@oxyhq/core 1.5.0 → 1.6.1

package/dist/esm/HttpService.js

@@ -25,7 +25,9 @@ import { isNative, getPlatformOS } from './utils/platform';
  */
 const isNativeApp = isNative();
 /**
- * Token store for authentication (singleton)
+ * Token store for authentication (instance-based)
+ * Each HttpService gets its own TokenStore to prevent conflicts
+ * when multiple OxyServices instances coexist server-side.
  */
 class TokenStore {
     constructor() {
@@ -34,12 +36,6 @@ class TokenStore {
         this.csrfToken = null;
         this.csrfTokenFetchPromise = null;
     }
-    static getInstance() {
-        if (!TokenStore.instance) {
-            TokenStore.instance = new TokenStore();
-        }
-        return TokenStore.instance;
-    }
     setTokens(accessToken, refreshToken = '') {
         this.accessToken = accessToken;
         this.refreshToken = refreshToken;
@@ -83,6 +79,7 @@ class TokenStore {
 export class HttpService {
     constructor(config) {
         this.tokenRefreshPromise = null;
+        this.tokenRefreshCooldownUntil = 0;
         this._onTokenRefreshed = null;
         // Performance monitoring
         this.requestMetrics = {
@@ -95,7 +92,7 @@ export class HttpService {
         };
         this.config = config;
         this.baseURL = config.baseURL;
-        this.tokenStore = TokenStore.getInstance();
+        this.tokenStore = new TokenStore();
         this.logger = new SimpleLogger(config.enableLogging || false, config.logLevel || 'error', 'HttpService');
         // Initialize performance infrastructure
         this.cache = new TTLCache(config.cacheTTL || 5 * 60 * 1000);
@@ -247,6 +244,20 @@ export class HttpService {
                         // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
                     }
+                    // On 403 with CSRF error, clear cached token and retry once
+                    if (response.status === 403 && !config._isCsrfRetry) {
+                        try {
+                            const clonedResponse = response.clone();
+                            const errBody = await clonedResponse.json();
+                            if (errBody?.code === 'CSRF_TOKEN_INVALID' || errBody?.code === 'CSRF_TOKEN_MISSING') {
+                                this.tokenStore.clearCsrfToken();
+                                return this.request({ ...config, _isCsrfRetry: true, retry: false });
+                            }
+                        }
+                        catch {
+                            // Failed to parse error body — not a CSRF error
+                        }
+                    }
                     // Try to parse error response (handle empty/malformed JSON)
                     let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
                     const contentType = response.headers.get('content-type');
@@ -403,52 +414,57 @@ export class HttpService {
             return existingPromise;
         }
         const fetchPromise = (async () => {
-            try {
-                if (isDev())
-                    console.log('[HttpService] Fetching CSRF token from:', `${this.baseURL}/api/csrf-token`);
-                // Use AbortController for timeout (more compatible than AbortSignal.timeout)
-                const controller = new AbortController();
-                const timeoutId = setTimeout(() => controller.abort(), 5000);
-                const response = await fetch(`${this.baseURL}/api/csrf-token`, {
-                    method: 'GET',
-                    headers: { 'Accept': 'application/json' },
-                    credentials: 'include', // Required to receive and send cookies
-                    signal: controller.signal,
-                });
-                clearTimeout(timeoutId);
-                if (isDev())
-                    console.log('[HttpService] CSRF fetch response:', response.status, response.ok);
-                if (response.ok) {
-                    const data = await response.json();
+            const maxAttempts = 2;
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+                try {
+                    if (isDev())
+                        console.log('[HttpService] Fetching CSRF token from:', `${this.baseURL}/csrf-token`, `(attempt ${attempt})`);
+                    // Use AbortController for timeout (more compatible than AbortSignal.timeout)
+                    const controller = new AbortController();
+                    const timeoutId = setTimeout(() => controller.abort(), 5000);
+                    const response = await fetch(`${this.baseURL}/csrf-token`, {
+                        method: 'GET',
+                        headers: { 'Accept': 'application/json' },
+                        credentials: 'include', // Required to receive and send cookies
+                        signal: controller.signal,
+                    });
+                    clearTimeout(timeoutId);
+                    if (isDev())
+                        console.log('[HttpService] CSRF fetch response:', response.status, response.ok);
+                    if (response.ok) {
+                        const data = await response.json();
+                        if (isDev())
+                            console.log('[HttpService] CSRF response data:', data);
+                        const token = data.csrfToken || null;
+                        this.tokenStore.setCsrfToken(token);
+                        this.logger.debug('CSRF token fetched');
