@oxy.so/core 4.1.0 → 4.2.0

package/dist/cjs/session/refresh.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REMINT_AFTER_EXPIRY_MS = exports.TOKEN_REFRESH_LEAD_MS = void 0;
 exports.refreshDeviceSecretArm = refreshDeviceSecretArm;
+exports.refreshSharedDeviceArm = refreshSharedDeviceArm;
 exports.refreshPersistedSession = refreshPersistedSession;
 exports.createAuthRefreshHandler = createAuthRefreshHandler;
 exports.installAuthRefreshHandler = installAuthRefreshHandler;
 exports.startTokenRefreshScheduler = startTokenRefreshScheduler;
+const authStateStore_1 = require("./authStateStore");
 const identitySession_1 = require("./identitySession");
 const platform_1 = require("../utils/platform");
 const errorUtils_1 = require("../utils/errorUtils");
@@ -65,9 +67,13 @@ exports.REMINT_AFTER_EXPIRY_MS = 2000;
  *
  * On success it persists `nextDeviceSecret` (read-back-verified) BEFORE planting
  * the access token; a failed durable persist yields `persist-failed` WITHOUT
- * planting. This function performs NO store mutation on failure — the caller
+ * planting. Apart from the account-mode logout marker below, failure mutations
+ * belong to the caller, which
  * applies the drop/clear policy (which differs web vs native) from the returned
- * status.
+ * status. A native account store with a suppression marker records a current
+ * `no_active_session`, or an invalid secret with prior authenticated session
+ * history, records durable ACCOUNT logout intent; it never deletes that holder.
+ * Error classification uses the existing 401 message markers.
  *
  * `pin` makes the mint IDENTITY-BOUND: the request carries the pinned
  * `accountId` (so the server mints that account's token without touching
@@ -78,7 +84,10 @@ exports.REMINT_AFTER_EXPIRY_MS = 2000;
 async function refreshDeviceSecretArm(deps) {
     const { oxy, store } = deps;
     const pin = deps.pin ?? null;
+    const isCurrent = deps.isCurrent ?? (() => true);
     return oxy.http.runSingleFlightDeviceSecretMint(async () => {
+        if (!isCurrent())
+            return { status: 'session-ended' };
         const epoch = oxy.http.getSessionEpoch();
         const persisted = await store.load();
         if (!persisted?.deviceId || !persisted?.deviceSecret) {
@@ -120,10 +129,29 @@ async function refreshDeviceSecretArm(deps) {
                 // transient and KEEP the credential so a later attempt self-heals. Wiping the
                 // credential on an ambiguous 401 is what logged users out on every deploy,
                 // ecosystem-wide.
-                if (body.includes('invalid_device_secret'))
-                    return { status: 'invalid-secret' };
-                if (body.includes('no_active_session'))
-                    return { status: 'no-session' };
+                const invalidSecret = body.includes('invalid_device_secret');
+                const noSession = body.includes('no_active_session');
+                if (invalidSecret || noSession) {
+                    // A stopped ACCOUNT sibling cannot receive the other app's logout
+                    // push. Its exact live holder's authoritative empty-device rejection
+                    // must suppress automatic key recovery on this and future boots.
+                    // A late rejection for a replaced session/local epoch is not current.
+                    if (pin === null && store.setAutomaticIdentitySignInSuppressed && (!invalidSecret || (persisted.sessionId && persisted.userId))) {
+                        const current = await store.load();
+                        if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch ||
+                            current?.deviceId !== persisted.deviceId ||
+                            current.deviceSecret !== persisted.deviceSecret ||
+                            current.sessionId !== persisted.sessionId ||
+                            current.userId !== persisted.userId ||
+                            current.accessToken !== persisted.accessToken)
+                            return { status: 'session-ended' };
+                        if (!(await store.setAutomaticIdentitySignInSuppressed(true, {
+                            expectedState: persisted, isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch,
+                        })))
+                            return { status: 'session-ended' };
+                    }
+                    return { status: invalidSecret ? 'invalid-secret' : 'no-session' };
+                }
                 // A pinned mint whose account left the device set. The secret is intact —
                 // never classify this as a bad secret, or the caller would drop a healthy
                 // credential over a stale identity binding.
