@oxyhq/core 1.5.0 → 1.6.1

package/dist/cjs/mixins/OxyServices.privacy.js

@@ -44,7 +44,7 @@ function OxyServicesPrivacyMixin(Base) {
          */
         async getBlockedUsers() {
             try {
-                return await this.makeRequest('GET', '/api/privacy/blocked', undefined, {
+                return await this.makeRequest('GET', '/privacy/blocked', undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache
                 });
@@ -63,7 +63,7 @@ function OxyServicesPrivacyMixin(Base) {
                 if (!userId) {
                     throw new Error('User ID is required');
                 }
-                return await this.makeRequest('POST', `/api/privacy/blocked/${userId}`, undefined, {
+                return await this.makeRequest('POST', `/privacy/blocked/${userId}`, undefined, {
                     cache: false,
                 });
             }
@@ -81,7 +81,7 @@ function OxyServicesPrivacyMixin(Base) {
                 if (!userId) {
                     throw new Error('User ID is required');
                 }
-                return await this.makeRequest('DELETE', `/api/privacy/blocked/${userId}`, undefined, {
+                return await this.makeRequest('DELETE', `/privacy/blocked/${userId}`, undefined, {
                     cache: false,
                 });
             }
@@ -106,7 +106,7 @@ function OxyServicesPrivacyMixin(Base) {
          */
         async getRestrictedUsers() {
             try {
-                return await this.makeRequest('GET', '/api/privacy/restricted', undefined, {
+                return await this.makeRequest('GET', '/privacy/restricted', undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache
                 });
@@ -125,7 +125,7 @@ function OxyServicesPrivacyMixin(Base) {
                 if (!userId) {
                     throw new Error('User ID is required');
                 }
-                return await this.makeRequest('POST', `/api/privacy/restricted/${userId}`, undefined, {
+                return await this.makeRequest('POST', `/privacy/restricted/${userId}`, undefined, {
                     cache: false,
                 });
             }
@@ -143,7 +143,7 @@ function OxyServicesPrivacyMixin(Base) {
                 if (!userId) {
                     throw new Error('User ID is required');
                 }
-                return await this.makeRequest('DELETE', `/api/privacy/restricted/${userId}`, undefined, {
+                return await this.makeRequest('DELETE', `/privacy/restricted/${userId}`, undefined, {
                     cache: false,
                 });
             }

package/dist/cjs/mixins/OxyServices.security.js

@@ -23,7 +23,7 @@ function OxyServicesSecurityMixin(Base) {
                     params.offset = offset;
                 if (eventType)
                     params.eventType = eventType;
-                const response = await this.makeRequest('GET', '/api/security/activity', params, { cache: false });
+                const response = await this.makeRequest('GET', '/security/activity', params, { cache: false });
                 return response;
             }
             catch (error) {
@@ -51,7 +51,7 @@ function OxyServicesSecurityMixin(Base) {
          */
         async logPrivateKeyExported(deviceId) {
             try {
-                await this.makeRequest('POST', '/api/security/activity/private-key-exported', { deviceId }, { cache: false });
+                await this.makeRequest('POST', '/security/activity/private-key-exported', { deviceId }, { cache: false });
             }
             catch (error) {
                 // Don't throw - logging failures shouldn't break user flow
@@ -68,7 +68,7 @@ function OxyServicesSecurityMixin(Base) {
          */
         async logBackupCreated(deviceId) {
             try {
-                await this.makeRequest('POST', '/api/security/activity/backup-created', { deviceId }, { cache: false });
+                await this.makeRequest('POST', '/security/activity/backup-created', { deviceId }, { cache: false });
             }
             catch (error) {
                 // Don't throw - logging failures shouldn't break user flow