+                        return token;
+                    }
+                    // Also check response header for CSRF token
+                    const headerToken = response.headers.get('X-CSRF-Token');
+                    if (headerToken) {
+                        this.tokenStore.setCsrfToken(headerToken);
+                        this.logger.debug('CSRF token from header');
+                        return headerToken;
+                    }
                     if (isDev())
-                        console.log('[HttpService] CSRF response data:', data);
-                    const token = data.csrfToken || null;
-                    this.tokenStore.setCsrfToken(token);
-                    this.logger.debug('CSRF token fetched');
-                    return token;
+                        console.log('[HttpService] CSRF fetch failed with status:', response.status);
+                    this.logger.warn('Failed to fetch CSRF token:', response.status);
                 }
-                // Also check response header for CSRF token
-                const headerToken = response.headers.get('X-CSRF-Token');
-                if (headerToken) {
-                    this.tokenStore.setCsrfToken(headerToken);
-                    this.logger.debug('CSRF token from header');
-                    return headerToken;
+                catch (error) {
+                    if (isDev())
+                        console.log('[HttpService] CSRF fetch error:', error);
+                    this.logger.warn('CSRF token fetch error:', error);
+                }
+                // Wait before retry (500ms)
+                if (attempt < maxAttempts) {
+                    await new Promise(resolve => setTimeout(resolve, 500));
                 }
-                if (isDev())
-                    console.log('[HttpService] CSRF fetch failed with status:', response.status);
-                this.logger.warn('Failed to fetch CSRF token:', response.status);
-                return null;
-            }
-            catch (error) {
-                if (isDev())
-                    console.log('[HttpService] CSRF fetch error:', error);
-                this.logger.warn('CSRF token fetch error:', error);
-                return null;
-            }
-            finally {
-                this.tokenStore.setCsrfTokenFetchPromise(null);
             }
-        })();
+            return null;
+        })().finally(() => {
+            this.tokenStore.setCsrfTokenFetchPromise(null);
+        });
         this.tokenStore.setCsrfTokenFetchPromise(fetchPromise);
         return fetchPromise;
     }
@@ -465,18 +481,25 @@ export class HttpService {
             const currentTime = Math.floor(Date.now() / 1000);
             // If token expires in less than 60 seconds, refresh it
             if (decoded.exp && decoded.exp - currentTime < 60 && decoded.sessionId) {
-                // Deduplicate concurrent refresh attempts
-                if (!this.tokenRefreshPromise) {
-                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId);
+                // Skip if we recently failed a refresh (5s cooldown to prevent storms)
+                if (Date.now() < this.tokenRefreshCooldownUntil) {
+                    return `Bearer ${accessToken}`;
                 }
-                try {
-                    const result = await this.tokenRefreshPromise;
-                    if (result)
+                // Deduplicate concurrent refresh attempts. The promise is shared
+                // across all concurrent callers and cleared only after it settles,
+                // so every awaiter receives the same result.
+                if (!this.tokenRefreshPromise) {
+                    this.tokenRefreshPromise = this._refreshTokenFromSession(decoded.sessionId)
+                        .then((result) => {
+                        if (!result)
+                            this.tokenRefreshCooldownUntil = Date.now() + 5000;
                         return result;
+                    })
+                        .finally(() => { this.tokenRefreshPromise = null; });
                 }
-                finally {
-                    this.tokenRefreshPromise = null;
-                }
+                const result = await this.tokenRefreshPromise;
+                if (result)
+                    return result;
             }
             return `Bearer ${accessToken}`;
         }
@@ -487,7 +510,7 @@ export class HttpService {
     }
     async _refreshTokenFromSession(sessionId) {
         try {
-            const refreshUrl = `${this.baseURL}/api/session/token/${sessionId}`;
+            const refreshUrl = `${this.baseURL}/session/token/${sessionId}`;
             const response = await fetch(refreshUrl, {
                 method: 'GET',
                 headers: { 'Accept': 'application/json' },
@@ -640,14 +663,9 @@ export class HttpService {
     getMetrics() {
         return { ...this.requestMetrics };
     }
-    // Test-only utility
-    static __resetTokensForTests() {
-        try {
-            TokenStore.getInstance().clearTokens();
-        }
-        catch (error) {
-            // Silently fail in test cleanup - this is expected behavior
-            // TokenStore might not be initialized in some test scenarios
-        }
+    // Test-only utility — clears tokens on this instance
+    __resetTokensForTests() {
+        this.tokenStore.clearTokens();
+        this.tokenStore.clearCsrfToken();
     }
 }

