@oxy.so/services 6.2.0 → 8.1.0

package/src/ui/context/OxyContext.tsx

@@ -9,24 +9,13 @@ import {
   useState,
 } from 'react';
 import { Linking, Platform } from 'react-native';
-import { DeviceManager, OxyServices, oxyClient, type OxyAuthScreen } from '@oxy.so/core';
+import { OxyServices } from '@oxy.so/core';
 import type { LoginSessionResult } from '@oxy.so/contracts';
-import type {
-  User,
-  SessionLoginResponse,
-  AuthStateStore,
-  PersistedAuthState,
-  AccountDialogController,
-  AccountDialogView,
-} from '@oxy.so/core';
-import {
-  KeyManager,
-  establishIdentitySession,
-  installAuthRefreshHandler,
-  startTokenRefreshScheduler,
-  createAccountDialogController,
-  logger as loggerUtil,
-} from '@oxy.so/core';
+import type { User, SessionLoginResponse } from '@oxy.so/core';
+import type { AuthStateStore, PersistedAuthState, AccountDialogController, AccountDialogView } from '@oxy.so/core/session';
+import { KeyManager } from '@oxy.so/core/crypto';
+import { refreshDeviceSecretArm, establishIdentitySession, installAuthRefreshHandler, startTokenRefreshScheduler, createAccountDialogController } from '@oxy.so/core/session';
+import { logger as loggerUtil } from '@oxy.so/core';
 import {
   registerAccountDialogControls,
   notifyAccountDialogVisibility,
@@ -37,6 +26,8 @@ import {
   type StartWebOAuthSignInOptions,
 } from '../oauth/browserAuthTransport';
 import type { WebOAuthSignInResult } from '../oauth/types';
+import { openBridgeWindow, resolveBridgeOrigin, runBrowserBridge } from '../oauth/browserBridge';
+import { trackDeviceCredential, type CredentialTrackingAuthStateStore } from '../session/deviceCredentialTracker';
 import {
   requestOAuthConsent,
   type OAuthConsentResult,
@@ -45,7 +36,7 @@ import {
 import { isWebBrowser } from '../utils/isWebBrowser';
 import { resolveDeliveryPlatform } from '../utils/deliveryPlatform';
 import { runProviderColdBoot } from '../boot/runProviderColdBoot';
-import { hasPersistedDeviceCredential, loadPersistedDeviceCredential } from '../utils/deviceCredential';
+import { hasPersistedSessionCredential, loadPersistedDeviceCredential } from '../utils/deviceCredential';
 import { createTokenLossRecovery } from '../session/tokenLossRecovery';
 import { bindAuthStoreToRuntime } from '../stores/authStore';
 import { useLanguageManagement } from '../hooks/useLanguageManagement';
@@ -96,13 +87,7 @@ import { DEFAULT_SESSION_VALIDITY_MS } from './oxyContextHelpers';
 // never dereferenced at module scope here.
 import { useFollow } from '../hooks/useFollow';
 import { commitDeviceSetAndResolve } from './commitSessionFlow';
-import { runPasskeyLogin, runPasskeyAdd } from './passkeyFlow';
-import {
-  isPasskeySupported,
-  runRegistrationCeremony,
-  runAuthenticationCeremony,
-} from '../../webauthn/passkeyClient';
-import { queryKeys } from '../hooks/queries/queryKeys';
+import { clearSignInFlows } from '../components/signIn/signInFlowStore';
 import { useOxyAccountGraph } from './useOxyAccountGraph';
 
 export type { LogoutResult, OxyContextState, OxyRuntimeProviderProps } from './oxyContextTypes';
@@ -160,7 +145,10 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     } else if (baseURL) {
       // `authWebUrl` now only points the OAuth "Sign in with Oxy" third-party
       // link builder at the central auth host; there is no cold-boot redirect.
-      oxyServicesRef.current = new OxyServices({ baseURL, authWebUrl, authRedirectUri });
+      //
+      // `enableCache: false`: React Query owns caching and dedup here. A second
+      // response cache under it served stale data after an invalidate-refetch.
+      oxyServicesRef.current = new OxyServices({ baseURL, authWebUrl, authRedirectUri, enableCache: false });
     } else {
       throw new Error('Either oxyServices or baseURL must be provided to OxyProvider');
     }
@@ -169,11 +157,13 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
 