package/dist/cjs/mixins/OxyServices.user.js

@@ -12,7 +12,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getProfileByUsername(username) {
             try {
-                return await this.makeRequest('GET', `/api/profiles/username/${username}`, undefined, {
+                return await this.makeRequest('GET', `/profiles/username/${username}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache for profiles
                 });
@@ -29,7 +29,7 @@ function OxyServicesUserMixin(Base) {
                 const params = { query, ...pagination };
                 const searchParams = (0, apiUtils_1.buildSearchParams)(params);
                 const paramsObj = Object.fromEntries(searchParams.entries());
-                const response = await this.makeRequest('GET', '/api/profiles/search', paramsObj, {
+                const response = await this.makeRequest('GET', '/profiles/search', paramsObj, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -74,7 +74,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getProfileRecommendations() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/api/profiles/recommendations', undefined, { cache: true });
+                return await this.makeRequest('GET', '/profiles/recommendations', undefined, { cache: true });
             }, 'getProfileRecommendations');
         }
         /**
@@ -82,7 +82,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getUserById(userId) {
             try {
-                return await this.makeRequest('GET', `/api/users/${userId}`, undefined, {
+                return await this.makeRequest('GET', `/users/${userId}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000, // 5 minutes cache
                 });
@@ -96,7 +96,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getCurrentUser() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/api/users/me', undefined, {
+                return await this.makeRequest('GET', '/users/me', undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache for current user
                 });
@@ -108,7 +108,7 @@ function OxyServicesUserMixin(Base) {
          */
         async updateProfile(updates) {
             try {
-                return await this.makeRequest('PUT', '/api/users/me', updates, { cache: false });
+                return await this.makeRequest('PUT', '/users/me', updates, { cache: false });
             }
             catch (error) {
                 const errorAny = error;
@@ -134,7 +134,7 @@ function OxyServicesUserMixin(Base) {
         async getPrivacySettings(userId) {
             try {
                 const id = userId || (await this.getCurrentUser()).id;
-                return await this.makeRequest('GET', `/api/privacy/${id}/privacy`, undefined, {
+                return await this.makeRequest('GET', `/privacy/${id}/privacy`, undefined, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -151,7 +151,7 @@ function OxyServicesUserMixin(Base) {
         async updatePrivacySettings(settings, userId) {
             try {
                 const id = userId || (await this.getCurrentUser()).id;
-                return await this.makeRequest('PATCH', `/api/privacy/${id}/privacy`, settings, {
+                return await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
             }
@@ -164,7 +164,7 @@ function OxyServicesUserMixin(Base) {
          */
         async requestAccountVerification(reason, evidence) {
             try {
-                return await this.makeRequest('POST', '/api/users/verify/request', {
+                return await this.makeRequest('POST', '/users/verify/request', {
                     reason,
                     evidence,
                 }, { cache: false });
@@ -181,7 +181,7 @@ function OxyServicesUserMixin(Base) {
                 // Use httpService for blob responses (it handles blob responses automatically)
                 const result = await this.getClient().request({
                     method: 'GET',
-                    url: `/api/users/me/data`,
+                    url: `/users/me/data`,
                     params: { format },
                     cache: false,
                 });
@@ -198,7 +198,7 @@ function OxyServicesUserMixin(Base) {
          */
         async deleteAccount(password, confirmText) {
             try {
-                return await this.makeRequest('DELETE', '/api/users/me', {
+                return await this.makeRequest('DELETE', '/users/me', {
                     password,
                     confirmText,
                 }, { cache: false });
@@ -212,7 +212,7 @@ function OxyServicesUserMixin(Base) {