@@ -145,24 +173,33 @@ async function refreshDeviceSecretArm(deps) {
             expiresAt: mint.expiresAt,
             ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
         };
+        if (!isCurrent())
+            return { status: 'session-ended' };
         if (oxy.http.getSessionEpoch() !== epoch) {
-            // Signed out while minting. A store that still holds the presented
-            // secret takes the server's `nextDeviceSecret` (the token-null lane keeps
-            // the store so a reload can restore); a store the sign-out cleared must
-            // NOT be refilled. Either way, plant nothing.
+            // A logout or account/session switch invalidated this mint. Preserve
+            // only credential rotation for an otherwise unchanged retained context;
+            // never transplant the old mint's account, session or bearer. Compare
+            // the entire snapshot inside the store queue: same holder bytes alone
+            // cannot distinguish an account switch, nor a queued save of that switch.
+            const retainedEpoch = oxy.http.getSessionEpoch();
             const current = await store.load();
-            if (current?.deviceId === persisted.deviceId && current.deviceSecret === persisted.deviceSecret) {
-                await store.save(next);
+            if (store.saveIfCurrent && current && (0, authStateStore_1.matchesAuthState)(current, persisted)) {
+                await store.saveIfCurrent({ ...current, deviceSecret: mint.nextDeviceSecret }, {
+                    expectedState: current,
+                    isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === retainedEpoch,
+                });
             }
             return { status: 'session-ended' };
         }
         // Persist nextDeviceSecret (read-back-verified) BEFORE planting the token.
         // A failed durable persist must NOT plant.
-        const persistedOk = await store.save(next);
+        const persistedOk = store.saveIfCurrent
+            ? await store.saveIfCurrent(next, { expectedState: persisted, isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch })
+            : await store.save(next);
         if (!persistedOk) {
             return { status: 'persist-failed' };
         }
-        if (oxy.http.getSessionEpoch() !== epoch) {
+        if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch) {
             return { status: 'session-ended' };
         }
         oxy.session.setAccessToken(mint.accessToken);
@@ -175,15 +212,76 @@ async function refreshDeviceSecretArm(deps) {
         };
     });
 }
+/**
+ * Prove a shared native ACCOUNT holder before replacing local bytes. Callers
+ * may replace a local credential only after its explicit mint rejection. The
+ * optional guarded storage seam makes custom stores fail closed on adoption.
+ * This lane never clears explicit sign-out intent or uses an identity key.
+ */
+async function refreshSharedDeviceArm(deps) {
+    const { oxy, store, shared } = deps;
+    const isCurrent = deps.isCurrent ?? (() => true);
+    return oxy.http.runSingleFlightDeviceSecretMint(async () => {
+        const epoch = oxy.http.getSessionEpoch();
+        if (!isCurrent())
+            return { status: 'session-ended' };
+        const before = await store.load();
+        if (before?.deviceId && before.deviceSecret && !deps.rejectedLocalHolder)
+            return { status: 'no-secret' };
+        const read = await shared.read();
+        if (read.state !== 'present' || !store.saveIfCurrent)
+            return { status: 'no-secret' };
+        const credential = read.credential;
+        if (credential.deviceId === before?.deviceId && credential.deviceSecret === before.deviceSecret)
+            return { status: 'no-secret' };
+        let mint;
+        try {
+            mint = await oxy.devices.mintToken(credential.deviceId, credential.deviceSecret);
+        }
+        catch (error) {
+            if ((0, errorUtils_1.extractErrorStatus)(error) === 429)
+                oxy.http.noteRefreshRateLimited();
+            if ((0, errorUtils_1.extractErrorStatus)(error) === 401) {
+                const message = error?.message;
+                if (typeof message === 'string' && message.includes('invalid_device_secret')) {
+                    // There is no cross-app CAS clear in the bridge contract. An old
+                    // rejection cannot delete a slot another app has since published.