   // The device-first persisted auth-state store (per-origin device credential on
   // web; SecureStore session blob on native). Built ONCE per provider mount.
-  const authStoreRef = useRef<AuthStateStore | null>(null);
+  // Tracked, so a sign-in press can tell SYNCHRONOUSLY whether this origin
+  // holds a device credential (the browser bridge must open inside the press).
+  const authStoreRef = useRef<CredentialTrackingAuthStateStore | null>(null);
   if (!authStoreRef.current) {
-    authStoreRef.current = createPlatformAuthStateStore({ sessionMode });
+    authStoreRef.current = trackDeviceCredential(createPlatformAuthStateStore({ sessionMode }));
   }
-  const authStore = authStoreRef.current;
+  const authStore: AuthStateStore = authStoreRef.current;
 
   // Identity-bound session binding (`sessionMode: 'identity'`) — the platform pin
   // store plus the memoised pinned account id every lane below binds to. Built
@@ -283,25 +273,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
 
   useEffect(() => runtime.start(), [runtime]);
 
-  // Keep the shared `oxyClient` singleton's token store in lockstep with the
-  // session owned by THIS provider's instance (many apps build API clients
-  // against the exported singleton while passing only `baseURL` here). Skipped
-  // when the app passed the singleton itself as `oxyServices`.
-  useEffect(() => {
-    if (oxyServices === oxyClient) {
-      return;
-    }
-    const applyToSingleton = (accessToken: string | null) => {
-      if (accessToken) {
-        oxyClient.setTokens(accessToken);
-      } else {
-        oxyClient.clearTokens();
-      }
-    };
-    applyToSingleton(oxyServices.getAccessToken());
-    return oxyServices.onTokensChanged(applyToSingleton);
-  }, [oxyServices]);
-
   const storageKeys = useMemo(() => getStorageKeys(storageKeyPrefix), [storageKeyPrefix]);
 
   const clientId = useMemo(() => {
@@ -523,7 +494,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     // Explicit FULL wipe: also drop the persisted device credential so a reload
     // finds nothing to restore.
     await authStore.clear();
-    oxyServices.clearCache();
+    oxyServices.cache.clear();
   }, [queryClient, storage, clearSessionState, authStore, logger, oxyServices]);
 
   const { getDeviceSessions, logoutAllDeviceSessions, updateDeviceName } = useDeviceManagement({
@@ -563,8 +534,8 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       }
     };
     const recovery = createTokenLossRecovery({
-      remint: () => oxyServices.httpService.refreshAccessToken('preflight'),
-      hasDeviceCredential: () => hasPersistedDeviceCredential(authStore),
+      remint: () => oxyServices.http.refreshAccessToken('preflight'),
+      hasDeviceCredential: () => hasPersistedSessionCredential(authStore),
       hasKeyedRecovery: async () => {
         if (Platform.OS === 'web') {
           return false;
@@ -578,7 +549,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         }
       },
       isSignedIn: () => runtime.getSnapshot().account !== null,
-      hasToken: () => Boolean(oxyServices.getAccessToken()),
+      hasToken: () => Boolean(oxyServices.session.accessToken),
       signOutLocally,
     });
     const handleTokenChange = (accessToken: string | null) => {
@@ -599,8 +570,8 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         runtime.setTokenReady(true);
       }
     };
-    handleTokenChange(oxyServices.getAccessToken());
-    const unsubscribe = oxyServices.onTokensChanged(handleTokenChange);
+    handleTokenChange(oxyServices.session.accessToken);
+    const unsubscribe = oxyServices.session.onChange(handleTokenChange);
     return () => {
       unsubscribe();
       recovery.dispose();
@@ -637,7 +608,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   const commitSession = useCallback(
     async (input: CommitInput, options: { activate: boolean }): Promise<void> => {
       if (input.accessToken) {
-        oxyServices.setTokens(input.accessToken);
+        oxyServices.session.setAccessToken(input.accessToken);
       }
       if (input.deviceState) {
         sessionClient.adoptState(input.deviceState);
@@ -707,7 +678,7 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         addCurrentAccount: () => sessionClient.addCurrentAccount(),
         startSocket: () => sessionClient.start(),
         syncFromClient,
-        getCurrentUser: () => oxyServices.getCurrentUser(),
+        getCurrentUser: () => oxyServices.users.me(),
         loginSuccess: (fullUser) => runtime.setAccount(fullUser),
         onAuthStateChange: onAuthStateChangeRef.current,
         markAuthResolved: markAuthResolvedRef.current,
@@ -785,20 +756,6 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     [webAuthMode, oxyServices, clientId, authorizeBaseUrl, isIdentityBound, user?.id],
   );
 
