@oxyhq/core 11.0.1 → 12.1.0

package/dist/types/index.d.ts

@@ -10,7 +10,7 @@
  * ```ts
  * import { OxyServices, oxyClient } from '@oxyhq/core';
  *
- * const user = await oxyClient.signIn(publicKey);
+ * const user = await oxyClient.getCurrentUser();
  * ```
  *
  * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
@@ -87,7 +87,7 @@ export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY, OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, normalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, } from './utils/oauthPkce';
 export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
-export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins';
+export { buildIdpHubOrigin, buildHubSyncUrl, isIdpHubOrigin, isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, normalizeOfficialReturnOrigin, parseHubSyncReturnUrl, } from './utils/officialOrigins';
 export { syncHubAfterSignIn, redeemHubTicketOnHub, } from './session/hubSync';
 export type { SyncHubAfterSignInOptions } from './session/hubSync';
 export { SessionClient } from './session/SessionClient';
@@ -99,7 +99,7 @@ export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountId
 export { projectSwitchableAccounts, switchableAccountIds, } from './session/accountProjection';
 export type { SwitchableAccount, SwitchableAccountUser, ProjectSwitchableAccountsInput, } from './session/accountProjection';
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, SignInFlowPhase, SignInFlowState, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, SignInFlowPhase, SignInFlowState, } from './session/accountDialogController';
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
 export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
 export { refreshPersistedSession, refreshDeviceSecretArm, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh';

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -450,50 +450,6 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
             available: boolean;
             message: string;
         }>;
-        /**
-         * Register a new user with email/username and password
-         */
-        signUp(username: string, email: string, password: string, deviceName?: string, deviceFingerprint?: any): Promise<SessionLoginResponse>;
-        /**
-         * Sign in with email or username and password
-         */
-        signIn(identifier: string, password: string, deviceName?: string, deviceFingerprint?: any): Promise<SessionLoginResponse>;
-        /**
-         * Convenience helper for email sign-in
-         */
-        signInWithEmail(email: string, password: string, deviceName?: string, deviceFingerprint?: any): Promise<SessionLoginResponse>;
-        /**
-         * Device-first password sign-in. Unlike the legacy {@link signIn} (which
-         * assumes a one-step session and is kept intact for existing callers until
-         * the F4 cutover), this returns the FULL `POST /auth/login` contract — the
-         * discriminated {@link LoginResult}: either a 2FA challenge
-         * (`{ twoFactorRequired, loginToken }`) to complete via
-         * {@link completeTwoFactorSignIn}, or a session arm.
-         *
-         * On the session arm, a returned access token is planted immediately
-         * (mirroring {@link verifyChallenge}), so the caller has an authenticated
-         * client without a second round-trip. The response's `deviceId` +
-         * `deviceSecret` are the zero-cookie restore credential the caller persists.
-         */
-        passwordSignIn(identifier: string, password: string, options?: {
-            deviceName?: string;
-            deviceFingerprint?: string;
-            deviceId?: string;
-        }): Promise<LoginResult>;
-        /**
-         * Complete a 2FA-gated sign-in started by {@link passwordSignIn}. Presents
-         * the short-lived `loginToken` with either a TOTP `token` or a `backupCode`
-         * to `POST /security/2fa/verify-login`, which must resolve to the session
-         * arm of {@link LoginResult} (a second 2FA challenge here is a protocol
-         * error). A returned access token is planted immediately.
-         */
-        completeTwoFactorSignIn(params: {
-            loginToken: string;
-            token?: string;
-            backupCode?: string;
-            deviceName?: string;
-            deviceId?: string;
-        }): Promise<LoginSessionResult>;
         /**
          * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
          * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
@@ -543,9 +499,9 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
          * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
          * browser `AuthenticationResponseJSON` (`response`) alongside the
          * device-session envelope. Resolves to the SAME {@link LoginResult} contract
-         * as `POST /auth/verify`; on the session arm the access token is planted
-         * immediately (mirroring {@link passwordSignIn}), and the response's
-         * `deviceId` + `deviceSecret` are the zero-cookie restore credential.
+         * as `POST /auth/verify`; the access token is planted immediately, and the
+         * response's `deviceId` + `deviceSecret` are the zero-cookie restore
+         * credential.
          */
         webauthnLoginVerify(response: unknown, envelope?: {
             deviceName?: string;
@@ -554,7 +510,7 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
         }): Promise<LoginResult>;
         /**
          * Exchange an OAuth authorization code (returned to the RP redirect URI
-         * after password sign-in at auth.oxy.so) for a device-first session.
+         * after sign-in at auth.oxy.so) for a device-first session.
          * Public first-party clients use PKCE (`codeVerifier`); the access token is
          * planted immediately on success.
          */