+                    return { status: 'invalid-secret' };
+                }
+                if (typeof message === 'string' && message.includes('no_active_session'))
+                    return { status: 'no-session' };
+            }
+            return { status: 'transient' };
+        }
+        const bound = mint.state.accounts.find(account => account.accountId === mint.state.activeAccountId);
+        if (!bound || mint.state.deviceId !== credential.deviceId || !mint.accessToken || !mint.nextDeviceSecret)
+            return { status: 'transient' };
+        if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch || !(0, authStateStore_1.matchesAuthState)(await store.load(), before))
+            return { status: 'session-ended' };
+        const next = {
+            deviceId: mint.state.deviceId, deviceSecret: mint.nextDeviceSecret,
+            sessionId: bound.sessionId, userId: bound.accountId,
+            accessToken: mint.accessToken, expiresAt: mint.expiresAt,
+        };
+        if (!(await store.saveIfCurrent(next, { expectedState: before, isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch })))
+            return { status: 'persist-failed' };
+        if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch)
+            return { status: 'session-ended' };
+        oxy.session.setAccessToken(mint.accessToken);
+        return { status: 'ok', token: mint.accessToken, sessionId: bound.sessionId, userId: bound.accountId, state: mint.state };
+    });
+}
 /**
  * Re-mint the persisted session and return the fresh access token, or `null`
  * when no arm could produce one.
  *
  * Arm 1 (`POST /session/device/token`, via {@link refreshDeviceSecretArm}): mint
- * from the persisted `deviceId` + `deviceSecret`. On a 401 the secret is diverged
- * or the device has no live session: drop the secret so the mint lane stops (or
- * clear the store on web, where there is no fallback), then fall to arm 2 on
- * native. A transient error — or a durable-persist failure — leaves the store and
+ * from the persisted `deviceId` + `deviceSecret`. An authenticated native
+ * holder's invalid-secret or `no_active_session` verdict suppresses key recovery
+ * while permitting a separately proved new shared holder. The latter verdict
+ * retains that holder and ends ACCOUNT recovery without a new key challenge.
+ * Classification still uses the existing 401 message markers, not a new parser.
+ * A transient error — or a durable-persist failure — leaves the store and
  * returns `null` WITHOUT falling to arm 2 (those are not bad-secret signals).
  *
  * Arm 2 (native Commons identity): when the secret is absent or was just
@@ -200,9 +298,11 @@ async function refreshDeviceSecretArm(deps) {
  */
 async function refreshPersistedSession(deps) {
     const { oxy, store } = deps;
+    if (deps.isCurrent && !deps.isCurrent())
+        return null;
     const identity = deps.identity ?? null;
     // The shared identity is never an identity-bound client's recovery path.
-    const allowCommonsIdentityFallback = identity ? false : (deps.allowCommonsIdentityFallback ?? (0, platform_1.isNative)());
+    const allowCommonsIdentityFallback = identity ? false : (deps.allowCommonsIdentityFallback ?? (0, platform_1.isNative)()) && !(await store.isAutomaticIdentitySignInSuppressed?.());
     const epoch = oxy.http.getSessionEpoch();
     // Resolved per call: a re-established identity session can move the pin, and a
     // replaced/removed local key clears it (in which case arm 1 must NOT mint —
@@ -211,7 +311,7 @@ async function refreshPersistedSession(deps) {
     if (identity && !pin) {
         return recoverIdentitySession(oxy, store, identity);
     }
-    const arm1 = await refreshDeviceSecretArm({ oxy, store, pin });
+    const arm1 = await refreshDeviceSecretArm({ oxy, store, pin, isCurrent: deps.isCurrent });
     switch (arm1.status) {
         case 'ok':
             return arm1.token;
@@ -229,6 +329,28 @@ async function refreshPersistedSession(deps) {
             return null;
         case 'invalid-secret':
         case 'no-session': {
+            if (!identity && deps.sharedDeviceCredential) {
+                const joined = await refreshSharedDeviceArm({ oxy, store, shared: deps.sharedDeviceCredential, rejectedLocalHolder: true, isCurrent: deps.isCurrent });
+                if (joined.status === 'ok')
+                    return joined.token;
+                if (joined.status === 'session-ended' || joined.status === 'persist-failed')
+                    return null;
+            }
+            if (!identity && arm1.status === 'invalid-secret' && await store.isAutomaticIdentitySignInSuppressed?.())
+                return null;
+            if (arm1.status === 'no-session' && !identity) {
+                if (store.setAutomaticIdentitySignInSuppressed)
+                    return null;
+                // The holder is still valid, but its account session ended. Retain only
+                // the holder for a later deliberate/shared sign-in; never use the key
+                // to turn this signed-out verdict into a new account session.