-  // What only auth.oxy.so can do for an Oxy app on the web — assert the
-  // `oxy.so` passkey, create or recover a passkey account — runs in its window
-  // over the app, for that one step. A blocked window falls back to the same
-  // page in this tab.
-  const continueOnAuth = useCallback(
-    (screen: OxyAuthScreen): Promise<WebOAuthSignInResult> =>
-      startWebOAuthSignInForContext({
-        redirectUri: authRedirectUri ?? globalThis.location?.origin ?? '',
-        transport: 'popup',
-        screen,
-      }),
-    [startWebOAuthSignInForContext, authRedirectUri],
-  );
-
   // ── Unified account dialog ─────────────────────────────────────────────────
   // The single account-chooser + sign-in surface. Built ONCE per provider mount
   // and bound to the live `oxyServices` + `sessionClient` + this provider's
@@ -877,6 +834,85 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
   }
   const accountDialogController = accountDialogControllerRef.current;
 
+  // Every sign-in on the web PROVES the device this origin holds (ADR 0029 D2):
+  // the QR claim and the email and password sign-ins send it, so the account lands on the
+  // browser's shared device and every Oxy app holding it sees it at once.
+  // Native is untouched: its apps already share a device through the keychain.
+  useEffect(() => {
+    if (!isWebBrowser()) return undefined;
+    return oxyServices.session.setDeviceCredentialProvider(() => loadPersistedDeviceCredential(authStore));
+  }, [oxyServices, authStore]);
+
+  // ── The browser bridge (ADR 0029 D2) ──────────────────────────────────────
+  // The first time a person presses sign-in in this app on the web and it holds
+  // no device credential, open auth.oxy.so/bridge FROM THE PRESS: it hands this
+  // app a one-use code to join the browser's device and closes at once. Then
+  // restore through the ordinary mint — signed in already if the browser is,
+  // otherwise the dialog's sign-in carries the device proof. Never on page load,
+  // never on auth.oxy.so itself, never identity-bound; a blocked window only
+  // means this app signs in on a device of its own.
+  const bridgeInFlightRef = useRef(false);
+  const closeAccountDialogRef = useRef<() => void>(() => undefined);
+  const startBrowserBridge = useCallback((): void => {
+    if (isIdentityBound || !clientId || !isWebBrowser() || bridgeInFlightRef.current) return;
+    if (authStoreRef.current?.heldDeviceCredential() !== null) return;
+    const bridgeOrigin = resolveBridgeOrigin(authorizeBaseUrl);
+    const pageOrigin = globalThis.location?.origin;
+    if (!bridgeOrigin || !pageOrigin || pageOrigin === bridgeOrigin) return;
+    const popup = openBridgeWindow();
+    if (!popup) return;
+    bridgeInFlightRef.current = true;
+    void (async () => {
+      const joined = await runBrowserBridge({
+        popup,
+        bridgeOrigin,
+        oxyServices,
+        clientId,
+        redirectUri: authRedirectUri ?? pageOrigin,
+      });
+      if (!joined.ok) return;
+      // A sign-in that finished while the bridge ran keeps its own credential.
+      if ((await loadPersistedDeviceCredential(authStore)) !== null) return;
+      const credential = { deviceId: joined.deviceId, deviceSecret: joined.deviceSecret };
+      await authStore.save({ sessionId: '', userId: '', ...credential });
+      sessionClientHost.setDeviceCredential(credential);
+      const minted = await refreshDeviceSecretArm({ oxy: oxyServices, store: authStore });
+      if (minted.status === 'invalid-secret') {
+        await authStore.clear();
+        sessionClientHost.setDeviceCredential(null);
+        return;
+      }
+      if (minted.status !== 'ok') return;
+      // The browser is already signed in: this app follows, and the dialog it
+      // opened for a sign-in has nothing left to do.
+      await commitSessionRef.current(
+        {
+          sessionId: minted.sessionId,
+          accessToken: minted.token,
+          userId: minted.userId,
+          deviceState: minted.state,
+        },
+        { activate: false },
+      );
+      closeAccountDialogRef.current();
+    })()
+      .catch((bridgeError) => {
+        logger('The browser bridge failed', bridgeError);
+      })
+      .finally(() => {
+        bridgeInFlightRef.current = false;
+      });
+  }, [
+    isIdentityBound,
+    clientId,
+    authorizeBaseUrl,
+    authRedirectUri,
+    oxyServices,
+    authStore,
+    sessionClientHost,
+    logger,
+  ]);
+
   const openAccountDialog = useCallback((view?: AccountDialogView): void => {
     if (isIdentityBound) {
       // No controller was built, and there is nothing to choose: this app's user
@@ -890,6 +926,8 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       return;
     }
     const nextView = view ?? 'accounts';
+    // Synchronously, while the press is still being handled.
+    startBrowserBridge();
     accountDialogControllerRef.current?.setView(nextView);
 
