@oxy.so/services 4.0.2 → 4.0.4

package/lib/typescript/module/ui/runtime/createOxyRuntime.d.ts

@@ -83,7 +83,9 @@ export interface OxyRuntime {
     /**
      * Project the client's current device state onto the snapshot. Idempotent and
      * revision-guarded: a projection whose profile fetch was overtaken by a
-     * fresher state discards itself rather than publishing a stale subject.
+     * fresher state discards itself rather than publishing a stale subject. It is
+     * also teardown-guarded: one started before {@link clearSession} publishes
+     * nothing, whatever `SessionClient` still holds.
      */
     reconcileFromClient(): Promise<void>;
     /** Read the device directory and publish it (opts this runtime into ADR 0002). */
@@ -137,7 +139,10 @@ export interface OxyRuntime {
         preserveSessionIds?: string[];
     }): void;
     setActiveSessionId(sessionId: string | null): void;
-    /** Local teardown: drop the session projection without touching the server. */
+    /**
+     * Local teardown: drop the session projection without touching the server.
+     * Every projection already in flight is abandoned.
+     */
     clearSession(): void;
 }
 export declare function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime;

package/lib/typescript/module/ui/runtime/createOxyRuntime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createOxyRuntime.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/createOxyRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,cAAc,CAAC;AAYvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAoC,MAAM,YAAS,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,IAAI,kBAAkB,GAAG,IAAI,CAAC;IACtC,YAAY,IAAI,eAAe,GAAG,IAAI,CAAC;IACvC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5E,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,aAAa,CAAC;IAC3B,aAAa,EAAE,oBAAoB,CAAC;IACpC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAExC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAE1D;;;;OAIG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAErD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAEhF,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,IAAI,kBAAkB,CAAC;IAClC,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAE5C,0EAA0E;IAC1E,KAAK,IAAI,MAAM,IAAI,CAAC;IAEpB;;;;OAIG;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,kFAAkF;IAClF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;OAMG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,yEAAyE;IACzE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAEhC,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,gBAAgB,IAAI,IAAI,CAAC;IAEzB;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7G,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAEnD,+EAA+E;IAC/E,YAAY,IAAI,IAAI,CAAC;CACtB;AA2DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAyYrE"}
+{"version":3,"file":"createOxyRuntime.d.ts","sourceRoot":"","sources":["../../../../../src/ui/runtime/createOxyRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,cAAc,CAAC;AAYvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAoC,MAAM,YAAS,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,IAAI,kBAAkB,GAAG,IAAI,CAAC;IACtC,YAAY,IAAI,eAAe,GAAG,IAAI,CAAC;IACvC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5E,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,aAAa,CAAC;IAC3B,aAAa,EAAE,oBAAoB,CAAC;IACpC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAExC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAE1D;;;;OAIG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAErD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAEhF,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,IAAI,kBAAkB,CAAC;IAClC,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAE5C,0EAA0E;IAC1E,KAAK,IAAI,MAAM,IAAI,CAAC;IAEpB;;;;;;OAMG;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,kFAAkF;IAClF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;OAMG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;;OAQG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,yEAAyE;IACzE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAEhC,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,gBAAgB,IAAI,IAAI,CAAC;IAEzB;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7G,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAEnD;;;OAGG;IACH,YAAY,IAAI,IAAI,CAAC;CACtB;AA2DD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAyZrE"}