+                const persisted = await store.load();
+                if (persisted?.deviceId && persisted.deviceSecret) {
+                    await store.save({ sessionId: '', userId: '', deviceId: persisted.deviceId, deviceSecret: persisted.deviceSecret });
+                }
+                return null;
+            }
+            // Identity mode retains its separate pinned-key recovery contract.
             // 401: secret diverged or no live session. When a key-based arm 2 can still
             // recover (the native Commons identity, or an identity-bound client's own
             // primary key) drop ONLY the secret and keep the deviceId; otherwise (web) the
@@ -239,13 +361,6 @@ async function refreshPersistedSession(deps) {
                     await store.save({ ...persisted, deviceSecret: undefined });
                 }
             }
-            else if (arm1.status === 'no-session' && persisted?.deviceId && persisted.deviceSecret) {
-                // Web, a credential the server still recognises: this origin stays a
-                // holder of the browser's device (ADR 0029 D2) — the next sign-in in any
-                // app lands on it, and this app follows without opening the bridge
-                // again. Only the session fields go.
-                await store.save({ sessionId: '', userId: '', deviceId: persisted.deviceId, deviceSecret: persisted.deviceSecret });
-            }
             else {
                 await store.clear();
             }
@@ -257,6 +372,13 @@ async function refreshPersistedSession(deps) {
             logger_1.logger.debug('Pinned device-secret mint rejected: the pinned account is no longer on this device — re-establishing from the identity key', { component: 'refresh', method: 'refreshPersistedSession' });
             break;
         case 'no-secret':
+            if (!identity && deps.sharedDeviceCredential) {
+                const joined = await refreshSharedDeviceArm({ oxy, store, shared: deps.sharedDeviceCredential, isCurrent: deps.isCurrent });
+                if (joined.status === 'ok')
+                    return joined.token;
+                if (joined.status === 'session-ended' || joined.status === 'persist-failed' || joined.status === 'transient')
+                    return null;
+            }
             break;
     }
     if (identity) {
@@ -264,14 +386,14 @@ async function refreshPersistedSession(deps) {
     }
     // Never after a sign-out: the shared identity is a KEY, not a session, and
     // proving it here would sign the user straight back in.
-    if (allowCommonsIdentityFallback && !oxy.http.hasSessionEnded()) {
+    if (allowCommonsIdentityFallback && (deps.isCurrent?.() ?? true) && !oxy.http.hasSessionEnded() && !(await store.isAutomaticIdentitySignInSuppressed?.())) {
         try {
             // Planted here, not by the sign-in: a sign-out that lands while the
             // challenge round-trips must win, or the identity proof signs the user
             // straight back in.
             const session = await oxy.auth.signInWithCommonsIdentity({ plantTokens: false });
             if (session?.accessToken) {
-                if (oxy.http.getSessionEpoch() !== epoch) {
+                if (!(deps.isCurrent?.() ?? true) || oxy.http.getSessionEpoch() !== epoch || await store.isAutomaticIdentitySignInSuppressed?.()) {
                     return null;
                 }
                 // Repopulate the fast device-secret lane from the identity re-mint.