package/dist/types/mixins/OxyServices.identity.d.ts

@@ -33,7 +33,7 @@ import type { OxyServicesBase } from '../OxyServices.base';
  */
 export type IdentityRecordType = OxySignedRecordType;
 /** Auth-method types that can be unlinked via {@link OxyServicesIdentityMixin}. */
-export type UnlinkableAuthMethodType = 'identity' | 'password' | 'google' | 'apple' | 'github';
+export type UnlinkableAuthMethodType = 'identity' | 'webauthn';
 /**
  * Result of a link/unlink auth-method mutation (`POST /auth/link`,
  * `DELETE /auth/link/:type`).
@@ -106,14 +106,6 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
          * exact bytes the server reconstructs and verifies.
          */
         linkIdentityKey(): Promise<LinkAuthMethodResult>;
-        /**
-         * Link password authentication to the current account. Adds a `password`
-         * auth method (does not remove existing methods).
-         *
-         * @param email - The email to associate with password auth.
-         * @param password - The new password (server enforces strength rules).
-         */
-        linkPassword(email: string, password: string): Promise<LinkAuthMethodResult>;
         /**
          * Unlink an authentication method from the current account. The server
          * refuses to remove the last remaining method (the account would become
@@ -122,6 +114,18 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
          * @param type - The auth-method type to remove.
          */
         unlinkAuthMethod(type: UnlinkableAuthMethodType): Promise<LinkAuthMethodResult>;
+        /**
+         * Remove ONE passkey (WebAuthn credential) from the current account.
+         *
+         * Passkeys are per-credential, so unlike {@link unlinkAuthMethod} (which
+         * removes an auth method by type) this targets a specific credential id.
+         * The server refuses to remove the last remaining auth method (the account
+         * would become inaccessible) and deletes the stored `WebauthnCredential`.
+         *
+         * @param credentialId - The passkey's public credential id
+         *   (`AuthMethodEntry.credentialId`).
+         */
+        removePasskey(credentialId: string): Promise<LinkAuthMethodResult>;
         /**
          * Sign a record with the on-device identity key, WITHOUT publishing it.
          * The subject is the current user's DID. NATIVE-ONLY (requires a stored