package/dist/esm/OxyServices.base.js

@@ -23,9 +23,10 @@ export class OxyServicesBase {
         // Initialize unified HTTP service (handles auth, caching, deduplication, queuing, retry)
         this.httpService = new HttpService(config);
     }
-    // Test-only utility to reset global tokens between jest tests
-    static __resetTokensForTests() {
-        HttpService.__resetTokensForTests();
+    // Test-only utility to reset tokens on this instance between jest tests
+    // Note: tokens are now per-instance, so create new instances in tests for isolation
+    __resetTokensForTests() {
+        this.httpService.__resetTokensForTests();
     }
     /**
      * Make a request with all performance optimizations
@@ -231,7 +232,7 @@ export class OxyServicesBase {
             return false;
         }
         try {
-            const res = await this.makeRequest('GET', '/api/auth/validate', undefined, {
+            const res = await this.makeRequest('GET', '/auth/validate', undefined, {
                 cache: false,
                 retry: false,
             });

package/dist/esm/crypto/keyManager.js

@@ -5,7 +5,7 @@
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
 import { ec as EC } from 'elliptic';
-import { isWeb, isIOS, isAndroid } from '../utils/platform';
+import { isWeb, isIOS, isAndroid, isReactNative, isNodeJS } from '../utils/platform';
 import { logger } from '../utils/loggerUtils';
 import { isDev } from '../shared/utils/debugUtils';
 // Lazy imports for React Native specific modules
@@ -56,18 +56,6 @@ async function initSecureStore() {
     }
     return SecureStore;
 }
-/**
- * Check if we're in a React Native environment
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if we're in a Node.js environment
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Check if we're on web platform
  * Identity storage is only available on native platforms (iOS/Android)

package/dist/esm/crypto/signatureService.js

@@ -6,21 +6,10 @@
  */
 import { ec as EC } from 'elliptic';
 import { KeyManager } from './keyManager';
+import { isReactNative, isNodeJS } from '../utils/platform';
 // Lazy import for expo-crypto
 let ExpoCrypto = null;
 const ec = new EC('secp256k1');
-/**
- * Check if we're in a React Native environment
- */
-function isReactNative() {
-    return typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-}
-/**
- * Check if we're in a Node.js environment
- */
-function isNodeJS() {
-    return typeof process !== 'undefined' && process.versions != null && process.versions.node != null;
-}
 /**
  * Initialize expo-crypto module
  */
@@ -44,9 +33,7 @@ async function sha256(message) {
     // In Node.js, use Node's crypto module
     if (isNodeJS()) {
         try {
-            // eslint-disable-next-line @typescript-eslint/no-implied-eval
-            const getCrypto = new Function('return require("crypto")');
-            const nodeCrypto = getCrypto();
+            const nodeCrypto = await import('crypto');
             return nodeCrypto.createHash('sha256').update(message).digest('hex');
         }
         catch {