          */
         async followUser(userId) {
             try {
-                return await this.makeRequest('POST', `/api/users/${userId}/follow`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/users/${userId}/follow`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -223,7 +223,7 @@ function OxyServicesUserMixin(Base) {
          */
         async unfollowUser(userId) {
             try {
-                return await this.makeRequest('DELETE', `/api/users/${userId}/follow`, undefined, { cache: false });
+                return await this.makeRequest('DELETE', `/users/${userId}/follow`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -234,7 +234,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getFollowStatus(userId) {
             try {
-                return await this.makeRequest('GET', `/api/users/${userId}/follow-status`, undefined, {
+                return await this.makeRequest('GET', `/users/${userId}/follow-status`, undefined, {
                     cache: true,
                     cacheTTL: 1 * 60 * 1000, // 1 minute cache
                 });
@@ -249,7 +249,7 @@ function OxyServicesUserMixin(Base) {
         async getUserFollowers(userId, pagination) {
             try {
                 const params = (0, apiUtils_1.buildPaginationParams)(pagination || {});
-                const response = await this.makeRequest('GET', `/api/users/${userId}/followers`, params, {
+                const response = await this.makeRequest('GET', `/users/${userId}/followers`, params, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -269,7 +269,7 @@ function OxyServicesUserMixin(Base) {
         async getUserFollowing(userId, pagination) {
             try {
                 const params = (0, apiUtils_1.buildPaginationParams)(pagination || {});
-                const response = await this.makeRequest('GET', `/api/users/${userId}/following`, params, {
+                const response = await this.makeRequest('GET', `/users/${userId}/following`, params, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000, // 2 minutes cache
                 });
@@ -288,7 +288,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getNotifications() {
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/api/notifications', undefined, {
+                return await this.makeRequest('GET', '/notifications', undefined, {
                     cache: false, // Don't cache notifications - always get fresh data
                 });
             }, 'getNotifications');
@@ -298,7 +298,7 @@ function OxyServicesUserMixin(Base) {
          */
         async getUnreadCount() {
             try {
-                const res = await this.makeRequest('GET', '/api/notifications/unread-count', undefined, {
+                const res = await this.makeRequest('GET', '/notifications/unread-count', undefined, {
                     cache: false, // Don't cache unread count - always get fresh data
                 });
                 return res.count;
@@ -312,7 +312,7 @@ function OxyServicesUserMixin(Base) {
          */
         async createNotification(data) {
             try {
-                return await this.makeRequest('POST', '/api/notifications', data, { cache: false });
+                return await this.makeRequest('POST', '/notifications', data, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -323,7 +323,7 @@ function OxyServicesUserMixin(Base) {
          */
         async markNotificationAsRead(notificationId) {
             try {
-                await this.makeRequest('PUT', `/api/notifications/${notificationId}/read`, undefined, { cache: false });
+                await this.makeRequest('PUT', `/notifications/${notificationId}/read`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -334,7 +334,7 @@ function OxyServicesUserMixin(Base) {
          */
         async markAllNotificationsAsRead() {
             try {
-                await this.makeRequest('PUT', '/api/notifications/read-all', undefined, { cache: false });
+                await this.makeRequest('PUT', '/notifications/read-all', undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -345,7 +345,7 @@ function OxyServicesUserMixin(Base) {
          */
         async deleteNotification(notificationId) {
             try {
-                await this.makeRequest('DELETE', `/api/notifications/${notificationId}`, undefined, { cache: false });
+                await this.makeRequest('DELETE', `/notifications/${notificationId}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/mixins/OxyServices.utility.js