     // Its own detached surface is already open → just re-point the view above.
@@ -932,12 +970,15 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       }
     });
     setAccountDialogOpen(true);
-  }, [isIdentityBound]);
+  }, [isIdentityBound, startBrowserBridge]);
 
   const closeAccountDialog = useCallback((): void => {
     accountDialogControllerRef.current?.cancelSignIn();
     dismissAccountDialogSurface();
   }, [dismissAccountDialogSurface]);
+  useEffect(() => {
+    closeAccountDialogRef.current = closeAccountDialog;
+  }, [closeAccountDialog]);
 
   // Start driving the dialog on mount; tear it down on unmount.
   useEffect(() => {
@@ -959,66 +1000,12 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     notifyAccountDialogVisibility(accountDialogOpen);
   }, [accountDialogOpen]);
 
-  // ── Passkey (WebAuthn) ─────────────────────────────────────────────────────
-  // Web-only sign-in / registration via the browser WebAuthn ceremony. The fixed
-  // `options → ceremony → verify → commit` ordering lives in the pure
-  // `passkeyFlow` helpers (deps-injected, unit-tested); these wrappers supply the
-  // real deps (core `webauthn*` methods, the platform ceremony client, and the
-  // `commitSession` funnel). All three GATE on `isPasskeySupported()` so a native
-  // / unsupported surface throws loudly instead of stalling in a ceremony.
-
-  // Passkey sign-in. No `username` → usernameless (discoverable) flow. With a
-  // `username` → username-first: the server scopes `allowCredentials` to that
-  // user's passkeys so a non-discoverable hardware key (U2F/security key) can
-  // be selected.
-  const signInWithPasskey = useCallback(
-    async (opts?: { username?: string; deviceName?: string; deviceFingerprint?: string }): Promise<void> => {
-      const persisted = await authStore.load();
-      await runPasskeyLogin({
-        isSupported: isPasskeySupported,
-        getLoginOptions: (username) => oxyServices.webauthnLoginOptions(username),
-        runCeremony: runAuthenticationCeremony,
-        loginVerify: (response, envelope) => oxyServices.webauthnLoginVerify(response, envelope),
-        commit: (input) => commitSession(input, { activate: true }),
-        username: opts?.username,
-        deviceId: persisted?.deviceId,
-        deviceName: opts?.deviceName,
-        // The same shape every other sign-in path sends; the server only reads it
-        // to place a device that has no persisted id yet.
-        deviceFingerprint: opts?.deviceFingerprint ?? JSON.stringify(DeviceManager.getDeviceFingerprint()),
-      });
-    },
-    [oxyServices, authStore, commitSession],
-  );
-
-  // Add a passkey to the already-signed-in account (bearer present). No new
-  // session is committed — just refresh the linked auth-methods list.
-  const addPasskey = useCallback(
-    async (params?: { deviceName?: string }): Promise<void> => {
-      await runPasskeyAdd({
-        isSupported: isPasskeySupported,
-        getRegisterOptions: () => oxyServices.webauthnRegisterOptions(),
-        runCeremony: runRegistrationCeremony,
-        registerVerify: (response, envelope) => oxyServices.webauthnRegisterVerify(response, envelope),
-        onLinked: () => {
-          void queryClient.invalidateQueries({ queryKey: queryKeys.authMethods.all });
-        },
-        deviceName: params?.deviceName,
-      });
-    },
-    [oxyServices, queryClient],
-  );
-
-  // Remove a passkey from the already-signed-in account by credential id. Not a
-  // ceremony — a plain unlink — so it needs no `isPasskeySupported` gate; it just
-  // refreshes the linked auth-methods list on success.
-  const removePasskey = useCallback(
-    async (credentialId: string): Promise<void> => {
-      await oxyServices.removePasskey(credentialId);
-      void queryClient.invalidateQueries({ queryKey: queryKeys.authMethods.all });
-    },
-    [oxyServices, queryClient],
-  );
+  // A closed dialog forgets the sign-in or sign-up step it was on: the next
+  // open starts over. (While it is open the step survives the surface's
+  // breakpoint remount — `signInFlowStore`.)
+  useEffect(() => {
+    if (!accountDialogOpen) clearSignInFlows(accountDialogControllerRef.current);
+  }, [accountDialogOpen]);
 