package/dist/esm/index.js

@@ -40,6 +40,8 @@ export { DEFAULT_CIRCUIT_BREAKER_CONFIG, createCircuitBreakerState, calculateBac
 export { isDev, debugLog, debugWarn, debugError, createDebugLogger, } from './shared/utils/debugUtils';
 // --- i18n ---
 export { translate } from './i18n';
+// --- Auth Helpers ---
+export { SessionSyncRequiredError, AuthenticationFailedError, ensureValidToken, isAuthenticationError, withAuthErrorHandling, authenticatedApiCall, } from './utils/authHelpers';
 // --- Session Utilities ---
 export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual } from './utils/sessionUtils';
 // --- Constants ---

package/dist/esm/mixins/OxyServices.analytics.js

@@ -11,7 +11,7 @@ export function OxyServicesAnalyticsMixin(Base) {
          */
         async trackEvent(eventName, properties) {
             try {
-                await this.makeRequest('POST', '/api/analytics/events', {
+                await this.makeRequest('POST', '/analytics/events', {
                     event: eventName,
                     properties
                 }, { cache: false, retry: false }); // Don't retry analytics events
@@ -33,7 +33,7 @@ export function OxyServicesAnalyticsMixin(Base) {
                     params.startDate = startDate;
                 if (endDate)
                     params.endDate = endDate;
-                return await this.makeRequest('GET', '/api/analytics', params, {
+                return await this.makeRequest('GET', '/analytics', params, {
                     cache: true,
                     cacheTTL: CACHE_TIMES.LONG,
                 });

package/dist/esm/mixins/OxyServices.assets.js

@@ -8,7 +8,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async deleteFile(fileId) {
             try {
-                return await this.makeRequest('DELETE', `/api/assets/${encodeURIComponent(fileId)}`, undefined, { cache: false });
+                return await this.makeRequest('DELETE', `/assets/${encodeURIComponent(fileId)}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -29,7 +29,7 @@ export function OxyServicesAssetsMixin(Base) {
             if (token)
                 params.set('token', token);
             const qs = params.toString();
-            return `${base}/api/assets/${encodeURIComponent(fileId)}/stream${qs ? `?${qs}` : ''}`;
+            return `${base}/assets/${encodeURIComponent(fileId)}/stream${qs ? `?${qs}` : ''}`;
         }
         /**
          * Get file download URL asynchronously (returns signed URL directly from CDN)
@@ -53,7 +53,7 @@ export function OxyServicesAssetsMixin(Base) {
                     paramsObj.limit = limit;
                 if (offset)
                     paramsObj.offset = offset;
-                return await this.makeRequest('GET', '/api/assets', paramsObj, {
+                return await this.makeRequest('GET', '/assets', paramsObj, {
                     cache: false,
                 });
             }
@@ -66,7 +66,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async getAccountStorageUsage() {
             try {
-                return await this.makeRequest('GET', '/api/storage/usage', undefined, {
+                return await this.makeRequest('GET', '/storage/usage', undefined, {
                     cache: false,
                 });
             }
@@ -109,7 +109,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async getBatchFileAccess(fileIds, context) {
             try {
-                return await this.makeRequest('POST', '/api/assets/batch-access', {
+                return await this.makeRequest('POST', '/assets/batch-access', {
                     fileIds,
                     context
                 });
@@ -170,7 +170,7 @@ export function OxyServicesAssetsMixin(Base) {
                 }
                 const response = await this.getClient().request({