package/lib/typescript/module/ui/session/tokenLossRecovery.d.ts

@@ -0,0 +1,37 @@
+export interface TokenLossRecoveryDeps {
+    /** Re-mint once through the installed refresh handler; the token, or null. */
+    remint: () => Promise<string | null>;
+    /** Whether the durable auth store still holds `deviceId` + `deviceSecret`. */
+    hasDeviceCredential: () => Promise<boolean>;
+    /**
+     * Whether a key-based lane could still re-establish the session without a
+     * device secret. Consulted only once the credential is gone.
+     */
+    hasKeyedRecovery: () => Promise<boolean>;
+    /** Whether the UI still shows a signed-in user. */
+    isSignedIn: () => boolean;
+    /** Whether a bearer is planted right now. */
+    hasToken: () => boolean;
+    /** Tear down the local session (the provider's `clearSessionState`). */
+    signOutLocally: () => Promise<void>;
+    /** Timer seam for tests. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface TokenLossRecovery {
+    /** Start recovering, unless a recovery is already running. */
+    start(): void;
+    /** Abandon any running recovery (provider unmount). */
+    dispose(): void;
+    /** Whether a recovery is running. */
+    isRecovering(): boolean;
+}
+/**
+ * Delays between re-mint attempts while the device credential is intact. Starts
+ * near the post-failure refresh cooldowns and settles at one attempt a minute,
+ * which also respects the mint's own 60s rate-limit cooldown.
+ */
+export declare const TOKEN_RECOVERY_BACKOFF_MS: readonly number[];
+/** Attempts through a key-based lane once the device credential is gone. */
+export declare const MAX_KEYED_RECOVERY_ATTEMPTS = 3;
+export declare function createTokenLossRecovery(deps: TokenLossRecoveryDeps): TokenLossRecovery;
+//# sourceMappingURL=tokenLossRecovery.d.ts.map

package/lib/typescript/module/ui/session/tokenLossRecovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenLossRecovery.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenLossRecovery.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C;;;OAGG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,mDAAmD;IACnD,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,wEAAwE;IACxE,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,4BAA4B;IAC5B,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,KAAK,IAAI,IAAI,CAAC;IACd,uDAAuD;IACvD,OAAO,IAAI,IAAI,CAAC;IAChB,qCAAqC;IACrC,YAAY,IAAI,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAE3G,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAS7C,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAoEtF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/services",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -164,7 +164,7 @@
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@expo/vector-icons": "^15.0.3",
-    "@oxy.so/core": "1.9.0",
+    "@oxy.so/core": "1.10.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^12.0.1",
     "@react-native/babel-preset": "^0.86.2",
@@ -216,7 +216,7 @@
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxy.so/bloom": "^4.21.1",
-    "@oxy.so/core": "^1.9.0",
+    "@oxy.so/core": "^1.9.1",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": ">=11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",

package/src/ui/context/OxyContext.tsx

@@ -45,7 +45,8 @@ import {
 import { isWebBrowser } from '../utils/isWebBrowser';
 import { resolveDeliveryPlatform } from '../utils/deliveryPlatform';
 import { runProviderColdBoot } from '../boot/runProviderColdBoot';
-import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
+import { hasPersistedDeviceCredential, loadPersistedDeviceCredential } from '../utils/deviceCredential';
+import { createTokenLossRecovery } from '../session/tokenLossRecovery';
 import { bindAuthStoreToRuntime } from '../stores/authStore';
 import { useLanguageManagement } from '../hooks/useLanguageManagement';
 import { useSessionManagement } from '../hooks/useSessionManagement';
@@ -543,14 +544,52 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   });
 