@@ -285,7 +407,7 @@ async function refreshPersistedSession(deps) {
                         expiresAt: session.expiresAt,
                     });
                 }
-                if (oxy.http.getSessionEpoch() !== epoch) {
+                if (!(deps.isCurrent?.() ?? true) || oxy.http.getSessionEpoch() !== epoch || await store.isAutomaticIdentitySignInSuppressed?.()) {
                     return null;
                 }
                 oxy.session.setAccessToken(session.accessToken);

package/dist/cjs/session/sharedDeviceCredential.js

@@ -201,7 +201,9 @@ async function publishProvenDeviceCredential(deps) {
  *    seam, no lane left out, and no new call site to forget.
  *  - Adopting on read would hide a change of WHO THIS APP IS SIGNED IN AS inside
  *    a storage primitive, and would run on every `load()`. Adoption is an
- *    explicit, once-per-boot cold-boot step instead (`shared-device-adopt`).
+ *    explicit cold-boot/resume recovery instead; an existing local holder must
+ *    first be rejected by the server, and a new shared holder must mint before
+ *    conditional persistence.
  *
  * `clear()` deliberately does NOT clear the shared slot. This app signing out is
  * not authority over the device-wide join point: other apps may still be signed
@@ -216,8 +218,22 @@ function createSharedMirroringAuthStateStore(deps) {
     // next launch rather than mid-process.
     let mirrored = null;
     return {
+        ...local,
         load: () => local.load(),
         clear: () => local.clear(),
+        ...(local.saveIfCurrent ? { saveIfCurrent: async (state, guard) => {
+                const committed = await local.saveIfCurrent?.(state, guard);
+                if (!committed)
+                    return false;
+                const credential = readLocalDeviceCredential(state);
+                if (credential && guard.isCurrent()) {
+                    try {
+                        await publishProvenDeviceCredential({ shared, credential });
+                    }
+                    catch { /* Local durability already verified. */ }
+                }
+                return true;
+            } } : {}),
         save: async (state) => {
             // The durable local write is the contract this store owes its caller —
             // run it first and report ITS result, unchanged. The mirror is additive.

package/dist/cjs/utils/officialOrigins.js

@@ -1,12 +1,14 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAllowedDeviceJoinOrigin = exports.isLoopbackOrigin = void 0;
+exports.isOfficialWebOrigin = isOfficialWebOrigin;
+const contracts_1 = require("@oxy.so/contracts");
+var contracts_2 = require("@oxy.so/contracts");
+Object.defineProperty(exports, "isLoopbackOrigin", { enumerable: true, get: function () { return contracts_2.isLoopbackOrigin; } });
 /**
  * Official first-party web origin allowlist — shared by OAuth redirect
  * validation and the server-side trusted-origin checks.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAllowedDeviceJoinOrigin = void 0;
-exports.isLoopbackOrigin = isLoopbackOrigin;
-exports.isOfficialWebOrigin = isOfficialWebOrigin;
 const authWebUrl_1 = require("./authWebUrl");
 const registrableApex_1 = require("./registrableApex");
 /** Official first-party registrable apexes (mirrors API trusted origins). */
@@ -26,22 +28,9 @@ const OFFICIAL_APEXES = new Set([
  * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
  * or `[::1]` on any port, http or https).