                     method: 'POST',
-                    url: '/api/assets/upload',
+                    url: '/assets/upload',
                     data: formData,
                     cache: false,
                 });
@@ -228,7 +228,7 @@ export function OxyServicesAssetsMixin(Base) {
                     body.visibility = visibility;
                 if (webhookUrl)
                     body.webhookUrl = webhookUrl;
-                return await this.makeRequest('POST', `/api/assets/${fileId}/links`, body, { cache: false });
+                return await this.makeRequest('POST', `/assets/${fileId}/links`, body, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -239,7 +239,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async assetUnlink(fileId, app, entityType, entityId) {
             try {
-                return await this.makeRequest('DELETE', `/api/assets/${fileId}/links`, {
+                return await this.makeRequest('DELETE', `/assets/${fileId}/links`, {
                     app,
                     entityType,
                     entityId
@@ -254,7 +254,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async assetGet(fileId) {
             try {
-                return await this.makeRequest('GET', `/api/assets/${fileId}`, undefined, {
+                return await this.makeRequest('GET', `/assets/${fileId}`, undefined, {
                     cache: true,
                     cacheTTL: 5 * 60 * 1000,
                 });
@@ -273,7 +273,7 @@ export function OxyServicesAssetsMixin(Base) {
                     params.variant = variant;
                 if (expiresIn)
                     params.expiresIn = expiresIn;
-                return await this.makeRequest('GET', `/api/assets/${fileId}/url`, params, {
+                return await this.makeRequest('GET', `/assets/${fileId}/url`, params, {
                     cache: true,
                     cacheTTL: 10 * 60 * 1000,
                 });
@@ -287,7 +287,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async assetRestore(fileId) {
             try {
-                return await this.makeRequest('POST', `/api/assets/${fileId}/restore`, undefined, { cache: false });
+                return await this.makeRequest('POST', `/assets/${fileId}/restore`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -299,7 +299,7 @@ export function OxyServicesAssetsMixin(Base) {
         async assetDelete(fileId, force = false) {
             try {
                 const params = force ? { force: 'true' } : undefined;
-                return await this.makeRequest('DELETE', `/api/assets/${fileId}`, params, { cache: false });
+                return await this.makeRequest('DELETE', `/assets/${fileId}`, params, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -322,7 +322,7 @@ export function OxyServicesAssetsMixin(Base) {
          */
         async assetUpdateVisibility(fileId, visibility) {
             try {
-                return await this.makeRequest('PATCH', `/api/assets/${fileId}/visibility`, {
+                return await this.makeRequest('PATCH', `/assets/${fileId}/visibility`, {
                     visibility
                 }, { cache: false });
             }
@@ -360,7 +360,7 @@ export function OxyServicesAssetsMixin(Base) {
                 params.variant = variant;
             if (expiresIn)
                 params.expiresIn = expiresIn;
-            const urlRes = await this.makeRequest('GET', `/api/assets/${encodeURIComponent(fileId)}/url`, Object.keys(params).length ? params : undefined, {
+            const urlRes = await this.makeRequest('GET', `/assets/${encodeURIComponent(fileId)}/url`, Object.keys(params).length ? params : undefined, {
                 cache: true,
                 cacheTTL: cacheTTL ?? 10 * 60 * 1000,
             });