 
-  // Token-change side effects: an invalidated bearer (HttpService clears tokens
-  // on an unrecoverable 401 and emits `null`) must locally sign out an
-  // authenticated user so `isAuthenticated` never lingers true with no token.
-  // The persisted store is NOT cleared here — the refresh handler already
-  // cleared it if the family was revoked; a transient null leaves it intact so a
-  // later reload can still restore.
+  // Token-change side effects. HttpService clears the bearer and emits `null`
+  // when a request draws a 401 its refresh could not answer — which happens on a
+  // transient failure (network, a cooling-down or rate-limited mint) as well as
+  // on a real revocation. A signed-in user is therefore NOT signed out on the
+  // spot: `tokenLossRecovery` keeps the session while the durable device
+  // credential survives and re-mints it, the way a relaunch would, and signs out
+  // only once the refresh handler has dropped that credential on a definitive
+  // server verdict (OxyHQ/Mention#1140). Until a token is back, `tokenReady` is
+  // false, so private queries wait instead of 401-ing.
   const clearingInvalidTokenRef = useRef(false);
   useEffect(() => {
+    const signOutLocally = async (): Promise<void> => {
+      if (clearingInvalidTokenRef.current) {
+        return;
+      }
+      clearingInvalidTokenRef.current = true;
+      try {
+        await clearSessionStateRef.current();
+      } catch (clearError) {
+        logger('Failed to clear invalidated auth session', clearError);
+      } finally {
+        clearingInvalidTokenRef.current = false;
+        if (runtime.getSnapshot().authResolved) {
+          runtime.setTokenReady(true);
+        }
+      }
+    };
+    const recovery = createTokenLossRecovery({
+      remint: () => oxyServices.httpService.refreshAccessToken('preflight'),
+      hasDeviceCredential: () => hasPersistedDeviceCredential(authStore),
+      hasKeyedRecovery: async () => {
+        if (Platform.OS === 'web') {
+          return false;
+        }
+        try {
+          // The same keys the refresh handler's second arm signs with: the
+          // identity-bound client's own key, or the cross-app shared identity.
+          return identity ? await KeyManager.hasIdentity() : await KeyManager.hasSharedIdentity();
+        } catch {
+          return false;
+        }
+      },
+      isSignedIn: () => runtime.getSnapshot().account !== null,
+      hasToken: () => Boolean(oxyServices.getAccessToken()),
+      signOutLocally,
+    });
     const handleTokenChange = (accessToken: string | null) => {
       runtime.setHasAccessToken(Boolean(accessToken));
       if (accessToken) {
@@ -562,20 +601,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       }
       if (runtime.getSnapshot().account !== null) {
         runtime.setTokenReady(false);
-        if (clearingInvalidTokenRef.current) {
-          return;
-        }
-        clearingInvalidTokenRef.current = true;
-        clearSessionStateRef.current()
-          .catch((clearError) => {
-            logger('Failed to clear invalidated auth session', clearError);
-          })
-          .finally(() => {
-            clearingInvalidTokenRef.current = false;
-            if (runtime.getSnapshot().authResolved) {
-              runtime.setTokenReady(true);
-            }
-          });
+        recovery.start();
         return;
       }
       if (runtime.getSnapshot().authResolved) {
@@ -583,8 +609,12 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       }
     };
     handleTokenChange(oxyServices.getAccessToken());
-    return oxyServices.onTokensChanged(handleTokenChange);
-  }, [logger, oxyServices, runtime, sessionClient]);
+    const unsubscribe = oxyServices.onTokensChanged(handleTokenChange);
+    return () => {
+      unsubscribe();
+      recovery.dispose();
+    };
+  }, [logger, oxyServices, runtime, sessionClient, authStore, identity]);
 
   // Unified in-session refresh (SDK-owned; every RP inherits it). Installs the
   // ONE core refresh handler (re-mint from the persisted zero-cookie device

package/src/ui/runtime/createOxyRuntime.ts

@@ -107,7 +107,9 @@ export interface OxyRuntime {
   /**
    * Project the client's current device state onto the snapshot. Idempotent and
    * revision-guarded: a projection whose profile fetch was overtaken by a
-   * fresher state discards itself rather than publishing a stale subject.
+   * fresher state discards itself rather than publishing a stale subject. It is
+   * also teardown-guarded: one started before {@link clearSession} publishes
+   * nothing, whatever `SessionClient` still holds.
    */
   reconcileFromClient(): Promise<void>;
 
@@ -166,7 +168,10 @@ export interface OxyRuntime {
   mergeSessions(incoming: ClientSession[], options?: { merge?: boolean; preserveSessionIds?: string[] }): void;
   setActiveSessionId(sessionId: string | null): void;
 
-  /** Local teardown: drop the session projection without touching the server. */
+  /**
+   * Local teardown: drop the session projection without touching the server.
+   * Every projection already in flight is abandoned.
+   */
   clearSession(): void;
 }
 