  */
-function isLoopbackOrigin(origin) {
-    try {
-        const parsed = new URL(origin);
-        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-            return false;
-        }
-        const host = parsed.hostname.toLowerCase();
-        return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
-    }
-    catch {
-        return false;
-    }
-}
 /** Whether an origin belongs to the official Oxy web ecosystem. */
 function isOfficialWebOrigin(origin) {
-    if (isLoopbackOrigin(origin)) {
+    if ((0, contracts_1.isLoopbackOrigin)(origin)) {
         return true;
     }
     try {

package/dist/esm/HttpService.js

@@ -15,7 +15,7 @@
 import { TTLCache, registerCacheForCleanup, unregisterCacheFromCleanup } from './utils/cache.js';
 import { RequestDeduplicator, RequestQueue, SimpleLogger } from './utils/requestUtils.js';
 import { retryAsync } from './utils/asyncUtils.js';
-import { createCancelledError, ErrorCodes, handleHttpError, parseHttpErrorBody } from './utils/errorUtils.js';
+import { createCancelledError, ErrorCodes, handleHttpError, isCancelledError, parseHttpErrorBody } from './utils/errorUtils.js';
 import { decodeTokenClaims } from './utils/tokenClaims.js';
 import { isReactNative } from '@oxy.so/protocol/random';
 import { computeIdentityTag, fnv1a32 } from './utils/cacheKey.js';
@@ -24,6 +24,35 @@ import { OxyAuthenticationError } from './OxyServices.errors.js';
 import { peekBrowserEdgeRegionHeader } from './utils/edgeRegion.js';
 import { getBrowserActivityIdHeader } from './utils/activityId.js';
 import { trimLeadingSlashes, trimTrailingSlashes } from './utils/slashes.js';
+/** Comparison only fences local async work; it never validates token authority. */
+function sameTokenSession(left, right) {
+    if (left === right)
+        return true;
+    if (!left || !right)
+        return false;
+    const a = decodeTokenClaims(left);
+    const b = decodeTokenClaims(right);
+    if (!a || !b || !(a.userId || a.id || a.sub) || !(b.userId || b.id || b.sub))
+        return false;
+    // A refresh may rotate exp/iat/jti while preserving its account and session.
+    // Opaque/malformed context fields cannot establish that equivalence.
+    return ['userId', 'id', 'sub', 'sessionId', 'operatorId', 'clientId', 'appId', 'authMethodId'].every((key) => (a[key] === undefined || typeof a[key] === 'string') && a[key] === b[key]);
+}
+/** Cancel this wait only; the shared mint continues for other callers. */
+function awaitRequestSignal(pending, signal) {
+    if (!signal)
+        return pending;
+    return new Promise((resolve, reject) => {
+        const onAbort = () => { reject(createCancelledError()); };
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener('abort', onAbort, { once: true });
+        // Both handlers remain attached even after cancellation, so a late shared
+        // failure is observed without reviving this request or becoming unhandled.
+        pending.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
 /** Methods whose calls concurrent callers may share (read-only). */
 const SAFE_METHODS = new Set(['GET']);
 /** Methods safe to re-send after a transient failure (RFC 9110 §9.2.2). */
@@ -302,8 +331,7 @@ export class HttpService {
         const currentToken = this.tokenStore.getAccessToken();
         if (providedToken) {
             if (providedToken !== currentToken) {
-                this.tokenStore.setTokens(providedToken);
-                this.notifyTokenChange();
+                this.setTokens(providedToken);
             }
             return providedToken;
         }
@@ -1011,8 +1039,12 @@ export class HttpService {
             this.tokenRefreshPromise = this.authRefreshHandler(reason)
                 .then((newToken) => {
                 if (epoch !== this.sessionEpoch) {
-                    // The session ended while this re-mint was in flight. Not a failure
-                    // (no cooldown), and nothing to plant.
+                    // A guarded refresh handler can itself adopt a new active context.
+                    // Acknowledge only an already-installed, exact result; never plant
+                    // a stale return value over a concurrent switch/logout.
+                    if (newToken && !this.sessionEnded && this.tokenStore.getAccessToken() === newToken) {
+                        return newToken;
+                    }
                     this.logger.debug('Discarded a token refresh that outlived its session');
                     return null;
                 }
@@ -1023,8 +1055,7 @@ export class HttpService {
                 // A token is planted again, so there is a session again.
                 this.sessionEnded = false;
                 if (this.tokenStore.getAccessToken() !== newToken) {
-                    this.tokenStore.setTokens(newToken);
-                    this.notifyTokenChange();
+                    this.setTokens(newToken);
                 }
                 this.noFresherTokenThan = isInsideRefreshLeadWindow(newToken) ? newToken : null;
                 // A success clears the failure timestamp so the next refresh is never
@@ -1180,23 +1211,61 @@ export class HttpService {
      * abort signal defines the lifetime of a healthy stream.
      */
     async requestAuthenticatedResponse(config) {
-        const authHeader = await this.getAuthHeader();
-        if (!authHeader) {
+        return this.requestRawResponse(config, true);
+    }
+    /**
+     * Raw response for public or authenticated app endpoints. The SDK supplies
+     * its current bearer when available; caller headers never supply authority.