package/dist/esm/mixins/OxyServices.auth.js

@@ -40,7 +40,7 @@ export function OxyServicesAuthMixin(Base) {
             if (this._serviceToken && this._serviceTokenExp > Date.now() + 60000) {
                 return this._serviceToken;
             }
-            const response = await this.makeRequest('POST', '/api/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
+            const response = await this.makeRequest('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false });
             this._serviceToken = response.token;
             this._serviceTokenExp = Date.now() + response.expiresIn * 1000;
             return this._serviceToken;
@@ -74,7 +74,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async register(publicKey, signature, timestamp) {
             try {
-                const res = await this.makeRequest('POST', '/api/auth/register', {
+                const res = await this.makeRequest('POST', '/auth/register', {
                     publicKey,
                     signature,
                     timestamp,
@@ -96,7 +96,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async requestChallenge(publicKey) {
             try {
-                return await this.makeRequest('POST', '/api/auth/challenge', {
+                return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
                 }, { cache: false });
             }
@@ -116,7 +116,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async verifyChallenge(publicKey, challenge, signature, timestamp, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/api/auth/verify', {
+                return await this.makeRequest('POST', '/auth/verify', {
                     publicKey,
                     challenge,
                     signature,
@@ -134,7 +134,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkPublicKeyRegistered(publicKey) {
             try {
-                return await this.makeRequest('GET', `/api/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-publickey/${encodeURIComponent(publicKey)}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -145,7 +145,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getUserByPublicKey(publicKey) {
             try {
-                return await this.makeRequest('GET', `/api/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
+                return await this.makeRequest('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, { cache: true, cacheTTL: 2 * 60 * 1000 });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -156,7 +156,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getUserBySession(sessionId) {
             try {
-                return await this.makeRequest('GET', `/api/session/user/${sessionId}`, undefined, {
+                return await this.makeRequest('GET', `/session/user/${sessionId}`, undefined, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                 });
@@ -174,7 +174,7 @@ export function OxyServicesAuthMixin(Base) {
                     return [];
                 }
                 const uniqueSessionIds = Array.from(new Set(sessionIds)).sort();
-                return await this.makeRequest('POST', '/api/session/users/batch', { sessionIds: uniqueSessionIds }, {
+                return await this.makeRequest('POST', '/session/users/batch', { sessionIds: uniqueSessionIds }, {
                     cache: true,
                     cacheTTL: 2 * 60 * 1000,
                     deduplicate: true,
@@ -189,7 +189,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getTokenBySession(sessionId) {
             try {
-                const res = await this.makeRequest('GET', `/api/session/token/${sessionId}`, undefined, { cache: false, retry: false });
+                const res = await this.makeRequest('GET', `/session/token/${sessionId}`, undefined, { cache: false, retry: false });
                 this.setTokens(res.accessToken);
                 return res;
             }
@@ -202,7 +202,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async getSessionsBySessionId(sessionId) {
             try {
-                return await this.makeRequest('GET', `/api/session/sessions/${sessionId}`, undefined, {
+                return await this.makeRequest('GET', `/session/sessions/${sessionId}`, undefined, {
                     cache: false,
                 });
             }
@@ -216,8 +216,8 @@ export function OxyServicesAuthMixin(Base) {
         async logoutSession(sessionId, targetSessionId) {
             try {
                 const url = targetSessionId
-                    ? `/api/session/logout/${sessionId}/${targetSessionId}`
-                    : `/api/session/logout/${sessionId}`;
+                    ? `/session/logout/${sessionId}/${targetSessionId}`
+                    : `/session/logout/${sessionId}`;
                 await this.makeRequest('POST', url, undefined, { cache: false });
             }
             catch (error) {
@@ -229,7 +229,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async logoutAllSessions(sessionId) {
             try {
-                await this.makeRequest('POST', `/api/session/logout-all/${sessionId}`, undefined, { cache: false });
+                await this.makeRequest('POST', `/session/logout-all/${sessionId}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -245,11 +245,11 @@ export function OxyServicesAuthMixin(Base) {
                     urlParams.deviceFingerprint = options.deviceFingerprint;
                 if (options.useHeaderValidation)
                     urlParams.useHeaderValidation = 'true';
-                return await this.makeRequest('GET', `/api/session/validate/${sessionId}`, urlParams, { cache: false });
+                return await this.makeRequest('GET', `/session/validate/${sessionId}`, urlParams, { cache: false });
             }
             catch (error) {
                 // Session is invalid — clear any cached user data for this session (#196)
-                this.clearCacheEntry(`GET:/api/session/user/${sessionId}`);
+                this.clearCacheEntry(`GET:/session/user/${sessionId}`);
                 throw this.handleError(error);
             }
         }
@@ -258,7 +258,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkUsernameAvailability(username) {
             try {
-                return await this.makeRequest('GET', `/api/auth/check-username/${username}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-username/${username}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -269,7 +269,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async checkEmailAvailability(email) {
             try {
-                return await this.makeRequest('GET', `/api/auth/check-email/${email}`, undefined, { cache: false });
+                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -280,7 +280,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async signUp(username, email, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/api/auth/signup', {
+                return await this.makeRequest('POST', '/auth/signup', {
                     username,
                     email,
                     password,
@@ -297,7 +297,7 @@ export function OxyServicesAuthMixin(Base) {
          */
         async signIn(identifier, password, deviceName, deviceFingerprint) {
             try {
-                return await this.makeRequest('POST', '/api/auth/login', {
+                return await this.makeRequest('POST', '/auth/login', {
                     identifier,
                     password,
                     deviceName,