@@ -268,6 +273,14 @@ export function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime {
   let dirty = false;
   /** The subject as it stood when the OUTERMOST transition opened. */
   let subjectAtEntry: string | null = null;
+  /**
+   * Bumped by every local teardown. A projection captures it before its first
+   * await and discards itself if it moved: the revision guard alone cannot see
+   * a sign-out, because a local teardown (the token-null lane, a `logoutAll`
+   * whose device call already failed) leaves `SessionClient` holding the SAME
+   * state, at the same revision, that the projection was started for.
+   */
+  let sessionGeneration = 0;
 
   function buildSnapshot(): OxyRuntimeSnapshot {
     const activeContext = resolveActiveContext(facts.directory);
@@ -401,6 +414,7 @@ export function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime {
     // profile fetch if a fresher state has landed — last-writer-wins, so two
     // overlapping projections can never publish in the wrong order.
     const capturedRevision = state.revision;
+    const capturedGeneration = sessionGeneration;
     // Resolve the pin BEFORE the fetch (memoised: one storage + keychain read
     // per boot) so the first pass over a freshly applied state is already bound.
     // Deferring it would let a sibling app's switch render once as this
@@ -414,6 +428,12 @@ export function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime {
       logger('Failed to resolve account profiles during the device projection', fetchError);
       return;
     }
+    if (capturedGeneration !== sessionGeneration) {
+      // Signed out while the profiles were in flight. Committing now would put
+      // the account back on a device with no bearer — the "Hi <old user>"
+      // greeting to a signed-out visitor.
+      return;
+    }
     const latest = sessionClient.getState();
     if (!latest || latest.revision !== capturedRevision) {
       return;
@@ -608,6 +628,7 @@ export function createOxyRuntime(config: OxyRuntimeConfig): OxyRuntime {
     },
 
     clearSession() {
+      sessionGeneration += 1;
       transition(() => {
         setSessions(EMPTY_SESSIONS);
         setActiveSessionIdFact(null);

package/src/ui/session/__tests__/tokenLossRecovery.test.ts

@@ -0,0 +1,195 @@
+/**
+ * A lost access token is a question, not a sign-out (OxyHQ/Mention#1140).
+ *
+ * The provider used to sign the user out on ANY cleared bearer. HttpService
+ * clears it whenever a 401's refresh comes back empty — including when the mint
+ * is merely cooling down after a 429 or the network blipped — and with no token
+ * the refresh scheduler stops, so the session never came back until a relaunch
+ * re-minted from the device credential that had been intact the whole time.
+ */
+import {
+  createTokenLossRecovery,
+  MAX_KEYED_RECOVERY_ATTEMPTS,
+  TOKEN_RECOVERY_BACKOFF_MS,
+  type TokenLossRecoveryDeps,
+} from '../tokenLossRecovery';
+
+interface Harness {
+  deps: TokenLossRecoveryDeps;
+  state: { signedIn: boolean; token: string | null; credential: boolean; keyed: boolean };
+  remint: jest.Mock<Promise<string | null>, []>;
+  signOutLocally: jest.Mock<Promise<void>, []>;
+  sleeps: number[];
+}
+
+function harness(remintAnswers: Array<string | null | 'drop-credential'>): Harness {
+  const state = { signedIn: true, token: null as string | null, credential: true, keyed: false };
+  const sleeps: number[] = [];
+  const remint = jest.fn(async (): Promise<string | null> => {
+    const answer = remintAnswers.length > 0 ? remintAnswers.shift() : null;
+    if (answer === 'drop-credential') {
+      // What the refresh handler does on `invalid_device_secret` /
+      // `no_active_session`: the credential goes, and the mint returns nothing.
+      state.credential = false;
+      return null;
+    }
+    if (answer) {
+      state.token = answer;
+    }
+    return answer ?? null;
+  });
+  const signOutLocally = jest.fn(async () => {