+     * No caching, envelope transformation or transport-error retry is performed.
+     */
+    async requestResponse(config) {
+        return this.requestRawResponse(config, false);
+    }
+    async requestRawResponse(config, requireAuth) {
+        // Validate before obtaining a bearer: an unrelated origin must not trigger
+        // an auth mint, even when the trusted transport accepts absolute URLs.
+        const target = new URL(this.buildURL(config.url));
+        const base = new URL(this.baseURL);
+        if (target.origin !== base.origin || !['http:', 'https:'].includes(target.protocol)
+            || target.username || target.password) {
+            throw new Error('Raw response requests must target the configured API origin');
+        }
+        if (config.signal?.aborted)
+            throw createCancelledError();
+        // Snapshot caller-owned options once, including headers, before any await.
+        const request = { ...config, headers: new Headers(config.headers) };
+        const contextToken = this.syncAccessTokenFromProvider();
+        const beforeAuthEpoch = this.sessionEpoch;
+        const authHeader = await awaitRequestSignal(this.getAuthHeader(), config.signal);
+        if (beforeAuthEpoch !== this.sessionEpoch || !sameTokenSession(contextToken, this.tokenStore.getAccessToken())) {
+            throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
+        }
+        if (config.signal?.aborted)
+            throw createCancelledError();
+        if (requireAuth && !authHeader) {
             throw new OxyAuthenticationError('An active Oxy session is required for this request', 'AUTH_REQUIRED');
         }
-        return this.requestAuthenticatedResponseAttempt(config, authHeader, false);
+        return this.requestResponseAttempt(request, target.href, authHeader, false, this.sessionEpoch, contextToken);
     }
-    async requestAuthenticatedResponseAttempt(config, authHeader, isAuthRetry) {
+    async requestResponseAttempt(config, fullUrl, authHeader, isAuthRetry, epoch, contextToken) {
+        const assertCurrent = () => {
+            this.syncAccessTokenFromProvider();
+            if (epoch !== this.sessionEpoch || !sameTokenSession(contextToken, this.tokenStore.getAccessToken())) {
+                throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
+            }
+        };
         const startTime = Date.now();
+        if (config.signal?.aborted)
+            throw createCancelledError();
+        assertCurrent();
         const headers = new Headers(config.headers);
-        if (!headers.has('Accept')) {
+        if (!headers.has('Accept'))
             headers.set('Accept', 'application/json');
-        }
-        // Authentication is owned by this SDK instance. A caller cannot replace
-        // the bearer with a different session or leak one across linked apps.
-        headers.set('Authorization', authHeader);
-        // Never awaited: the PoP is a hint, and waiting on its trace fetch put up
-        // to a second in front of requests.
+        // Never accept ambient credentials or another authority from a caller.
+        for (const name of ['Authorization', 'Cookie', 'Cookie2', 'Host', 'Proxy-Authorization'])
+            headers.delete(name);
+        if (authHeader)
+            headers.set('Authorization', authHeader);
         const edgeRegionHeader = peekBrowserEdgeRegionHeader();
         for (const [name, value] of Object.entries(edgeRegionHeader))
             headers.set(name, value);
@@ -1204,22 +1273,51 @@ export class HttpService {
         for (const [name, value] of Object.entries(activityIdHeader))
             headers.set(name, value);
         try {
-            const fullUrl = this.buildURL(config.url);
-            const response = await fetch(fullUrl, {
+            const body = config.method === 'GET' ? undefined : config.body;
+            const init = {
                 method: config.method,
                 headers,
-                body: config.method === 'GET' ? undefined : config.body,
+                body,
                 signal: config.signal,
-                credentials: this.getCredentialsMode(fullUrl),
-            });
-            if (response.status === 401 && !isAuthRetry) {
-                const refreshed = await this.refreshAccessToken('response-401');
+                credentials: 'omit',
+                redirect: 'error',
+            };
+            // Node fetch requires this flag for streaming uploads; ordinary and
+            // multipart bodies keep the platform's existing body serialization.