@@ -52,7 +52,7 @@ function OxyServicesUtilityMixin(Base) {
          */
         async fetchLinkMetadata(url) {
             try {
-                return await this.makeRequest('GET', '/api/link-metadata', { url }, {
+                return await this.makeRequest('GET', '/link-metadata', { url }, {
                     cache: true,
                     cacheTTL: mixinHelpers_1.CACHE_TIMES.EXTRA_LONG,
                 });
@@ -67,25 +67,36 @@ function OxyServicesUtilityMixin(Base) {
          * Validates JWT tokens against the Oxy API and attaches user data to requests.
          * Uses server-side session validation for security (not just JWT decode).
          *
+         * **Design note — jwtDecode vs jwt.verify:**
+         * This middleware intentionally uses `jwtDecode()` (decode-only, no signature
+         * verification) for user tokens. This is by design, NOT a security gap:
+         * - Third-party apps using `oxy.auth()` don't have the Oxy JWT secret
+         * - Security comes from API-based session validation (`validateSession()`)
+         *   which checks the session server-side on every request
+         * - Service tokens (type: 'service') DO use cryptographic HMAC verification
+         *   via the `jwtSecret` option, since they are stateless
+         * - The backend's own `authMiddleware` uses `jwt.verify()` because it has
+         *   direct access to `ACCESS_TOKEN_SECRET`
+         *
          * @example
          * ```typescript
          * import { OxyServices } from '@oxyhq/core';
          *
          * const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
          *
-         * // Protect all routes under /api/protected
-         * app.use('/api/protected', oxy.auth());
+         * // Protect all routes under /protected
+         * app.use('/protected', oxy.auth());
          *
          * // Access user in route handler
-         * app.get('/api/protected/me', (req, res) => {
+         * app.get('/protected/me', (req, res) => {
          *   res.json({ userId: req.userId, user: req.user });
          * });
          *
          * // Load full user profile from API
-         * app.use('/api/admin', oxy.auth({ loadUser: true }));
+         * app.use('/admin', oxy.auth({ loadUser: true }));
          *
          * // Optional auth - attach user if present, don't block if absent
-         * app.use('/api/public', oxy.auth({ optional: true }));
+         * app.use('/public', oxy.auth({ optional: true }));
          * ```
          *
          * @param options Optional configuration
@@ -119,6 +130,7 @@ function OxyServicesUtilityMixin(Base) {
                             return next();
                         }
                         const error = {
+                            error: 'MISSING_TOKEN',
                             message: 'Access token required',
                             code: 'MISSING_TOKEN',
                             status: 401
@@ -139,6 +151,7 @@ function OxyServicesUtilityMixin(Base) {
                             return next();
                         }
                         const error = {
+                            error: 'INVALID_TOKEN_FORMAT',
                             message: 'Invalid token format',
                             code: 'INVALID_TOKEN_FORMAT',
                             status: 401
@@ -158,6 +171,7 @@ function OxyServicesUtilityMixin(Base) {
                                 return next();
                             }
                             const error = {
+                                error: 'SERVICE_TOKEN_NOT_CONFIGURED',
                                 message: 'Service token verification not configured',
                                 code: 'SERVICE_TOKEN_NOT_CONFIGURED',
                                 status: 403
@@ -187,13 +201,22 @@ function OxyServicesUtilityMixin(Base) {
                                 throw new Error('Invalid signature');
                             }
                         }
-                        catch {
+                        catch (verifyError) {
+                            const isSignatureError = verifyError instanceof Error &&
+                                (verifyError.message === 'Invalid signature' || verifyError.message === 'Invalid token structure');
+                            if (!isSignatureError) {
+                                console.error('[oxy.auth] Unexpected error during service token verification:', verifyError);
+                                const error = { error: 'AUTH_INTERNAL_ERROR', message: 'Internal authentication error', code: 'AUTH_INTERNAL_ERROR', status: 500 };
+                                if (onError)
+                                    return onError(error);
+                                return res.status(500).json(error);
+                            }
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;
                                 return next();
                             }
-                            const error = { message: 'Invalid service token signature', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                            const error = { error: 'INVALID_SERVICE_TOKEN', message: 'Invalid service token signature', code: 'INVALID_SERVICE_TOKEN', status: 401 };
                             if (onError)
                                 return onError(error);
                             return res.status(401).json(error);
@@ -205,7 +228,7 @@ function OxyServicesUtilityMixin(Base) {
                                 req.user = null;
                                 return next();
                             }
-                            const error = { message: 'Service token expired', code: 'TOKEN_EXPIRED', status: 401 };
+                            const error = { error: 'TOKEN_EXPIRED', message: 'Service token expired', code: 'TOKEN_EXPIRED', status: 401 };
                             if (onError)
                                 return onError(error);
                             return res.status(401).json(error);
@@ -217,7 +240,7 @@ function OxyServicesUtilityMixin(Base) {
                                 req.user = null;
                                 return next();
                             }
-                            const error = { message: 'Invalid service token: missing appId', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                            const error = { error: 'INVALID_SERVICE_TOKEN', message: 'Invalid service token: missing appId', code: 'INVALID_SERVICE_TOKEN', status: 401 };
                             if (onError)
                                 return onError(error);
                             return res.status(401).json(error);
@@ -244,6 +267,7 @@ function OxyServicesUtilityMixin(Base) {
                             return next();
                         }
                         const error = {
+                            error: 'INVALID_TOKEN_PAYLOAD',
                             message: 'Token missing user ID',
                             code: 'INVALID_TOKEN_PAYLOAD',
                             status: 401
@@ -260,6 +284,7 @@ function OxyServicesUtilityMixin(Base) {
                             return next();
                         }
                         const error = {
+                            error: 'TOKEN_EXPIRED',
                             message: 'Token expired',
                             code: 'TOKEN_EXPIRED',
                             status: 401
@@ -282,6 +307,7 @@ function OxyServicesUtilityMixin(Base) {
                                     return next();
                                 }
                                 const error = {
+                                    error: 'INVALID_SESSION',
                                     message: 'Session invalid or expired',
                                     code: 'INVALID_SESSION',
                                     status: 401
@@ -316,6 +342,7 @@ function OxyServicesUtilityMixin(Base) {
                                 return next();
                             }
                             const error = {
+                                error: 'SESSION_VALIDATION_ERROR',
                                 message: 'Session validation failed',
                                 code: 'SESSION_VALIDATION_ERROR',
                                 status: 401
@@ -373,6 +400,8 @@ function OxyServicesUtilityMixin(Base) {
          * Returns a middleware function for Socket.IO that validates JWT tokens
          * from the handshake auth object and attaches user data to the socket.
          *
+         * Uses `jwtDecode()` + API session validation (same rationale as `auth()`).
+         *
          * @example
          * ```typescript
          * import { OxyServices } from '@oxyhq/core';