   // ── Cold boot ────────────────────────────────────────────────────────────
   // Device-first session restore via `runProviderColdBoot` (see boot/runProviderColdBoot.ts).
@@ -1083,13 +1070,13 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
     const onVisibility = (): void => {
       if (document.visibilityState !== 'visible') return;
       const reconcile = async (): Promise<void> => {
-        if (!oxyServices.getAccessToken() && sessionClientHost.getDeviceCredential()) {
+        if (!oxyServices.session.accessToken && sessionClientHost.getDeviceCredential()) {
           // Route through the ONE shared single-flight the scheduler/preflight/401
           // use — never a private mint lane — so a tab-focus reconcile can't
           // double-rotate the device secret against them.
-          await oxyServices.httpService.refreshAccessToken('preflight');
+          await oxyServices.http.refreshAccessToken('preflight');
         }
-        if (!oxyServices.getAccessToken() && !sessionClientHost.getDeviceCredential()) {
+        if (!oxyServices.session.accessToken && !sessionClientHost.getDeviceCredential()) {
           return;
         }
         await sessionClient.bootstrap();
@@ -1123,11 +1110,11 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
         return;
       }
       void (async () => {
-        if (oxyServices.getAccessToken() || !sessionClientHost.getDeviceCredential()) {
+        if (oxyServices.session.accessToken || !sessionClientHost.getDeviceCredential()) {
           return;
         }
-        await oxyServices.httpService.refreshAccessToken('preflight');
-        if (!oxyServices.getAccessToken()) {
+        await oxyServices.http.refreshAccessToken('preflight');
+        if (!oxyServices.session.accessToken) {
           return;
         }
         await sessionClient.bootstrap();
@@ -1280,13 +1267,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       hasIdentity,
       getPublicKey,
       signIn,
-      signInWithPasskey,
-      addPasskey,
-      removePasskey,
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignIn: startWebOAuthSignInForContext,
-      continueOnAuth,
       requestOAuthConsent: requestOAuthConsentForContext,
       logout,
       logoutAll,
@@ -1338,13 +1321,9 @@ export const OxyRuntimeProvider: React.FC<OxyRuntimeProviderProps> = ({
       hasIdentity,
       getPublicKey,
       signIn,
-      signInWithPasskey,
-      addPasskey,
-      removePasskey,
       revokeSuspiciousSignIn,
       handleWebSession,
       startWebOAuthSignInForContext,
-      continueOnAuth,
       requestOAuthConsentForContext,
       logout,
       logoutAll,

package/src/ui/context/hooks/useAuthOperations.ts

@@ -1,14 +1,15 @@
 import { useCallback } from 'react';
-import type { ApiError, AuthStateStore, IdentityBinding, SessionClient, User } from '@oxy.so/core';
+import type { ApiError, User } from '@oxy.so/core';
+import type { AuthStateStore, IdentityBinding, SessionClient } from '@oxy.so/core/session';
 import type { ClientSession, SessionLoginResponse } from '@oxy.so/core';
 import type { OxyRuntime } from '../../runtime';
 import type { LogoutResult } from '../oxyContextTypes';
-import { DeviceManager } from '@oxy.so/core';
+import { DeviceManager } from '@oxy.so/core/session';
 import { fetchSessionsWithFallback } from '../../utils/sessionHelpers';
 import { handleAuthError, isInvalidSessionError } from '../../utils/errorHandlers';
 import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxy.so/core';
-import { SignatureService } from '@oxy.so/core';
+import { SignatureService } from '@oxy.so/core/crypto';
 
 export interface UseAuthOperationsOptions {
   oxyServices: OxyServices;
@@ -113,7 +114,7 @@ export const useAuthOperations = ({
       const deviceInfo = await DeviceManager.getDeviceInfo();
       const deviceName = deviceInfo.deviceName || DeviceManager.getDefaultDeviceName();
 
