@oxyhq/core 17.1.0 → 18.0.0

package/dist/esm/boot/sessionColdBoot.js

@@ -131,10 +131,9 @@ export async function runSessionColdBoot(opts) {
     //    origin persisted a deviceId + deviceSecret, mint a short access token with
     //    a single bearer-less POST (no cookie, no navigation). The mint itself runs
     //    through `refreshDeviceSecretArm`, which acquires the client's PROCESS-WIDE
-    //    single-flight, persists the rotated `nextDeviceSecret` BEFORE planting the
-    //    token, and returns a classified outcome — so this step can never
-    //    double-rotate the server against the scheduler/transport/401 lanes, and
-    //    the durable store always converges on the true `current` secret.
+    //    single-flight, persists `nextDeviceSecret` BEFORE planting the token, and
+    //    returns a classified outcome — so concurrent mint lanes share one in-flight
+    //    request and the durable store always converges on the server's credential.
     steps.push({
         id: 'device-secret-mint',
         // Network step — skip entirely when the caller reports the device offline so
@@ -153,7 +152,7 @@ export async function runSessionColdBoot(opts) {
             const result = await refreshDeviceSecretArm({ oxy, store, pin });
             switch (result.status) {
                 case 'ok':
-                    // The arm persisted the rotated secret and planted the token.
+                    // The arm persisted nextDeviceSecret and planted the token.
                     return {
                         kind: 'session',
                         session: {

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -60,8 +60,9 @@ export function OxyServicesDeviceBootMixin(Base) {
          * Zero-cookie mint. Present the first-party `deviceId` + `deviceSecret` to
          * `POST /session/device/token` — NO bearer, NO cookies: possession of the
          * secret IS the device-ownership proof. Returns a fresh short access token
-         * for the device's active account plus `nextDeviceSecret` (rotation-in-use)
-         * and the projected device-session `state`.
+         * for the device's active account plus `nextDeviceSecret` (on mint, the same
+         * proven secret echoed back — rotation happens on sign-in, not mint) and
+         * the projected device-session `state`.
          *
          * `skipAuth`: this call carries no bearer, so a 401 must surface DIRECTLY —
          * never trigger `HttpService`'s 401→refresh→retry dance. The cold boot / re-

package/dist/esm/session/refresh.js

@@ -32,19 +32,14 @@ const MIN_SCHEDULE_DELAY_MS = 1000;
 const MIN_FAILURE_BACKOFF_MS = 5000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
 /**
- * Arm 1 — the rotating device-secret mint, run under the owning client's
- * PROCESS-WIDE single-flight (`httpService.runSingleFlightDeviceSecretMint`).
+ * Arm 1 — the device-secret mint, run under the owning client's PROCESS-WIDE
+ * single-flight (`httpService.runSingleFlightDeviceSecretMint`).
  *
- * The server ROTATES the presented `deviceSecret` on every successful mint and
- * the just-presented secret is valid only for a short grace window. If two lanes
- * (cold boot, the proactive scheduler, a request-time preflight, a 401 retry,
- * the socket token transport, or a tab-focus reconcile) minted concurrently they
- * would double-rotate the server and the durable store could converge on the
- * SUPERSEDED secret — after the grace window the next cold boot mint 401s and the
- * user is signed out. Routing EVERY lane through this one single-flight makes
- * concurrent callers await the SAME in-flight mint and all receive its result, so
- * there is exactly one rotation and the store always converges on the true
- * `current` secret.
+ * Concurrent lanes (cold boot, the proactive scheduler, a request-time preflight,
+ * a 401 retry, the socket token transport, or a tab-focus reconcile) must not
+ * each persist a different view of the mint response. Routing EVERY lane through
+ * this one single-flight makes concurrent callers await the SAME in-flight mint
+ * and all receive its result, so the durable store converges on one credential.
  *
  * On success it persists `nextDeviceSecret` (read-back-verified) BEFORE planting
  * the access token; a failed durable persist yields `persist-failed` WITHOUT
@@ -115,8 +110,8 @@ export async function refreshDeviceSecretArm(deps) {
             expiresAt: mint.expiresAt,
             ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
         };
-        // Rotation-in-use anti-loss: persist the NEXT secret and read-back-VERIFY it
-        // landed BEFORE planting the token. A failed durable persist must NOT plant.
+        // Persist nextDeviceSecret (read-back-verified) BEFORE planting the token.
+        // A failed durable persist must NOT plant.
         const persistedOk = await store.save(next);
         if (!persistedOk) {
             return { status: 'persist-failed' };