+    state.signedIn = false;
+  });
+  const deps: TokenLossRecoveryDeps = {
+    remint,
+    hasDeviceCredential: async () => state.credential,
+    hasKeyedRecovery: async () => state.keyed,
+    isSignedIn: () => state.signedIn,
+    hasToken: () => state.token !== null,
+    signOutLocally,
+    sleep: async (ms) => {
+      sleeps.push(ms);
+    },
+  };
+  return { deps, state, remint, signOutLocally, sleeps };
+}
+
+async function runToCompletion(recovery: ReturnType<typeof createTokenLossRecovery>): Promise<void> {
+  for (let i = 0; i < 200 && recovery.isRecovering(); i += 1) {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  expect(recovery.isRecovering()).toBe(false);
+}
+
+describe('token loss recovery', () => {
+  it('keeps a user with an intact device credential signed in through transient failures, then restores the token', async () => {
+    // The incident: the mint is rate limited / cooling down for a while, then
+    // succeeds — exactly what a relaunch a few minutes later did.
+    const h = harness([null, null, null, 'fresh']);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+    expect(h.state.token).toBe('fresh');
+    expect(h.remint).toHaveBeenCalledTimes(4);
+    expect(h.sleeps).toEqual(TOKEN_RECOVERY_BACKOFF_MS.slice(0, 3));
+  });
+
+  it('signs out once a re-mint gets a definitive verdict and no key can re-establish the session', async () => {
+    const h = harness([null, 'drop-credential']);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+    expect(h.remint).toHaveBeenCalledTimes(2);
+  });
+
+  it('signs out at once when the credential was already gone and there is no key-based lane (the old behaviour for a real revocation)', async () => {
+    const h = harness([]);
+    h.state.credential = false;
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).not.toHaveBeenCalled();
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-establishes through the shared identity when the credential is gone, like the cold boot does', async () => {
+    const h = harness([null, 'from-shared-key']);
+    h.state.credential = false;
+    h.state.keyed = true;
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+    expect(h.state.token).toBe('from-shared-key');
+  });
+
+  it('gives the key-based lane a bounded number of tries, then signs out', async () => {
+    const h = harness([]);
+    h.state.credential = false;
+    h.state.keyed = true;
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(MAX_KEYED_RECOVERY_ATTEMPTS);
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+  });
+
+  it('stops without touching the session when the user signs out meanwhile', async () => {
+    const h = harness([]);
+    h.remint.mockImplementation(async () => {
+      h.state.signedIn = false;
+      return null;
+    });
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(1);
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+  });
+
+  it('stops when another lane planted a token first', async () => {
+    const h = harness([]);
+    h.remint.mockImplementation(async () => {
+      h.state.token = 'planted-by-a-sign-in';
+      return null;
+    });
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(1);
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+  });
+
+  it('runs one recovery at a time', async () => {
+    const h = harness([null, 'fresh']);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(2);
+  });
+
+  it('signs out rather than strand a signed-in UI with no bearer when recovery itself throws', async () => {
+    const h = harness([]);
+    h.deps.hasDeviceCredential = async () => {
+      throw new Error('store exploded');
+    };
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+  });
+
+  it('does nothing after dispose', async () => {
+    const h = harness([]);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.dispose();
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).not.toHaveBeenCalled();
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+  });
+});