package/dist/types/session/accountDialogController.d.ts

@@ -12,18 +12,23 @@
  *   - the unified account list (via {@link projectSwitchableAccounts}), fetched
  *     from `SessionClient` state ∪ `oxyServices.listAccounts()` and hydrated
  *     with `oxyServices.getUsersByIds()`;
- *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add`);
+ *   - the dialog `view` state machine (`accounts` | `signin` | `qr` | `add` |
+ *     `signup`);
  *   - `switchTo` (the uniform switch: `SessionClient.switchAccount` for an
  *     account already on the device, `oxyServices.switchToAccount` to mint on
  *     first entry into a graph account — reusing the existing SDK primitives, no
  *     new switch path);
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
  *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`).
+ *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *   - `commonsAvailability` — whether Commons is installed on this device
+ *     (native only, via the injected `canOpenApp` probe), so the QR view can
+ *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
- * It deliberately owns NO password/2FA logic — those live at the IdP
- * (auth.oxy.so). {@link AccountDialogController.openPasswordAtOxyAuth} only
- * builds the hand-off URL; device-first convergence syncs the session back.
+ * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
+ * password, social login, and 2FA were removed ecosystem-wide. Account
+ * creation (`signup` view) is the same two identity backends: a passkey
+ * ceremony on web, or a Commons-created identity.
  */
 import type { OxyServices } from '../OxyServices';
 import type { SessionLoginResponse, MinimalUserData } from '../models/session';
@@ -31,7 +36,19 @@ import type { SessionClient } from './SessionClient';
 import type { SocketIOFactory } from './socketLoader';
 import { type SwitchableAccount } from './accountProjection';
 /** The dialog's top-level view. */
-export type AccountDialogView = 'accounts' | 'signin' | 'qr' | 'add';
+export type AccountDialogView = 'accounts' | 'signin' | 'qr' | 'add' | 'signup';
+/**
+ * Whether Commons is installed on this device, as resolved by the injected
+ * `canOpenApp` probe:
+ *   - `'unknown'` — not yet probed, OR no probe was injected (web — there is
+ *     no API to ask a browser whether a custom URL scheme is registered, so
+ *     this stays `'unknown'` forever there and the QR view renders
+ *     unconditionally, no gating).
+ *   - `'checking'` — the probe is in flight.
+ *   - `'available'` / `'unavailable'` — the probe's resolved terminal answer
+ *     (native only). A probe error is treated as `'unavailable'` (fail-closed).
+ */
+export type CommonsAvailability = 'unknown' | 'checking' | 'available' | 'unavailable';
 /** Lifecycle phase of the "Sign in with Oxy" device flow. */
 export type SignInFlowPhase = 'idle' | 'starting' | 'waiting' | 'authorized' | 'error';
 /** State of the "Sign in with Oxy" (shared-key / QR) device flow. */
@@ -68,6 +85,8 @@ export interface AccountDialogSnapshot {
     switchingAccountId: string | null;
     /** The "Sign in with Oxy" device-flow state. */
     signIn: SignInFlowState;
+    /** Whether Commons is installed on this device. See {@link CommonsAvailability}. */
+    commonsAvailability: CommonsAvailability;
 }
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
@@ -85,25 +104,38 @@ export interface AccountDialogControllerOptions {
     /** Locale for display-name resolution. */
     locale?: string;
     /**
-     * Commit a freshly-authorized session (device flow / shared identity / minted
-     * graph switch) into the host's session set — device-first registration +
-     * durable persist + profile hydration. The consumer supplies its provider's
-     * commit path (`useOxy().handleWebSession` / the auth-sdk equivalent). Called
-     * AFTER the SDK has planted the access token. When omitted the controller
-     * falls back to `SessionClient.registerAndActivate` (registration + activation
-     * only — no provider-side durable persist/hydration).
+     * Commit a freshly-authorized SIGN-IN session (device flow / shared identity)
+     * into the host's session set — device-first registration + durable persist +
+     * profile hydration. The consumer supplies its provider's commit path
+     * (`useOxy().handleWebSession` / the auth-sdk equivalent). Called AFTER the SDK
+     * has planted the access token. When omitted the controller falls back to
+     * `SessionClient.registerAndActivate` (registration + activation only — no
+     * provider-side durable persist/hydration).
+     *
+     * This is the SIGN-IN commit: on an official web origin it may run the
+     * cross-origin hub-sync (a full-page redirect to `auth.oxy.so/sync`) that
+     * bootstraps silent OAuth restore on OTHER origins. A first sign-in on a web
+     * origin legitimately needs that. An account SWITCH does NOT — see
+     * {@link commitSwitchedSession}.
      */
     commitSession?: (session: SessionLoginResponse) => Promise<void>;
-    /** Notified after a completed sign-in (bearer planted + session committed). */
-    onSignedIn?: (user: MinimalUserData) => void;
-    /** Central IdP apex for `openPasswordAtOxyAuth` (defaults to `CENTRAL_IDP_APEX`). */
-    idpApex?: string;
     /**
-     * Registered OAuth redirect URI for this RP (exact match against
-     * `Application.redirectUris`). When set, wins over `returnUrl` /
-     * `location.origin` normalization in {@link openPasswordAtOxyAuth}.
+     * Commit a minted graph SWITCH session into the host's session set — same
+     * device-first registration + durable persist + profile hydration as
+     * {@link commitSession}, but IN-PLACE: it must NOT trigger the cross-origin
+     * hub-sync redirect. Switching into an account you already operate reuses the
+     * device credential that was already hub-synced at the original sign-in, so
+     * re-syncing is redundant and a full-page redirect on switch is the exact
+     * regression this separation prevents. Cross-tab/app propagation of the switch