package/dist/cjs/utils/authHelpers.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * Authentication helper utilities for common token validation
+ * and authentication error handling patterns.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationFailedError = exports.SessionSyncRequiredError = void 0;
+exports.ensureValidToken = ensureValidToken;
+exports.isAuthenticationError = isAuthenticationError;
+exports.withAuthErrorHandling = withAuthErrorHandling;
+exports.authenticatedApiCall = authenticatedApiCall;
+/**
+ * Error thrown when session sync is required
+ */
+class SessionSyncRequiredError extends Error {
+    constructor(message = 'Session needs to be synced. Please try again.') {
+        super(message);
+        this.name = 'SessionSyncRequiredError';
+    }
+}
+exports.SessionSyncRequiredError = SessionSyncRequiredError;
+/**
+ * Error thrown when authentication fails
+ */
+class AuthenticationFailedError extends Error {
+    constructor(message = 'Authentication failed. Please sign in again.') {
+        super(message);
+        this.name = 'AuthenticationFailedError';
+    }
+}
+exports.AuthenticationFailedError = AuthenticationFailedError;
+/**
+ * Ensures a valid token exists before making authenticated API calls.
+ * If no valid token exists and an active session ID is available,
+ * attempts to refresh the token using the session.
+ *
+ * @throws {SessionSyncRequiredError} If the session needs to be synced (offline session)
+ */
+async function ensureValidToken(oxyServices, activeSessionId) {
+    if (oxyServices.hasValidToken() || !activeSessionId) {
+        return;
+    }
+    try {
+        await oxyServices.getTokenBySession(activeSessionId);
+    }
+    catch (tokenError) {
+        const errorMessage = tokenError instanceof Error ? tokenError.message : String(tokenError);
+        if (errorMessage.includes('AUTH_REQUIRED_OFFLINE_SESSION') || errorMessage.includes('offline')) {
+            throw new SessionSyncRequiredError();
+        }
+        throw tokenError;
+    }
+}
+/**
+ * Checks if an error is an authentication error (401 or auth-related message)
+ */
+function isAuthenticationError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const errorObj = error;
+    const errorMessage = errorObj.message || '';
+    const status = errorObj.status || errorObj.response?.status;
+    return (status === 401 ||
+        errorMessage.includes('Authentication required') ||
+        errorMessage.includes('Invalid or missing authorization header'));
+}
+/**
+ * Wraps an API call with authentication error handling.
+ * On auth failure, optionally attempts to sync the session and retry.
+ *
+ * @throws {AuthenticationFailedError} If authentication fails and cannot be recovered
+ */
+async function withAuthErrorHandling(apiCall, options) {
+    try {
+        return await apiCall();
+    }
+    catch (error) {
+        if (!isAuthenticationError(error)) {
+            throw error;
+        }
+        if (options?.syncSession && options?.activeSessionId && options?.oxyServices) {
+            try {
+                await options.syncSession();
+                await options.oxyServices.getTokenBySession(options.activeSessionId);
+                return await apiCall();
+            }
+            catch {
+                throw new AuthenticationFailedError();
+            }
+        }
+        throw new AuthenticationFailedError();
+    }
+}
+/**
+ * Combines token validation and auth error handling for a complete authenticated API call.
+ *
+ * @example
+ * ```ts
+ * return await authenticatedApiCall(
+ *   oxyServices,
+ *   activeSessionId,
+ *   () => oxyServices.updateProfile(updates)
+ * );
+ * ```
+ */
+async function authenticatedApiCall(oxyServices, activeSessionId, apiCall, syncSession) {
+    await ensureValidToken(oxyServices, activeSessionId);
+    return withAuthErrorHandling(apiCall, {
+        syncSession,
+        activeSessionId,
+        oxyServices,
+    });
+}