package/src/ui/session/tokenLossRecovery.ts

@@ -0,0 +1,146 @@
+/**
+ * What a signed-in app does when its access token disappears at runtime.
+ *
+ * `HttpService` clears the bearer when a request draws a 401 and the refresh it
+ * then tries returns nothing. That refresh can return nothing for reasons that
+ * say NOTHING about the session: the mint is cooling down after a failure or a
+ * 429, the network dropped, the server was restarting. The provider used to read
+ * every such clear as a sign-out and tore the session down on the spot — and
+ * because the proactive refresh scheduler only runs while a token exists, nothing
+ * was left to bring the session back. Only a relaunch did, because the cold boot
+ * mints from the durable device credential that had been there all along
+ * (OxyHQ/Mention#1140).
+ *
+ * So a lost token is a question, and this answers it the way a relaunch would:
+ *
+ *  - The durable store still holds the device credential → the session is NOT
+ *    known to be over. Keep the user signed in (private queries pause, because
+ *    there is no bearer) and re-mint with backoff until one succeeds. A
+ *    definitive server verdict (`invalid_device_secret`, `no_active_session`)
+ *    makes the refresh handler drop or clear that credential, which is what ends
+ *    this loop in a sign-out — so a real revocation still signs out.
+ *  - No credential, but a key-based lane can still re-establish (the native
+ *    shared identity, or an identity-bound client's own key) → try that a few
+ *    times, as the cold boot's shared-key step would, then sign out.
+ *  - Neither → the session is over. Sign out now, as before.
+ *
+ * Framework-free and clock-injectable so the policy is unit tested without a
+ * provider.
+ */
+import { logger } from '@oxy.so/core';
+
+export interface TokenLossRecoveryDeps {
+  /** Re-mint once through the installed refresh handler; the token, or null. */
+  remint: () => Promise<string | null>;
+  /** Whether the durable auth store still holds `deviceId` + `deviceSecret`. */
+  hasDeviceCredential: () => Promise<boolean>;
+  /**
+   * Whether a key-based lane could still re-establish the session without a
+   * device secret. Consulted only once the credential is gone.
+   */
+  hasKeyedRecovery: () => Promise<boolean>;
+  /** Whether the UI still shows a signed-in user. */
+  isSignedIn: () => boolean;
+  /** Whether a bearer is planted right now. */
+  hasToken: () => boolean;
+  /** Tear down the local session (the provider's `clearSessionState`). */
+  signOutLocally: () => Promise<void>;
+  /** Timer seam for tests. */
+  sleep?: (ms: number) => Promise<void>;
+}
+
+export interface TokenLossRecovery {
+  /** Start recovering, unless a recovery is already running. */
+  start(): void;
+  /** Abandon any running recovery (provider unmount). */
+  dispose(): void;
+  /** Whether a recovery is running. */
+  isRecovering(): boolean;
+}
+
+/**
+ * Delays between re-mint attempts while the device credential is intact. Starts
+ * near the post-failure refresh cooldowns and settles at one attempt a minute,
+ * which also respects the mint's own 60s rate-limit cooldown.
+ */
+export const TOKEN_RECOVERY_BACKOFF_MS: readonly number[] = [2_000, 5_000, 10_000, 20_000, 30_000, 60_000];
+
+/** Attempts through a key-based lane once the device credential is gone. */
+export const MAX_KEYED_RECOVERY_ATTEMPTS = 3;
+
+const defaultSleep = (ms: number): Promise<void> =>
+  new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+
+const LOG_CONTEXT = { component: 'OxyContext', method: 'tokenLossRecovery' } as const;
+
+export function createTokenLossRecovery(deps: TokenLossRecoveryDeps): TokenLossRecovery {
+  const sleep = deps.sleep ?? defaultSleep;
+  let running = false;
+  let disposed = false;
+
+  const settled = (): boolean => disposed || deps.hasToken() || !deps.isSignedIn();
+
+  const run = async (): Promise<void> => {
+    let attempt = 0;
+    let keyedAttempts = 0;
+    logger.warn('Access token lost while signed in — recovering the session instead of signing out', LOG_CONTEXT);
+    while (!settled()) {
+      if (!(await deps.hasDeviceCredential())) {
+        const keyed = keyedAttempts < MAX_KEYED_RECOVERY_ATTEMPTS && (await deps.hasKeyedRecovery());
+        if (!keyed) {
+          if (settled()) {
+            return;
+          }
+          logger.warn('Session recovery ended: no device credential and no key-based lane left — signing out', {
+            ...LOG_CONTEXT,
+            attempts: attempt,
+            keyedAttempts,
+          });
+          await deps.signOutLocally();
+          return;
+        }
+        keyedAttempts += 1;
+      }
+      if (settled()) {
+        return;
+      }
+      const token = await deps.remint().catch(() => null);
+      attempt += 1;
+      if (token || settled()) {
+        if (token) {
+          logger.warn('Session recovered after a lost access token', { ...LOG_CONTEXT, attempts: attempt });
+        }
+        return;
+      }
+      await sleep(TOKEN_RECOVERY_BACKOFF_MS[Math.min(attempt - 1, TOKEN_RECOVERY_BACKOFF_MS.length - 1)]);
+    }
+  };
+
+  return {
+    start(): void {
+      if (running || disposed) {
+        return;
+      }
+      running = true;
+      void run()
+        .catch(async (error: unknown) => {
+          // Never leave a signed-in UI with no bearer and nothing recovering it.
+          logger.warn('Session recovery failed unexpectedly — signing out', LOG_CONTEXT, error);
+          if (!settled()) {
+            await deps.signOutLocally().catch(() => undefined);
+          }
+        })
+        .finally(() => {
+          running = false;
+        });
+    },
+    dispose(): void {
+      disposed = true;
+    },
+    isRecovering(): boolean {
+      return running;
+    },
+  };
+}