+     * still happens instantly via the server's device-scoped `session_state` /
+     * `session_accounts_changed` socket broadcast — no navigation required.
+     *
+     * When omitted the controller falls back to {@link commitSession} (if wired)
+     * and then to `SessionClient.registerAndActivate`.
      */
-    authRedirectUri?: string | null;
+    commitSwitchedSession?: (session: SessionLoginResponse) => Promise<void>;
+    /** Notified after a completed sign-in (bearer planted + session committed). */
+    onSignedIn?: (user: MinimalUserData) => void;
     /**
      * QR device-flow FALLBACK poll interval in ms (default 12000). The primary
      * approval signal is the `/auth-session` socket's `auth_update` event (instant);
@@ -119,8 +151,8 @@ export interface AccountDialogControllerOptions {
      */
     socketFactory?: SocketIOFactory;
     /**
-     * Optional URL opener. When provided, `openPasswordAtOxyAuth` invokes it with
-     * the built URL in addition to returning it (web: `location.assign`; native:
+     * Optional URL opener. When provided, the controller invokes it to deep-link
+     * the Commons app for the QR handoff (web: `location.assign`; native:
      * `Linking.openURL`). Headless core never touches `window`/`Linking` itself.
      */
     openUrl?: (url: string) => void;
@@ -142,9 +174,8 @@ export declare class AccountDialogController {
     private readonly clientId;
     private readonly locale?;
     private readonly commitSession?;
+    private readonly commitSwitchedSession?;
     private readonly onSignedIn?;
-    private readonly idpApex;
-    private readonly authRedirectUri;
     private readonly pollIntervalMs;
     private readonly openUrl?;
     private readonly canOpenApp?;
@@ -157,6 +188,7 @@ export declare class AccountDialogController {
     private error;
     private switchingAccountId;
     private signIn;
+    private commonsAvailability;
     /** The secret device-flow token of the active QR flow (never surfaced). */
     private signInToken;
     private pollTimer;
@@ -225,6 +257,8 @@ export declare class AccountDialogController {
     close(): void;
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add(): void;
+    /** Switch to the "create account" view (passkey / Commons signup entry). */
+    startSignup(): void;
     /**
      * Reload the account graph and per-account profiles, then re-project. Safe to
      * call repeatedly; concurrent calls are reconciled by a sequence guard so a
@@ -270,32 +304,27 @@ export declare class AccountDialogController {
      */
     showQr(): Promise<void>;
     /**
-     * When a `canOpenApp` probe is injected and reports Commons installed, open the
-     * approve deep link via the injected `openUrl`. Best-effort and non-blocking: a
-     * probe/open failure is logged and swallowed — the QR/polling fallback remains.
+     * Resolve whether Commons is installed on this device via the injected
+     * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
+     * observable snapshot state. Native only — a no-op when `canOpenApp` was
+     * not injected (web), where `commonsAvailability` stays `'unknown'` forever
+     * and the QR view renders unconditionally (no gating).
+     *
+     * Replaces the old `maybeOpenCommons` fire-and-forget probe, whose outcome
+     * was only ever reflected by whether Commons silently opened — a probe
+     * failure or "not installed" answer was swallowed into a debug log with no
+     * way for the UI to react. `commonsAvailability` fixes that.
      */
-    private maybeOpenCommons;
-    /** Tear down the active sign-in device flow (timers + socket + token) and reset to idle. */
-    cancelSignIn(): void;
+    private resolveCommonsAvailability;
     /**
-     * Build (and, when an `openUrl` handler was supplied, open) the auth.oxy.so
-     * password sign-in URL. Password + 2FA are NOT in the SDK — they live at the
-     * IdP; this only hands off. Device-first: after login at the IdP the device
-     * session converges and the caller is woken via the device socket /
-     * `BroadcastChannel`, so the URL only needs to point at the IdP sign-in with
-     * the right return.
-     *
-     * @param params.returnUrl - Where the IdP returns after login. Defaults to the
-     *   current document URL on web (`globalThis.location.href`); pass explicitly
-     *   on native (no `location`).
-     * @param params.state - Optional opaque state echoed back on return.
-     * @returns The absolute auth.oxy.so sign-in URL.
+     * When Commons is confirmed installed, deep-link straight into its approve
+     * screen via the injected `openUrl` with the same `oxycommons://approve?...`
+     * payload the QR encodes. Best-effort and non-blocking — the QR/polling
+     * fallback stays live regardless of the outcome here.
      */
-    openPasswordAtOxyAuth(params?: {
-        returnUrl?: string;
-        state?: string;
-        redirectUri?: string;
-    }): Promise<string>;
+    private deepLinkIntoCommonsIfAvailable;
+    /** Tear down the active sign-in device flow (timers + socket + token) and reset to idle. */
+    cancelSignIn(): void;
     private scheduleNextPoll;
     /**
      * Run one status check + (on approval) claim. Triggered by the fallback timer
@@ -313,8 +342,14 @@ export declare class AccountDialogController {
     private completeSignIn;
     /**
      * Register a token-planted session into the device set. Prefers the
-     * consumer's `commitSession` (durable persist + hydration); falls back to
+     * consumer's commit funnel (durable persist + hydration); falls back to
      * `SessionClient.registerAndActivate` (registration + activation only).
+     *
+     * A SWITCH (`opts.fromSwitch`) uses the IN-PLACE `commitSwitchedSession` funnel
+     * so it never runs the cross-origin hub-sync redirect; a SIGN-IN uses
+     * `commitSession` (which may hub-sync on an official web origin). When the
+     * switch funnel is not wired it falls back to the sign-in funnel, then to
+     * `registerAndActivate`.
      */
     private commitAuthorizedSession;
     private failSignIn;