+            if (body && typeof body === 'object' && 'getReader' in body)
+                init.duplex = 'half';
+            const response = await (config.fetch ?? globalThis.fetch)(fullUrl, init);
+            try {
+                assertCurrent();
+            }
+            catch (error) {
+                await response.body?.cancel();
+                throw error;
+            }
+            const replayable = body === undefined || typeof body === 'string';
+            if (response.status === 401 && !isAuthRetry && authHeader && replayable && !config.signal?.aborted) {
+                let refreshed;
+                try {
+                    refreshed = await awaitRequestSignal(this.refreshAccessToken('response-401'), config.signal);
+                }
+                catch (error) {
+                    void response.body?.cancel().catch(() => undefined);
+                    throw error;
+                }
+                try {
+                    assertCurrent();
+                }
+                catch (error) {
+                    await response.body?.cancel();
+                    throw error;
+                }
                 if (refreshed) {
                     await response.body?.cancel();
-                    return this.requestAuthenticatedResponseAttempt(config, `Bearer ${refreshed}`, true);
+                    if (config.signal?.aborted)
+                        throw createCancelledError();
+                    return this.requestResponseAttempt(config, fullUrl, `Bearer ${refreshed}`, true, epoch, contextToken);
                 }
-                this.tokenStore.clearTokens();
-                this.notifyTokenChange();
+                this.clearTokens();
             }
             const duration = Date.now() - startTime;
             this.updateMetrics(response.ok, duration);
@@ -1230,8 +1328,12 @@ export class HttpService {
             const duration = Date.now() - startTime;
             this.updateMetrics(false, duration);
             this.config.onRequestEnd?.(config.url, config.method, duration, false);
-            const normalizedError = error instanceof Error ? error : new Error(String(error));
+            const normalizedError = config.signal?.aborted || isCancelledError(error)
+                ? createCancelledError()
+                : error instanceof Error ? error : new Error(String(error));
             this.config.onRequestError?.(config.url, config.method, normalizedError);
+            if (isCancelledError(normalizedError) || normalizedError instanceof OxyAuthenticationError)
+                throw normalizedError;
             throw handleHttpError(normalizedError);
         }
     }
@@ -1253,6 +1355,9 @@ export class HttpService {
     }
     // Token management
     setTokens(accessToken) {
+        const current = this.tokenStore.getAccessToken();
+        if (current && !sameTokenSession(current, accessToken))
+            this.sessionEpoch += 1;
         this.sessionEnded = false;
         this.tokenStore.setTokens(accessToken);
         this.notifyTokenChange();
@@ -1261,17 +1366,19 @@ export class HttpService {
      * End the local session: clear the bearer and abandon every re-mint already
      * in flight, so none of them can plant a token after the sign-out.
      *
-     * {@link clearTokens} alone only drops the bearer, which is right for a
-     * mirror (a linked client following its parent) but not for a sign-out: a
-     * refresh started a moment earlier would finish and plant a new one.
+     * Unlike {@link clearTokens}, this also marks the session as ended and
+     * invalidates pending re-mints even when no bearer is currently present.
      */
     endSession() {
-        this.sessionEpoch += 1;
+        if (!this.tokenStore.getAccessToken())
+            this.sessionEpoch += 1;
         this.sessionEnded = true;
         this.clearTokens();
     }
     /**
-     * The current session epoch — see {@link endSession}. A re-mint lane that
+     * The current context epoch: account/session switches and bearer removal
+     * invalidate pending work; rotation within the same context preserves it.
+     * A re-mint lane that
      * plants tokens itself (the device-secret arm) compares it across its awaits.
      */
     getSessionEpoch() {
@@ -1298,6 +1405,8 @@ export class HttpService {
         this.anonymousAuthProvider = provider;
     }
     clearTokens() {
+        if (this.tokenStore.getAccessToken())
+            this.sessionEpoch += 1;
         this.tokenStore.clearTokens();
         // Drop the response cache on logout. The cache is identity-scoped, so a
         // different user could never read these entries, but a logged-out client