyServices.setTokens(accessToken),
+    onTokensChanged: (listener) => oxyServices.session.onChange(listener),
+    setTokens: (accessToken) => oxyServices.session.setAccessToken(accessToken),
     getCurrentAccountId: () => currentAccountId,
     setCurrentAccountId: (id) => {
       currentAccountId = id;