package/dist/types/utils/officialOrigins.d.ts

@@ -5,6 +5,12 @@
 export declare function buildIdpHubOrigin(): string;
 /** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
 export declare function isIdpHubOrigin(): boolean;
+/**
+ * Whether an origin is a loopback / local-dev origin (`localhost`, `127.0.0.1`,
+ * or `[::1]` on any port, http or https). Local dev must never be bounced to a
+ * hosted IdP for cross-origin session restore.
+ */
+export declare function isLoopbackOrigin(origin: string): boolean;
 /** Whether an origin belongs to the official Oxy web ecosystem. */
 export declare function isOfficialWebOrigin(origin: string): boolean;
 /** Normalize and validate a return URL against official origins. Returns origin only. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "11.0.1",
+  "version": "12.1.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -109,7 +109,7 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "^0.14.2",
+    "@oxyhq/contracts": "^0.15.0",
     "@oxyhq/protocol": "^0.1.5",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",

package/src/index.ts

@@ -10,7 +10,7 @@
  * ```ts
  * import { OxyServices, oxyClient } from '@oxyhq/core';
  *
- * const user = await oxyClient.signIn(publicKey);
+ * const user = await oxyClient.getCurrentUser();
  * ```
  *
  * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
@@ -558,6 +558,7 @@ export {
     buildIdpHubOrigin,
     buildHubSyncUrl,
     isIdpHubOrigin,
+    isLoopbackOrigin,
     isOfficialWebOrigin,
     isAllowedDeviceJoinOrigin,
     normalizeOfficialReturnOrigin,
@@ -610,9 +611,10 @@ export type {
 
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
-// — no password/2FA logic (that lives at the IdP; `openPasswordAtOxyAuth` only
-// hands off). Reuses `SessionClient.switchAccount` / `oxyServices.switchToAccount`
-// for the uniform switch and the existing device-flow methods for sign-in.
+// — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
+// password, social login, and 2FA were removed ecosystem-wide. Reuses
+// `SessionClient.switchAccount` / `oxyServices.switchToAccount` for the uniform
+// switch and the existing device-flow methods for sign-in.
 export {
     AccountDialogController,
     createAccountDialogController,
@@ -621,6 +623,7 @@ export type {
     AccountDialogControllerOptions,
     AccountDialogSnapshot,
     AccountDialogView,
+    CommonsAvailability,
     SignInFlowPhase,
     SignInFlowState,
 } from './session/accountDialogController';

package/src/mixins/OxyServices.auth.ts

@@ -1058,144 +1058,6 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       }
     }
 