package/dist/cjs/utils/platform.js

@@ -12,6 +12,8 @@ exports.isWeb = isWeb;
 exports.isNative = isNative;
 exports.isIOS = isIOS;
 exports.isAndroid = isAndroid;
+exports.isReactNative = isReactNative;
+exports.isNodeJS = isNodeJS;
 exports.setPlatformOS = setPlatformOS;
 /**
  * Detect the current platform without importing react-native
@@ -82,6 +84,18 @@ function isIOS() {
 function isAndroid() {
     return getPlatformOS() === 'android';
 }
+/**
+ * Check if running in React Native
+ */
+function isReactNative() {
+    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
+}
+/**
+ * Check if running in Node.js
+ */
+function isNodeJS() {
+    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
+}
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform

package/dist/esm/AuthManager.js

@@ -243,7 +243,7 @@ export class AuthManager {
                 // Use session-based token endpoint which handles auto-refresh server-side
                 const response = await httpService.request({
                     method: 'GET',
-                    url: `/api/session/token/${sessionId}`,
+                    url: `/session/token/${sessionId}`,
                     cache: false,
                     retry: false,
                 });
@@ -296,6 +296,19 @@ export class AuthManager {
             clearTimeout(this.refreshTimer);
             this.refreshTimer = null;
         }
+        // Invalidate current session on the server (best-effort)
+        try {
+            const sessionJson = await this.storage.getItem(STORAGE_KEYS.SESSION);
+            if (sessionJson) {
+                const session = JSON.parse(sessionJson);
+                if (session.sessionId && typeof this.oxyServices.logoutSession === 'function') {
+                    await this.oxyServices.logoutSession(session.sessionId);
+                }
+            }
+        }
+        catch {
+            // Best-effort: don't block local signout on network failure
+        }
         // Revoke FedCM credential if supported
         try {
             const services = this.oxyServices;