-      const challengeResponse = await oxyServices.requestChallenge(publicKey);
+      const challengeResponse = await oxyServices.auth.requestChallenge(publicKey);
       const challenge = challengeResponse.challenge;
 
       // Note: Biometric authentication check should be handled by the app layer
@@ -129,7 +130,7 @@ export const useAuthOperations = ({
       // `verifyChallenge` plants the first access token internally, mirroring
       // `claimSessionByToken`, so the client is authenticated as soon as this
       // resolves.
-      sessionResponse = await oxyServices.verifyChallenge(
+      sessionResponse = await oxyServices.auth.verifyChallenge(
         publicKey,
         challenge,
         signature,
@@ -191,7 +192,7 @@ export const useAuthOperations = ({
       // has already planted the access token for this session, so the bearer IS
       // the session identity. Avoids a second, session-id-keyed source of truth
       // (`GET /session/user/:sessionId`) that can disagree with the bearer.
-      fullUser = await oxyServices.getCurrentUser();
+      fullUser = await oxyServices.users.me();
 
       // Fetch device sessions
       let allDeviceSessions: ClientSession[] = [];
@@ -217,7 +218,7 @@ export const useAuthOperations = ({
       if (existingSession) {
         // Switch to existing session instead of creating duplicate
         try {
-          await oxyServices.logoutSession(sessionResponse.sessionId, sessionResponse.sessionId);
+          await oxyServices.session.logout(sessionResponse.sessionId, sessionResponse.sessionId);
         } catch (logoutError) {
           // Non-critical - continue to switch session even if logout fails
           if (__DEV__ && logger) {
@@ -384,7 +385,7 @@ export const useAuthOperations = ({
       // device-scoped and therefore cannot implement "sign out everywhere" by
       // itself. The global endpoint deliberately preserves the current
       // session long enough for the device-scoped cleanup below to authenticate.
-      await oxyServices.logoutAllSessions(activeSessionId);
+      await oxyServices.session.logoutAll(activeSessionId);
       await sessionClient.signOut({ all: true });
       // logoutAll is ALWAYS a full sign-out: clear the persisted device
       // credential so the next cold boot finds no session to restore, then tear

package/src/ui/context/oxyContextTypes.ts

@@ -1,6 +1,7 @@
 import type { ReactNode } from 'react';
 import type { LoginSessionResult } from '@oxy.so/contracts';
-import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView, ApiError, SessionClient, SessionMode, OxyAuthScreen } from '@oxy.so/core';
+import type { OxyServices, User, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, ApiError } from '@oxy.so/core';
+import type { AccountDialogController, AccountDialogView, SessionClient, SessionMode } from '@oxy.so/core/session';
 import type { UseFollowHook } from '../hooks/useFollow.types';
 import type { useLanguageManagement } from '../hooks/useLanguageManagement';
 import type { RouteName } from '../navigation/routes';
@@ -74,41 +75,11 @@ export interface OxyContextState {
 
   signIn: (publicKey: string, deviceName?: string) => Promise<User>;
 
-  /**
-   * Sign in with a passkey (WebAuthn). With no `username` this is the
-   * usernameless / discoverable-credential flow: the browser prompts for any
-   * resident Oxy passkey. Pass `username` for the username-first flow — the
-   * server scopes `allowCredentials` to that user's passkeys so a
-   * NON-discoverable hardware key (e.g. a U2F/security key) can be used.
-   * WEB-ONLY — throws on native or an unsupported browser (native passkeys are
-   * Commons' job). On `useOxy()`, NOT re-exposed on `useAuth()`.
-   */
-  signInWithPasskey: (opts?: {
-    username?: string;
-    deviceName?: string;
-    deviceFingerprint?: string;
-  }) => Promise<void>;
-
-  /**
-   * Add a passkey to the already-signed-in account (bearer present). Does NOT
-   * commit a new session; refreshes the linked auth-methods list on success.
-   * WEB-ONLY — throws on native or an unsupported browser.
-   */
-  addPasskey: (params?: { deviceName?: string }) => Promise<void>;
-
-  /**
-   * Remove a passkey from the current account by its credential id
-   * (`AuthMethodEntry.credentialId`). Refreshes the linked auth-methods list on
-   * success. Works on any platform (it is a plain unlink, not a WebAuthn
-   * ceremony) but is only reachable from surfaces that list passkeys.
-   */
-  removePasskey: (credentialId: string) => Promise<void>;
-
   revokeSuspiciousSignIn: () => Promise<void>;
   /**
    * Commit a session a first-party sign-in minted on THIS origin — an OAuth
-   * code exchange, or a passkey registration on auth.oxy.so (sign-up,
-   * recovery) — as the active one.
+   * code exchange, an email code or link, a password, a sign-up — as the
+   * active one.
    */
   handleWebSession: (session: SessionLoginResponse | LoginSessionResult) => Promise<void>;
 