-    /**
-     * Register a new user with email/username and password
-     */
-    async signUp(
-      username: string,
-      email: string,
-      password: string,
-      deviceName?: string,
-      deviceFingerprint?: any
-    ): Promise<SessionLoginResponse> {
-      try {
-        const session = await this.makeRequest<SessionLoginResponse>('POST', '/auth/signup', {
-          username,
-          email,
-          password,
-          deviceName,
-          deviceFingerprint,
-        }, { cache: false });
-        return {
-          ...session,
-          user: normalizeUserIdentity(session.user),
-        };
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Sign in with email or username and password
-     */
-    async signIn(
-      identifier: string,
-      password: string,
-      deviceName?: string,
-      deviceFingerprint?: any
-    ): Promise<SessionLoginResponse> {
-      try {
-        const session = await this.makeRequest<SessionLoginResponse>('POST', '/auth/login', {
-          identifier,
-          password,
-          deviceName,
-          deviceFingerprint,
-        }, { cache: false });
-        return {
-          ...session,
-          user: normalizeUserIdentity(session.user),
-        };
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Convenience helper for email sign-in
-     */
-    async signInWithEmail(
-      email: string,
-      password: string,
-      deviceName?: string,
-      deviceFingerprint?: any
-    ): Promise<SessionLoginResponse> {
-      return this.signIn(email, password, deviceName, deviceFingerprint);
-    }
-
-    /**
-     * Device-first password sign-in. Unlike the legacy {@link signIn} (which
-     * assumes a one-step session and is kept intact for existing callers until
-     * the F4 cutover), this returns the FULL `POST /auth/login` contract — the
-     * discriminated {@link LoginResult}: either a 2FA challenge
-     * (`{ twoFactorRequired, loginToken }`) to complete via
-     * {@link completeTwoFactorSignIn}, or a session arm.
-     *
-     * On the session arm, a returned access token is planted immediately
-     * (mirroring {@link verifyChallenge}), so the caller has an authenticated
-     * client without a second round-trip. The response's `deviceId` +
-     * `deviceSecret` are the zero-cookie restore credential the caller persists.
-     */
-    async passwordSignIn(
-      identifier: string,
-      password: string,
-      options: { deviceName?: string; deviceFingerprint?: string; deviceId?: string } = {},
-    ): Promise<LoginResult> {
-      try {
-        const res = await this.makeRequest<unknown>('POST', '/auth/login', {
-          identifier,
-          password,
-          deviceName: options.deviceName,
-          deviceFingerprint: options.deviceFingerprint,
-          ...(options.deviceId ? { deviceId: options.deviceId } : {}),
-        }, { cache: false });
-        const parsed = safeParseContract(loginResultSchema, res);
-        if (!parsed) {
-          throw new Error('auth/login returned an unexpected response shape');
-        }
-        if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
-          this.setTokens(parsed.accessToken);
-        }
-        return parsed;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Complete a 2FA-gated sign-in started by {@link passwordSignIn}. Presents
-     * the short-lived `loginToken` with either a TOTP `token` or a `backupCode`
-     * to `POST /security/2fa/verify-login`, which must resolve to the session
-     * arm of {@link LoginResult} (a second 2FA challenge here is a protocol
-     * error). A returned access token is planted immediately.
-     */
-    async completeTwoFactorSignIn(params: {
-      loginToken: string;
-      token?: string;
-      backupCode?: string;
-      deviceName?: string;
-      deviceId?: string;
-    }): Promise<LoginSessionResult> {
-      try {
-        const res = await this.makeRequest<unknown>('POST', '/security/2fa/verify-login', {
-          loginToken: params.loginToken,
-          token: params.token,
-          backupCode: params.backupCode,
-          deviceName: params.deviceName,
-          ...(params.deviceId ? { deviceId: params.deviceId } : {}),
-        }, { cache: false });
-        const parsed = safeParseContract(loginResultSchema, res);
-        if (!parsed || 'twoFactorRequired' in parsed) {
-          throw new Error('security/2fa/verify-login returned an unexpected response shape');
-        }
-        if (parsed.accessToken) {
-          this.setTokens(parsed.accessToken);
-        }
-        return parsed;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
     /**
      * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
      * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
@@ -1258,7 +1120,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
             if (!parsed) {
               throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
             }
-            if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+            if (parsed.accessToken) {
               this.setTokens(parsed.accessToken);
             }
             return parsed;
@@ -1301,9 +1163,9 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
      * browser `AuthenticationResponseJSON` (`response`) alongside the
      * device-session envelope. Resolves to the SAME {@link LoginResult} contract
-     * as `POST /auth/verify`; on the session arm the access token is planted
-     * immediately (mirroring {@link passwordSignIn}), and the response's
-     * `deviceId` + `deviceSecret` are the zero-cookie restore credential.
+     * as `POST /auth/verify`; the access token is planted immediately, and the
+     * response's `deviceId` + `deviceSecret` are the zero-cookie restore
+     * credential.
      */
     async webauthnLoginVerify(
       response: unknown,
@@ -1320,7 +1182,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
         if (!parsed) {
           throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
         }
-        if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+        if (parsed.accessToken) {
           this.setTokens(parsed.accessToken);
         }
         return parsed;
@@ -1331,7 +1193,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
 
     /**
      * Exchange an OAuth authorization code (returned to the RP redirect URI
-     * after password sign-in at auth.oxy.so) for a device-first session.
+     * after sign-in at auth.oxy.so) for a device-first session.
      * Public first-party clients use PKCE (`codeVerifier`); the access token is
      * planted immediately on success.
      */