@@ -130,14 +101,6 @@ export interface OxyContextState {
    */
   startWebOAuthSignIn: (options: StartWebOAuthSignInOptions) => Promise<WebOAuthSignInResult>;
 
-  /**
-   * The passkey sign-in (`signin`), account creation (`signup`) or recovery
-   * (`recover`) in auth.oxy.so's window over the app — the one step the
-   * account dialog cannot run itself, since the passkey belongs to `oxy.so`.
-   * Web only; call it from the press, so the window opens with the gesture.
-   */
-  continueOnAuth: (screen: OxyAuthScreen) => Promise<WebOAuthSignInResult>;
-
   /**
    * Ask the already-authenticated user for explicit OAuth consent to exact
    * application scopes. Must be called from a user gesture. Works on web and

package/src/ui/context/useOxyAccountGraph.ts

@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useState, type RefObject } from 'react';
-import type { OxyServices, AccountNode, CreateAccountInput, AccountDialogController, SessionClient } from '@oxy.so/core';
+import type { OxyServices, AccountNode, CreateAccountInput } from '@oxy.so/core';
+import type { AccountDialogController, SessionClient } from '@oxy.so/core/session';
 import { logger as loggerUtil } from '@oxy.so/core';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 import { IdentityBoundSessionError } from '../session';
@@ -38,12 +39,12 @@ export function useOxyAccountGraph({
   const [accounts, setAccounts] = useState<AccountNode[]>([]);
 
   const refreshAccounts = useCallback(async (): Promise<void> => {
-    if (identityBound || !isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
+    if (identityBound || !isAuthenticated || !tokenReady || !oxyServices.session.accessToken) {
       setAccounts([]);
       return;
     }
     try {
-      const list = await oxyServices.listAccounts();
+      const list = await oxyServices.accounts.list();
       setAccounts(list);
     } catch (err) {
       if (isUnauthorizedStatus(err)) {
@@ -79,7 +80,7 @@ export function useOxyAccountGraph({
         return;
       }
 
-      const result = await oxyServices.switchToAccount(accountId);
+      const result = await oxyServices.accounts.actAs(accountId);
       if (!result?.user || !result?.sessionId) {
         throw new Error('Account switch did not return a valid session');
       }
@@ -107,7 +108,7 @@ export function useOxyAccountGraph({
 
   const createAccount = useCallback(
     async (data: CreateAccountInput): Promise<AccountNode> => {
-      const account = await oxyServices.createAccount(data);
+      const account = await oxyServices.accounts.create(data);
       await refreshAccounts();
       return account;
     },

package/src/ui/hooks/accountDialogSnapshot.ts

@@ -1,5 +1,5 @@
 import { useCallback, useSyncExternalStore } from 'react';
-import type { AccountDialogController, AccountDialogSnapshot } from '@oxy.so/core';
+import type { AccountDialogController, AccountDialogSnapshot } from '@oxy.so/core/session';
 
 /**
  * The snapshot `useSyncExternalStore` reads before a controller exists.

package/src/ui/hooks/mutations/mutationFactory.ts

@@ -51,7 +51,7 @@ export interface ProfileMutationConfig<TData, TVariables> {
  * ```ts
  * const updateProfile = createProfileMutation({
  *   mutationKey: mutationKeys.account.updateProfile,
- *   mutationFn: (updates) => oxyServices.updateProfile(updates),
+ *   mutationFn: (updates) => oxyServices.users.updateMe(updates),
  *   optimisticUpdate: (user, updates) => updates,
  *   errorMessage: 'Failed to update profile',
  * });